ML20081K052

Candu 3 Usi/Gsi/Tmi Applicability,

ML20081K052
Person / Time
Site:	05200005
Issue date:	10/04/1994
From:	Sciacca F, Shaffer C, Thomas W SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML20081K038	List: ML20081K043 ML20081K052 ML20081K061
References
CON-FIN-J-2002, CON-NRC-03-93-032, CON-NRC-3-93-32 SEA-93-704-03-A, SEA-93-704-03-A:3, SEA-93-704-3-A, SEA-93-704-3-A:3, NUDOCS 9503280379
Download: ML20081K052 (179)

Text

SEA 93-7M-03-A:3 Technical Evaluation Report i

CANDU 3 USI/GSI/TMI APPLICABILITY t

October 7,1994 i

i Clinton J. Shaffer Frank W. Sciacca Willard R. Thomas Joseph DeBor Science and Engineering Associates, Inc.

Contract: NRC-03-93-032 Job Code No: J-2002

, Task Order No: 3 1

l I PDR ADOCK 05200005 L A PDR *

. ^ ~ ~ .- - . . , _ _ ,,,MA-

W

- t1 i

SEA 93-7%03-A:3 I

Technical Evaluation Report CANDU 3 USI/GSI/TMI APPLICABILITY i October 7,1994 I Clinton J. Shaffer Frank W. Sciacca l Willard R. Thomas  !

Joseph DeBor Science and Engineering Associates, Inc.

I I

I Contract: NRC-03-93-032 Job Code No: J-2002 Task Order No: 3 l

I  :

- - d

I I ABSTRACT I Science and Engineering Associates, Inc. (SEA) has, under contract to the NRC, reviewed documents pertaining to the Canadian Deuterium Uranium 3 (CANDU 3) reactor design in preparation of the design certification review. These documents were submitted to the NRC by AECL Technologies, the U.S. sponsors of the design for its designers, the Atomic Energy of I Crnada, Ltd. (AECL). SEA was contracted to review the documents to assist the staff in obtaining early identification of the USIs, GSIs, and TMI Action Plan Items that are technically relevant to the CANDU 3 design. All issues identified in NUREG-0933, "A Prioritization of Generic Safety Issues," and the NRR Generic Letters were reviewed for possible application to the CANDU 3 design. This report identifies those safety issues determined to be applicable to the CANDU 3 design and provides a brief discussion concerning that applicability.

I I

I I 1 I

I l

I . . .

lu

I I

EXECUTIVE

SUMMARY

I The NRC is reviewing the Canadian Deuterium Uranium 3 (CANDU 3) reactor design in preparation of the design certification review. CANDU 3 is being designed by Atomic Energy of Canada, Ltd (AECL) and is sponsored in the U.S. by AECL Technologies. Science and Engineering Associates, Inc. was contracted to technically review documentation submitted to the NRC by AECL Technologies to assist the staff in obtaining early identification of the Unresolved Safety Issues (USIs), the Generic Safety Issues (GSIs), and the Three Mile Island (Bil) Action Plan Items that are technically relevant to the CANDU 3 design. All issues identified in NUREG-0933, "A Prioritization of Generic Safety Issues," and the NRR Generic Letters were reviewed for possible application to the CANDU 3 design.

I The documentation reviewed generally represents the conceptual design as it existed in 1989. Since the design has continued to develop beyond the state represented by these documents, this review does not necessarily represent the current design. However,it is likely that the applicability of the identified safety issues will not change substantially. Further, the documentation reviewed was generally deficient in regards to the details needed to perform a comprehensive applicability review.

I ne objective was to identify all safety issues applicable to the CANDU 3 design and to briefly chscuss the applicability of each issue. The review addressed both resolved and unresolved safety issues. Steps were taken to reduce duplicate safety issue coverage and it is deemed unhkely that any major safety issue was completely missed.

I An applicability rating and subject classification was applied to each safety issue and generic letter to provide a means of grouping the issues and letters for easier review and for presentation in this report.

He ratings and classifications were maintained in a computer database. The applicability ratings were based primarily on the level of design to which they applied, i.e., conceptual, standardized, sited, and I operated. An additional rating was included to group issues addressing CANDU 3 unique features for which the resolution of the issue might be expected to present novel resolution challenges for U.S.

methods and codes. His report is organized with these unique featured issues presented first, followed by the conceptual, then the standardized, sited, and operated design level issues. Each rating group is further subdivided by their subject classifications. Le issues and letters determined to be non-applicable are listed in the appendices, correlated by the reason for their determination of non-applicability.

I I v I

E as his review determined that 175 of the NUREG-0933 safety issues and 21 of the NRR generic letters were applicable to the CANDU 3 design. The majority of the issues and letters are either not applicable to the CANDU 3 design, provide duplicate coverage, or are ranked as low- or non-safety priority in NUREG-0933. The generic letters addressed relatively few safety concerns that are not contained in NUREG-0933.

The subject category containing the most issues is the systems and reliability engineering and risk assessment group. The safety analysis and emergency operating procedures category contains the most issues with the unique applicabilities rating, primarily because U.S. analysis methods and codes are not generally applicable to the CANDU 3 reactor and the Canadian codes have not been validated for use in the U.S.

The unique features group contained a total of 24 safety issues and generic letters. The majority of these issues address unique features of the CANDU 3 reactor design, i.e., the horizontal pressure tubes and the associated feeder tubes, the positive reactivity void coefficient, and the relatively large reactor zirconium .

inventory. Approximately half of these issues specifically address safety analyses and its application to the development of adequate emergency operating procedures. The resolution of concerns regarding l inadequate core cooling (ICC) should be very different from the resolution of those concerns for U.S.

plants. Other unique issues deal with the CANDU seismic design and the relatively high level of automation of the CANDU 3 control systems. ,

The conceptual design group contained a total of 39 safety issues and generic letters. A large portion of E

these issues addressed aspects of residual heat removal reliability, i.e., system interactions, loss of power, 5 auxiliary heat removal, ECCS, essential support systems, and LOCAs. Other conceptual level issues address reactor control, containment cooling and integrity, and plant and control system layout.

The standardized design group contained a total of 80 safety issues and generic letters. These issues,in general, involved the more detailed aspects of the plant design, for example, does the CANDU 3 control room design include position indicators for the' relief and safety valves. Further, the documentation available for this review was generally deficient of information regarding the resolution of these issues.

I The 16 sited design issues deal primarily with offsite electrical power systems and emergency plannmg.

Emergency planning issues deal with surrounding area population distributions and local govemments.

Other site related issues involve local weather conditions. The 37 plant operations and management issues addressed a variety of areas. 'Ihese include: plant procedures for performing routine maintenance, collecting reliability data and providing feedback, and control room access; the administration of training and qualificat2on of reactors operators and plant personnel, plant drills, and reporting; and plant decommissioning.

vi I

m

II f

TABLE OF CONTENTS ABSTRACT m iI EXEC 1JITVE

SUMMARY

v vii

CONTENTS LIST OF TABLES xiv ACRONYMS xv l

1

1.0 INTRODUCTION

Background Information 1 1.1 I

1 1.2 Statement of Work 1

f 1.3 CANDU 3 Documentation Reviewed 1

1.4 Technical Review Participants 2 2.0 REVIEW APPROACH AND APPLICABILITY CRITERIA 3 2.1 Database Structure 3 2.2 Applicability Rating System 3 l

2.3 Subject Classification 6 2.4 Review Process 7 l

= 3.0 OVERVIEW OF ISSUE APPLICABILITY 11 3.1 Applicability Rating Distribution 11 32 Subject Classification Distribution for Applicable Issues 12 4.0 APPLICABLE ISSUES WITH UNIQUE CONSIDERATIONS 13 4.1 Heat Transport Systems Issues 14 l

t 4.1.1 Issue A-1: Water Hammer 14 4.1.2 Issue 14: PWR Pipe Cracks 15 4.2 Containment Issues 16 II 4.2.1 Issue A-48: Hydrogen Control Measures and Effects of Hydrogen Burns on Safety Equipment 16 4.2.2 Issue 121: Hydrogen Control for Large Dry PWR Containments 18 4.2.3 Issue 157: Containment Performance 18 4.3 Balance of Plant Issues 19 4.3.1 Issue 82: Beyond Design Basis Accidents in Spent Fuel Pools 19 4.4 Safety Analysis and Emergency Operating Procedures Issues 20 4.4.1 issue I.C.1(1): Small Break LOCAs 20 4.4.2 Issue I.C.1(2): Inadequate Core Cooling 20 iI v I

E 4.43 Issue I.C.1(3): Transients and Accidents 21 4.4.4 Issue I.C.1(4): Confirmatory Analyses of Selected Transients 21 4.4.5 Issue II.K3 (30): Revised Small-Break LOCA Methods to Show Compliance with 10 CFR 50, Appendix K 22 4.4.6 Issue II.K3 (31): Plant-Specific Calculations to Show Compliance with 10 CFR 50.46 22 4.4.7 Issue A-9: ATWS 23 4.4.8 Issue 116: Accident Management 24 4.4.9 Generic Letter 79-58: ECCS Calculations on Fuel Cladding 24 4.4.10 Generic Letter 80-12: Analysis of a PWR Main Steam Line Break with Continued Feedwater Addition 25 4.4.11 Generic Letter 83-11: Licensee Qualification for Performing Safety Analyses in E

Support of Licensing Actions 25 5 4.5 Seismic issues 26 4.5.1 Issue A-40: Seismic Design Criteria 26 4.5.2 Issue A-41: Long-Term Seismic Program 26 4.53 Generic Letter 79-07: Seismic (SSE) and LOCA Responses 27 4.6 Instrumentation and Control Issues 27 4.6.1 Issue LD.1: Control Room Design Reviews 27 4.6.2 Issue II.F.2: Identification and Recovery from Conditions Leading to inadequate Core Cooling 29 4.63 Issue II.K.3(5): Automatic Trip of Reactor Coolant Pumps 30 5 4.6.4 Generic Letter 82-28: Inadequate Core Cooling Instrumentation System 30 5.0 APPLICABLE CONCEPTUAL DESIGN ISSUES 33 I

5.1 Reactor Issues 35 5.1.1 Issue D-3: Control Rod Drop Accident 35 5.1.2 Issue 22: Inadvertent Boron Dilution Events 35 5.13 Generic Letter 84-21: Long Term Low Power Operation in Pressurized Water Reactors 36 5.2 Heat Transport Systems issues 36 5.2.1 Issue 11.B.1: Reactor Coolant System Vents 36 5.2.2 Issue ll.K3(1): Install Automatic PORV Isolation System and Perform Operational Test 37 5.2.3 issue A-49: Pressurized Thermal Shock 37 e

5.2.4 issue 66: Steam Generator Requirements 38 5.2.5 issue 163: Multiple Steam Generator Tube Ixakage 38 vill

il 53 Containment Issues 39 53.1 Issue II.B.2: Plant Shielding to Provide Access to Vital Areas and Protect l Safety Equipment for Post-Accident Operation 39 53.2 Issue II.E.43: Integrity Check 40 533 Issue II.E.4.4(4): Evaluate Purging and Venting During Normal Operation 40 53.4 Issue B-12: Containment Cooling Requirements (Non-LOCA) 41 5.4 Balance of Plant Issues 41 5.4.1 Issue A-29: Nuclear Power Plant Design for the Reduction of Vulnerability of Industrial Sabotage 41 i

I 5.4.2 Issue A-36: Control of Heavy Loads Near Spent Fuel 42 42 l 5.43 Generic Letter 80-96: Fire Protection 5.5 Systems and Reliability Engineering and Risk Assessment Issues 43 L

5.5.1 Issue II.K3(25): Effect of Loss of AC Power on Pump Seals 43 i

5.5.2 Issue A-24: Qualification of Class 1E Safety-Related Equipment 43 5.53 Issue A-25: Non-Safety Loads on Class IE Power Sources 44 l

5.5.4 Issue A-31: RHR Shutdown Requirements 45 5.5.5 Issue A-43: Containment Sump Performance 45 5.5.6 Issue A-44: Station Blackout 46 5.5.7 Issue A-45: Shutdown Decay Heat Removal Requirements 48 5.5.8 Issue 23: Reactor Coolant Pump Seal Failures 48 5.5.9 Issue 24: Automatic Emergency Core Cooling System Switch to Recirculation 49 5.5.10 Issue 36: Loss of Service Water 50 5.5.11 Issue 47: Loss of Offsite Power 50 5.5.12 issue 105: Interfacing Systems LOCA at LWRs 50 j 5.5.13 Issue 122.2: Initiating Feed and Bleed 52 5.5.14 Issue 124: Auxiliary Feedwater System Reliability 53 5.5.15 Issue 130: Essential Service Water Pump Failures at Multiplant Sites 53 J l

5.5.16 Issue 143: Availability of Chilled Water Systems and Room Cooling 54 5.5.17 Issue 153: Loss of Essential Service Water in LWRs 54 l

5.6 Seismic Issues 55 5.6.1 Issue A-46: Seismic Qualification of Equipment in Operating Plants 55 5.6.2 Generic Letter 80-88: Seismic Qualification of Auxiliary Feedwater Systems 55 5.7 Instrumentation and ControlIssues 56 5.7.1 Issue I.D.2: Plant Safety Parameter Display Console 56

.I 5.7.2 Issue I.D.3: Safety Systems Status Monitoring 57 5.73 Issue III.A.I.2(1): Technical Support Center 58 3 Ex l

E O

5.7.4 Issue III.A.I.2(2): On-Site Operational Support Center 58 5.7.5 1ssue III.D.3.4: Control Room Habitability 58 6.0 APPLICABLE STANDARDIZED DESIGN ISSUES 61 6.1 Heat Transport Systems Issues 64 6.1.1 Issue II.D.1: Testing Requirements for Reactor Coolant System Relief and Safety Valves 64 6.1.2 Issue II.K.3(2): Report on Overall Safety Effects of PORV Isolation System 65 6.1.3 Issue A-2: Asymmetric Blowdown Loads on Reactor Primary Coolant Systems 65 6.1.4 Issue A-3: Westinghouse Steam Generator Tube Integrity 66 6.1.5 Issue A-12: Fracture Toughness of Steam Generator and Reactor Coolant Pump Supports 66 3 6.1.6 Issue A-13: Snubber Operability Assurance 67 6.1.7 Issue A-15: Primary Coolant System Decontamination and Steam Generator Chemical Cleaning 67 6.1.8 Issue A-26: Reactor Vessel Pressure Transient Protection 68 6.1.9 Issue B.60: Loose Parts Monitoring System 68 6.1.10 Issue C-7: PWR System Piping 69 6.1.11 Issue C 12: Primary System Vibration Assessment 69 6.1.12 Issue 15: Radiation Effects on Reactor Vessel Supports 70 6.1.13 Issue 29: Bolting Degradation or Failure in Nuclear Power Plants 70 '

6.1.14 Issue 78: Monitoring of Fatigue Transient Limits for Reactor Coolant System 70 6.1.15 Issue 79: Unanalyzed Reactor Vessel Thermal Stress During Natural Convection Cooldown 71 6.1.16 Issue 94: Additional IAw Temperature Overpressure Protection for Light Water Reactors 71 6.1.17 Issue 135: Steam Generator and Steam IJne Overfill 72 6.1.18 Generic Letter 88-05: Boric Acid Corrosion of Carbon Steel Reactor Pressure 72  !

Boundary Components in PWR Plants 6.2 Containment Issues 72 l 6.2.1 Issue II.E.4.1: Dedicated Penetrations 72 6.2.2 Issue B-5: Ductility of Two-Way Slabs and Shells and BucMing Behavior of Steel Containments 73 6.2.3 Issue B-9: Electrical Cable Penetrations of Containment 74 6.2.4 Issue B-26: St-uctural Integrity of Containment Penetrations 74 6.2.5 1ssue 118: Tendon Anchor Head Failure 74 X

I

.E

I 6.2.6 Generic Letter 80-98: Prevention of Damage Due to Water Leakage Inside Containment I 63 Balance of Plant issues 75 75 63.1 Issue 106: Piping and Use of Highly Combustible Gases in Vital Areas 75 63.2 Issue 146: Support Flexibility of Equipment and Components 76 633 Issue 162: Inadequate Technical Specifications for Shared Systems at Multiplant Sites When One Unit is Shutdown 76 63.4 Issue 167: Combustible Gas Storage Facilities 76 6.3.5 Generic Letter 92-08: Thermo-Lag 330-1 Fire Barriers 76 6.4 Systems and Reliability Engineering and Risk Assessment Issues 77 6.4.1 Issue II.C.2: Continuation of Interim Reliability Evaluation Program 77 I 6.4.2 Issue II.E.1.1: Auxiliary Feedwater System Evaluation 78 6.43 Issue II.E.1.2: Auxiliary Feedwater System Automatic Initiation and Flow Indication 78 6.4.4 Issue II.E.3.1: Reliability of Power Supplies for Natural Circulation 79 6.4.5 Issue II.E.4.2: Isolation Dependability 79 6.4.6 Issue II.G.1: Power Supplies for Pressurizer Relief Valves, Block Valves, and Level Indicators 80 6.4.7 Issu II.K3(7): Evaluation of PORV Opening Probability During Overpressure Transient 80 6.4.8 Issue A-17: Systems Interactions in Nuclear Power Plants 80 6.4.9 Issue B-17: Criteria for Safety-Related Operator Actions 81 6.4.10 Issue B-56: Diesel Reliability 81 6.4.11 Issue B-58: Passive Mechanical Failures 82 6.4.12 Issue B-61: Allowable ECCS Equipment Outage Periods 82 6.4.13 Issue C-11: Assessment of Failure and Reliability of Pumps and Valves 82 l

6.4.14 Issue 43: Reliability of Air Systems 83 I 6.4.15 Issue 57: Effects of Fire Protection System Actuation on Safety-Related Equipment 83 6.4.16 Issue 70: PORV and Block Valve Reliability 84  !

6.4.171ssue 83: Control Room thbitability 84 6.4.18 Issue 93: Steam Binding of Auxiliary Feedwater Pumps 85 6.4.19 Issue 120: On-Line Testability of Protection Systems 86 6.4.201ssue 125.11.7: Reevaluate Provision to Automatically Isolate Feedwater from i Steam Oenerator During a Line Break 86 6.4.21 Issue 128: Electrical Power Reliability 87 x1 I

E 6.4.22 Issue 156.6.1: Pipe Break Effects on Systems and Components 87 6.4.23 Issue 158: Performance of Power-Operated Valves Under Design Basis Conditions 88 6.4.24 Issue 159: Qualification of Safety-Related Pumps While Running on Minimum Flow 88 6.4.25 Issue 165: Safety and Safety / Relief Valve Reliability 88 6.4.26 Generic Letter 79-36: Adequacy of Station Electric Distribution Systems Voltages 88 6.4.27 Generic Letter 80-35: Effect of a DC Power Supply Failure on ECCS Performance 89 6.4.28 Generic Letter 88-20: Individual Plant Examination for Severe Accident Vulnerabilities 89 6.5 Instrumentation and ControlIssues 91 6.5.1 Issue I.D.5(1): Operator-Process Communication 91 6.5.2 Issue I.D.5(2): Plant Status and Post-Accident Monitoring 92 E

6.53 Issue I.D.5(3): On-Line Reactc Surveillance System 92 3 6.5.4 Issue II.D3: Relief and Safety Valve Position Indication 93 6.5.5 Issue II.F.1: Additional Accident Monitoring Instrumentation 93 6.5.6 Issue A-47: Safety Implications of Control Systems 94 6.5.7 Issue B-66: Control Room Infiltration Measurements 94 6.5.8 Issue C 1: Assurance of Continuous long-Term Capability of Hermetic Seals on Instrumentation and Electrical Equipment 94 6.5.9 Issue 3: Set Point Drift in Instrumentation 95 6.5.10 Issue 20: Effects of Electromagnetic Pulse on Nuclear Power Plants 95 96 5

3 6.5.11 Issue 45: Inoperability of Instrumentation Due to Extreme Cold Weather 6.5.12 Issue 64: Identification of Protection System Instrument Sensing Lines 96 6.5.13 Issue 6733: Improved Accident Monitoring 96 6.5.14 Issue 142: Leakage Through Electrican Isolators in Instrumentation Circuits 97 6.5.15 Issue 160: Spurious Actions of Instrumentation Upon Restoration of Power 97 6.5.16 Issue HF5.1: Local Control Stations 98 6.5.17 Generic Letter 80-25: Engineering Safety Feature (ESF) Reset Controls 98 6.6 Quality Assurance Issues 98 6.6.1 Issue I.F.2(2): Include QA Personnel in Review and Approval of Plant Procedures 98 6.6.2 Issue I.F.2(3): Include QA Personnel in All Design, Construction, Installation, Testing, and Operation Activities 99 6.63 Issue I.F.2(9): Clarify Organizational Reporting Levels for the QA Organization 99 6.6.4 Generic Letter 88-15: Electric Power Systems - Inadequate Control Over Design Processes 99 6.7 Radiation Protection Issues 100 I  :

=i

l

.I 6.7.1 !ssue II.B.3: Post-Accident Sampling 100 6.7.2 Issue III.D.3.1: Radiation Protection Plans 100 7.0 APPLICABLE SITED DESIGN OR OPERATING PLANT ISSUES 103 7.1 Sited Design Issues 103 7.2 Operated Plant Issues 104 I

8.0 REFERENCES

107 8.1 CANDU Technology Documents 107 8.2 Canadian Regulatory Documents 108 j 109 I 8.3 Canadian Standards Association (CSA) Standards 8.4 USNRC Regulations and Other Review References 110 APPENDICES A. ISSUES NOT APPLICABLE TO CANDU 3 DESIGN A-1 B. ISSUES COVERED BY ANOTHER ISSUE OR PROGRAM B-1 C. ISSUES OF NON OR LOW SAFETY PRIORITY C-1 SAFETY ISSUE AND GENERIC LETTER INDEX D-1 I

D.

E. NRC SAFETY PRIORTIY RANKING DESIGNATIONS E-1 I

I I

I I

I

{I I X1u I

1

E LIST OF TABLES TABLE PAGE 1.1 Technical Review Participants 2 2.1 Applicability Rating System 4 3.1 Summary of Applicability Deterrnmation 11 1.2 Summary of Subject Classification Determination for Applicability Issues and Letters 12 4.1 Applicable Issues with Unique Considerations 13 5.1 Applicable Conceptual Design Issues 33 6.1 Applicable Standardized Design Issues 61 7.1 issues Applicable to Sited Designs 103 5 7.2 Issues Applicable to Operating Designs 104 I

I I

I I

I I

I I

XiV I

E

=

I I ACRONYMS I AECB Atomic Energy Control Board AECL Atomic Energy of Canada, Ltd.

AFW Auxthary Feedwater ALWR Advanced Light Water Reactor ASI Adverse Systems Interaction A DVS Anticipated Transient Without Scram I CANDU CCFP Canadian Deuterium Uranium Conditional Containment Failure Probability CFR Code of Federal Regulations CHRS Contamment Heat Removal System CP Construction Permit CPSA Conceptual Probabilistic Safety Assessment CSA Canadian Standards Association CSR Conceptual Safety Report DBE Design Basis Earthquake DCH Direct Containment Heating I DHR Decay Heat Removal DNB Departure from Nucleate Boiling ECCS Emergency Core Cooling System EMP Electromagnetic Pulse EOF Emergency Operations Facility ESF Engineering Safety Feature ESW Essential Service Water F/M Fuel Handling Machine GDC General Design Criteria I GLM GSI Gross leakage Monitoring Generic Safety issue H13 Heat Transport System ICC Inadequate Core Cooling IPE Individual Plant Exammation IPEEE Individual Plant Examination External Events Interim Reliability Evaluation Program I IREP LER Licensee Event Report xv J

E

=

LOCA Loss of Coolant Accident LWR Light Water Reactor MCR Main Control Room 3 MSLB Main Steam Line Break MSSV Main Steam Safety Valve NEPA National Environmental Policy Act NRC Nuclear Regulatory Commission OBE Operating Basis Earthquake ORNL Oak Ridge National Laboratories OSC Operational Support Center PHTS Primary Heat Transfer System PHWR Pressurized Heavy Water Reactor PRA Probabilistic Risk Assessment PSA Probabilistic Safety Analysis PWR Pressurized Water Reactor QA Quality Assurance RBCS Reactor Building Cooling System R/C Reinforced Concrete g RCP Reactor Coolant Pump 5 RCWS Recirculation Cooling Water System RSWS Raw Service Water System SCA Secondary Control Area SDE Site Design Earthquake SDG Safety Design Guides SRP Standard Review Plan SSE Safe Shutdown Earthquake TD Technical Description g TMI Three Mile Island 5 15 Technical Specifications TSC Technical Support Center TTR Technical Transfer Report USI Unresolved Safety issue USNRC United States Nuclear Regulatory Comnussion i

av, I

I

-I

1.0 INTRODUCTION

I 1.1 Background Information The NRC is currently reviewing the Canadian Deuterium Uranium 3 (CANDU 3 ) reactor design in preparation for a design certification application scheduled to be submitted in calendar year 1994.

The staff is maintaining cognizance of the design, maintaining technical progress on key issues, and conducting computer code development and benchmarking. CANDU 3 is being designed by Atomic Energy of Canada, Ltd. (AECL) and sponsored in the U.S. by AECL Technologies. AECL

-I Technologies submitted pertinent CANDU 3 documents to the NRC for the NRC's review.

1.2 Statement of Work The objective of this task was to assist the staff in obtaining early identification of the USIs, GSIs, and TMI Action Plan items that are technically relevant to the CANDU 3 design. It was noted that 10 CFR 52.47" requires the technical resolution for all technically relevant medium and high priority USIs and GSIs. SEA was contracted to technically review the CANDU 3 Technical Description 2, the Conceptual I Safety Report', the Technology Transfer Reports (ITRs), and other pertinent documents supplied by the NRC technical monitor. The review was to address the USIs, GSIs, and TMI Action Plan Items documented in NUREG-0933", "A Prioritization of Generic Safety Issues," and the staff issued NRR Generic Letters to determine their applicability to the CANDU 3 design. The final report was to include a list of the issues and a discussion of their applicability to CANDU 3.

1.3 CANDU 3 Documentation Reviewed I A complete list of the CANDU 3 and CANDU technology documents reviewed during the l

l performance of this task are listed in reference Section 8.1,8.2, and 8.3. The main documents relied l I upon for our applicability determinations are: 1 CANDU 3 Technical Description CANDU 3 Technical Outline 2 CANDU 3 Conceptual Safety Report'

~

CANDU 3 Conceptual Probabilistic Safety Assessment' 5

TTR-276,"The Technology of CANDU Loss-of-Coolant Accidents" 1TR-291', "Ihe Technology of CANDU Fuel Channels" TIR-411, "CANDU 3 and U.S. NRC Requirements"  :

r I ,

E O

- TIR423", "CANDU and the U.S. NRC General Design Criteria" TTR429"," Comparison of CANDU 3 with NRC Positions for Evolutionary Light Water - g Reactor (LWR) Certification Issues in SECY-90-016" 5

Since several of these documents are referenced many times throughout this report, these references will frequently appear in an abbreviated form, i.e., the Technical Description, the Technical Outline; the CSR for the Conceptual Safety Report; the CPSA for the Conceptual Probabilistic Safety Assessment; and TTR-xxx for the various Technology Transfer Reports.

The design documents reviewed for this study generally represented this CANDU 3 design as it existed in 1989 but the design has since changed due to continued development. For example, the 1989 design shows 2 main reactor coolant circulation pumps, whereas the 1992 Technical Outline shows 4. This review will therefore not necessarily represent the current design, however it is expected that the applicability of these issues to CANDU 3 will not change significantly due to final design changes in the CANDU 3 design. Further, the documentation reviewed was generally deficient in regards to the detads needed to perform a comprehensive applicability review.

1.4 Technical Review Padicipants The participants in the identification of safety issues applicable to the CANDU 3 containment design are listed in Table 1.1.

Table 1.1: Review Participants Participant Contribution Primary Experience Pertaining to Issue Applicability Identification Frank W. Sciacca Project Manager Safety Issue Evaluation Experience, Severe Accident Analysis, and PRA Clinton J. Shaffer Overall Review / Report Thermal-Hydraulic, Severe Accident l Analysis, Radionuclide Transport 5 '

Analysis, Reactor Systems, and PRA Willard R. Thomas Reviewer Risk and Reliability Assessments, and Reactor and Power Syr> ems Analysis Joseph DeBor Reviewer Control Systems and Human Factors E Analysis g I

2 I

5 <

I I 2.0 REVIEW APPROACH AND APPLICABILITY CRITERIA I All issues contained in NUREG-0933 (Revision 16) and all NRR generic letters contained in an NRC supplied database were evaluated for applicability to the CANDU 3 design. There were a relatively large number of issues and letters that had to be evaluated, i.e.,816 NUREG-0933 issues and 550 generic letters. Therefore, a database system was used to manage their evaluation to ensure completeness and to facilitate the organization of the report. The database included an applicability rating and a subject classification for each issue and letter, based on the determination of its applicability, allowing them to be categorized in the report.

2.1 Database Structure The database consisted of one line of information entered into a PC in ASCII format for each issue and letter. The NUREG-0933 issues and the generic letters have separate databases. These databases ,

are accessed with a small FORTRAN program with the capability to categorize the issues and letters I j

l by applicability rating and subject. The information entered into each database includes: Sequence Number, Applicability Rating, Subject Classification, NRC Safety Priority Ranking, issue Identspcation, and l Title; for NUREG-0933 issues and Sequence Number, Applicability Rating, Subject Classspcation, I Identspcation. and Title for the generic letters.

2.2 Applicability Rating System All NUREG-0933 issues and NRR generic letters were group into one of the following seven groups according to their applicability to the CANDU 3 design, as determined by our technical review of the available documentation. This rating system is intended to separate potentially difficult or unique issue resolutions from those issues for which the resolution applied to U.S. plants will likely be directly applicable to CANDU 3. Further, the rating system reflects the fact that this applicability I rating was detemdned by reviewing conceptual design level documentation. The applicability ratings are summarized in Table 2.1 and described below.  !

Uniaue Considerations This rating was applied to issues for which its resolution relative to the j CANDU 3 design will likely require considerations unique to the CANDU 3 design or to CANDU I

technology and that could present novel resolution challenges for U.S. methods and codes. For example, the resolution of issues regarding the assurance of adequate core cooling for the CANDU 3 borizontal pressure tube design will require considerations not previously considered for U.S. power

>I 3 1

I

E o

reactors. Further, analytical methods and codes currently accepted by the USNRC will not necessarily be capable of analyzing the CANDU 3 design without modification. Issues involving CANDU 3 unique considerations for which the resolution was anticipated to be similar to its resolution for a U.S. plant or for which the unique consideration appeared to significantly enhance safety relative to U.S. reactors were given one of the other applicability ratings.

Table 2.1: App?icability Rating System Applicability Rating Example Applicable issues / Letters Unique Considerations Ensure Adequate Core Cooling Conceptual Design Containment Heat Removal Standardized Design Snubber Operability Sited or Operating Design Emergency Planning Non-Applicable issues / Letters Non-Applicable to CANDU 3 BWR Jet Pumps Duplicate Coverage Issue 28 Covered by Issue A-49 Non-Safety Environmental Issue I

l Conceptual Desicn This rating was applied to issues with ba.ec conceptual design considerations, i.e.,

the more fundamental or primary aspects of the design. The intent here is to apply this rating to issues addressing safety concerns for which design changes, if required, could substantially alter the design and could therefore be rather difficult to perform. Further, the CANDU 3 documents reviewei generally described the design at the conceptual level and so there was usually some informatior, available regarding these issues. For example, issues addressing adequate containment heat removal capability should be addressed at the conceptual design level and information was available.

liowever, there were issues that should have been addressed at the conceptual design level, but apparently were not. For example, each plant is required to have a dedicated technical support area l to provide for management and technical pmonnel to orderly conduct emergency operations, therefore the plant layout should consider such an area. The plant layout and control room diagrams did not mention or appear to leave room for such an area.

1 4

I 5

lI lI l

Standardized Desien This rating was applied to all other issues applicable to a standardize CANDU 3 plant design. Design changes,if req sired, would generally impact a less fundamental aspect of the lg l5 design. The information available regarding the resolution of these issues was generally sparse if not completely missing. Examples of this rating include loose par:s monitoring, snubber operability, and the effects of an electromagnetic pulse.

Sited or Oneratinc Desien This rating was applied to issues related to a plant site or surrounding area or to the operation and management of the plant which were not directly applicable to the standardized plant design. Information regarding the resolution of these issues was generally not l

included in the available conceptual design documentation. Examples of issues receiving this rating  ;

I

, include operator qualification, local government preparedness, plant drills, and emergency plannmg.

lI J Non-ArolicaHe to CANDU 3 Desien Many issues were determined not to be applicable to the CANDU 3 design for variety of reasons. These reasons include:

l The issue specifically applies to BWR technology without apparent application to CANDU 3.

The issue specifically applies to technology of a particular PWR vendor without apparent application to CANDU 3.

l The issue specifically applies to a component, system, process or analysis that is not

. applicable to CANDU 3. ,

The issue specifically addresses the TMI-2 plant.

l The issue specifically addresses a specific plant without apparent applicability to CANDU 3.

l The issue issued for operating plants without apparent adaptability to future plants.

The issue applies to a specific manufacture or model of component.

j The issue specifically applies to the NRC staff or NRC research progams.

l . The issue was not directly associated with the design of a power plant, such as transportation.

Examples of this rating include issues dealing with suppression pools, automatic depressurization l systems, core sprays, containment sprays, ice condensers, and the preparation of regulatory guides and licensmg criteria.

(

Duplicate Coverace This rating was applied to issues that were covered in the resolution of other issues and were therefore not considered further to avoid a duplication of effort. The determination of duplicate coverage for the NUREG-0933 issues was based almost entirely on the safety priority I 5 I 1 1

B es ranking placed on the issue by the NRC, i.e., when this ranking, as listed in Table II of NUREG-0933, specified that the issue was covered by another issue, we then declared the issue to be a duplication. g A few other issues appeared to be covered by another issue at least when applied to the CANDU 3 5, design and were therefore declared to be duplicate coverage. Generic letters pertaining to the resolution of a NUREG-0933 issue were considered to be duplication of the safety issue. When several generic letters addressed the same safety related subject, such as fire protection, then one letter was selected for technical review and the remaining were declared duplicate coverage. Therefore, there is only one applicability discussion regarding fire protection although the assurance of adequate fire protection should consider all of the letters.

Non-Safety This rating was applied to NUREG-0933 issues with a low safety priority rankmg (NRC detennination) or generic letters which were not directly related to safety. The resolution of these issues is not required by 10 CFR 52.47. The non-safety NUREG-0933 issues included:

Licensing issues (LI) not directly related to protecting the public health and safety.

Regulatory impact issues (RI) not improving the safety of nuclear power plants.

- Environmental issues (EI) involve impacts on the human environment and the values sought to be protected by the National Environmental Policy Act (NEPA).

Low Priority issues (LOW) with little or no prospect of safety improvements that are both substantial and worthwhile.

Issues dropped from further consideration by the NRC due to negligible significance.

The non-safety generic letters included:

I Administrative letters such as meeting notices.

Letters requesting analytical support data and information from nuclear plant operators.

letters regarding regulatory policy, guidance and research.

Letters transmitting regulatory documents.

Letters without any record of the communication ever being issued. ,

2.3 Subject Classifications A subject classification was specified for each issue and letter to group like issues and letters which could then be reviewed together and grouped within the final report. For issues determined to be applicable to the CANDU 3 design, the following general subject classifications were used:

Reactor ,

- Heat Transport Systems Containment I

6 I'

=

l e Balance of Plant Safety Analysis and Emergency Operating Procedures

~I -

Systems and Reliability Engineering and Risk Assessment Seismic I -

Instrumentation and Control Quality Assurance Radiation Protection Site or Surrounding Area Personnel and Plant Operations For issues and letters determined to non-applicable, duplicate-coverage, or non-safety, the subject classification was used to indicate the reason for that determmation. These reasons are as listed and discussed in Section 2.2. In cases where an issue or letter applied to more than one subject classification, the classification deemed most appropriate was chosen.

2.4 Review Process The overall objective was to identify all safety issues applicable to the CANDU 3 design and to briefly I discuss the applicability of each issue. The primary source of safety issue discussion was of course NUREG-0933 which is a continuously updated compilation of NRC documented safety issues. The NRR generic letters were also searched for applicable safety issues not covered by NUREG-0933. The review addressed both resolved and unresolved safety issues since an issue which was resolved for U.S. reactors is not necessarily resolved when applied to CANDU technology.

generally avoided. The NPC safety priority I Duplicate coverage of the same basic safety issue v, ranking was relied on to identify most of the duplicate coverage within NUREG-0933. Generic letters addressing the resolution of safety issues identified in NUREG-0933 were declared duplicate and dismissed from further consideration. In cases where more than one generic letter addresses the same safety issue, one letter was selected to represent that issue.

I The complete list of generic letters was obtain from a NRC-generated dBase database of over 2000 letters. An examination of the database revealed that it contained 550 letters labeled GL for generic letters. The database did not contain the actualletters, however most of the letters could be dismissed from further consideration based on the database information. For example, many letters were clearly I meeting notices. We were able to dismiss all but 48 of these letters based on database information alone. We then obtained copies of the remaining 48 letters for further review.

I -

/

I

E e

Some issues were determined to be applicable to CANDU 3 in an indirect manner, for example, the safety concerns regarding thermal shock to the reactor vessel does not directly apply to CANDU 3 since it does not have a reactor vessel, however thermal shock may have a corresponding applicability to the CANDU 3 horizontal pressure tubes. Thermal shock likely does not have the same importance to CANDU 3 as it does to a U.S. reactor vessel, however it should remain under consideration until it can be dismissed for valid reasons.

Issues addressing a non-generic problem encountered with a specific component or model manufactured by a specific manufacturer were generally assumed not to L- applicable to the CANDU 3 design. This assumption is based on the number of years which has passed since the troublesome components were manufactured, i.e., surely the specific problem addressed by the NUREG-0933 safety issue or generic letter would be corrected before a CANDU 3 plant is built.

Issues requiring NRC staff resolution, such as developing regulatory guidance, or addressing NRC safety research were not rated as applicable to the CANDU 3 design although the design must still comply with all appropriate regulations.

The current version of NUREG-0933 (Revision 16) contains 9 issues ranked by the NRC as NOTE 4 g

meaning that the issue will be prioritized in the future. Descriptions of these issues were not readily 3 available for our review, therefore the applicability of these 9 issues was determined based on their title alone. These issues are:

146 Support Flexibility of Equipment and Components 156.6.1 Pipe Break Effects on Systems and Components 158 Performance of Power-Operated Valves Under Design Basis Conditions 159 Qualification of Safety-Related Pumps While Runnmg on Minimum Flow 160 Spurious Actions of Instrumentation Upon Restoration of Power 162 Inadequale Technical Specifications for Shared Systems at Multiplant Sites When One Unit is Shut Down 163 Multiple Steam Generator Tube Leakage 165 Safety and Safety / Relief Valve Reliability 167 Combustible Gas Storage Facilities A word about completeness. While it is possible that an issue might have been incorrectly identified as non-applicable, it is deemed unlikely that any major basis safety issue was completely missed. One 3 area of concem, however, is the possibility that an issue ranked as low prio.ity or dropped from 8

I I

I I further consideration by the NRC might contain a safety concem of a higher priority when evaluated against CANDU technology instead of U.S. technology.

I The applicability rating system was intended to group issues for easier review by focusing issues deemed more important or anticipated to be more difficult to resolve to the front of the report, i.e.,

placing issues involving CANDU technology unique considerations first. The report then tends to flow in direction of the level of design, i.e , conceptual, standardized, and then sited or operated. Issues and letters found to be non-applicable are listed in the appendices correlated by the reason for that determination. Rating issues by design level or uniqueness a.'ti classifying them by subject was I somewhat subjective. Another reviewer might have arranged many of these issues differently.

The applicable issues reported in this report are organized first by their applicability rating, then by subject classification, and then by the order they appear in NUREG-0933. Applicable generic letters are placed in the report following the NUREG-0933 issues arranged by date. Each issue applicability report briefly summarizes the basic safety concems as presented in NUREG-0933 and the generic I letters. The issue descriptions do not, however, contain details of history and resolution of the issue or list associated documentation since this information is readily available in NUREG-0933.

I I

I I

I I

I I

E 9 I

i I 3.0 OVERVIEW OF ISSUE APPLICABILITY I Applying the applicability criteiia outlined in Section 2 to the NUREG-0933 issues and the NRR generic letters determined that 174 issues and 21 generic letters were applicable to the CANDU 3 design. This section shows the applicability and subject classification distribution of both the applicable and non-applicable issues and le+ters. The unique consioeration issues are discussed in Section 4, followed by issues applicable to the conceptual design in Secdon 5, issues applicable to the standardized design in Section 6, and then issues applicable to a sited design or an operated plant in Section 7. The issues determined not to be applicable to the CANDU 3 design are listed in Appendices A, B, and C, categorized by the reason for their non-applicability. Appendix D contains a list of all NUREG-0933 issues in the order found in that document and all NRR generic letters by date along with indicators of their applicability rating r.nd subject clarification to assist in determmmg the disposition of a particular issue or letter.

3.1 Applicability Rating Distribution I The applicability rating distribution for the issues and letters is shown in Table 3.1. The table illustrates that the majority of the issues and letters are either not applicable to the CANDU 3 design, I provide duplicate coverage, or are ranked as low- or non-safety priority. The generic letters address relatively few safety concerns that are not contained in NUREG-00933.

Table 3,1: Summary of Applicability Determination I Applicability Rating Number of NUREG-0933 Issues Number of NRR Generic Letters Rating Totals Applicable issues /Ietters Unique Considerations 19 5 24 Conceptual Design 36 3 39 Standardized Design 72 8 80 Sited or Operating Design 48 5 53 Non-Applicable issues /lztters Non-Applicable to CANDU 3 171 106 277 Duplicate Coverage 152 78 '30 Non-Safety 318 345 663 issue and Iziter Totale 816 550 1366 11 I

D.

[]

3.2 Subject Classification Distribution for Applicable Issues ne subject classification distribution for the applicable issues and letters is shown in Table 3.2. The subject category containing the most issues is the systems and reliability engineering and risk assessment group. He safety analysis and emergency operating procedures category contains the f 1

most issues with the unique applicabilities rating. This is primarily because U.S. analytical methods 1 and codes are not generally applicable to the CANDU 3 reactor and the Canadian codes have not been validated for use in the U.S.

Table 3.2: Summary of Subject Classification Determination for Applicable Issues and Letters l

Subject Classification Unique Conceptual Standardized Sited or l Operated Reactor 3 3 Heat Transport Systems 2 5 18 25 Containment 3 4 6 13 l Balance of Plant 1 3 5 9 l 1

Safety Analysis & EOPs 11 11 Systems, Reliability, 17 28 45 i

& Risk Seismic 3 2 5 Instrumentation & 4 5 17 26 Control Quality Assurance 4 4

=

Radiation Protection 2 2 Site & Surrounding Area 16 16 Personnel & Optrations 37 37 Totals 24 39 80 53 196 I

I 12 I

5

I I 4.0 APPLICABLE ISSUES WITH UNIQUE CONSIDERATIONS The application of these safety issues to the CANDU 3 design willlikely require considerations unique to the CANDU 3 design and could present novel resolution challenges for US. methods and codes.

A total of 24 issues, which are listed in Table 4.1, were grouped in this category. Each issue listed in Table 4.1 is followed by the NRC's safety priority ranking for that issue in parentheses. The majority of these issues address unique features of the CANDU 3 reactor design,i.e., the horizontal pressure tubes and the associated feeder tubes, the positive reactivity void coefficient, and the relatively large I reactor zirconium inventory. Approximately half of these issues specifically address safety analyses and its application to the development of adequate emergency operating procedures. This is primarily because the necessary Canadian codes performing these analyses have not been validated for use in the U.S. and U.S. codes will require modifications before they can be applied to CANDU reactors.

The resolution of concerns regarding inadequate core cooling (ICC) should be very different from the resolution of those concems for U.S. plants. Other issues deal with the CANDU seismic design and the relatively high level of automation of the CANDU 3 control systems.

I Table 4.1: Applicable Issues with Unique Considerations Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

Heat Transport Systems issues A-1 Water Hammer (NOTE 3a) 14 PWR Pipe Cracks (NOTE 3b)

Containment issues A-48 Hydrogen Control Measures and Effects of Hydrogen Bums on Safety Equipment (NOTE 3a) 121 Hydrogen Control for Large Dry PWR Containments (NOTE 3b) 157 Containment Performance (NOTE 3b)

Balance of Plant issues 82 Beyond Design Basis Accidents in Spent Fuel Pools (NOTE 3b)

Safety Analysis and Emergency Operating Procedures issues I.C.1(1) Small Break LOCAs (I)

I.C.1(2) Inadequate Core Cooling (I)

I.C.1(3) Transients and Accidents (I)

I.C.1(4) Confirmatory Analyses of Selected Transients (NOTE 3b)

I 13 I

5 o

Issue Title (NRC Safety Priority Ranking - Legend in Appendix "

I II.K.3(30) Revised Small-Break LOCA Methods to Show Compliance with 10 CFR ,

Appendix K (I)

II.K.3(31) Plant-Specific Calculations to Show Compliance with 10 CFR 50.46 (I)

A-9 ATWS (NOTE 3a) 116 Accident Management (S)

GL-79-58 ECCS Calculations on Fuel Cladding GL-80-12 Analysis of a PWR Main Steam Line Break with Continued Feedwater Addition GL-83-11 Licensee Qualification for Performing Safety Analyses in Support of Licensing Seismic issues A-40 Seismic Design Criteria (NOTE 3a)

A-41 Long-Term Seismic Program (NOTE 3b)

GL-79-07 Seismic (SSE) and LOCA Responses Instnamentation and Control issues I.D.1 Control Room Design Reviews (I) li.F.2 Identification and Recovery from Conditions Leading to Inadequate Core Cooling (I)

II.K.3(5) Automatic Trip of Reactor Coolant Pumps (I)

GL-82-28 Inadequate Core Cooling Instrumentation System I

4.1 Heat Transport Systems issues 4.1.1 lssue A-1: Water Hammer This issue addresses safety concerns associated with the effects of water hammer. Various water hammer incidents have occurred involving a number of systems,inc.uding steam generator feedrings and piping, ECCS, RHR systems, containment speay, service wate , feedwater, and steam hnes. The incidents have been attributed to such causes as rapid condensation of steam pockets, steam-driven slugs of wa+er, pump startup with partially empty lines, and rapid valve motion. Several of the incidents involved damage to piping and valves. The NRC staff believe that future plants should be systematically reviewed to ensure that water hammer is given appropriate consideration.

14

.I

I I This issue is applicable to the CANDU 3 design with potential CANDU 3 unique cansiderations. The CANDU 3 reactor is the first of its kind considered for licensing in the U.S. and its design has little

I in common with the design of U.S. power reactors. The CANDU 3 reactor does not house the fuel assemblies in a single vertically-oriented pressure vessel. Instead, the fuel assemblies in the CANDU 3 design are contained in a set of 232 horizontal pressure tubes. Flow to each fuel channelis supplied by an inlet feeder pipe and removed from the channel by an outlet feeder pipe. Water hammer analysis applied to U.S. reactors may not be applicable to the CANDU 3 design.

One potential CANDU 3 unique consideration might be coolant boiling which occurs at full power (Technical Description, page 2-120). The reactor cutlet header quality is rated at 4% and the peak channel power in the CANDU 3 design was increased to 8.1 MW from the 7.3 MW of operating CANDU 6 reactors. The quality of flow from the peak channel, depending upon core flow distribution, may be higher than the outlet header quality. The safety implication of this boiling is not at all clear since the CANDU 3 is a PWR, but it appears that a two-phase flow exists from core exit to some point in the steam generators whenever the reactor is operated at full power. Condensing steam may provide a driving mechanism for a water hammer or vibrations.

The available CANDU 3 documentation does not specifically address the topic of water hammer, I however the avoidance of damage to systems from water hammer is important to the safety of CANDU 3 plants.

4.1.2 issue 14: PWR Pipe Cracks I nis issue addresses cracking of high pressure piping in PWRs (Iow pressure piping is addressed in issue I C-7) and was focused on occurrences of main feedwater line cracking at Westinghouse and Combustion Engineering PWRs. Cracking in PWR nonprimary system piping could lead to a lessening of the system functional capability and possibly result in situations such as degraded core cooling. Cracking in the primary system piping has not been experienced and the mechanisms and environmental conditions necessary to initiate and propagate the cracking in this piping are not known to exist and the associated risk is negligible. f This issue is both directly and uniquely applicable to the CANDU 3 design. The applicability of the issue M the feedwater piping should be similar to its applicability to a U.S. PWR, however it is not possible to determine whether the same conclusions will be reached when s.ssessing this issue for the CANDU 3 I design. It should be noted that the CANDU 3 design operates at a significantly lowers pressures than U.S.

15 I

O O

PWRs, i.e., a secondary system pressure of 4.6 MPa for CANDU 3 and about 7.4 MPa for a typical U.S.

PWR.

I ne unique applicability concern is that the CANDU 3 primary system is very different from the primary system for a U.S. PWR, i.e., horizontal pressure tubes instead of a pressure vessel. Therefore, the conclusion that was drawn for this issue that cracking in the primary system piping has an associated negligible risk must be reevaluated for the CANDU 3 design.

4.2 Containment Issues 4.2.1 Issue A-48: Hydrogen Control Measures and Effects of Hydrogen Burns on Safety Equipment I

This issue addressed hydrogen control and mitigation systems in power reactors with small containment structures, i.e., Mark I, II, and III BWR containments and ice condenser containments. J Large dry PWR containments were excluded from Issue A-48 because they have a greater ability to I

accommodate th,; large quantities of hydrogen associated with a recoverable degraded core accident than the smaller BWR and ice condenser containments. Hydrogen control in large dry containments

]

was specifically addressed with Issue 121 (discussed in the next section). Ej l

Since the CANDU 3 containment design depends upon a large free volume to acconunodate reactor accident effluents, rather than a pressure-suppression engineered-safety-feature such as a suppression pool or an ice condenser, the CANDU 3 containment resembles a U.S. large dry containment.

Therefore, the primary applicability of Issue A-48 to the CANDU 3 design is provide a more complete set of generic hydrogen es el requirements to the licensing review process. (Hydrogen control in the CANDU 3 containmen* as examined in more detail in a review of the containment performed by SEA".)

The CANDU 3 design includes the capability to control combustible gases by rmxmg and dispersing I

with the fan coolers and by recombination using igniters. The operability and performance of the fans are assured by normal operation. De igniters are seismically qualified and have sufficient redundancy to accommodate single failures without loss of function. The HVAC systems and other equipment used for hydrogen control are designed to withstand the effects of hydrogen burn or detonation. 1 10 CFR 50.34 requires the provision of a system for hydrogen control that can safely accommodate hydrogen generated by the equivalent of a 100% fuel-clad metal water reaction with reasonable 16 I ,

l

$I a

l I

I assurance that the uniformly distributed hydrogen concentration in the containment does not exceed 10 % If all the fuel bundle zirconium in the CANDU 3 design were oxidized, the resulting I containment hydrogen concentration would reach about 8%, however there is considerably more zirconium in the reactor than just the fuel bundle zirconium. The CANDU 3 pressure tubes and calandria tubes mass about 14400 and 5100 kg of zircoloy respectively, compared to about 6400 kg for the fuel bundles. The Canadian safety calculations seem to show that significant pressure tube oxidation is prevented by heat transfer to the calandria tank moderator water, therefore pressure tube oxidation was not included in their combustible gas analysis but the Canadian calculations do not consider severe accident conditions. During a core meltdown cccident scenario, at least partial pressure tube and calandria tube oxidation must be considered.

The hydrogen produced within a CANDU 3 heavy water reactor will be in the form of deuterium.

The Canadians report that experimental data do not show significant differences in the diffusion, mixing, ignition, and burning of deuterium versus hydrogen. This conclusion will need verification.

The type and performance of the igniters will need examination. TTR-429 states that the igniters may be either the glow plug type or the autocatalytic type. If the autocatalytic type is used, then the analysis should concider the relatively slow time response of autocatalytic recombiners as a possible I impediment to their efficiency.

The CANDU 3 containment design pressure and free volume are both lower than typical for U.S.

PWRs. The CANDU 3 design pressure is 29 psi compared to a range of about 45 to 60 psi for U.S.

PWRs. The CANDU 3 free volume is about 1.4 million cubic feet compared to over two million cubic feet for most U.S. PWRs. However, when the free volume is related to reactor thermal power, the CANDU 3 design has about 3 times the free volume per MW as most U.S. PWRs.

The CANDU 3 containment interior is subdivided into spaces that are accessible and non-accessible while the reactor is at power. Hydrogen releases to the containment would most likely occur in the smaller non-accessible space and dampers or blowout panels must open before hydrogen mixing can occur.

Analyses associated with the CANDU 3 design was done with Canadian codes which probably have not been reviewed by the NRC. Their combustion and containment response analyses do not appear to be implicitly integrated. Hydrogen is simulated in their containment code, PRESCON, by adding I an equa! volume of air to the containment atmosphere. The combustion analysis is modeled by the VENT code as combustion within a volume venting to a much larger volume implying each 17

O subcompartment must be analyzed separately. Their analyses will need to be reviewed and probably verified by calculations done with U.S. codes.

4.2.2 Issue 121: Hydrogen Control for Large Dry PWR Containments This issue deals specifically with hydrogen control measures within a large dry containment and the I

possibility and effects of local and global detonations and is directly applicable to the CANDU 3 design. The safety concerns addressed by this issue and the preceding issue A-48 should probably be resolved simultaneously to ensure a comprehensive review of hydrogen control measures; mixing and potential for local as well as global detonations; and effects of hydrogen burns on safety equipments as they relate to the CANDU 3 design. The CANDU 3 design as discuss in Issue A-48 applies to this issue as well.

4.2.3 Issue 157: Containment Performance This issue deals with the challenge to the containment following a large core-melt. The containment is the final barrier to the release of radioactive material to the environment. CDC 16" requires the reactor contairunent to provide an essentially leak tight barrier against the uncontrolled release of radioactivity to the environment, especially during the early stage of a severe accident. Challenges 5 to the containment considered by this issue include bypass, DCH, and hydrogen combustion. The issue was resolved for U.S. PWR containments because their conditional failure probabilities are low.

This issue is applicable to CANDU 3 and its resolution must consider the unique features of the CANDU 3 design. Its complete applicability cannot be assessed until the Canadians complete their severe accident analyses. The fuel channel reactor design almost eliminates the possibility of a high pressure core melt ejection. The possibility of containment bypass will need to be evaluated, particularly under severe accident conditions. The possibility of hiling the steel liner covering the basemat should be considered since the current level of design descripti7n does not adequately specify the location of the liner relative to where core debris might accumulate. However, before the core debris can reach the containment floor, it must penetrate several barriers, i.e., the heavy water filled calandria and the water filled shield tank.

The potentially most severe challenge to the CANDU 3 containment following a core meltdown would come from hydrogen combustion. The amount of hydrogen produced during a core meltdown of a B

CANDU 3 plant is uncertain at this time since the severe accident analyses have not been done. The E complete oxidation of all fuel bundle zirconium in the core without any hydrogen reduction would 18 I

I

I results in a containment hydrogen concentration of about 8% but the pressure and calandria tubes contain approximately three times as much zirconium as does the fuel bundles. During a core I meltdown accident scenario, at least partial oxidation of the pressure and calandria tubes must be considered.

I The CANDU 3 containment design pressure and free volume are both lower than typical for U.S. large dry PWRs, thereby potentially making the containment more susceptible to an early containment failure. The CANDU 3 design pressure is 29 psig compared to a typical pressure about 45 to 60 psig for U.S. PWRs. The CANDU 3 free volume is about 1.4 million cubic feet compared to over two million cubic feet for most U.S. PWR. However, when the free volume is related to reactor thermal power, the CANDU 3 design has about 3 times the free volume per MW as most U.S. PWRs. l 4.3 Balance of Plant Issues l

4.3.1 !ssue 82: Beyond Design Basis Accidents in Spent Fuel Pools This issue deals with potential accidents involving high density casite fuel storage racks, such as the effect of the increased heat loads. Specifically, this issues deals with any possibility that the pool could be drained, the pool cooling system could be lost for an extended time, and any possibility of criticality.

This issue applies to CANDU 3 with possible unique considerations. All piping that penetrates the storage bay walls is of sufficient height above the stored fuel to prevent drairiing of the bay and syphoning is prevented by the use of syphon breakers or vents. The use of syphon breakers may differ from U.S. practice and there reliability could be a sigruficant safety consideration.

I Criticality of the irradiated natural uranium fuel bundles is not considered by the Canadians to be a concern unless flooded with heavy water and flooding of the storage bay by heavy water is not considered credible. However, the reduced spacing requirements to prevent criticality with natural uranium fuel may allow the fuel bundles to be more densely packed than is practiced in the U.S. If the bundles as packed more densely, then the concerns of this issue regarding the loss of cooling may be a greater concern for CANDU 3 than for U.S. reactors. Further, the continuous on-power refueling of approximately one fuel channel per day implies that there will always be very ' fresh' fuelin the bay.

s The irradiated fuel storage bay will be designed to hold an accumulation of irradiated fuel corresponding to a muumum of 6 years of full power operation, plus emergency provision for one

}

19 I

l

,O, ;

U additiond core load. His relatively low number of years may be a concern for operating a plant in the U.S., based on demonstrated U.S. inability to deal with spent fuel.

4.4 Safety Analysis and Emergency Operating Procedures issues 4.4.1 lasue I.C.1(1): Small Break LOCAs issue I.C.1 addressed improvement to the quality of procedures used for normel, transient, and accident conditions. The overall goal was to provide greater assurance that operator and staff actions are technically correct, explicit, and easily understood. Licensees of operating plants and applicants were required to perform analyses of transients and accidents, prepare emergen y procedure guidelines, upgrade emergency proced ures, including procedures for operating with natural circulation conditions, and to conduct operator retraining. Initiatirg events should include the events presented in the FSAR, loss of instrumentation buses, and natural phenomena such as carthquakes, floods, and tornadoes. The analyses should consider the occurrences of multiple and consequential failures t.nd the analyses should be carried out far enough 8.nto the event to assure that all relevant thermal / hydraulic /neutronic phenomena are identified. The specific focus of Part I was to improve the quality of procedures related to small-break LOCAs.

This issue is applicable to the CANDU 3 design with CANDU 3 unique considerations. The design of the CANDU 3 reactor, i.e., horizontal pressure tubes, potentially increases both the probability and variety of possible small break LOCAs. Possible unique types of small break LOCAs include: a pressure tube rupture within the moderator cooling system, a feeder line break, a refueling accident leading to an end-fitting failure, and a refueling machine LOCA while the machine is connected to the reactor. The reactor's positive void coefficient will cause a power surge as the fuel channels void prior to significant reactivity insertion. Further, the systems available to respond to a small LOCA differ considerable from those of U.S. plants. It will be important that procedures used at CANDU 3 plants be technically correct, explicit, and easily understood. 3 4.4.2 Issue I.C.1(2): Inadequate Core Cooling This is Part 2 of 1.C.1 which addresses improvement to the quality of procedures used for normal, transient, and accident conditions. He specific focus of Part 2 was to improve the quality of procedures related to inadequate core cooling.

20 I

E_

m

This issue is applicable to the CANDU 3 design with CANDU 3 unique considerations. The systems available to provide core cooling in the CANDU 3 design differ considerably from U.S. plants. For I example, the moderator cooling system can be used to remove heat from the reactor. The design facilitates the use of natural circulation to cool the core. However, in the CANDU 3 design, the adequacy of core cooling must be assessed for each individual fuel channelinstead of a single reactor vessel.

I 4.4.3 Issue 1.C.1(3): Transients and Accidents I This is Part 3 of 1.C.1 which addresses improvement to the quality of procedures used for normal, transient, and accident conditions. The specific focus of Part 3 was to improve the quality of I procedures related to transients and accidents.

This issue is applicable to the CANDU 3 design with CANDU 3 unique considerations. The systems which respond to a transient or accident in the CANDU 3 design differs considerably from U.S. plants.

For example, responding to an ATWS event by tripping the circulation pumps, as is done in BWR procedures, would increase core power in the CANDU 3 design instead of reducing it due to its positive void reactivity coefficient.

I 4.4.4 Issue I.C.1(4): Confirmatory Analyses of Selected Transients This is Part 4 of I.C.1 which addresses improvement to the quality of procedures used for normal, transient, md accident conditions. The specific focus of Part 4 was to establish requirements for confirmatory analyses of selected transients by NRR. These confirmatory analyses would be used to provide the basis for comparisons with analytical methods used by reactor vendors. The safety significance is the reduction in operator errors and upgrading of operating systems, thereby provi, ding greater assurance that operator and staff actions are technically correct.

I This issue is applicable to the CANDU 3 design with CANDU 3 unique considerations. Much of the confirmatory analyses performed for U.S. plants will likely not be applicable to the CANDU 3 design.

Therefore, additional confirmatory analyses pertinent to the CANDU 3 design will be required.

Further, due to the uniqueness of the CANDU 3 design, these analyses will require either acquiring and using appropriate Canadian codes or modifying U.S. codes so that they are applicable to the CANDU 3 design.

I I 21

E O

4.4.5 Issue II.K.3 (30): Revised Small-Break LOCA Methods to Show Compliance with 10 CFR 50, Appendix K This issue requires all operating licenses and license applicants to submit revised analyses used by the NSSS vendors and/or fuel suppliers for SBLOCA analysis in compliance with 10 CFR 50, Appendix K. The revisions should account for comparisons with experimental data, including data from the LOFT Test and Semiscale Test facilities. A number of concerns were identified regarding the adequacy of certain features of SBIDCA models, particularly the need to confirm specific model features, such as condensation heat transfer rates, against applicable experimental data.

His issue applies to the CANDU 3 design with CANDU unique considerations. He probability of SBIDCAs could be especially important to the safety of a CANDU 3 plant due to its use of horizontal fuel channels rather than a reactor vessel. Small breaks could occur in one of its many feeder lines, pressure tubes, or related fittings and connections. On-power refueling with the refueling machine continually connecting to the fuel channels while the reactor is at power should contribute significantly to the probability of a SBLOCA.

The systems related experimental data for comparison will come from CANDU related experiments conducted by AECL rather than the LOFT and Semiscale Tests. The analytical codes and models used by AECL are unique to CANDU reactors and probably have not been verified by the NRC. The available analysis, presented in the CSR, which is applicable to small breaks in a CANDU 3 heat transport system consists of pressure tube rupture calculations. Other CANDU unique considerations include its positive void fraction reactivity coefficient and the fuel ejection scenario following an end-fitting failure.

4.4.6 issue II.K.3 (31): Plant-Specific Calculations to Show Compliance with 10 CFR 50.46 his issue requires all operating licenses and license applicants to submit plant-specific calculations using NRC approved models for SBLOCA to show compliance with 10 CFR 50.46. Rese calculations are as described in issue II.K.3 (30) to show compliance to 10 CFR 50, Appendix K. His issue however specifically states that NRC-approved models must be used.

His issue applies to the CANDU 3 design with CANDU unique consideratiors in the same marmer as Issue II.K.3 (30). Again, the analytical codes and models used by AECL are unique to CANDU reactors and probably have not been verified by the NRC.

22 ar.

I 4.4.7 Issue A-9: ATWS I This issue involved an assessment of the probability of an Anticipated Transient Without Scram (ADVS) event. The assessment includes the analytical models and the development of appropriate safety objectives.

The CANDU 3 design incorporates two reactor shutdown systems in addition to the regulating system.

One system consists of 24 mechanical spring-assisted gravity-drop vertical shutdown rods. The other I system injects a gadolinium nitrate solution into the moderator. These two systems are independent in concept and physically separated. The shutdown systems respond automatically to both neutronic and process signals. Either system is capable of shutting down the reactor and keeping it shutdown for all design basis events. The reactor regundng system, which is independent of the two shutdown systems, has gravity-drop control rods to shutdown the reactor.

I The ATWS event is applicable to all types of reactors including CANDU 3, however the Canadian position regarding an ADVS appears to be that an ATWS is not a credible event due to the redundancy in their design. Apparently an ADVS event has not been evaluated as analytical models and methods were not presented. Methods by which an operator might control an ATWS were also I not presented.

There are unique aspects to an ATWS event in a reactor of the CANDU 3 design. In particular, the CANDU 3 reactor has a positive void reactivity coefficient, whereas U.S. reactors are designed with a negative void coefficient. In the U.S., the negative coefficient can be relied upon to possibly control an ATWS event and if a power excursion does take place, then the negative void reactivity will eventually shutdown the reactor as the increased power produces sufficient voiding. In a CANDU I 3 reactor, a power excursion will produce voiding which will further increase the power until some other mechanism such as fuel temperature or fuel relocation provides sufficient negative reactivity to shutdown the reactor. An ATWS event in CANDU 3 could rapidly degrade the reactor.

An evaluation of CANDU 3 ADVS events should possibly consider another type of loss-of-reactor- l control which is unique to CANDU reactors,i.e., a pressure tube rupture that is postulated to damage )

l control rod guide tubes and displace moderator poison. It is considered possible that a pressure tube rupture could damage control rod guide tubes and the depressurization cf the heat transport system can displace moderator poison as moderator water is ejected from the tank and replaced by heavy f water from the heat transport system. It is considered improbable that a sufficient number of control l l

i 23 I

E

=

rod guide tubes can be damaged to prevent reactor shutdown, however a licensing review should look into this type of CANDU unique event.

I 4.4.8 Issue 116: Accident Management This issue addresses procedures and training for operator use in dealing with accidents that go beyond inadequate core cooling with severe core damage or core-melt. Operators without procedures and untrained in core-melt accident progression, phenomena, and consequences might fail to take full advantage of opportunities or give erroneous advice and guidance to offsite emergency personnel.

It is important for the operators to assess what systems or components have failed, what that failure means to the future success of core cooling, and to consider makeshift repairs if necessary.

This issue is applicable to the CANDU 3 design with CANDU 3 unique considerations. Severe core damage accidents were not assessed in the available documentation. The accident progression scenarios have not been adequately described. Although a CANDU 3 severe accident may have some features that are similar in nature to a severe accident in a U.S. reactor, there will undoubtedly be CANDU 3 unique features as well. Analyzing the severe accident management of a CANDU 3 plant while it is still in the design stage could show weaknesses which are correctable at this stage.

4.4.9 Generic Letter 79-58": ECCS Calculations on Fuel Cladding This generic letter addresses the adequacy of calculational models dealing with fuel cladding swelling I

and the incidence of rupture. Section 50.46 of 10 CFR Part 50 requires that the peak cladding temperature following a postulated LOCA not exceed 2200 F. The letter requests the licensees to review staff analysis on cladding strain and fuel blockage models to confirm that the licensee's models are conservative with respect to the staff's new models. If the licensee's models are less conservative, then additional calculations were required to demonstrate compliance with the limits of 10 CFR 50.46.

This issue was discussed further in GL-79-69" and GL-80-106.

1 I

This generic letter is applicable to the CANDU 3 design with CANDU 3 unique considerations. The j models associated with calculating the response of fuel rods following a LOCA in the horizontal I pressure tubes of CANDU 3 must differ considerably from the models used to evaluate U.S. plants. j The models must, for instance, address flow stratification in the horizontal fuel channel. The models must address the heat transfer to the moderator system through the pressure and calandria tubes. The models must address the possible differences in the various 232 fuel channels. Further, the models 3 24 i i

l C

l

must address the initial power surge caused by the positive reactivity void coefficient prior to significant negative reactivity insertion.

I The available documentation did not show the cladding temperature response to an accident sequence with the ECCS functioning, however the temperature response of a large break LOCA calculation without ECCS shows (CSR, Volume 3, Figure 2.1-2) cladding temperatures exceeding the 2200 F limit about 6 seconds after the break occurred. The rapid increase in the cladding temperature of this calculation tends to cast doubt that the ECCS in the CANDU 3 design can prevent the cladding temperature from exceeding the 2200 F limit.

4.4.10 Generic Letter 80-12: Analysis of a PWR Main Steam Line Break with Continued Feedwater Addition This generic letter addresses a deficiency in some steam line break analyses significantly affecting predicted containment pressure. Steam line break analyses should consider the possibility of the auxiliary feedwater system continuing to supply feedwater at runout conditions to the steam generator that had experienced the steam line break.

This issue is directly applicable to the steam line break analysis for CANDU 3 design. Auxiliary feedwater is supplied to the steam generators by mean of the safety-related group 2 feedwater system taking suction from two tanks located in the group 2 service building; and from the diesel-driven group 1 feedwater system which takes suction from a reserve feedwater tank. The CANDU 3 design review will need to determine the possibility of feedwa ter runout following a steam line break and it impact on the steam generator and reactor systems and on the containment pressure.

I 4.4.11 Generic Letter 83-11'2: Licensee Qualification for Performing Safety Analyses in Support of Licensing Actions This generic letter describes the current NRR practice regarding the qualification of licensee personnel l used to perform safety analyses in support of licensing actions. The NRC recognizes that a large i

percentage of the errors encountered with results derived from large and complex thermal-hydraulic codes can be traced to the user rather than to the code itself. This generic letter requests that licensees who plan to perform their mvn safety analyses demonstrate proficiency in using the code by performing their own code verification, as opposed to relying on the code verification work previously I performed by others. f I

E O

I, This generic letter has potential unique considerations when applied to the CANDU 3 design. The CANDU reactors with their horizontal pressure tube designs require analytical codes which differ substantially from the codes used in the U.S. The Canadians have developed their own computer codes. U.S. licensees will either have to adapt the Canadian codes or use U.S. codes modified to accommodate the CANDU 3 design. Certain aspects of the CANDU 3 design, in particular the horizontal pressure tubes, will require significant modifications to thermal-hydraulic codes, such as RELAP and TRAC, or core meltdown codes, such as MELCOR. Applying the modified codes will also require additional qualification by licensee personnel performing their own analyses. Therefore, the design certification review should consider the availability of appropriate codes for which plant licensees can qualify to preform their analyses. The proficiency of individuals involved in safety analyses will be important to the overall sa'ety of the CANDU 3 plants.

4.5 Seismic Issues I

4.5.1 Issue A-40: Seismic Design Criteria I

This issue investigated selected areas of the seismic design sequence including analytical methods, conservatism, and altemate approaches; and modified the SRP criteria. This effort was necessary to properly account for the numerous and significant changes in the seismic design process that had occurred during the course of the commercial nuclear power program.

This issue does not directly apply to the CANDU 3 design since the licensing process will require that I

the design meet the SRP criteria which were updated to include the safety concerns of this issue.

However, the CANDU 3 seismic design sequence may have used analytical methods which differ significantly with those methods evaluated during the resolution of this issue. If so, then these other E

methods may need to be appropriately evaluated before the seismic design can be accepted. B 4.5.2 1ssue A-41: Long-Term Seismic Program This purpose of this issue was to quantify the inherent safety margins in the NRR's seismic design requirements. PRA studies have indicated that the seismic risk may be a signincant contributor to the total risk for nuclear power plants but most PRAs prepared, to the date of this issue, do not include an assessment of risk from earthquakes. It was deemed important that the NRC have methods to quantify and assess seismic risk to evaluate and ers. hance the credibility of PRAs. This issue is related to Issue A-40.

26

I I This issue does not directly apply to the CANDU 3 design since the licensing process will require that the design meet the NRR's seismic design requirements. However, the CANDU 3 seismic design sequence may have used analytical methods which differ significantly with those methods evaluated during the resolution of this issue. If so, then these other methods may need to be appropriately -

evaluated before the seismic design can be accepted.

4.5.3 Generic Letter 79-073: Seismic (SSE) and LOCA Responses This generic letter is not available for review, but since it apparently addressed the contents of I NUREG-0484", its applicability was evaluated on the basis of the safety concern addressed in NUREG-0484 which discusses the NRC's requirement that the structural and mechanical responses due to various accident loads caused by natural phenomena, such as carthquakes, be combined when analyzing structures, systems, and components. GDC 2" calls for an appropriate combination of the effects to be reflected in the design bases of safety equipment. NUREG-0484 addresses the methodology for combining dynamic responses with emphasis on combining safe shutdown earthquake (SSE) and LOCA responses.

Tlus issue is directly applicable to the methodology used to combine loading responses in the CANDU I 3 design. The licensing review must verify that the methodology actual used in designing CANDU 3 agrees with methodology accepted in the U.S.

The emphasis on combining SSE and LOCA responses is particularly applicable to the CANDU 3 design because, based on available documentation, a design basis earthquake (DBE)-induced LOCA is not considered a design basis event in the CANDU 3 design, i.e., the design is not designed to cope with a LOCA simultaneously with a DBE. (The Canadian DBE is equivalent to the NRC SSE.)  ;

I 1 1

l 4.6 Instrumentation and Control Issues i

4.6.1 Issue I.D.1: Control Room Design Reviews l

l This issue required all licensees and applicants for operating licenses to conduct a detailed control-room design review to identify and correct design deficiencies. The review audit emphasized the adequacy of information presented to the operator to reflect plant status; display grouping and panel layout; impronments in the safety monitoring and human factors enhancements; communications; signal types; plant operability; procedures and training; alarm categorization; and location of shift supervisor's office. The control room must be designed with appropriate human factors engineering j i

27

E a

design principles to assure that the operator-machine interfaces of the control room are adequate to support safe operation of the plant.

This issue is applicable to the CANDU 3 design with CANDU 3 unique considerations. Based on the description of the instrumentation and control systems, and the plant display system of the CANDU 3 control room is an evolutionary step from the operating CANDU plants. Most control functions are implemented by a distributed control system (DCS) which uses a data highway for signal transmissions, and a programmable controller for control logic. The DCS consists of a number of channelized stations distributed throughout the plant, linked by channelized dust redundant co-axial cable data highways. The control system uses the same dual-redundant fault-tolerant concepts as used in previous CANDU computerized control systems to assure a high level of system reliability. The DCS features automatic failure detection and recovery features for cable and module faults. A separate g control system is used for control and monitoring of the fueling machine and related systems.

The plant display system (PDS) is used for centralized operator interface functions, including CRT alarm annunciation, CRT graphic display system and data logging. Most process information from the plant is fed to the PDS via the distribution control system (DCS). Operator setpoints for the control functions are input to the DCS via the PDS. In addition, the PDS also receives infonnation from systems not connected to the DCS, such as safety systems, meteorological monitoring, and the station clock to provide a complete signal data base accessible to the operator.

The CANDU 3 unique considerations are primarily in regard to the level of automation. The level of I

automation in CANDU 3 is much greater than the existing U.S. plants. Therefore the role of the human operator is different. Control of the safety functions is essentially allocated to the automated distributed control system. The human operator is responsible for monitoring and controlling the automation. The most important CANDU 3 control room considerations are in what happens when the distributed control systems or plant display systems fail and in how the operator information and g

control needs are met when the automatic safety systems fail. 3 Further, the level of automation in CANDU 3 affects the way operators control the plant in emergencies. U.S. plants function on a symptom based accident mitigation strategy because the plants are relatively manual and require human intervention. Highly automated control systems tend to require less human intervention in the control of safety functions, and more human monitoring of automated system performance. This drives an accident mitigation strategy that tends to focus on events such as faults in the safety control systems. The NRC needs to determine if the control room 28 I

I

y I

design incorporates the information and controls need to mitigate the comequ-nees of automatic control and safety system faults.

The control room review should include the role of the human operators in the CANDU design; the role of automatic safety systems in CANDU design; the role of manual safety systems in the CANDU design; the operator information and control requirements during both normal and emergency operations; and the intemational standards applied to the design.

Issue II.F.2: Identification and Recovery from Conditions Leading to Inadequate Core I

4.6.2 Cooling This issue addresses instrumentation needed to provide an unambiguous, easy-to-interpret indiention of inadequate core cooling (ICC). Licensees shall provide a description of any additional instrumentation or controls proposed to supplement existing instrumentation, including functional design requirements, procedures, analysis, and installation schedules. (Note that ICC monitoring is also covered in Generic Letter 82-28"(addressed in this section) which contains several specific requirements including a reactor coolant inventory tracking system.)

This issue is uniquely applicable to the CANDU 3 design because, unlike PWRs, the CANDU 3 reactor does not house the fuel assemblies in a single vertically-oriented pressure vessel. Instead, the fuel assemblies in the CANDU 3 design are contained in a set of 232 horizontal pressure tubes. Flow to each fuel channel is supplied by an inlet feeder pipe and removed from the channel by an outlet feeder pipe. In addition to the fuel assemblies, each channel includes inlet and outlet shield plugs, a fuel pusher plug to remove fuel during refueling, and a latched spacer plug. If any fuel channel should become blocked, then cooling to fuel in that channel could certainly become inadequate. Further, if I a coolant inlet header were to partially void, then coolant flow might well be denied to some fuel chrnnels. Small LOCAs, known as fuel channe'. pressure tube ruptures, are also a potential for ICC.

De CANDU 3 design includes instrumentation to monitor the outlet coolant temperature of each fuel channel. However, since coolant boiling occurs at full power, the reactor power must be reduced for the channel temperature monitoring system measuremes to be meaningful. Hence, channel flow verification is done while the reactor is retummg to full power. This implies that these outlet channel temperature measurements are inadequate to continually monitor for ICC during normal full power operation. In addition to the channel temperature measurements, the CANDU 3 design includes I instrumentation to monitor the heat transport system, the moderator system, and to detect leakage.

29

e

'L a O

4.6.3 Issue II.K.3(5h Automatic Trip of Reactor Coolant Pumps This issue addresses the automatic tripping of reactor coolant pumps at PWRs in the event of a LOCA.

Tripping of the reactor coolant pumps in case of a LOCA is not an ideal solution. The licensees were directed to consider other solutions in the case of a small LOCA, for example, an increase in the safety injection flow rate.

The CSR (Section 7.1'2.63 of Vol 2) indicates that the heat transport pumps will be automatically tripped during certain LOCA conditions. The timing of the pump trip signal will depend on the break size. For example, in the case of some small breaks, the pump trip is delayed until sufficient time has possed to allow the primary coolant system refill via the ECCS.

This issue is applicable to the CANDU 3 design with potential CANDU 3 unique considerations, I

simply because the CANDU 3 design is quite different from any plant licensed in the U.S. Therefore, the resolution of this issue for U.S. plants may not apply to a CANDU 3 plant. The need for automatically tripping of the heat transport pumps at CANDU 3 plants following the initiation of a LOCA should be fully evaluated.

4.6.4 Generic Letter 82-28'8: Inadequate Core Cooling Instrumentation System This generic letter was prepared to notify most Westinghouse and CE PWR licensees that safety ,

considerations required installation of a primary coolant inventory tracking system. This system would improve the reliability of plant operators in diagnosing the approach of inadequate core cooling.

The current instrumentation may not provide operators with sufficient information regarding a void fonnation in the reactcr vessel head. The inventory tracking system would complement the subcooling margin monitors and core-exit thermocouples. (Note that this issue is related to Issue II.F.2.)

This issue is uniquely applicable to the CANDU 3 design because, unhke PWRs, the CANDU 3 reactor does not nouse the fuel assemblies in a single vertically-oriented pressure vessel. Instead, the fuel assemblies in the CANDU 3 design are contained in a set of 232 horizontal pressure tubes. Flow to each fuel channel is supplied by an inlet feeder pipe and removed from the channel by an outlet feeder pipe. In addition to the fuel assemblies, each channel includes inlet and outlet shield plugs, a fuel t pusher plug to remove fuel during refueling, and a latched spacer plug. If any fuel channel should become blocked, then cooling to fuel in that channel could certainly become inadequate. Further, if I

a coolant inlet header were to partially void, then coolant flow might well be denied to some fuel 3 channels. Small LOCAs, known as fuel channel pressure tube ruptures, are also a potential for ICC.

, I B

=

I I The CANDU 3 design includes instrumentation to monitor the outlet coolant temperature of each fuel channel. However, since coolant boiling occurs at full power, the reactor power must be reduced for I the channel temperature monitoring system measurements to be meaningful. Hence, channel flow verification is done while the reactor is returning to full power. This implies that these outlet channel temperature measurements are inadequate to continually monitor for ICC during normal operation.

Subcoohng margin monitors may not be applicable if coolant boiling occurs at full power. In addition to the channel temperature measurements, the CANDU 3 design includes instrumentation to monitor the heat transport system, the moderator system, and to detect leakage.

I I

I I

I I  ;

I I

I 31 I ,

~I I 5.0 APPLICABLE CONCEPTUAL DESIGN ISSUES l

The issues grouped in this section are safety issues with basic conceptual design considerations, i.e.,

these are issues which either were or probably should have been covered in the conceptual design level of documentation available for this review. A total of 39 issues, which are listed in Table 5.1, were grouped in this category. A large portion of these issues addressed aspects of residual her.t removal reliability, i.e., system interactions, loss of power, auxiliary heat removal, ECCS, essential support systems, and LOCAs. Other issues address reactor control, containment cooling and integrity, I

I and plant and control system layout.

l Table 5.1: Applicable Conceptual Design Issues Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

Reactor issues D-3 Control Rod Drop Accident (NOTE 3b) 22 Inadvertent Boron Dilution Events (NOTE 3b)

GL-84-21 Long Term Low Power Operation in Pressurized Water Reactors Heat Transport Systems issues II.B.1 Reactor Coolant System Vents (I)

II.K.3(I) Install Automatic PORV isolation System and Perform Operational Test (I)

A-49 Pressurized Thermal Shock (NOH 3a) 66 Steam Generator Requirements (NOTE 3b) l 163 Multiple Steam Gerserator Tube Leakage (NOTE 4)

Containment issues ILB.2 Plant Shielding to Provide Access to Vital Areas and Protect Safety Equipment for Post-Accident Operation (I)

II.E.4.3 Integrity Check (NOTE 3b)

ILE.4.4(4) Evaluate Purging and Venting During Normal Operation (NOTE 3b)

B-12 Containment Cooling Requirements (Non-LOCA) (NOTE 3b)

Balonce of Plant issues .

l A-29 Nuclear Power Plant Design for the Reduction of Vulnerability of Industrial Sabotage j (NOTE 3b)

A-36 Control of Heavy Loads Near Spent Fuel (NOTE 3a)  !

'I 33 I

E O

Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

GL-80-96 Fire Protection Systems and Reliability Engineering and Risk Assessment issues II.K.3(25) Effect of Loss of AC Power on Pump Seals (I)

A-24 Qualification of Class IE Safety-Related Equipment (NOTE 3a)

A-25 Non-Safety Loads on Class 1E Power Sources (NOTE 3a)

A-31 RHR Shutdown Requirements (NOTE 3a)

A-43 Containment Sump Performance (NOTE 3a)

A-44 Station Blackout (NOTE 3a)

A-45 Shutdown Decay Heat Removal Requirements (NOTE 3b) l 23 Reactor Coolant Pump Seal Failures (HIGH) 24 Automatic Emergency Core Cooling System Switch to Recirculation (MEDIUM) 36 Loss of Service Water (NOTE 3b) 47 Loss of Offsite Power (NOTE 3b) 105 Interfacing Systems LOCA at LWRs (NOTE 3b) 122.2 Initiating Feed and Bleed (NOTE 3b) 124 Auxiliary Feedwater System Reliability (NOH 3a) 130 Essential Service Water Pump Failures at Multiplant Sites (NOTE 3a) 143 Availability of Chilled Water Systems and Room Cooling (HIGH) 153 Loss of Essential Service Water in LWRs (NOTE 3b)

Seismic issues A-46 Seismic Qualification of Equipment in Operating Plants (NOTE 3a)

GL-80-88 Seismic Qualification of Auxiliary Feedwater Systems Instrumentation and Controlissues I.D.2 Plant Safety Parameter Display Console (I) 1.D.3 Safety Systems Status Monitoring (MEDIUM)

III.A.I.2(1) Technical Support Center (I)

III.A.I.2(2) On-Site Operational Support Center (I)

III.D.3.4 Control Room Habitability (I)

I 34 E

e

I I

5.1 Reactor Issues I

5.1.1 1ssue D-3: Control Rod Drop Accident This issue addresses concerns related to assessing uncertainties in calculations of the control rod drop accident, including the choice of negative reactivity insertion rate due to a scram and potential differences between two- and three-dimensional calculations.

I This issue is applicable to the CANDU 3 design since four of its eight mechanical zone control rods enter the core from the bottom. They are drawn into the core by steel cab:es suspended through the control rod guide tubes from an electrically driven winch. Details of the winch and its control system were not included in the available documentation. The possibility of one of these zone control rods dropping from the core due to a failure of the control system or an interruption of the winch drive power should be considered.

The Canadians calculate the reactivity of their cores and the power and fuel bumup distributions using three-dimensional two-group neutron diffusion codes, therefore the differences between two- and I three-dimensional calculations is not relevant to CANDU 3 calculations. The three dimensional calculations are apparently necessitated because of the relatively large size of CANDU reactors cores.

The CANDU 3 core, which is the smallest of the CANDU reactors, has an effective diameter of 16.1 ft and a length of 19.5 ft. Further, the CANDU 3 core must contend with spacial flux instabilities caused by unique CANDU operations such as refueling at power. The CANDU 3 design includes a system for automatic spacial control and the total reactor power is automatically controlled from zero to full power. The various control rods are also repositioned as necessary for power distribution I shaping and fuel management 5.1.2 1ssue 22: Inadvertent Boron Dilution Events This issue addresses concems related to potentialboron dilution events at PWRs during cold shutdown conditions. Many PWRs do not have a positive means of detecting boron dilution in the cold shutdown mode. The concem regarding boron dilution of this type is related to the possibility of an inadvertent criticality situation.

This issue is applicable to the CANDU 3 design since the reactor design uses moderator poison to reduce excess reactivity during fresh fuel conditions or during a shutdown to compensate for xenon 35 I .

=

decay. Boron is used to reduce excess reactivity during the fresh fuel conditions, while gadolinium nitrate is used during shutdown. The moderator punfication system gradually reduces the boron concentration as the neutron-absorbing fission products reach equilibrium in the fuel. No discussion is given in the available CANDU 3 documentation regarding a positive means of detecting dilution of either boron or gadolinium nitrate. Further assessments will be required to assess the safety significance of boron dilution at CANDU 3 plants.

5.1.3 Generic Letter 84-21": Long Term Low Power Operation in Pressurized Water Reactors l

This generic letter was prepared to remind PWR applicants and licensees to ensure that their core I1 safety analyses have appropriately accounted for the actual plant operational conditions through a given fuel cycle. If the plant is not operated as originally planned, such as extended periods of low power operation, the licensee should perfonn a review of the fuel cycle safety analysis to verify its i applicability. Otherwise, actual bumup distributions on a retum to full power may result in an i unanticipated increase in the core peaking factor, and result in a situation outside the bounds of the applicable safety analysis.

This irue is applicable to the CANDU 3 design with possible unique considerations due to its refueling at power. The low power operation fuel cycle safety analysis must consider that the fuelin the CANDU 3 reactor is continually being changed out and rearranged. According to the CANDU j 3 Technical Description, the reactor is capable of operating in a range of power levels, and can operate at 60% full power on an indefinite basis. It is not stated whether or not power levels below 60% full power can be sustained on a long-term basis. It is noted in the CSR that variations in fuel burnup distribution could occur from several causes, including power cycling.

5.2 Heat Transport Systems Issues 5.2.1 Issue II.B.1: Reactor Coolant System Vents This issue deals with a requirement that vents be installed at high points on each reactor coolant system (RCS) and each reactor vessel to vent noncondensible gases from the RCS which may inhibit core cooling during natural circulation. The vents are to be remotely operated from the control room and the vents must not lead to an unacceptable increase in the probability of a LOCA or a challenge to containment integrity.

I 3e I

E

I I This issue is applicable to the CANDU 3 design since the heat transport system (H'I3) relies upon natural circulation for shutdown heat removal following pump rundown. An actual noncondensible gas venting I system was not found. A discussion of the degassing process for the HTS was not found but the available system diagrams show a degassing valve attached to the bleed condenser. The CANDU 3 design has a unique source of noncondensible gas which should be considered. Hydrogen is added to the heavy water coolant in the 1+2t transport purification system to suppress oxygen generated from radiolysis of heavy water. The rate of addition is 2.7 Ilmin for 30 minutes during an 8-hour shift.

5.2.2 Issue II.K.3(1): Install Automatic PORY Isolation System and Perform Operational Test Dis issue requires all PWRs to provide a system that uses the PORV block valve to protect against a I small-break LOCA. This system will automatically cause the block valve to close when the reactor coolant system pressure decays after the PORV has opened. He failure of this system should not decrease overall safety by aggravating plant transients and accidents and a confirmatory test of the automatic block valve closure system must be performed following installation.

I The CANDU 3 design is a PWR type of reactor, therefore this issue is applicable to the design. Tht.

design does include pressure relief valves, however there is insufficient detail to determine if the relief I valves include a system designed to protect against a small-break LOCA. Overpressure protection of the heat transport system is provided by the shutdown cooling system and by two instrumented liquid relief valves connected to the reactor outlet header and discharging into the bleed condenser. The bleed condenser then in turn is equipped with spring loaded safety relief valves. In addition, two steam relief valves are provided on the pressurizer to provide overpressure protection of the pressurizer whenever it is isolated from the heat transport system.

I 5.2.3 Issue A-49: Pressurized Thermal Shock his issue addresses concerns regarding thermal shock to a pressurized reactor vessel caused by an overcooling event while at high pressure. This issue focuses on reactor vessels that have been neutron irradiated sufficiently to decrease their fracture toughness. Decreased fracture toughness makes it more likely that a small inner surface crack could grow to a size that might threaten vessel integrity following a severe pressurized overcooling event.

This issue is not directly applicable to the CANDU 3 design since the design does not have a rea: tor I vessel, however the basic issue of thermal shock should be examined for the CANDU 3 design to ensure that a similar concern does not exist for the design's horizontal pressure tubes. Here are unique aspects 37 I

E to the application of this issue to the CANDU 3 design which may show that the issue is not a valid concern. For instance, the pressure tubes are made of zirconium not steel, the fuel channels can be replaced if neutron irradiation becomes unacceptable, and the operating pressure of the heat transport system is significantly lower than that of a U.S. PWR. However, the pressure tubes are also much thinner than a U.S. PWR reactor vessel wall.

5.2.4 Issue 66: Steam Generator Requirements This issues addresses the developments of generic steam generator requirements which would help mitigate or reduce steam generator tube degradations and ruptures. Steam generators tubes are part of the RCS pressure boundary and a tube leak or rupture could provide a direct path for the loss of primary system coolant through the steam generator to the environment outside the primary containment structure. Safety concerns were related to secondary inservice inspection and quality assurance, loose parts on the secondary side, secondary water chemistry program, condenser inservice inspection, and rafety injection signal reset.

His issue is applicable to the CANDU 3 design which employs two inverted vertical U tube steam generators, similar to those of a Westinghouse plant. He possibility of bypassing the primary containment and releasing radioactive fission products directly to the environment has a possible CANDU 3 unique consideration due to the Canadian practice of automatically depressurizing the secondary system to the atmosphere following a LOCA. Our review could not preclude the possibility that a steam generator tube rupture could generate a LOCA signal, thereby providing a direct path from the primary system to the atmosphere, prior to the isolation of the steam generator by the operator. Information regarding the integrity of the CANDU 3 steam generator tubes, the potential and history of corrosion problems, safety analyses of SGTR events, and risk analysis were not found in the available documentation. He integrity of the CANDU 3 steam generator tubes is discussed further in Issue A-3.

5.2.5 Issue 163: Multiple Steam Generator Tube 12akage his issue is currently being prioritized. As a consequence, a description of the issue was not readily I

available for our review. However the NRC now requires that analysis of multiple steam generator tubes involving two to five steam generater tubes be included in the application for design certification for the passive PWRs".

The issue title indicates that the issue will be directly applicable to the CANDU 3 design since the CANDU 3 design contains two inverted vertical U-tube in shell steam generators. Either of the two steam 3 generators can be isolated by closing the appropriate turbine stop valve and the steam interconnect valve l 38 I !

)

I by remote manual operation from the main control room. Steam generator rupture or leakage analysis for the CANDU 3 design was not available for review. The issue's applicability will also depend upon the I priority ranking assigned.

5.3 Containment Issues i 5.3.1 Issue II.B.2: Plant Shielding to Provide Access to Vital Areas and Protect Safety Equipment for Post-Accident Operatien ,

I This issue deals with radiation shielding design around systems that may, as a result of an accident, contain highly radioactive materials. A design review is required which identifies the location of vital areas and equipment, such as the control room, radwaste control stations, emergency power supplies, motor control centers, and instrument areas, in which personnel occupancy may be unduly limited or safety equipment may be unduly degraded by the radiation fields during postaccident operations of these systems. Each license shall provide for adequate access to vital areas and protection of safety equipment.

The buildings in the CANDU 3 plant design are laid out to assist in the necessary segregation of I radioactivity and other hazards from the personnel and the population during normal operations.

Radiation control zones are defined and physical barriers are provided to direct movement of contaminated material or persons from contaminated to clean zones.

The spaces inside containment are divided into two areas: areas that permit on-power access and those areas that do not. The inaccessible areas are contained behind the concrete shielding that forms part I

of the internal structure. The accessible areas of the cor.tainment contain instrumentation, process and mechanical systems and associated auxiliaries, however, the majonty of the components that require frequent inspection and access are housed outside the containment. 'Ihe reactor core has the primary shielding provided by the shield tank supplemented by concrete. Secondary shielding 3.s placed around the components of the heat transport system. Auxiliary shielding is provided for the main moderator system, auxiliary system components, the shutdown cooling system, heat transport purification system, the fueling machine, ion exchangers, and cover gas system components.

I The CANDU 3 shielding design was not discussed, as it relates to postaccident operations, in the available accumentation. This issue is applicable to the CANDU 3 design and the appropriate I postaccident shielding design review will have to be performed. The shielding design review should address both the main control room and the secondary control area and the protection of the reactor 39 I

E O

operators in the event that reactor control is transferred from the main control room to the secondary control area following an accident.

I 5.3.2 1ssue ILE.4.3: Integrity Check This issue deals with periodic and continu. - testing to detect unknown gross openings in the containment structure. Severe offsite exposure would be expected should a LOCA resulting in major fuel damage occur in a plant which has an undetected breach in the containment building. A possible solution would be to incorporate systems which can continuously monitor containment pressure, g, temperature, inflow and outflow of fluids, and alarm upon abnormal conditions. 5 This issue is applicable to the CANDU 3 design and the conceptual design already includes an appropriate monitoring system. The containment Gross leakage Monitoring (GLM) system monitors building air pressure and temperature along with other data , while the plant is operating to warn of significant leakage and to provide a timely indication of any gross breach of containment. The containment is normally operated at a slightly subatmospheric pressure. In addition, the design provides the capability to periodically leakage test the isolation valves to ensure operability and to check that the leakage is within acceptable limits. The leakage rates of airlocks, equipment hatch and ventilation system isolation dampers are checked on a yearly basis. The containment is designed for an unavailability of not more than 10'8 yr/yr.

5.3.3 Issue ll.E.4.4(4): Evaluate Purging and Venting During Normal Operation This issue deals with radiological consequences of containment purging of nuclear power plants while in the power operation mode, i.e., radiation releases will occur should a LOCA occur while the g containment is being purged. The amount of radioactivity released could be relatively large if the 5 LOCA resulted in major fuel damage and the containment purge system was not isolated. Specific concerns of Issues II.E.4.4(1), ILE.4.4(2), and ILE.4.4(3) should be reviewed to ensure completeness. ,

This issue is applicable to the CANDU 3 design with CANDU unique considerations. The CANDU 3 containment ventilation system provides air exchange and maintains the containment at a slightly lower than atmospheric pressure. The system draws air from outside the containment and exhausts it through the exhaust system to the atmosphere. The exhaust air is continuously monitored for activity and is filtered as necessary before release to the exhaust stack. Containment isolation is accomplished by two valves in series in each of the ventilation duct penetrations in the containment l l

wall. Schedules and procedures for maintenance within the containment are different for the CANDU 40 Il 1 I

=,

3 design than for U.S. plants because of their on-power refueling. Since on-power refueling makes maintenance outages less frequent, more maintenance in done while the reactor is at power. Most of I the containment is accessible during normal operations.

The requirements of maintaining air quality and temperature for human occupation in the accessible areas and fewer maintenance outages therefore could increase the likelihood of a LOCA occurnng while the contamment ventilation system is purging air to the environment. The NRC proposed solution of limiting the use of the pwge system is less feasible for a CANDU 3 plant than for a U.S.

plant.

5.3.4 Issue B-12: Containment Cooling Requirements (Non-LOCA)

This issue deals with the adequacy of the design requirements imposed on the containment ventilation systems, i.e., the consequences of a loss of normal containment cooling including the impact, if any, on the operability of safety and control systems. Specifically, the resolution of this issue will establish whether or not: 1) the normal ventilation system is essential to achieve a safe cold shutdown, 2) a failure in the system could cause an accident, and 3) the system is required to mitigate accidents.

The applicability of this issue to the CANDU 3 design is similar to its applicability to a U.S. PWR.

I Containment cooling is achieved by air coolers supplied with recirculated cooling water. The ventilation system draws supply air from outside containment and exhausts it through the exhaust stack to atmosphere. Air is circulated within containment by the cooling system and the heavy water vapor recovery system.

I The technical review did not find any indications that the normal ventilation system is essential to achieve a safe cold shutdown or that a failure in the system could cause an accident. The containment I air coolers appear to be the only method of removing heat from the containment atmosphere and with ,

I their unavailability, the containment temperature should be expected to rise. However their is no I

indication that the ventilation system is required to mitigate a non-LOCA accident.

5.4 Balance of Plant Issues 5.4.1 1ssue A-29: Nuclear Power Plant Design for the Reduction of Vulnerability of Industrial Sabotage I This issue involved the consideration of altematives to the basic design of nuclear power plants with the primary emphasis on reducing the vulnerability of reactors to industnal sabotage. Value/ impact i

1 l

I 41 i

l

l O]

O analyses were done to study the addition of an independent hardened decay heat removal system for use by operators during a sabotage incident or other extreme emergency.

The issue of plant security is applicable to cil nuclear power stations including the CANTU 3 design.

The CANDU 3 design should be reviewed and analyzed to ensure that no unacceptable vulnerabilities to sabouge eust and to search for potential improsements which could be implemented into the design.

5.4.2 Issue A 36: Control of Heavy Loads Near Spent Fuel All nuclear power plants use overhead cranes to lift heavy objects in the vicinity of spent fuel. A g release of radioactivity could occur if a heavy object were to fall onto spent fuelin the storage pool m or in the reactor core during refueling.

The CANDU 3 design includes cranes both inside and outside the containment, therefore this issue is applicable. An overhead crane will span the width of the irradiated fuel storage bay. Detailed information showing the location of the cranes relative to spent fuel was not available for review.

5.4.3 Generic Letter 80-96": Fire Protection This generic letter provides guidance to the Northeast Nuclear Energy Company regarding the schedule for implementation of proposed fire protection requirements specified in 10 CFR 50.48" and 10 CFR 50, Appendix R". These fire protection requirements include a number of major elements, for example the establishment of a fire protection program and an analysis of fire hazards. Also included are requirements for separation of redundant equipment to help ensure that safe shutdown capabilities will be maintained following a fire. The separation of redundant safe shutdown equipment includes related cabling. Additional fire protection requirements and guidance is provided for evolutionary I

5 LWR certification in SECY-90-016" and an associated Memorandum". This generic letter was chosen as a focal point for these safety aspects, as there does not appear to be a USI or GSI covering fire protection. Further, other generic letters dealing with fire protection, such as GL-81-12", " Fire Protection Rule," were declared duplicate or non-applicable as appropriate.

Fire protection applies to the all nuclear power stations including the CANDU 3 design. The CANDU 3 design includes features for fire protection, per the Safety Design Guide, SDG-005," Fire Protection."

(The SDGs were provided as appendices to the CSR.) SDG-005 requires the design to conform to Canadian Standard CAN/CSA-N293-M87, " Fire Protection for CANDU Nuclear Plants." The fire 42 I

w

I protection requirements include requirements that at least one group of shutdown and decay heat removal equipment be operable following a fire. Also given are requirements for the establishment I of a fire protection program, requirements for fire prevention, and requirements for the mitigation of fires. The separation of cables is also addressed. Further, SDG-004, "Crouping and Separation,"

specifies requirements regarding the grouping and separation of systems. The Technical Description provides limited discussions regarding the fire protection for the nuclear steam plant, the nuclear steam services, and the diesel generators.1TR-429 provides a discussion of the conformance of the CANDU 3 design to certification issues in SECY-90-016.

5.5 Systems and Reliability Engineering and Risk Assessment issues r 5.5.1 Issue II.K.3(25h Effect of Loss of AC Power on Pump Seals This issue requires most operating plants and all applicants to verify the adequacy of pump seals to withstand loss of cooling water due to loss of AC power for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Issue 23 addressed pump seal failures in a more general sense.

This issue is applicable to the CANDU 3 design because the CANDU 3 design includes 4 electrically I driven centrifugal heat transport pumps located between the steam generator outlets and the reactor inlet headers at the inlet side of the reactor. The heat transport pumps used in the CANDU 3 design may be susceptible to seal failures during a loss of AC power condition. These pumps have mechanical seals that are normally cooled and lubricated externally via cocied and filtered D 2O from the discharge of the D2 O feed pumps. If the D:O pumps are not available, a backup supply seal cooling water is supp3ed via the heat transport pump casing. While not explicitly stated in the CANDU 3 documentation, it appears that the backup seal cooling water supply requires operation of the associated heat transport pump. During a loss of AC power condition, neither the D 2O or heat transport pumps would be operating, and thus the heat transport pump seals would lose their primary and backup sources of cooling. Failure of the seals would lead to the leakage of coolant from the heat transport loop. Furthermore, the lack of AC power would preclude the use of the ECCS or any other sources of primary coolant makeup.

5.5.2 Issue A-24: Qualification of Class 1E Safety-Related Equipment This issue addresses acceptable methods and criteria for the qualification of class IE safety-related I equipmmt. The methods and criteria deal with testing, aging effects on materials and equipment, and a.iequacy of testing simulators which simulate the worst case environment for the equipment. 'fhe I 43

0 0

environments should provide a sufficient margin envelope for design basis events for LOCA and MSLB. Further, the environments should consider pressures, temperatures, moisture, submergence, and radiation. In order to review and assess the adequacy of the equipment qualification methods and acceptance criteria, the NRC determined that a generic approach was required. There are several Generic Letters which deal with various aspects of this safety issue (including GL-80-05", GL-80-1375, GL-80-83', GL-80-104", and GL-82-09') which were declared duplication of the basis safety issue covered here.

His issue is applicable to the CANDU 3 design in a manner similar to its applicability to a U.S. plant.

The available CANDU 3 documentation related to equipment qualification of safety-related equipment is sparse, however it appears that aspects of environmental qualification to harsh environmental g

conditions following design basis events were considered in a comprehensive manner. Further, W requirements for environmental qualifications are covered by SDG-003," Environmental Qualification,"

(CSR, Appendix D3).

5.5.3 Issue A-25: Non-Safety Loads on Class IE Power Sources This issue deals with a concem related to the connecting of non-safety related equipment to Class IE power sources. Specifically, non-safety related equipment could interact with the Class 1E power sources in an adverse manner such that plant systems essential to reactor safety might be degraded or disabled. The issue was addressed with special requirements for connection of non-safety loads to a Class 1E power source.

l The electrical power distribution system in the CANDU 3 design differs from the systems used m U.S. l plants. The CANDU 3 distribution systems are divided into four classes of power, based on the availability of the power, i.e., Classes I,IL III, and IV. None of these classes directly correspond to the U.S. Class IE power class. The four classes range from uninterruptible power to that which can be interrupted with limited and acceptable consequences. Safety related systems in the CANDU 3 design El B

are assigned to Group 2 and these systems are powered by Class I, II, or III power. Group 2 systems are provided with their own on-site standby generators. The maximum interruption time of Class III power is 180 seconds.

This issue is applicable to the CANDU 3 design because there are buffered connections between the safety-related group 2 power supply system and the non-safety Group 1 loads. Details of the buffered connections are not available in the current documentation.

44 5

I I 5.5.4 Issue A-31: RHR Shutdown Requirements I This issue deals with the ability of a power plant to transition from hot-standby to cold-shutdown under any accident conditions when this action is determined to be the safest course of action. He ability to transfer heat from the reactor to the emironment after a shutdown is an important safety function.

Like LWRs, it is important that CANDU 3 reactors have the ability to be able to transition from hot-standby to cold-shutdown conditions under any acident conditions, therefore this issue is applicable to the CANDU 3 design. He CANDU 3 design includes a shutdown cooling system that is used to cool the HTS

- after a reactor shutdown. This system is also designed to cool down the HTS from zero power hot temperature under abnormal conditions, and will operate as a heat sink for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> af ter a DBE. If both redundant shutdown cooling pumps were to fail, the heat transport pumps could be used to recirculate primary coolant th ough the shutdown cooling system heat exchangers. Group 2 raw service watcr is available as a backup source of cooling water to these heat exchangers.

5.5.5 Issue A-43: Containment Sump Perfonnance This issue deals with a concern for the availability of adequate recirculation cooling water following a LOCA when long-term recirculation of cooling water from the PWR containment sump must be initiated and maintained to prevent core-melt. The technical concerns are: 1) potential pump failure by means of vortex formation and air ingestion, 2) sump screen blockage by LOCA-generated insulation debris, and 3) the capability of pumps to continue pumping after ingestion of air or debris.

I This issue is applicable to the CANDU 3 long term ECC where water is recirculated from the I containment sump back into the HTS. (The CANDU 3 design does not have a containment spray system.) There is insufficient design information to deteranne the potential for vortex formation or air ingestion. The CANDU 3 design does include fibrous insulation such as glass fibre insulation panels in the feeder cabinets. Other high energy piping is insulated with (or equivalent): Caposite with armosite asbestos from Holmes Insulation Limited, or Atlasite from Altas Asbestos Company for carbon steel lines; and Thermasbestos from Johns-Manville or Caposite with sodium silicate binder from Holmes Insulation Limited for stainless steel lines. The SDG-010, " Pipe Rupture Protection,"

(CSR, Appendix D10) deals with the consequences of a pipe failure including jet impingement of high velocity fluid on surrounding equipment but does not specifically address this issue.

I I 45 I

E o

An advantage of the CANDU 3 design is that even if all ECC fails, the core can still be cooled by the moderator cooling system,if available, thereby limiting core damage. This capability should therefore reduce the impact of rectreulation failure on the overall risk.

5.5.6 Issue A-44: Station Blackout This issue addresses the evaluation of station blackout scenarios at nuclear power plants. A station blackout scenario involves the complete loss of AC clectrical power to the essential and nonessential switchgear buses. More specifically this condition involves the loss of offsite electric power E

concurrent with a turbine trip and unavailability of the emergency AC power system. The 3 consequences of a station blackout could be a severe core damage accident because many safety systems are required for reactor core decay heat removal that are dependent on AC power.

The CANDU 3 design utilizes four diesel generators having two different sizes and designs providing Class III electrical power. One set of these diesel generators (4.5 MW each) is used to provide power to group 1 loads with each of these non-safety diesel generators capable of powering one complete set of normal shutdown loads. The other two diesel generators rated at 1.4 MW provide power to the safety-related group 2 loads and each is capable of powering essential safe shutdown loads. Only the group 2 diesel generators are designed to withstand a seismic event.

Following a total loss of Class IV power, the reactor trips and the main heat transport pumps, the main feedwater pumps, and the cooling water pumps for the main condenser become unavailable. Circulation through the core and the steam generators is by thermosyphoning after pump coastdown. Feedwater flow to the steam generators is reestablished by the group 1 auxiliary feedwater pump if available and if not then by the group 2 feedwater system. The group 1 auxiliary feedwater pump is diesel driven and therefore g independent of AC power sources. W AECL cites" an overall probability of a station blackout event for the CANDU 3 design, including the 4

reliability of the offsite power grid, as <10 /yr and funher states in TTR-429 that the design meets the NRC position for station blackout power sources for evolutionary reactors. Even though the CANDU 3 design includes a total of four diesel generators, two safety-grade and two non safety-grade, it is not at all 4

obvious that the frequency of a station blackout of <10 /yr is accurate. For example, there may be potentially important common cause failure modes that could cause the loss of all four diesel generators (for instance, contaminated fuel supplies). A thorough Probabilistic Risk Assessment (PRA) would have to be done on the actual as-built facility design to adequately assess the reliability of the electrical power sources.

46

I ,

I It is important to recognize that the CANDU 3 design does not appear to have the ability to maintain adequate long-term core cooling without the availability of a source of Class III AC electrical power (from a diesel generator, external grid and/or station turbine generators). The discussion below provides three specific examples of potential CANDU 3 vulnerabilities during a loss of all Class III AC power, namely the potential for heat transport pump seal leakage, the need to isolate the bleed condenser, and the need to maintain proper reactor instrumentation / control functions.

I The heat transport pumps used in the CANDU 3 design may be susceptible to seal failures during a station I blackout condition. These pumps have mechanical seals that are normally cooled and lubricated externally via cooled and filtered D2 O from the discharge of the D2 O feed pumps. If the D 2O pumps are not available, a backup supply of seal cooling water is supplied via the heat transport pump casing. While not explicitly stated in the CANDU 3 documentation, it appears that the backup seal cooling water supply requires operation of the associated heat transport pump. During a station blackout condition, neither the D 2O or heat transport pumps would be operating, and thus the heat transport pump seals would lose their primary and backup sources of cooling. Failure of the seals would lead to the leakage of coolant from the heat transport loop. Furthermore, the lack of AC power would preclude the use of the ECCS or any other a

sources of primary coolant makeup.

I During the postulated loss of all Class III AC power, it will be necessary to achieve isolation of the bleed condenser. Otherwise, primary coolant will be lost, and, as noted above, no means will be available to provide for primary coolant makeup. Battery power would be required to accomplish necessary bleed condenser valve isolations during blackout conditions. However, the available design information is not sufficiently detailed to identify valve power sources, and thus it is not possible to determine whether or not battery power could be used for essential valve manipulations.

I Finally, it would be necessary to maintain an adequate ability to maintain monitoring of the plant status during loss of all Class 111 power. Again, the available design information does not contain enough information to ascertain the adequacy of battery-powered instrumentation or how long the battery supplies would last without recharging from AC sources.

I In summary, the station blackout issue is applicable to the CANDU 3 design. While the design does include separate sets of safety and non-safety onsite diesel generators, further design details would have to become available before a determination could be made regarding compliance to pertinent NRC station blackout requirements.

I 47

E as 5.5.7 Issue A-45: Shutdown Decay Heat Removal Requirements This issue evaluates the safety adequacy of the decay heat removal (DHR) function in operating LWRs and uses a value/ impact analysis to assess altemative measures to improve the reliability of the DHR function. PRA and deternunistic techniques were used to evaluate DHR systems required to achieve both hot and cold shutdown. The vulnerability of DHR systems to various internal and extemal events was assessed using systems analysis techniques. Transients, small-break LOCAs, and special challenges, such as fires, floods, earthquakes, and sabotage were considered in the analyses. In conjunction with the resolution of this issue, the NRC required that plant-specific analyses be conducted through the Individual Plant Examination (IPE) program. These IPE analyses should identify plant-specific vulnerabilities to severe accidents.

This issue is directly applicable to the CANDU 3 design. Circulation of the reactor coolant is maintained at all times during reactor operation, shutdown and maintenance. A separate shutdo vn cooling system is provided to remove reactor decay heat following shutdown. The shutdown cooling system cools the HTS after a reactor shutdown, maintains the system temperature, provides a means of draining, refilling, and level control, an<i provides long term heat sink capability 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after a DBE. The shutdown cooling system consists of two pumps and two heat exchangers arranged in parallel between the reactor outlet and inlet header of the HTS.

The mo.ierator cooling system, unique to CANDU reactors, provides circulation during maintenance and nonnal shutdown by operation with one moderator system pump only. The moderator cooling l system might therefore provide an altemative method of cooling the reactor should the normal shutdown cooling system be unavailable, however this was not discussed in the documentation and the capability would have to be demonstrated.

The CANDU 3 documentation reviewed did not address the reliability of the DHR function to the level of detail required in this issue and there is not currently enough detailed design information to accomplish a PRA-type analysis with the same level of detail as LWR IPE studies.

5.5.8 Issue 23: Reactor Coolant Pump Seal Failures This issue deals with the high rate of reactor coolant pump (RCP) seal failures that challenge the makeup capacity of the ECCS in PWRs. Flow rates from a RCP seal failure are comparable to break flow rates with an equivalent diameter in the range of 0.5 to 2 inches and pump seal failures have a frequency about an oroer of magnitude greater than the pipe break frequency. Thus, the overall 48

r probability of core melt due to small-size breaks could be dominated by events such as RCP seal failures.

The CANDU 3 design includes 4 electrically driven centrifugal heat transport pumps located between the steam generator outlets and the reactor inlet headers at the inlet side of the reactor. A removable coupling connecting the motor to the pump allows the pump seals and bearing to be removed without removing the motor. The shaft sealing arrangement consists of three mechanicalseals and one back-up seal in series. Each mechanical seal is designed to withstand the full differential pressure. " A gland I seal system supplies cooled and filtered heavy water for lubricating and cooling the mechanical seals.

This issue is applicable to the CANDU 3 design as it is in US. PWRs, however the issue is potentially less important to the CANDU 3 design. The pump seal failure probability in the CANDU 3 design apparently does not dominate the overall small bra pmbabilities as it can for US. PWRs. The screening initiating event frequency for pump seal failures in the ORNL systems study" contributed 3.5% of the overall small break frequency. Further, the CANDU 3 pump seals operate under less stressful conditions than US. PWRs, i.e., lower system pressures and temperatures. The CANDU 3 HTS reactor outlet pressure and temperature are 1436 psia and 590 F compared to 2250 psia and 632 F for a typical US. PWR.

I A CANDU 3 design objective is to achieve a muumum of two years of station operation between scheduled maintenance /in-service inspection outages, therefore the proposed solution of annual seal replacement could significantly reduce the performance of a CANDU 3 plant. The cost / benefit analysis for the issue will have to be recalculated with CANDU 3 data.

I 5.5.9 Issue 24: Automatic Emergency Core Cooling System Switch to Recirculation I This issue deals with safety considerations associated with options used to accomplish switch over I

from the ECCS injection phase to recirculation following a LOCA. The switch over to recirculation can be accomplished by manual actions, by total automation of these actions, or by a combination of manual and automatic actions. These three switch over options (manual, automatic, and semi- ,

automatic) are vulnerable to varying degrees of human errors and hardware failures.

l i

This issue is applicable to the CANDU 3 design which like US. PWRs includes both the injection and  !

recirculation phases of ECCS. The CANDU 3 design generally incorporates a higher level of ]

automation than is practiced in the U.S. and this level of automation apparently includes an l

,5 automation ECCS switchover to recirculation. l l

)

.l 49 l

E

=

5.5.10 Issue 36: Loss of Service Water This issue deals with concerns regarding the loss of service water raised by an incident at Calvert Cliffs involving the loss of both trains of service water after the service water system became air-bound as g

the result of the failure of a non-safety-related instrument air compressor aftercooler. This incident 3 was significant because it involved an interaction between safety and non-safety-related systems, and a common cause failure of redundant safety system trains, ne CANDU 3 design includes a two raw service water systems, one of which is in group 1 (non-safety) while the other is included in group 2 (safety class). One of the functions of the group 1 raw senice water system is to provide cooling for the group ) recirculated cooling water system. He recirculated cooling g

water system in turn provides, among other functions, the primary means of supplying cooling to the ECCS m heat exchangers in the ECCS recirculation mode. The CANDU 3 design includes a group 2 (safety class) raw service water system that supplies backup cooling to the ECCS heat exchangers in the event that the recirculated cooling water system fails. He group 2 raw senice water system consists of two 100% capacity pumps. The concerns raised by this issue are applicable to the CANDU 3 design.

5.5.11 Issue 47: Loss of Offsite Power This issue deals with identifying design and procedural deficiencies associated with responding to a loss of offsite power. Correct plant response would not result in risk to the public; however, there is j a large amount of equipment which must function to mitigate such an event. An evaluation of the overall plant response to such an event may indicate plant specific and/or generic problems that could lead to core melt. This issue is related to the station blackout issue (A-44).

This issue applies to the CANDU 3 design in the same manner as it applies to LWRs. The design includes backup power systems such as standby diesel generators to effect safe shutdown in the event g of loss of offsite power. The available documentation did not provide an adequate evaluation specific W to this issue.

5.5.12 Itsue 105: Interfacing Systems LOCA at LWRs lll This issue deals with leak-testing of the check valves that isolate those low pressure systems that are connected to the RCS. Issue B-63," Isolation of Low Pressure Systems connected to the Reactor Coolant Pressure Boundary," and Issue 96, "RHR Suction Valve Testing," also deal with this issue. Issue 105 appears to encompass Issue B-63 and according to the NRC's safety priority ranking of Issue 96, it is 50 m

I ,

considered to be covered by Issue 105 as well. Therefore, since Issue 105 appears to be the most comprehensive of the three related issues and has high priority status,it is included in this report and I the other two issues have been designated as duplicates.

This issue is applicable to the CANDU 3 conceptual design even through it deals primarily with maintenance, surveillance, and testing. Due to the importance of this issue, the CANDU 3 design should be reviewed to determine the acceptability of its pressure isolation valves. (The specific contems of Issues B-63 and 96 should also be considered.)

I The CANDU 3 design has five systems that interface with the Heat Transport System: 1) Shutdown Cooling System, 2) Pressure and Inventory Control System, 3) Purification System 4) Emergency Core Cooling System, and 5) Heavy Water Collection System.

The Shutdown Cooling System and the Pressure and Inventory Control System are both designed to withstand HTS pressures and are both located within the containment. The Pressure and Inventory Control System however interfaces with the Purification System. This interface consists of a series arrangement of a normally open motor-operated valve and two parallel bleed condenser level control valves.

The Purification System is located within the containment and has a relief valve discharging into the heavy water collection tank. There are redundant and diverse means to isolate valves between the bleed condenser (high pressure) and purification system components.

I The Heavy Water Collection System is located inside contaimnent, and has a relief valve that l discharges into containment. This system interfaces with the HTS via the Pressure and Inventory Control System in the same manner as the Purification System. In addition, the Heavy Water I Collection System collects inventory from a variety of drains, vents, leak-offs, and so on. Sight glasse l are used to detect leaks from these sources. In addition, drains and vents have normally. closed valves.

l The ECCS/ heat transport system interface lines are each isolated via three sets of valves, specifically a check valve bounded on either side by a motor-operated valve. There is a capability for testing at this interface, including continuous monitoring for leakage. Apparently, the ECCS is the only interfacing system not completely contained within the containment.

I l l

51 l l

I l I

E D1 5.5.13 Issue 122.2: Initiating Feed and Bleed l his issue deals with the adequacy of emergency procedures, opera';or training, and available plant I. I monitoring systems for determining the need to initiate feed-and-bleed cooling following loss of the steam generator heat sink. Basically, feed-and-bleed cooling is a method of last resort which can avert core damage if main and auxiliary feedwater are lost and other methods of decay heat removal are unavailable.

Depending on specific plant design, there may be a fairly short time period in which feed-and-bleed cooling will be successful. PRAs give considerable credit for feed-and bleed cooling.

This issue is applicable to the CANDU 3 design since the CANDU 3, like U.S. PWRs, uses a pressurized primary system coupled to steam generators and a loss of the normal heat sink will occur if all feedwater g is lost. In addition, the design includes a feed-and bleed circuit, however the possibility of using of this 5 feed-and-bleed circuit as a means of cooling the heat transport system was not discussed. Some type feed-and bleed type cooling mode may be possible, however this will have to be shown.

Other CANDU 3 unique features may lessen the importance of feed-and-bleed cooling. De CANDU 3 shutdown cooling system can be used in an emergency to cool down the heat transport system from the ,

zero power hot temperature of 260 deg. C. In contrast, the temperatures in LWRr must be reduced well l below their zero hot standby temperatures before the RHR cooling system can be used for decay heat removal. His feature provides the CANDU 3 reactor an additionallevel of protection in the event all feedwater sources are lost. Further, the moderator cooling system can apparently remove sufficient decay l heat to limit fuel damage.

The feed-and bleed circuit in the CANDU 3 design is used for inventory control (or pressure control I:

during the solid mode) for the heat transport system. Bleed flow is taken from the suction of one of the heat transport pumps and discharged into the bleed condenser as a two-phase flow. De steam is condensed by a cooling spray supplied by the heag water feed pumps. He bleed flow is then further  ;

cooled by the shutdown / bleed cooler before it enters the heat transport purification system. He Ei shutdown / bleed cooler also operates as a shutdown cooler for decay heat removal during reactor shutdown.

He feed flow to the heat transport system is taken either from the heavy water storage tank or the purification system. De feed-and-bleed circuit does not appear to be independent of the shutdown cooling system, therefore its ability to function as a last resort cooling system following loss of shutdown cooling seems uncertain. w.

I 52 I. l

=1 l

I I 5.5.14 Issue 124: Auxiliary Feedwater System Reliability This issue deals with achieving and maintaining a high degree of reliability for the auxiliary feedwater systems (AFW). Severalissues were integrated into this issue, specifically the following: 1) postulated loss of AFW resulting from turbine-driven AFW pump steam supply line rupture, 2) failure of isolation valves in closed position, 3) recovery of AFW, 4) interruption of AFW, and 5) review of existing AFW systems for single failures. In conjunction with the resolution of this issue, the NRC had PWR licensees and applicants demonstrate that their AFW systems were of high reliability (104 to 10-8 unavailability / demand).

The applicability of this issue to the CANDU 3 design is similar to its applicability to a U.S. LWR. In the CANDU 3 design, the normal feedwater system is a group 1 system but when unavailable the safety-related group 2 feedwater system then functions as an auxiliary feedwater system by supplying .

feedwater to the steam generators. The group 2 feedwater system consists of 2 motor-driven 100 capacity pumps (capacity for decay heat removal) that can be powered from the on-site group 2 emergency diesel generators and that take suction from two tanks located in the group 2 service building. In addition, the group 1 feedwater system includes a 4% diesel driven AFW pump which takes suction from a reserve feedwater tank. Taken together, the CANDU 3 group 2 feedwater and I AFW systems are comparable to a typical 3-pump PWR AFW system. In particular, a typical PWR AFW system contains 2 motor-driven pumps and one steam-turbine pump.

The unavailability of the auxiliary feedwater system was not specifically stated, however one general unavailability statement was found which may apply. TTR-276 (page 3-4) states, "The unavailability of each safety system should be demonstrated through design and operation, not to exceed 10-8."

5.5.15 Issue 130: Essential Service Water Pump Failures at Multiplant Sites This issue is the result of continued concern regr.rding the reliability of essential service water (ESW) systems at multiplant sites that have only two ESW pumps / unit. The issue is focused on addressing the potential adequacy of two ESW pumps per unit in the context of possible accident conditions. One of the considerations was the installation of a swing pump shared between the two units or a third pump added to each unit.

The limited information regarding multiple CANDU 3 plants indicates that multiple CANDU 3 units I will be essentially independent. Limited common services will be shared, for example waste management, D2 O management, major stores and management, water treatment, and administration I 53 I

E building. However, it appears m4 th-re wir 'ce m sharing of ESW equipment among units. The applicability of this istue to the CANDU 3 duip is to verify this conclusion.

5.5.16 1ssue 143: Availability of Chilled Water Systems and Room Cooling This issue addresses the potential for failure of certain safety-related components given the I ;

unavailability of cooling from HVAC and chilled water systems. This type of cooling may be required f in several plant areas, for example emergency switch gear and battery rooms, diesel generator rooms, and ECCS pump rooms.

This issue is applicable to the CANDU 3 -lesign which like U.S. plants contains safety-related components requiring HVAC cooling. For example, HVAC is required in the secondary control area to protect sensitive safety-related (Group 2) electronic equipment. Ventilation and recirculation systems used to supply HVAC to the secondary control have 100% redundancy in active components.

5.5.17 Issue 153: Loss of Essential Service Water in LWRs I

This issue is the result of continued concem regarding the reliability of essential service water (ESW) systems. Loss of the ESW system is a significant contributor to core damage at some plants. Reviews of previous incide nts showed that previous ESW failures were related to a variety of causes, including l fouling, ice effects, single failures and other design deficiencies, flooding, multiple equipment failures, and personnel ard procedural errors.

Since service water is required in the CANDU 3 design to supply cooling water to transfer heat from ll various safety-related and non-safety-related systems and equipment to the ultimate heat sink, this  !

issue is applicable. The CANDU 3 design includes two raw service water systems, one of which is in group 1 (non-safety) while the other is included in group 2 (safety class). One of the functions of the group 1 raw service water system is to provide cooling for the group 1 recirculated cooling water f system. The rectreulated cooling water system in tu'n provides, among other functions, the primary ,

means of supplying cooling to the ECCS heat exchangers in the ECCS recirculation mode. The CANDU 3 design includes a group 2 (safety class) raw service water system that supplies backup cooling to the ECCS heat exchangers in the event that the recirculated cooling water system fails. The group 2 raw service water system consists of two 100% capacity pumps.

1 S4 l l,

=

L__._..... . . . ..

.- . . . _ _ . _ . _ _ __ i

I 5.6 Seismic Issues I 5.6.1 Issue A-46: Seismic Qualification of Equipment in Operating Plants This issue establishes explicit guidelines to evaluate the adequacy of the seismic qualification of mechanical and electrical equipment in use at operating plants in lieu of attempting to backfit current design criteria applicable to new plants. This guidance will concern equipment required to safely shutdown the plant as well as equipment whose function is not required for safe shutdown, but whose failure could result in adverse conditions which might impair shutdown functions. This effort I was necessary to properly account for the numerous and significant changes in design criteria and methods for seismic qualification that had occurred during the course of the commercial nuclear power program. This issue is related to issue A-40 and A-41.

This issue does not directly apply to the CANDU 3 design since the licensing process will require that the design meet the current equipment seismic qualification criteria. However, the CANDU 3 seismic design process may have used methods which differ significantly with those methods evaluated during the resolution of this issue. If so, then these other methods may need to be appropriately evaluated before the seismic design can be accepted.

I Several aspects of the CANDU 3 design as described in the available documentation differ significantly  ;

from U.S. requirements. For example, a design basis earthquake (DBE)-induced LOCA is not considered a design basis event in the CANDU 3 design, i.e., the design is not designed to cope with a LOCA simultaneously with a DBE. Further, the CANDU 3 spent fuel cooling system is not seismically qualified as required by GDC 2".

5.6.2 Generic Letter 80-88": Seismic Qualification of Auxiliary Feedwater Systems This generic letter addresses seismic qualification of the awahary feedwater systems (AFW). The preferred method of decay heat removal following an anticipated transient or accident is through the steam generators. Therefore, the design of the AFW systems should satisfy the same standards applied to other safety related systems in the plant including seismic qualification.

I This issue is applicable to the CANDU 3 design which employs auxiliary feedwater systems. In the CANDU 3 design, the normal feedwater system is a group 1 system but when unavailable the safety-related group 2 feedwater system then functions as an auxiliary feedwater system by supplying feedwater to the steam generators. The group 2 feedwater system consists of 2 motor-driven 100 55 I

?

E U

capacity (capacity for decay heat removal) pumps that can be powered from the on-site group 2 emergency diesel generators and that take suction from two tanks located in the group 2 service building. In addition, the group 1 feedwater system includes a 4% diesel driven AFW pump which takes suction from a reserve feedwater tank. Taken together, the CANDU 3 gr up 2 feedwater and AFW systems are comparable to a typical 3-pump PWR AFW system. In particular, a typical PWR AFW system contains 2 motor-driven pumps and one steam-turbine pump.

The group 2 systems are seismically qualified whereas the group 1 systems are not. Therefore, the CANDU 3 group 2 AFW is seismically qualified but the group 1 AFW is not. This may result is a lower seismic-related AFW reliability.

5.7 Instrumentation and Control Issues 5.7.1 Issue I.D.2: Plant Safety Parameter Display Console This issue addresses the requirements that each licensee and applicant install a safety parameter display system (SPDS) that will display to operating personnel a minimum set of parameters which define the safety status of the plant. This can be attained through continuous indication of direct and I

derived variables as necessary to assess plant safety status. The SPDS is required to: provide a concise 5 display of critical plant variables; be located convenient to control room operators; to continuously display plant safety status information; have a high degree of reliability; be suitably isolated electronically; be designed incorporating accepted human factors principles; display minimum information sufficient to determine plant safety status with respect to reactivity control, reactor core cooling and heat removal from the primary system, reactor coolant system integrity, radioactivity release, and containment conditions; and address procedures and operator training.

This issue is applicable to all nuclear power stations including the CANDU 3 design. The available CANDU 3 documentation does not specifically mention a SPDS, however it does discuss their plant display system (PDS). The p. ant display system (PDS) is used for centralized interface functions, including CRT annunciation, CRT graphic data display and data logging. Most process information from the plant is fed to the PDS via the distributed control system (DCS). Operator setpoints for j control functions are input to the DCS via the PDS. The PDS also receives information from systems not connected to the DCS, such as safety system meteorological monitoring, station clock, to provide a signal data base accessible to the operator. The PDS reports and archives alarms; maintains the plant g

database; generates logs and records; interfaces with the distributed control system; and provides an 5 operator interface with plant display system. All information regarding trip parameters and the status 56 I

B u

and operation of the systems is displayed on dedicated panels in the main control room. Information for post accident management is also provided in the secondary control area.

I The CANDU 3 design plant display system will have to be reviewed in detail to determine its  !

acceptability for licensing in the U.S. relative to the U.S. requirements for the SPDS. Further, the higher level of automation in CANDU 3 design relative to U.S. plants may impact the SPDS requirements.

5.7.2 Issue I.D.3: Safety Systems Status Monitoring This issue addresses the installation of a bypass and inoperable status indication system, thereby providing the operator with timely information on the status of the plant safety systems. This operator aid could belo eliminate operator errors such as those f.csulting from valve misalignment due to maintenance or testing errors.

His issue is applicable to the CANDU 3 design. The available CANDU 3 documentation does not specifically discuss a safety systems status monitoring system. The safety systems in the CANDU 3 design include the reactor shutdown systems, the ECCS, the containment isolation system, and their I associated suppcrt systems. All information regarding trip parameters and the status and operation of the shutdown systems will be displayed on dedicated panels in the main control room and post accident management information will be provided in the secondary control area. A computerized monitoring and test system provides the operator with indications of all shutdown system parameters and assists the operator in testing. The ECCS is controlled by dedicated channelized computers which perform the initiation, monitoring, display and testing functions. Parameters and controls needed for l I long-term operation of the system are provided in the secondary control area. The containment isolation system automatically closes penetrations through the containment boundary when an increase in containment pressure or radioactivity level is detected. The safety support systems can be monitored and controlled from the main control room and the secondary control area, via buffered devices.

A central feature in the monitoring of CANDU 3 safety systems is software. Control, display and testing of these systems is based on the assumption that the software design is reliable. A detailed review of the software safety and quality management will be needed.

I 57

\

l I l

O O

5.7.3 Issue III.A.I.2(1): Technical Support Center This issue calls for a dedicated technical support center (TSC) to provide a place for management and technical personnel to support reactor control functions, to evaluate and diagnose plant conditions, and for a more orderly conduct of emergency operations. The TSC is required to be separate from but near the control room and is expected to have the capability to display and transmit plant status to those individuals knowledgeable of and responsible for engineering and management support of reactor operations,in the event of an accident.

This issue is directly applicable to the CANDU 3 design, however the available dccumentation does not show or discuss a TSC. The licensing review should ensure that the required TSC is provided.

5.7.4 Issue III.A.1.2(2): On-Site Operational Support Center i

This issue calls for the establishment of an operational support center (OSC) separate from the control room as a place in which opera 6 ions support personnel can assemble in an emergency situation to receive instructions from the operating staff. The OSC is to be provided with communications capability with the plant control room, TSC, and the near-site emergency operations facility (EOF).

This issue is directly spplicable to the CANDU 3 design, however the available documentation does not show or discuss an OSC. The licensing review should ensure that the required OSC is provided. '

5.7.5 Issue III.D.3.4: Control Room Habitability This issue requires assurance that control room operators will be adequately protected against the effects of accidental release of toxic and radioactive gases and that nuclear plants can be safely i operated or shut down under design basis conditions. The licensees are required to perform the necessary evaluations and identify appropriate modifications needed to provide this assurance. 3 This issue is applicable to all nuclear power stations including the CANDU 3 design. Control room habitability was discussed briefly in ITR-423 (Section 2.2.10). The CANDU 3 design includes a main control room (mci 4 and secondary control area (SCA). Radiation protection willbe provided for plant operators in the MCR under post-accident conditions where release of radioactive materials is a concem, except in the event of a LOCA followed by a site design basis earthquake within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

In the LOCA/ earthquake scenario, the operators would be adequately protected by moving to the  ;

SCA. The route from the MCR to the SCA is qualified to allow its use following earthquakes or 58 I

5 s

I tornadoes. Note that the MCR is designed for earthquakes and tornadoes only to the extent of providing physical protection to the operating staff. If the MCR were to become unmhabitable, control I of the plant would be shifted to the SCA. The available CANDU 3 design documentation does not address the issue of e ntrol room habitability from the release of toxic gases, other that to state (Technical Description, Section 2.43.1) that fresh air intakes will be separated from potential sources of chemical or gas contamination.

I I

I I

I I

I I

I i I

I I  !

I 59 I

I I 6.0 APPLICABLE STANDARDIZED DESIGN ISSUES The issues grouped in this section are safety issues rated as standardized design issues, i.e., these are issues which need resolution before a standardized plant design can be licensed but were not rated as unique or as conceptual design issues. Further, the documentation av. -:4 for this review was generally deficient of information regarding the resolution of these issues. A 'otal of 80 issues, which are listed in Table 6.1, were grouped in this category. These issues, in gen < 4. involved the more detailed aspects of the plant design, for example, does the CANDU 3 control room design include position indicators for the relief and safety valves.

Table 6.1: Applicable Standardized Design Issues I Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

Heat Transport Systems issues II.D.1 Testing Requirements for Reactor Coolant System Relief and Safety Valves (I)

ILK.3(2) Report on Overall Safety Effects of PORV isolation System (I)

A-2 Asymmetric Blowdown Loads on Reactor Primary Coolant Systems (NOTE 3a)

A-3 Westinghouse Steam Generator Tube Integrity (NOTE 3a)

A-12 Fracture Toughness of Steam Generator and Reactor Coolant Pump Supports (NOTE 3a)

A 13 Snubber Operability Assurance (NOTE 3a)

I A-15 Primary Coolant System Decontamination and Steam Generator Chemical Cleaning (NOTE 3b)

A 26 Reactor Vessel Pressure Transient Protection (NOTE 3a)

B-60 Loose Parts Monitoring Systera (NOTE 3b)

C-7 PWR System Piping (NOTE 3b)

C-12 Primary System Vibration Assessment (NOTE 3b) 15 Radiation Effects on Reactor Vessel Supports (HIGH) 29 Bolting Degradation or Failure in Nuclear Power Plants (NOTE 3b) 78 Monitoring of Fatigue Transient Limits for Reactor Coolant System (MEDIUM) 79 Unanalyzed Reactor Vessel 'Ihermal Stress During Natural Convection Cooldowm (NOTE 3b)

I 61 I

E

=

I Issue Title (NRC Safety Priority Ranking - Legend in Appendix E) 94 Additional Low Temperature Overpressure Protection for Light Water Reactors (NOTE 3a) 13S Steam Generator and Steam Line Overfill (NOTE 3b)

GL-88-OS Boric Acid Corrosion of Carbon Steel Reactor Pressure Boundary Components in PWR Plants Containment issues ll.E.4.1 Dedicated Penetrations (I)

B-S Ductility of Two-Way Slabs and Shells and Buckling Behavior of Steel Containments (NOTE 3b)

B-9 Electrical Cable Penetrations of Containment (NOTE 3b)

B-26 Structural Integrity of Containment Penetrations (NOTE 3b) 118 Tendon Anchor Head Failure (NOTE 3a)

GL-80-98 Prevention of Damage Due to Water Leakage Inside Containment Balance of Plant issues 106 Piping and Use of Highly Combustible Gases in Vital Areas (MEDIUM) 146 Support Flexibility of Equipment and Components (NOTE 4) 162 Inadequate Technical Specifications for Shared Systems at Multiplant Sites When One Unit is Shutdown (NOTE 4) 167 Combustible Gas Storage Facilities (NOTE 4)

GL-92-08 Thermo-Lag 330-1 Fire Barriers Systems and Reliability Engineering and Risk Assessment issues II.C.2 Continuation of Interim ReEability Evaluation Program (NOTE 3b)

ILE.1.1 Auxiliary Feedwater System Evaluation (I)

II.E.1.2 Auxilicry Feedwater System Automatic Initiation and Flow Indication (I)

II.E.3.1 Reliability of Power Supplies for Natural Circulation (I) 11.E.4.2 Isolation Dependability (I)

II.G.1 Power Supplies for Pressurizer Relief Valves, Block Valves, and Level Indicators (I)

ILK.3(7) Evaluation of PORY Opening Probability During Overpressure Transient (1)

A-17 Systems Interactions in Nuclear Power Plants (NOTE 3b)

B-17 Criteria for Safety-Related Operator Actions (MEDIUM) 62 I

I

I I Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

B-56 Diesel Reliability (NOTE 3a)

B-58 Passive Mechanical Failures (NOTE 3b)

B-61 Allowable ECCS Equipment Outage Periods (MEDIUM)

C-11 Assessment of Failure and Reliability of Pumps and Valves (NOTE 3b) 43 Reliability of Air Systems (NOTE 3a) 57 Effects of Fire Protection System Actuation on Safety-Related Equipment (MEDIUM) 70 PORV and Block Valve Reliability (NOTE 3a) 83 Control Room Habitability (NOTE 1) 93 Steam Binding of Auxiliary Feedwater Pumps (NOTE 3a) 120 On-Line Testability of Protection Systems (NOTE 3b) 125.IL7 Reevaluate Provision to Automatically Isolate Feedwater from Steam Generator During a Line Break (NOTE 3b) 128 Electrical Power Reliability (NOTE 3a) 156.6.1 Pipe Break Effects on Systems and Components (NOTE 4) 158 Performance of Power-Operated Valves Under Design Basis Conditions (NOTE 4) 159 Qualification of safety-Related Pumps While Runnmg on Minimum Flow (NOTE 4) 165 Safety and Safety / Relief Valve Reliability (NOTE 4)

GL-79-36 Adequacy of Station Electric Distribution Systems Voltages GL-80-35 Effect of a DC Power Supply Failure on ECCS Performance GL-88-20 Individual Plant Examination for Severe Accident Vulnerabilities instrumentation and Control issues LD.5(1) Operator-Process Communication (NOTE 3b) 1.D.5(2) Plant Status and Post-Accident Monitoring (NOTE 3a)

LD.5(3) On-Line Reactor Surveillance System (NOTE 1)

I _

ILD.3 Relief and Safety Valve Position Indication (I)

ILF.1 Additional Accident Monitoring Instrumentation (I)

A-47 Safety implications of Control Systems (NOTE 3a)

B-66 Control Room Infiltration Measurements (NOTE 3a)

C-1 Assurance of Continuous Long-Term Capability of Hermetic Seals on Instrumentation and Electrical Equipment (NOTE 3a) 63 I

E o<

Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

I 3 Set Point Drift in Instrumentation (NOTE 3b) 20 Effects of Electromagnetic Pulse on Nuclear Power Plants (NOTE 3b) 45 Inoperability of Instrumentation Due to Extreme Cold Weather (NOTE 3a) 64 Identification of Protection System Instmmentation Sensing Lines (NOTE 3b) 67.3.3 Improved Accident Monitoring (NOTE 3a) 142 Leakage Through Electrical Isolators in Instrumentation Circuits (NOTE 3b) 160 Spurious Actions of Instrumentation Upon Restoration of Power (NO'm 4)

HFS.1 Local Control Stations (NOTE 3b)

Gle80-25 Engineered Safety Feature (ESP) Reset Controls Quality Assurance issues 1.F.2(2) Include QA Personnel in Review and Approval of Plant Procedures (NOTE 3a)

I.F.2(3) Include QA personnel in All Design, Construction, Installation, Testing, and Operation Activities (NOTE 3a) 1.F.2(9) Clarify Organizational Reporting Levels for the QA Organization (NOTE 3a)

GL-88-15 Electric Power Systems - Inadequate Control Over Design Processes II.B.3 Post-Accident Sampling (I)

III.D.3.1 Radiation Protection Plans (NOTE 3b)

I 6.1 licat Transport Systems issues 6.1.1 Issue II.D.1: Testing Requircuients for Reactor Coolant System Relief and Safety Valves The objective of Task II.D is to demonstrate by testing and analysis that the relief and safety valves, and the associated piping in the reactor coolant systern are qualified for the full range of operating and accident conditions. 'Ihis issue specifically addresses the testing requirements.

This issue is applicable to the pressur -elief valves in the CANDU 3 design. Overpressure protection of I

the heat transport system is provided by the shutdown cooling system and by two instrumented liquid relief ,

valves connected to the reactor outlet header and discharging into the bleed condenser. The bleed condenser then in turn is equipped with spring loaded safety relief valves. In addition, two steam relief 64 5:

valves are provided on the pressurizer to provide overpressure protection of the pressurizer whenever it is isolated from the heat transport system. Details of these pressure relief valves were not provided.

I The CANDU 3 design should be reviewed regarding its capability to relieve pressure for the full range of operating and accident conditions. Further the capability of adequately testing these valves should be demonstrated.

I 6.1.2 Issue II.K.3(2): Report on Overall Safety Effects of PORV isolation System his issue requires all operating PWRs and operating license applicants to submit a report documenting actions taken to decrease the probability of a small-break LOCA caused by a stuck-open power-operated relief valve (PORV) and show how those actions constitute sufficient improvements in reactor safety.

Safety-valve failure rates based on past history of the operating plants designed by the specific nuclear steam supply system (NSSS) vendor should be included in the report.

I This issue applies to the CANDU 3 design if its relief valves are power operated. He relief valves in this design are not described in sufficient detail to determine their mode of operation, therefore this issue is applicable. The CANDU 3 applicant should show how their valves are designed to prevent a stuck-open PORV. The operating history of CANDU plants should be reviewed regarding safety-valve failure rates.

6.1.3 Issue A-2: Asymmetric Blowdown Loads on Reactor Primary Coolant Systems This issue addresses the safety significance of possible LOCA-related asymmetric loading on PWR reactor vessel supports. In a postulated event at the vessel nozzle, asymmetric LOCA loading could result from forces induced or the reactor intemals by transient differential pressures across the core I barrel and by forces on the vessel due to transient differential pressures in the reactor cavity. This type of asymmetric loading had not been considered in previous PWR plant designs.

This issue is potentially applicable to the CANDU 3 design but that applicability would be uniquely different from its applicability to U.S. PWRs. The CANDU 3 reactor is the first of its kind considered for liceraing in the U.S. and its design has little in common with the design of U.S. power reactors.

I The CANDU 3 reactor does not house the fuel assemblies in a single vertically-oriented pressure vessel. Instead, the fuel assemblies in the CANDU 3 design are contained in a set of 232 horizontal pressure tubes. Further, the CANDU 3 reactor internals and the reactor supports are completely different from those of U.S. reactors. The CANDU 3 design review should determine whether or not any asymmetrical loadings concems exist for the CANDU 3 design.

65 I J

E<

m 6.1.4 Issue A 3: Westinghouse Steam Generator Tube Integrity his issue addresses steam generator tube integrity and team generator tube rupture (SGTR) mitigation.

Operating experience prior to 1978 had shown that PWR steam generators were prone to extensive corrosion and mechanically-induced degradation of the steam generator tubes, frequent plant shutdowns to repair primary-to-secondary leaks, and two SGTR events. Risk analysis indicates that SGTR events beyond the design basis do not constitute a significant fraction of the early and latent cancer fatality risks associated with reactor events at a given site. Issues A-3, A-4, and A-5 address steam generator tube integrity for W, CE, and B&W plants, respectively. Issue A-3 was included in this report to address steam generator tube integrity in the CANDU 3 design and issues A-4 and A-5 were declared duplicates.

The CANDU 3 design employs two inverted vertical U-tube steam generators, similar to those of a Westinghouse plant. He normal operating pressure differential across a CANDU 3 tube will be about 770 psi which is considerably lower than the 1400 pi typical for a U.S. PWR. The CANDU 3 tubes are therefore correspondingly thinner than for a U.S. PWR. He CANDU 3 tube material is Incoloy-800.

He corrosion mechanisms for a CANDU 3 steam generator tube may differ from those for a U.S. PWR due to its heavy water primary system coolant. Oxygen from the radiolysis of heavy water is suppressed I

as by adding an excess of hydrogen gas to the coolant, thereby providing a driving force for the reverse radiolysis reaction. Corrosion concerns regarding hydrogen absorption by the pressure tubes may also apply to the steam generator tubes.

Information regarding the integrity of the CANDU 3 steam generator tubes, the potential and history of corrosion problems, safety analyses of SGTR events, and risk analysis were not found in the available documentation. His issue is applicable to the CANDU 3 design.

6.1.5 Issue A 12: Fracture Toughness of Steam Generator and Reactor Coolant Pump Supports This issue addresses questions raised as to the potential for lamellar tearing and low fracture toughness of the steam generator and RCP support materials. The toughness of ASTM A572 steel was found to be relatively poor at a temperature of 80 'F. He resolution of this issue, per SRP Section 5.3.4, applies to new construction only.

His issue is applicable to the CANDU 3 design, however the available information does not contain g sufficient detail to adequately determine the applicability of this issue to CANDU 3. The design does B require support structure for both the RCPs and the steam generators. He steam generator supports are 66 I

us 9 .

I supported by a steel structure, however the type of steel was not specified. He support structure for the RCPs was not discussed.

6.1.6 Issue A-13: Snubber Operability Assurance his issue addresses operability assurance concerns expressed over the substantial number of licensee event reports (LERs) related to the malfunction of snubbers which have included seal leakage in hydraulic snubbers, and a high rejection rate du..ag functional testing of snubbers. Further, differences were noted in the number of snubbers used in systems of similar configuration and the methodology used in I determining the need for snubbers was questioned. Snubbers are ed primarily as seismic and pipe whip restraints and their safety function is to operate as rigid supports for restraining the motion of attached systems or components under rapidly applied load conditions such as earthquakes, pipe breaks, and severe hydraulic transients.

I Snubbers were not addressed in the available documentation, however the CANDU 3 design must use some type of device to restrain the seismically qualified heat transport system, therefore this issue is applicable. Reir restraint system and their methodology shoulo be reviewed to determine assurance of ,

its operability.

I 6.1.7 Issue A 15: Primary Coolant System Decontamination and Steam Generator Chemical Cleaning This issue addresses the buildup of corrosion products on the interior metal surfaces of the primary coolant mtem from the standpoint of neutron activation. Accumulated material poses an increased safety risk to the health and safety of plant workers during inspection / maintenance activities because of increased radiation levels in the vicinity of the primary system.

His issue is applicable to the CANDU 3 design and the materials specified for use in the design should be reviewed to determined if this problem could become unusually difficult for a CANDU 3 plant.

Potential problems associated with corrosion product activation in the CANDU 3 primary system have been recognized as described in the CSR (Volume 2, Section 6.1.4.2) which describes the purification system and how it will be used to limit corrosion product buildup in the coolant. For the CANDU 3 design, this issue must also include neutron activation within the calandria and the moderator cooling system and the shield tank and shield cooling system as well the heat transport system.

He main activation products are Na 2

', Fe", Co", Zn" Ar, Cr#', Mn", C, and tritium. He tritium is produced from the heavy water and most of it is produced in the moderator system. Radioactive material l

67

3 E'

o-accumulation may also include fission products released from defective fuel. He Technical Description points out that about 0.1% of the fuel bundles at Bruce A have developed failures in the fuel sheathing during normal operation.

6.1.8 Issue A 26: Reactor Vessel Pressure Transient Protection his issue addresses concerns regarding incidents of pressure transients in PWRs where TS pressure and temperature limits have been exceeded. Since the reactor vessels have less toughness at lower temperatures, they are more susceptible to brittle fracture under these conditions than at normal operating temperatures. He NRC concluded that measures should be taken to minimize the number of future transients and reduce their severity.

His issue is not directly applicable to the CANDU 3 design since the design does not have a reactor vessel, however the basic issue of pressure transients exceeding limits should be examined for the CANDU 3 design to determine if a similar concern might exist for the design's horizontal pressure tubes. Here are unique aspects to the application of this issue to the CANDU 3 design which may show that the issue is not a valid concern. For instance, the pressure tubes are made of zirconium not steel, the fuel channels can be replaced if neutron irradiation becomes unacceptable, and the operating pressure of the heat g transport system is significantly lower than that of a U.S. PWR. However, the pressure tubes are also 5 much thinner than a U.S. PWR reactor vessel wall.

6.1.9 Issue B-60: Loose Parts Monitoring System I

his issue deals with monitoring the primary coolant system for the presence of a loose object. A loose part, whether it be from a failed or weakened component or from an item inadvertently left in the primary system can contribute to component damage and material wear by frequently impacting with other parts in the system. A loose part can pose a serious threat of a partial flow blockage with attendant fuel cladding DNB and it could potentially jam a control rod. The early protection provided by a loose parts monitoring system can provide the time required to avoid or mitigate safety-related damage.

Like LWRs, loose parts monitoring would be important at a CANDU 3 plant to help ensure safety, I

therefore this issue is applicable. A loose part the heat transport system (HTS) could cause flow blockage ,

in a fuel channel or in its feeder pipes. For the CANDU 3 design, the :oose parts monitoring system should also probably monitor the moderator cooling system as well as the HTS because a loose part in the calandria could potentially jam a control rod by damaging its control rod guide tube. Loose parts monitoring was not discussed in the avaibMe documentation.

68 I

5

=

l

6.1.10 !ssue C-7: PWR System Piping his issue addresses stress corrosion cracking of low pressure piping in PWRs (high pressure piping is addressed in Issue 14). Although these systems are not part of a reactor coolant pressure boundary, they are safety related, e.g., the containment spray system. He incidence of cracking has been restricted to thin wall, low pressure, low flow systems. In each of the cracking events that have occurred to date, the affected piping was determined to have been sensitized and, therefore particularly vulnerable to corrosive attack. Current licensing criteria preclude the use of sensitized piping in safety-related piping systems and places increased emphasis on the use of corrosion-resistant materials in such systems.

His issue is both directly and uniquely applicable to the CANDU 3 design. The design materials will need to be reviewed to determine if they meet the current licensing criteria regarding sensitizing and corrosion-resistance. The CANDU 3 design does not have a containment spray system which was explicitly ,

mentioned in the issue description, but it does have several low pressure safety-related systems such as the moderator cooling system. He design of these systems will require a through review relative to the I concerns addressed in this issue.

6.1.11 Issue C-12: Primary System Vibration Assessment I This issue deals with the possibility of structural damage to the primary system that can be caused by vibrations of sufficient magnitude. Vibration can cause internal components to come loose and be carried through the primary system by the coolant flow and can lead to fatigue failures of piping, interference with control rod movement, and structural damage to steam generator tubing. Further, vibration could be an early indication of possible problems. Monitoring for excessive vibration is one possible solution.

Like PWRs, the elimination of potentially-damaging vibrations would be important at a CANDU 3 plant to help ensure safety, therefore this issue is applicable. He CANDU 3 design includes a vibration monitoring and alarm system. The vibration monitoring system is an integrated system that monitors vibration on a number of important pumps and motors in both the nuclear steam plant and the conventional plant. Both casing vibration and shaft run-out are monitored. Typically the following pumps are included: 1) heat transport system pumps, 2) moderator sys:em pumps, 3) heat transport pumps,

4) shutdown cooling pumps, and 5) steam generator feedwater pumps. Vibration monitors for the reactor, steam generators, or primary system piping were .%t mentioned. 1 I l I 69 I

El

=:

6.1.12 Issue 15: Radiation Effects on Reactor Vessel Supports I i This issue addresses the potential problem of radiation embrittlement of reactor vessel support structures. '

Neutron damage of structural materials causes embrittlement that may increase the potential for propagation of flaws that might exist in the materials. A loss in fracture toughness due to radiation effects may result in failure of the reactor vessel support structures and consequent movement of the reactor vessel, given the occurrence of a transient stress or shock such as would be experienced in an earthquake.

Radiation effects should be accounted for in the design and fabrication of the support structures.

This issue is as applicable to the CANDU 3 design as it is to a U.S. reactor. however the design of the reactor and its support structures are completely different from any U.S. reactor. A description of the CANDU 3 support structures was not found in the documents reviewed but several of the figures illustrating the reactor assembly show four metal supports attached to the end hield tanks with these supports resting on concrete blocks.

6.1.13 Issue 29: Ilotting Degradation or Failure in Nuclear Power Plants his issue addresses degradation or failure of bolts in nuclear power plants, particularly those bolts g contributing to the primary system pressure boundary and major component support structures. Failure 5 of bolts or studs could result in the loss of reactor coolant or the loss of a safety related system or component.

The issue of bolt degradation or failure is applicable to the CANDU 3 design. De CANDU 3 design should be reviewed regarding bolt and stud design, materials, fabrication, installation. and inspection, looking for ways to minimize potential bolting problems.

6.1.14 Issue 78: Monitoring of Fatigue Transient Limits for Reactor Coolant System I

This issue addresses the monitoring of the number of transient occurrences to ensure that transient limits, based on design assumptions, are not exceeded. Repeated thermal cycling of RCS components produces some degree of fatigue degradation of the materials which could lead to failure, thereby increasing the likelihood of a LOCA.

This issue is not directly applicable to the CANDU 3 design since the ccrual monitoring does not occur g until after the plant is operating, however a detailed fatigue analysis should be performed for the design 5 to search for potential problems and to provide the transient limits for monitoring the heat transport 70 I

I

I I sptem during operation. His issue was not discussed in the available documents.

I 6.1.15 issue 79: Unanalyzed Reactor Vessel Thermal Stress During Natural Convection Cooldown his issue addresses a concern regarding an unanalyzed thermal stress in the reactor vessel of PWRs that could cmr during natural convection cooldown. When this unanalped thermal stress is added to existing stresses, the stresses in the flange area or studs could exceed the allowable stress. Moreover, the cycling of these temperature gradients could cause a reduction in the fatigue margin or usage factor of the vessel over the life of a plant. The possibility of vessel fracture exists depending upon the circumstances and temperature distributions. A slower cooldown rate may be required.

His issue is not directly applicable to the CANDU 3 design since the design does not have a reactor vessel, however the basic issue of thermal stresses occurring during a natural convection cooldown should be examined for the CANDU 3 design to determine if a similar concern might exist for the design. The available documents did not specifically address thermal stresses, however one discussion of CANDU pressure tube design found in TI'R 291 (Page 3-1) states:"He large diameter to wall thickness ratio (26:1) allows the evaluation of the pressure tube stress components using standard clas=ical elasticity equations for thin-walled cylinders and permits the thermal stresses to be neglected." Here are unique aspects to I the application of this issue to the CANDU 3 design and an evaluation may show that the issue is not a valid concern for the design.

6.1.16 Issue 94: Additional Imw Temperature Overpressure Protection for Light Water Reactors I This issue addresses primary system overpessure protection in LWRs while the system is operating at low I temperatures. Since the reactor vessels have less toughness at lower temperatures, they are more susceptible to brittle fracture under these conditions than at normal operating temperatures. Major overpressurization of the RCS,if combined with a critical size crack, could result in a brittle failure of the I reactor vessel and this failure could make it impossible to provide adequate coolant to the reactor and result in a major core damage or core-melt accident. His issue was originally addressed in Issue A-25 which was designated a duplicate issue for this report.

His issue is not directly applicable to the CANDU 3 design since the design does not have a reactor vessel, however the basic issue of low temperature overpressurization should be examined for the CANDU 3 design to determine if a similar concern exists for the design's heat transport system. There are unique

'I aspects to the application of this issue to the CANDU 3 design which may show that the issue is not a valid concern.

71 I

5 0

6.1.17 Issue 135: Steam Generator and Steam Line Overfill The issue addresses steam generator overfill and its consequences. Several major activities were included in the work scope related to the resolution of this issue, including reviews of eddy current testing practices, c steam generator tube rupture (SGTR), water hammer, overfill, and water carryover. Upon completion of the required studies, it was concluded that SGTR and steam line overfill events pose a relatively low public risk.

'Ihe CANDU 3 design employs two inverted vertical U-tube steam generators, similar to those of a Westinghouse plant. The applicability of the integrity of the CANDU 3 tubes was discussed in Issue A-3 and the possibility of bypassing the primary containment and releasing radioactive fission products directly to the environment was discussed in Issue 66. Steam generator and steam line overfill and its associated concerns were not discussed in the available documentation, however these events are applicable to the CANDU 3 design.

6.1.18 Generic Letter 88-05": Boric Acid Corrosion of Carbon Steel Reactor Pressure Boundary Components in PWR Plants This generic letter addresses corrosion of external surfaces of low alloy carbon steel pressure boundary components caused by exposure to boric acid. The boric acid, which is used in the primary system for reactivity control, can reach the outer surface of the reactor coolant boundary via a number of possible leakage paths, for example through valves and various flanged connections.

This issue is applicable to the CANDU 3 design since the CANDU 3 design may use boron, in the form of boric anhydride, to compensate for excess reactivity in a core loaded with fresh fuel. However,in the CANDU 3 design, the boron is injected into the moderator cooling system rather than the primary cooling system. Carbon steels are expected to be used ir the construction of some of the reactor amponents, for instance, the shield tank structure is designed to be constructed with bolted and welded carbon steel.

6.2 Containment Issues I

6.2.1 Issue II.E.4.1: Dedicated Penetrations I

This issue deals with external recombiners or purge systems for postaccident combustible gas control of the containment atmosphere. Plants using these systems should provide containment penetration 72 as

I I systems for them that are dedicated to that service only, that meet the redundancy and single-failure requirements of GDC 54 and 56 of Appendix A to 10 CFR Part 50", and that are sized to satisfy the flow requirements of the recombiner or purge system. (In Mdition,10 CFR 50.34(f)" requires that one or more dedicated containment penetrations, equivalent in size to a single 3-foot diameter opening, be provided in order not to preclude future installation of systems to prevent containment failure, such as a fdtered vented containment system.)

The method of hydrogen recombination provided in the CANDU 3 design, as presented in the available documents, is the use of igniters intemal to the containment. Postaccident purging is considered only after the first day if the containment pressure is near atmospheric and only with favorable wind conditions and population distribution. Discharge of contaminated air would occur through the containment ventilation stack filtered by activated charcoal filters. This is not a hardened vent system.

In the CANDU 3 design, lines connected to the containment atmosphere which penetrate containment are provided with two isolation valves in series normally located outside the containment. Relaxed isolation requirements are allowed for small diameter lines.

Even though the CANDU 3 design does not appear to include an extemal recombiner and only limited low pressure purging capability is provided, this issue should be considered applicable to CANDU 3 pending a more detailed review.

6.2.2 Issue B-5: Ductility of Two-Way Slabs and Shells and Buckling Dehavior of Steel l Containments I

This issue addressed two separate topics, specifically the ductility of two-way slabs and shells, and the 1

buckling behavior of steel containments. The focus of the ductility topic was to develop an improved procedure for evaluating the design adequacy of Category 1 reinforced concrete slabs subject to a l- postulated LOCA or high-energy line break. If structures were to fail due to loading caused by a LOCA or HELB, there would be a possibility that other portions of the reactor coolant system or safety-related systems could be damaged. The focus of the second topic was to further address the design adequacy of steel containments with regard to buckling from asymmetrical loads.

The CANDU 3 design includes a steel-lined reinforced concrete containment and concrete intemal structures. Tne first topic regarding ductility is applicable to the CANDU 3 design. The second topic regarding buckling behavior applies only to steel containments and, therefore is not applicable to the I 73 I

O o

CANDU 3 design. The reinforced concrete in the CANDU 3 design must be reviewed for compliance with the resolution of concems expressed in this issue.

6.2.3 Issue B-9: Electrical Cable Penetrations of Containment This issue deals with short-circuit failures of electrical penetrations of the containment. Penetration modules have failed due to an accumulation of carbon deposits creating a short-circuit conductive path. The deposits were the result of heating caused by high contact resistance due to epoxy intrusion into an area of the conductor splice which was not insulated during the manufacturmg process.

The applicability of this issue to CANDU 3 depends upon the module design and possibly the g manufacturing process which are currently not available for review. The CANDU 3 conceptual design 5 specifies that the penetration assemblies must withstand all rated cable shed circuit currents and meet all seismic requirements applicable to the station. The penetrations will be qualified to ASME Code,Section III, Subsection NE, Class MC. The containment cable penetration assemblies are tested for leak tightness during on-line operation. All electrical cable penetrations of the containment wall are designed to prevent leakage and maintain service during normal and accident conditions. Spacial separation is provided between the group 1 and group 2 electrical containment penetrations.

6.2.4 Issue B-26: Structural Integrity of Containment Penetrations This issue deals with the structural integrity, in-service inspection: and new surveillance or analysis I

methods applicable to containment penetrations which are identified as inaccessible. The specific containment penetrations involved in this issue include only the high-energy fluid systems.

This issue is applicable to CANDU 3 in the same manner that it is applicable to U.S. plants. The CANDU 3 containment design permits accessibility to all important areas for periodic inspection in E

accordance with an appropriate surveillance program. The penetrations will be leak tested 5 independently and more frequently than the building overall pressure test using a soap bubble test method, either on the exterior with the building pressurized or on the interior with the building at its normal subatmospheric pressure.

6.2.5 Issue 118: Tendon Anchor Head Failure  ;

This issue deals with the failure of tendon anchor heads caused by hydrogen stress-cracking. The Il hydrogen is generated by an anodic reaction of zine and steel in the presence of water.

I,'

74 l

m

I l I The CANDU 3 design includes a concrete containment structure, however the available documentation does not discuss tendon anchors. This issue is therefore applicable pending a more detailed review of the design.

l 6.2.6 Generic Letter 80-98": Prevention of Damage Due to Water Leakage Inside Containment The purpose of this generic letter is to provide licensees with guidance related to the prevention of damage inside containment due to intemal water leakage. This generic letter was written in response I to an incident that occurred at Indian Point 2 on October 17,1980. In this incident, over 100,000 gallons of water accumulated on the containment floor during reactor operation without the knowledge of operators. The source of water was service water that had leaked from piping and fan coolers.

The issue presented in this letter applies to the CANDU 3 design since the accumulation of water on the containment floor could damage important safety-related equipment. Further, the operation of the refueling machine could be adversely impacted. The CANDU 3 reactor building cooling system (RBCS) will have air coolers that use recirculated cooling systems (designed to non-nuclear Class 6 standards). A leak in one of these recirculated cooling water systems would spill water in the reactor I building. The RBCS is to be continuously monitored for leakage and the gross leakage monitoring system (GLM) measures the contairunent pressure, temperature, and humidity. The available CANDU 3 design containment drawings, however, do not show a containment sump and it is unclear whether or not water accumulating on the containment floor can be directly detected by means of water level measurements.

63 Balance of Plant Issues 63.1 Issue 106: Piping and Use of Highly Combustible Gases in Vital Areas I This issue is concemed with the normal process use of relatively small amounts of combustible gases on site. Leaks or breaks in piping could result in the accumulation of a combustible or explosive mixture within the auxiliary systems building, thereby endangering safety related system components.

I This issue is applicable to the CANDU 3 design. The plant turbine-generator in the CANDU 3 design is cooled by a hydrogen cooling system and the design also includes a hydrogen addition facility.

Oxygen from the radiolysis of heavy water is suppressed by adding an excess of hydrogen gas to the coolant, thereby providing a driving force for the reverse radiolysis reaction. The dissolved 75 I

E a

deuterium / hydrogen escapes by diffusion and hydrogen must be added regularly to the reactor coolant. The rate of hydrogen addition is 2.7 L/ min for 30 minutes during an 8-hour shift.

63.2 Issue 146: Support Flexibility of Equipment and Components I

l This issue is currently being prioritized. As a consequence, a description of the issue was not readily f

available for our review. The issue title indicates that the issue will be applicable to the CANDU 3 design since support flexibility of equipment and components is generic to all nuclear power plants. He available CANDU 3 documents do not provide specific information regarding support flexibility. The issue's applicability will also depend upon the priority ranking assigned.  !

633 Issue 162: Inadequate Technical Specifications for Shared Systems at Multiplant Sites When One Unit is Shutdown His issue is currently being prioritized. As a consequence, a description of the issue was not readily available for our review. The issue title indicates that the issue could be applicable to the CANDU 3 design since this issue might apply to any multiunit nuclear plant sites. The CANDU 3 Technical Outline I briefly discusses multiple unit layouts. De concept of a multiple unit CANDU 3 station allows essentially independent and self-sufficient units, containing all facilities required for routine day-to-day operation 3 including maintenance shops and change rooms. The limited number of common services provided in the common services area includes heavy water management, waste management, central stores, major overhaul facilities, change rooms for contract staff, and an administration area. He issue's applicability will also depend upon the priority ranking assigned and the specific concerns addressed.

63.4 Issue 167: Combustil,le Gas Storage Facilities His issue is currently being prioritized. As a consequence, a description of the issue was not readily available for our review. The issue title indicates that the issue will be applicable to the CANDU 3 design since this issue appears to be generic to all nuclear power plants. The issue's applicability will also depend upon the priority ranking assigned.

63.5 Generic Letter 92-08": Thermo-Lag 330-1 Fire Barriers This generic letter was issued to obtain additional information from licensees regarding Thermo-lag 330-1 fire barrier systems. His information was required by the NRC to address three areas of concern, specifically fire endurance capabilities, ampacity derating of cables enclosed in the barriers, 76 l

I

=

L

'I and the evaluation and application of test results to determine fire endurance ratings. The licensees were requested to supply pertinent information related to these areas of concern.

Brief discussions of fire barriers in the CANDU 3 design are found the CSR, Technical Description, Technical Outline and 1TR-429, however, there is not enough information to ascertain potential problems with premature failure of fire barriers, or the specific types of fire barrier materials to be used. It was noted that fire barriers will be used as necessary to augment spatial separation of equipment.

This issue must be considered applicable to the CANDU 3 design pending a more detailed review to ensure that the design does not include any fire barriers of this type and manufacture.

6.4 Systems and Reliability Engineering and Risk Assessment Issues 6.4.1 1ssue II.C.2: Continuation of Interim Reliability Evaluation Program I This issue addressed the possible continuation of the Interim Reliability Evaluation Program (IREP) to cover all operating reactors not covered in the initial IREP studies. In addition, consideration was I given to also include plants under design or construction. Because of NRC guidance requiring licensees to perform plant-specific Probabilistic Risk Assessment (PRA) studies, this issue was resolved and no new requirements were established. Note that licensees are currently required to prepare plant-specific risk assessments in conjunction with the Individual Plant Examination (IPE) and IPE Extemal Events (IPEEE) programs.

I The applicability of this issue to the CANDU 3 design is the assu'rance that all IREP safety concems are covered by a CANDU 3 PRA. The currently available CANDU 3 PRA documents are the Conceptual Probabilistic Safety Assessment * (CPSA) and a recently published study" performed by ORNL which applied PRA techniques to the CANDU 3 design to make preliminary identifications of potential accident initiating events, important system failure modes, and event sequences. The CPSA is a PRA study of the conceptual design and is therefore limited in scope. he ORNL study grouped event sequences into three classifications that might be later chosen for further analysis at the time of CANDU 3 design certification, specifically Anticipated Operational Occurrences, Design Basis Accidents, and Severe Accidents. Where necessary, the ORNL study made asstunptions to address situations of missin5 or incomplete information. Further, both the IPE and IPEEE programs are applicable to the CANDU 3 design as well.

I n

E 6.4.2 Issue II.E.1.1: Auxiliary Feedwater System Evaluation I

This issue requires the evaluation of the auxiliary feedwater (AFW) systems for all PWR operating plant licensees and operating license applications. This evaluation includes a reliability analysis, a g determmistic review, and a flow rate design basis and criteria review. The reliability analysis must 3 use event-tree and fault-tree logic techniques to determine the potential for AFW system failure under various loss-of-main-feedwater-transient conditions. Particular emphasis is given to determming potential failures that could result from human errors, cornm on causes, single-point vulnerabilities, and test and maintenance outages.

The applicability of this issue to the CANDU 3 design is similar to its applicability to a U.S. LWR. In the CANDU 3 design, the normal feedwater system is a group 1 system but when unavailable the safety-related group 2 feedwater system then functions as an auxiliary feedwater system by supplying feedwater to the steam generators. The group 2 feedwater system consists of 2 motor-driven 100W capacity pumps (capacity for decay heat removal) that can be powered from the on-site group 2 emergency diesel generators and that take suction from two tanks located in the group 2 service building. In addition, the group 1 feedwater system includes a 4% diesel driven ARV pump which takes suction from a reserve feedwater tank. Taken topther, the CANDU 3 group 2 feedwater and AFW systems are comparable to a typical 3-pump PWR AFW system. In particular, a typical PWR AFW system contains 2 motor-driven pumps and one steam-turbine pump.

6.4.3 Issue II.E.1.2: Auxiliary Feedwater System Automatic Initiation and Flow Indication This issue specifies requirements regarding the timely initiation of the AFW system. Automatic I

initiation is required with signals and circuits designed so that a single failure will not result in the loss od AFW function. The requirements further deal with testability, emergency power, and manual control room capability. Control room capability to ascertain the actual performance of the AFW is g also required, including safety-grade indication of auxiliary feedwater flow to each steam generator 5 with flow instrument channels powered from the emergency buses cc.nsistent with satisfying emergency power diversity requirements.

His issue is applicable to the CANDU 3 design. The AFW system in the CANDU 3 design consists of the safety-related group 2 feedwater system and the 4% diesel driven AFW pump in the group 1 feedwater system. Following a loss of normal feedwater, the group 2 feedwater pumps start automatically on low steam generator level or low feedwater supply pressure. The group 2 feedwater system is pcwered from Class III electrical buses which can be supplied by on-site standby diesel 78 I

I. l

I g

generators. The group 1 diesel driven pump is started automatically within 30 seconds of loss of all the main feedwater pumps either by a suitable process parameter such as low boiler level or by sensing the open condition of the circuit breakers. An abnormal condition associated with the diesel driven pump is alarmed in the main control room. Currently available information is insufficient to examine all aspects of this issue.

6.4.4 Issue II.E.3.1: Reliability of Power Supplies for Natural Circulation This issue deals with the pressurizer heater power supply design. It resulted in requirements for 1) upgrading of the pressurizer heater power supply and associated motive and control power interfaces sufficient to establish and maintain natural circulation in hot standby conditions, an:12) establishing new procedures and training for maintaining the RCS at hot standby with only onsite power available.

The CANDU 3 pressurizer has five electricalimmersion heaters located circumferentially at the bottom of the vessel and CANDU 3 will rely on naturai circulation flow. Details of the heater power supply design were not found in our review, however this issue is applicable to the CANDU 3 design.

6.4.5 Issue II.E.4.2: Isolation Dependability I This issue deals with the dependability of the containment isolathn system. Specifically that the design must include provision for: 1) diversity in the parameters sensed for the initiation of containment isolation, 2) the identification of essential and nonessential systems, 3) the automatic isolation of nonessential systems by the containment isolation signal, 4) isolation signal resetting that will not result in the automatic reopening of containment isolation valves, 5) a containment serpoint I pressure reduced to the mmunum compatible with normal operating conditions, 6) meeting purge valve operability criteria, and 7) closing purge and vent isolation valves on a high radiation signal.

This issue is applicable to the CANDU 3 containment design in the same manner that it is applicable l to the containment of a U.S. plant. In the CANDU 3 design, the automatic isolation signal can be l initiated on a two out of tluee signal indicating high containment pressure and/or lugh radiation activity within containment. The isolation system is locked in by control logic until all alarms are cleared and the system resets to prevent inadvertent valve opening after containment failure. The systems that are needed to mitigate accidents are individually identified and are therefore not l l

automatically isolated by the containment isolation signal. The automatic isolation devices are I designed to fail in the safe position.

I 79

l E,

6.4.6 Issue ll.G.1: Power Supplies for Pressurizer Relief Valves, Block Valves, and Level Indicators I

This issue specifies that: motive and control components of power-operated relief valves (PORVs) and PORV block valves be capable of being supplied from either offsite or emergency power; the power connections to the emergency buses for these valves be through safety-grade devices; and the pressurizer level indicators be powered from the vital instrument buses which are capable of being supplied from either offsite or emergency power.

This issue is applicable to the CANDU 3 design. Details of the CANDU 3 relief valves, pressurizer levelindicators, and their power supply design were not found in the available documentation.

6.4.7 Issue II.K.3(7): Evaluation of PORV Opening Probability During Overpressure Transient I

This issue deals with the opening of the power-operated relief valve (PORV) during an overpressure transient. PWR licensees should document that the PORV will open in less than 5% of all anticipated overpressure transients using the revised setpoints and anticipated trips for the range of plant conditions which might occur during a fuel cycle.

I This issue is applicable to CANDU 3, however the current documentation does not include information supporting this issue.

6.4.8 Issue A-17: Systems Interactions in Nuclear Power Plants This issue addresses the evaluation of the possibility that subtle dependencies known as adverse g systems interactions (ASIS) have remained unrecognized among strudures, systems, and components &

that could lead to safety-significant events. This issue is supported by the IPE program and the Multiple System Responses Program and addressed further in NRC Generic Letter No. 89-18". The IPE program includes an evaluation of internal flooding.

Like LWRs, the CANDU 3 design makes use of a number of systems that must operate properly to assure plant safety, therefore this issue and the related programs apply to the CANDU 3 design. A complete PRA was not available for review, however one Canadian safety design philosophy tends to limit unrecognized system interactions in the CANDU 3 design. All systems in the design are I

assigned to one of two groups,i.e., Group 1 or Group 2. The systems of each group are capable of shutting down the reactor, maintaining cooling of the fuel and providing plant monitoring capability 80

.m

I I in the event that the other group of systems is unavailable. Group 1 systems are those primarily dedicated to normal plant power production. Group 2 systems include safety and safety-related I systems. To guard against cross-linked and common-mode events, the two groups are located to greatest extent possible in separate areas of the plant. The design does include separate service buildings for each group of systems, however complete independence cannot be assured at this point, as illustrated by an electric power distribution diagram showing electrical connections between the two areas. An internal flooding analysis was not available for review.

6.4.9 Issue B 17: Criteria for Safety-Related Operator Actions This issue addresses the development and implementation of criteria for safety-related operator actions resulting in the automation of some actions currently performed by operators. Human factors are involved in determuung whether or not automatic actuation is required. The use of automated redundant safety-grade controls in lieu of operator actions is expected to reduce the frequency of improper action during the response to or recovery from transients and accidents by removing the potential for operator error, thereby reducing the core damage frequency and public risk. Manual ECCS switchover from the injection mode to the recirculation mode following a LOCA in some current PWR designs was specifically noted.

I This issue is applicable to the CANDU 3 design. Operator actions and operating procedures were not generally discussed in the available documentation. In the CANDU 3 design ECCS switchover to the long-term recirculation mode is automatic following depletion of the grade level water tank supplying the injection mode. The licensee review should review all safety-related operator actions to determine whether or not automatic actuation is needed. For instance, a CSR calculation for a pressure tube rupture with a highly poisoned moderator (Part 3, page 1-17) credits the operator for inserting I additional negative reactivity into the core 15 minutes after the rupture to ensure subcriticality. This type of situation should be applicable to this issue.

6.4.10 Issue B-56: Diesel Reliability  !

I This issue deals with the reliability of emergency orisite diesel generators. Events which result in a loss of offsite power necessitate reliance on the onsite emergency diesel generators for successful accident mitigation. Improvement of the starting reliability of onsite emergency diesel generators will reduce the probability of events which could escalate into a core-melt accident and thus could effect I

I an overall reduction in public risk. The NRC's goal for new plants is a diesel starting reliability of 0.99/ demand.

I 81 I

E DE This issue is applicable to the CANDU 3 design which relies on its four diesel generators for onsite electrical power should offsite power be lost. The starting reliability of the CANDU 3 diesel generators was not discussed.

6.4.11 Issue B-58: Passive Mechanical Failures This issue deals with the likelihood of passive mechanical valve failures. Passive failure of valves in safety-related systems presents a potentially significant safety concem because the effects on safety-related systems can be widespread.

Like other reactor types, CANDU 3 piping systems utilize many valves, and certain types of passive valve failures could directly degrade or disable safety systems at a CANDU 3 plant. It is expected that valves used in CANDU 3 reactors will be similar to valves used in LWRs, and will be subject to similar failure modes, including aging effects. The applicability of this issue deals mainly with plant operation procedures regarding maintenance, repair, or replacement, however the design should also be reviewed to determine if any of the valves are of a type with a history of unusually high unreliability.

6.4.12 Issue B-61: Allowable ECCS Equipment Outage Periods E

This issue deals with establishing surveillance test intervals and allowable equipment outage periods using analytically based criteria and methods for the technical specifications. Optimization of allowed outage periods and test / maintenance intervals can reduce equipment unavailability and in tum reduce public risk.

Like LWRs, the CANDU 3 design includes an ECCS for mitigation of certain types of postulated ,

accidents. The applicability of this issue deals mainly with plant operation procedures regarding testing and maintenance, however the design should be reviewed to determine if the optimization of allowed outage periods and test / maintenance intervals can be improved at this stage of the design.

6.4.13 inue C-11: Assessment of Failure and Reliability of Pumps and Valves This issue deals with the evaluation of active pumps and valves regarding their operability and reliability under accident loading conditions, and the implementation of a corrective action program that would be directed toward the improved design and fabrication of active pumps and valves. ,

Unreliability of active valves and pumps in nuclear plant safety systems contributes to the risk associated with postulated core-melt accident sequences.

82  ;

M l

I I It is expected that active pumps and valves used in CANDU 3 reactors will be similar to I corresponding components used in 1.WRs, and will be subject to similar failure modes, including aging effects. 'Ihis issue is applicable to the active valves and pumps in the CANDU 3 design.

6.4.14 Issue 43: Reliability of Air Systems This issue deals with the reliability of plant air systems and considers the potential unavailability of an air system from all causes. Safety-related equipment may be actuated or controlled by air systems which may or may not be safety grade. Safety-related systems have failed due to degraded or malfunctioning air systems. The failure or degradation of safety or safety-related systems increases the expected frequency of core-melt events and thereby increases the risk to the public.

I The CANDU 3 design employs compressed air systems to supply instrument air, service air and breathing air, filtered and dried as required, to all plant users including both group 1 (non-safety) and group 2 (safety) areas of the station. Tne instrument air system includes prefilters, dual-shell dryers, after-filters, and a pressure stabilizer and supplies low dew point, low particulate air. Air is further filtered by a carbon particulate filter before entering the air breathing distribution system. This issue I is applicable to the CANDU 3 design which should be reviewed in regards to its ability to maintain the proper quality of instrument air.

6.4.15 Issue 57: Effects of Fire Protection System Actuation on Safety-Related Equipment This issue deals with evaluating adverse effects on safety-related equipment caused by the actuation of fire protection systems. Previous events have shown that safety-related equipment subjected to fire protection sprays could be rendered inoperable. Adverse interactions of the fire protection system with plant safety systems reduce the availability of such safety systems needed to achieve safe plant shutdown or to mitigate a postulated accident.

I This issue applies to the CANDU 3 design which includes fire protection systems. All nuclear steam plant areas including the containment are protected by fire hoses and portable fire extinguishers.

Automatic sprinkler systems are provided for the high density cable routing areas and the diesel generator rooms. Other automatic extinguishing systems will be provided as needed following a fire hazards assessment. An automatic sprinkler system over the heat transport pump platforms in containment is possible. It is stated in the CSR (Part II, Section 10.5.6) that the fire protection design I considers "the potential for interruption of equipment functions due to fire extinguishing agents", however no additional details of this subject are prosided.

83 I

5 a

6A.16 Issue 70: PORY and Block Valve Reliability This issue addresses the reliability of power operated relief valves and block valves at PWRs. These valves are in certain conditions used in safety-related functions, for example to mitigate design basis accidents (e.g., SGTR) and transients, reduce safety valve challenges, and possibly help mitigate the effects of an ATWS. All plants are required to demonstrate the functionability of these valves for all expected flow conditions during operating and accident conditions. It is also required that the block valve be capable of closing to ensure that a stuck.open relief valve can be isolated, thereby terminating a small LOCA.

This issue is applicable to the pressure relief valves in the CANDU 3 design. Overpressure protection of the heat transport system is provided by the shutdown cooling system and by two instrumented liquid relief valves connected to the reactor outlet header and discharging into the bleed condenser. The bleed condenser then in turn is equipped with spring loaded safety relief valves. In addition, two steam relief valves are provided on the pressurizer to provide overpressure protection of the pressurizer whenever it is isolated from the heat transport system. Details of these pressure relief valves were not provided. ~1he CANDU 3 design should be reviewed regarding the reliability of these valves to remain functional during all expected flow conditions during operating and accident conditions.

6A.17 Issue 83: Control Ronm Habitability This issue addresses several specific concems regarding control room habitability. These coneems include deficiencies identified in the maintenance and testing of engineered safety features designed to maintam control room habitability; examples of design and installation errors such as inadvertent degradation of control room leak tightness; and cited shortages of NRC and licensee personnel knowledgeable about HVAC systems and nuclear air-cleaning technology. These concems encompass both plant licensing review and operations / inspection activities. Loss of control room habitability following an accidental release of extemal airbome toxic or radioactive material or smoke can impair or cause loss of the control room operator's capability to safely control the reactor and could lead to a core damaging accident. Aspects of control room habitability were also addressed in issue III.D.3.4,

" Control Room Habitability," and B-66," Control Room Infiltration Measurements." The human factors aspect of control room habitability appears to be covered under this issue.

This issue is directly applicable to the CANDU 3 design and the CANDU 3 design does address control room habitability, however the human factors aspects were not discussed in the available g documentation. The design includes both a main control room (MCR) and a secondary control area 5, (SCA). Control room habitability includes radiation protection for the MCR oprators and fresh air 84 I

5

=,

-I I intakes are separated from potential sources of chemical or gas contamination. If the MCR were to become urunhabitable, control of the plant would be shifted to the SCA. He route from the MCR to I. the SCA is qualified to allow its use following earthquakes or tornadoes. The available design documentation stated that the secondary control area will be provided with shutdown system displays and controls, ECCS displays and controls, safety support systems displays and controls.

The license review should evaluate the habitability of Qe control transfer route between the MCR and the SCA as well as both the MCR and SCA. The review should ensure that reactor controlis not lost I as a result of the transfer.

6.4.18 Issue 93: Steam Binding of Auxiliary Fsedwater Pumps This issue addresses vapor binding of the auriiary feedwater (AFW) pumps. Steam binding of AFW pumps can occur as a result of back-leakage o' heated main feedwater into the AFW system. Even though there are various combinations of check valv< s and control valves that isolate the main feedwater and AFW systems, there have been instances in wh':h bae@akage has occurred through several valves in series.

Once the heated main feedwater has entered an AFW train, it can flash to steam in the AFW pump and associated discharge line, thereby causing steam binding of the pump. There is also a potential for I common cause failures of multiple AFW trains, because AFW pumps are typically connected via common i

piping with only a single check valve to prevent back-leakage of hot water to a second or third pump.

The CANDU 3 design includes a group 2 feedwater system that is designed to remove decay and sensible heat to cool the reactor following a loss of the normal feedwater supply. This group 2 feedwater system consists of 2 motor-driven pumps that take suction from two tanks. These pumps can be powered from I the on-site group 2 emergency diesel generators. In addition, a group 1 diesel-driven AFW pump that can discharge limited flow into the two steam generators. His AFW pun p can take suction from a reserved feedwater tank.

The group 2 feedwater system is connected to each steam generator via nozzles that are separate and independent from the normal feedwater supply. Rus, the group 2 feedwater system cannot fail as a result of back-leakage of heated main feedwater. However, the group 1 AFW system is connected to the main feedwater system through a series of several isolation valves, and thus the potential exists for steam binding of the AFW system. Derefore, this issue is applicable to the CANDU 3 design.

I  !

\g  !

85 se

.E 6.4.19 issue 120: On Line Testability of Protection Systems The NRC staff raised this issue in 19S5 to address concerns related to plant protection system designs.

In particular,it was determined that protection system designs at some older plants did not provide as comprehensive a way of on-line protection system surveillance testing capability as other plants being evaluated at the time. The issue was fccused on those plants with lesser degrees of on-line testing capability and value/ impact effects of improving this testing capability through plant modifications.

This issue is applicable to the reactor shutdown systems of the CANDU 3 design. The Technical Description indicates the inclusion of adequate on-line surveillance testing capability, i.e.,

instrumentation, display / trip / test computers, and testing frequency. The CSR (Section 7.1.1.2.3 of Vol.

2) briefly describes a means to provide a check of shutoff rod units during plant operation. In particular, for each unit, there is a time delay relay to de-energize the clutch relay for a sufficient time to allow the corresponding rod to drop a defined distance. The post-test position of the rod will determine if there are any changes in shutoff unit performance. l l

6.4.20 issue 125.11.7: Reevaluate Provision to Automatically Isolate Feedwater from Steam Generator g

During a Line Break 5 His issue addresses the automatic isolation of auxiliary feedwater (AFW) from a steam generator following a steam or feedwater line break. Isolation is provided to mitigate the consequences of the break.

Automatic isolation has both positive and negative benefits. Positive benefits include: minimizing the break flow; reducing the overcooling of the primary system; and diverting AFW flow to an intact steam generator.

Disadantages include: the potentialloss of all AFW availability and the closure of the MSIVs. leaving only  ;

1 feed-and-bleed cooling to prevent core-melt; and possibly compromising long-term success of AFW for j main feedwater transients, steam generator tube ruptures, and small LOCAs. He NRC concluded that removal of AFW automatic isolation features would neither result in a substantial safety improvement nor would it be cost effective. Furthermore, for some plants, the removal could result in an increase in risk.

nis issue is potentially applicability to the CANDU 3 design. In the CANDU 3 design, the norrnal I

feedwater system is a group 1 system but when unavailable the safety-related group 2 feedwater system then functions as an auxiliary feedwater system by supplying feedwater to the steam generators. He group 2 feedwater system consists of 2 motor-driven 100%-capacity pumps that can be powered from the on-site g group 2 emergency diesel generators and that take suction from two tanks located in the group 2 service E building. In addition, the group 1 feedwater system includes a 4% diesel driven AFW pump which takes 86 I

.I

!I i

suction from a reserve feedwater tank. Finally, note that the main feedwater pumps used in the CANDU 3 design are electric-motor driven, as opposed to turbine driven.

1 He available documentation provides drawings showing the group 1 and the group 2 feedwater systems, nese drawing indicate the isolation valves, however there is no bdication that isolation of the group 2 feedwater or the group 1 diesel driven pump is automatic. Further, the CANDU 3 design does not include MSIVs and its feed-and-bleed capability as a last resort cooling system appears to be uncertain.

The resolution of this issue will have to be specific to the CANDU 3 design.

I 6.4.21 Issue 128: Electrical Power Reliability This issue deals with the reliability of on-site electrical power systems, more specifically three previously existing issues were combined to provide a more integrated approach for their resolution.

Three issues were: 1) Issue 48, "LCO for Class 1E Vital Instrument Buses in Operating Reactors" (concern: some operating plants do not have Technical Specifications or administrative controls governing operational restrictions for Class 1E 120 VAC vital instrument buses and associated inverters); 2) Issue 49, " Interlocks and LCOs for Class 1E Tie Breakers" (concern: under certain conditions, interconnection of redundant electrical loads groups could occur, violating the iI independence requirement of being able to accommodate a single failure), and 3) Issue A-30,

" Adequacy of Safety-Related DC Power Supplies" (concern: reliability of nuclear plant DC battery systems and the ability of plants to safely shut down in the event of a common mode failure or multiple failures of redundant systems).

I Since the CANDU 3 design includes AC and DC electrical systems that are comparable in design and I complexity with LWR clectrical safety systems, this issue is applicable. Like LWR plants, major portions of the CANDU 3 electrical system are required to be operable to ensure plant safety.

6A.22 Issue 156.6.1: Pipe Break Effects on Systems and Components 1

nis issue is currently being prioritized. As a consequence, a description of the issue was not readily available for our review. The issue title indicates that the issue will be directly applicable to the CANDU l 3 design since concerns regarding detrimental effects of pipe breaks are likely generic to all nuclear power plants. He available CANDU 3 documents do not provide specific information regarding pipe break effects. He issue's applicability will also depend upon the priority ranking assigned.

I B7 I

as 6.4.23 Issue 158: Performance of Power-Operated Valves Under Design Basis Condittas This isst.e is currently being prioritized. As a consequence, a description of the issue was not readily available for our review. He issue title indicates that the issue will be directly applicable to the CANDU 3 design xince the CANDU 3 design includes power-operated valves. The issue's applicability will also depend upon the priority ranking assigned.

6.4.24 Issue 159: Qualification of Safety Related Pumps While Running on Minimum Flow I

This issue is currently being prioritized. As a consequence, a description of the issue was not readily availabic for our review. He issue tit!c indicates that the issue will be directly applicable to the CANDU g

3 design since this issue appears to be generic to all nuclear power plants. The issue's applicability will also a depend upon the priority ranking assigned.

6.4.25 Issue 165: Safety and Safety / Relief Valve Reliability I

This issue is currently being prioritized. As a consequence, a description of the issue was not readily available for our review. He issue title indicates that the issue will be directly applicable to the CANDU 3 design since this issue appears to be generic to all nuclear power plants. The issue's applicability will also depend upon the priority ranking assigned.

I 6.4.26 Generic Letter 79-36" Adequacy of Station Electric Distribut.on Systems Voltages This generic letter was prepared to address concerns related to l) the potential overloading of electrical I

circuits due to transfers of either safety or non-safety loads, and 2) potential problems with degraded voltage supplies to safety equipment due to conditions originating on the electrical grid. At one plant, it was determined that in the event of a LOCA, the circuit used for immediate access to offsite power g did not have sufficient capacity and capability to accommodate full house loads and simultaneous 5 starting demands associated with emergency loads.

This issue is applicable to the CANDU 3 design in a manner similar to its applicability to a U.S. plant.

I Like LWRs, it is important that the CANDU 3 electrical system be appropriately designed and constructed to provide reliable sources of power to mitigate potential accidents. The available documentation does not contain sufficient information to address the concerns of this generic letter.

S8 I

I

=

I I 6.4.27 Generic Letter 80-35": Effect of a DC Power Supply Failure on ECCS Performance I This generic letter addresses the loss of ECCS equipment caused by the failure of DC power supplies.

The letter describes NRC concerns that generic BWR ECCS safety analyses may have failed to identify the worst ECCS system unavailability combinations. The NRC requested further study of possible accidents assuming a DC power supply failure.

I In the CANDU 3 design, it appears that 250 VDC will be used to power ECCS controls (CSR, Section 9.4.3.8.2). There are two separate group 2 battery sets, each located in a separate room and there also will be two separate 250 VDC buses. Redundant ECCS trains will have separate subsystems. Based on the preceding preliminary design information,it is concluded that loss of a single DC power source I will not defeat all the ECCS. However, it will be necessary to perform a more in-depth analysis of the as-built and as-operated reactor configuration to conclusively determine that effects of DC power supply failures on ECCS availability. This issue is applicable to the CANDU 3 design pending a more detailed review.

I 87 6.4.28 Generic Letter 88-20 : Individual Plant Examination for Severe Accident Vulnerabilities I This generic letter directs the licensees to perform an Individual Plant Examination (IPE) that looks for plant specific vulnerabilities to severe accidents and cost effective safety improvements that reduce or eliminate important vulnerabilities. An IPE study is performed by applying various Probabilistic Risk Assessment (FRA) methodologies. It is important that an IPE reflect the as-built and as-operated reactor configuration.

I Because many information items related to the CANDU 3 design are not yet available, it is not possible to perform a detailed IPE or PRA analysis of the CANDU 3 design at this time. However, it is noted that a recently-published study performed by ORNL" applied PRA techniques to the CANDU 3 design to make preliminary identifications of potential accident initiating events, important system failure modes, and event sequences. Where necessary, the ORNL study made assumptions to address situations of missing or incomplete information.

The conceptual probabilistic safety assessment

• performed by AECL relies on the use of event trees to represent various possible scenarios that could 1:3d to core damage associated with intemal events.

Because of the lack of detailed information,it was not ponible for the analysts to develop detailed I systems models to calculated system unreliabiMim. In some cases, system failure data were estimated from course fault tree analyses. In other cases, system failure data were derived from engineering I 89

C CJ evaluations combined with applicable operations data from Ontario Hydro. In the case of "special I

safety systems", the report states that system unreliabilities of 10-3were assumed. These "special safety systems" are shutdown system No.1 (shutoff rods), shutdown system no. 2 (gadolinium nitrate),

emergency core cooling, and containment. The assumed system unreliability value of 10-' was E

proposed to the Atomic Energy Control Board as a safety requirement to help achieve plant safety B goals. Once the plant design becomes complete, it will be necessary for the aaalysts to demonstrate that the four "special safety systems" do indeed meet the assumed unreliability criterion.

In the conceptual PRA, assumed mission times vary according to accident type and specific mitigating system. For the majority of the mitigating systems, mission times are assumed to be 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In other cases, mission times range from 30 minutes to 6 months. For example, a mission time of 6 months is assumed for the emergency core cooling system in the case of LOCAs that result in fuel failures. Beyond 6 months, core decay heat can be adequately removed by the shielding cooling system. Note that U. S. commercial reactor IPE studies assume mission times of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. i Results from the conceptual PRA must be used with caution because of numerous limitations. The majority of these limitations are related to the lack of detailed design and system information. Some of the more important limitations are listed below:

1) As stated above, a system unreliability of 10-' was assumed for the four "special safety systems."

g Because of the limited design information, there is currently no means to verify that this level of 5 system unreliability will actually be attained by the a> built, as-operated special safety systems.

2) While the analysis takes credit for system redundancies, common cause failures of identical I'

components in redundant trains is not addressed. Common cause failures of identical sets of redundant components have been found to be important contributors to core damage in a number of )

i IPE studies. 4 I

3) The event tree approach used in the analysis assumes that all systems in a given sequence path are completely independent. This assumption simplifies the sequence quantification process. However, j this analysis approach is valid only if there are no dependencies between and among systems along j the various sequence paths. Even though the analysts have attempted to account for known major )

dependencies by appropriate structuring of the event trees, it is very possible that other important dependencies have been overlooked.

/

90 Il I

I

4) In certain instances, "run" failures for standby systems were assumed to be negligible compared to I corresponding system " demand" failures. In the case of a standby pump, this assumption would mean that the probability of pump run failure during the assumed mission time would be negligible compared to the probability of pump start failure. Depending on the specific characteristics of the pump involved and assumed mission time, this assumption may be invalid.

5) A significant number of initiating events were not included in the analysis, for example internal plant flooding, loss of moderator system cooling, and loss of instnunent air.

I 6) Pre-accident human errors were not modeled in the analysis. The types of human errors can contribute to the unreliability of components, particularly those components with a standby ftmetion. l

7) The results are presented only in terms of point value estimates No uncertainty analysis was performed.

In summary, the IPE program is directly applicable to the CANDU 3 design. However, as previously noted, an IPE study of the CANDU 3 design cannot be performed until complete details of the as-built and as-operated plant are available.

6.5 Instrumentation and Control Issues 6.5.1 Issue I.D.5(1): Operator-Process Communication I This issue addresses the need to evaluate the operator machine interface in reactor control rooms with I emphasis on the use of lights, alarms, and annunciators. The method of presentation of information can significantly enhance the performance of the control room operators and thereby potentially affect operator error.

This issue is applicable to the CANDU 3 design and the available CANDU 3 documentation briefly discusses verbal communications. Written communications, however were not identified. In today's automated workstation environment, communications associated with operations and maintenance are frequently transmitted in written form on CRTs.

The CANDU communications systems include the telephone system, the public address system, the I maintenance communication system, and plastic suit communication system. The intemal telephone system provides verbal communication between working areas within the station, and has the I 91 I

E ai capability of simultaneous conversations. The public address system is provided for paging personnel and for issuing routine, operational and emergency instructions to station operators. The maintenance E

communications system provides a ready means of communications by means of a patch panel to all 5 points in the plant. The plastic suit communications system is used as a public address system for personnel wearing plastic suits.

6.5.2 Issue I.D.5(2h Plant Status and Post-Accident Monitoring This issue addresses the need to improve the ability of reactor operators to prevent, diagnose, and properly respond to accidents with an emphasis on the information needs of the operator, i.e., an indication of the plant status. This can enhance operator performance since operators must receive all the necessary information on the plant status in order to perform their functions.

This issue is directly applicable to the CANDU 3 design. The plant display system (PDS) is used far centralized interface functions, including CRT annunciation, CRT graphic data display and data logging. Most process information from the plant is fed to the PDS via the distributed control system (DCS). The PDS also receives information from systems not connected to the DCS, such as safety systems, meteorological monitoring, station clock, to provide signal data base accessible to the operator. All information regarding trip parameters and the status and operation of the systems is displayed on dedicated panels in the main control room. Information for post accident management is also provided in the secondary control area.

The CANDU 3 application review must ensure that all required safety related parameters associated with accident mitigation are displayed in the control room and that these displays be qualified IE as required.

6.5.3 Issue I.D.5(3): On-l.ine Reactor Surveillance System This issue addresses continuous on-line surveillance systems providing diagnostic information to I

predict anomalous behavior of operating reactors which could be used to maintain safe conditions.

Noise surveillance and diagnostic techniques have shown their safety significance.

This issue is directly applicable to the CANDU 3 design. Noise surveillance was not specifically I  !

1 mentioned in the available documentation, however some on-line monitoring was discussed. For instance, a computerized monitoring and test system provides the operator with indications of all shutdown system parameters and assists in operator testing. The system prompts the operator, 92 I

1 1

I I executes the testing, and records the test results. The design review should assess the adequacy of the CANDU 3 on-line surveillance capability.

I 6.5.4 Issue II.D.3: Relief and Safety Valve Position Indication This issue requires all operating licensees and applicants to provide the reactor coolant system relief and safety valves with position indication in the control room derived from a reliable valve-position device or a reliable indication of flow in the discharge pipe. Safety or relief valves that inadvertently open can result in a LOCA condition. The basic requirement is to provide the operator with unambiguous indication of valve position so the appropriate operator actions can be taken.

He CANDU 3 design uses relief and safety valves in the reactor coolant system, therefore this issue is applicable. There are two relief valves off of the pressurizer. In addition, there are two liquid relief valves that are used to prevent overpressurization of the heat transport system and there is a safety valve on the bleed condenser. The available CANDU 3 documentation does not describe safety / relief valve position monitoring.

6.5.5 issue II.F.1: Additional Accident Monitoring Instrumentation I

This issue was part of an effort to provide instrumentation to monitor plant variables and systems during and following an accident. The specific focus of this issue was related to the installation of additional accident moni+oring instrumentation, including instruments to monitor the radioactive noble gas effluents, containment high-range radiation, containment pressure, containment water level, and containment hydrogen concentration. A related issue, II.F.3, was resolved by updating Regulatory Guide 1.97, " Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and

'I Environs Conditions During and Following an Accident," to include the TAU-2 concems. His guide

had been used as guidance during licensing reviews.

i The applicability of this issue to the CANDU 3 design is to ensure that all appropriate instrumentation identified in this issue is included in the design. The currently available CANDU 3 documentation j provides limited information on accident monitoring. The documents do mention containment hydrogen monitors, containment temperature and pressure monitors, wide range radiation monitors, and effluent discharge path monitoring. The completeness of instrumentation and the appropriateness of the ranges and sensitivities must be determined from more complete information.

I I 93 I ,

e I,

6.5.6 !ssue A-47: Safety Implications of Control Systems This issue requires that a comprehensive review be performed of non-safety related control systems and to assess the effect of control system failures on plant safety. Nuclear power plant instrumentation and control systems are composed of safety-related protection systems and non-safety related control systems. The non-safety-related control systems are not relied upon to perform any safety functions during or following postulated transients or accidents but they control processes that could have an impact on plant dynamics. Separate tasks were established to identify potential control system failures that could cause overpressure, overcooling, overheating, overfilling, or reactivity events.

This issue is applicable to the CANDU 3 design. Information relative to this issue is sparse in the available CANDU 3 documentation. There is insufficient information to identify potential control '

system failures that could cause overpressure, overcooling, overheating, overfilbng, or reactivity events. The CANDU control systems, however, tend to be more automated than U.S. control systems and the CANDU 3 design appears to be an evolutionary step from operating CANDU plants. Hence, the resolution of this issue for U.S. plants may not be adequate for the CANDU 3 design.

6.5.7 Issue B-66: Control Room Infiltration Measurements I

This issue addresses control room air infiltration rates, which is a key parameter affecting control room habitability. Adequate control room habitability features are required to ensure that plant operators are adequttely protected against the effects of accidental release of toxic and radioactive gases and to assure that the control room can be maintained as a post-accident backup center for technical center personnel. Existing estimates of the air infiltration rates were based on data related to buildings substantially different than control room buildings. This issue is related to TMI Action Plan Item III.D.3.4, " Control Room Habitability Requirements."

This issue is applicable to the CANDU 3 design, however the available documentation does not include information regarding control room air infiltration rates. Control room habitability is an important aspect of safety at CANDU 3 plants.

6.5.8 Issue C 1: Assurance of Continuous Long Term Capability ofIIermetic Seals on Instrumentation and Electrical Equipment This issue addresses concerns related to the long-term capability of hermetically-sealed instruments and equipment that must function during post-accident environmental conditions. Certain safety-94

I I related components within containment must function during post-LOCA conditions, and their I

operability could be jeopardized if steam or water were to bypass defective seals. Seals could become defective as a result of personnel errors in the maintenance of such equipment. A basis for confidence that sensitive equipment has a seal during the lifetime of the plant is needed.

This issue is applicable to the CANDU 3 plant. The available documentation does not explicitly describe hermetic equipment seals, however it was stated that CANDU 3 structures, systems, and components important to safety will be designed to accommodate the effects of environmental conditions associated with postulated accidents, including LOCAs. Requirements for addressing aging-related component degradation are provided in SDG-003, " Environmental Qualification," (CSR, Appendix D3). The group 2 safety-related electrical systems will be environmentally qualified. It appears as though environmental qualification of Group 2 electrical equipment items and other safety-related equipment at CANDU 3 plants will be addressed in a comprehensive manner.

I 6.5.9 Issue 3: Set Point Dri't in Instrumentation i This issue addresses instrumentation set point drift beyond Technical Specification (TS) limits. An unplanned change in the set point of an instrument will alter the actual value of the measured I parameter at which a particular action is to occur, therefore a drift in an instrument set point could delay the initiation of a safety function.

This issue is applicable to the CANDU 3 design. The a+1able documentation does not discussed plant instrumentation in sufficient detail to include set point drift, however the availability of properly-operating instrumentation is important to the safety of CANDU 3 plants.

I 6.5.10 Issue 20: Effects of Electromagnetic Pulse on Nuclear Power Plants This issue deals with a concem raised because of the potential for a high-altitude nuclear weapon detonation causing a large electromagnetic pulse (EMP) which subsequently could induce large currents and voltages in electrical systems that could irreparably damage sensitive electronics and disable control systems.

I This issue is as applicable to CANDU 3 as any nuclear power plants, however the conceptual design does not contains information of sufficient detail to further evaluate the applicability of this issue.

I 95 I

E O

6.5.11 Issue 45: Inoperability of Instrumentation Due to Extreme Cold Weather This issue addresses the potential failure of instrumentation due to extreme cold weather conditions, thereby potentially compromising plant safety functions, such as the automatic change-over of the ECCS from the injection to recirculation mode during a LOCA condition. Licenses and construction permit holders were requested to review their plants to determine that adequate protective measures had been taken to assure that safety-related process, instrument, and sampling lines do not freeze during extremely cold weather.

This issue is applicable to the CANDU 3 design. The availabic documentation does not discuss plant instrumentation in sufficient detail to address cold weather freezing, however the availability of properly-operating instrumentation during any weather condition is important to the safety of CANDU 3 plants.

6.5.12 issue 64: Identification of Protection System Instrument Sensing Lines I

This issue addresses the identification of protection system equipment, such as interconnecting wiring, components, and modules. Redundant portions of the protection system shall be distinguished. Since g sensing lines are essential to the reliable operation of the protection systems, their identification would 5 facilitate verification that sensing lines are appropriately separated and protected from external hazards.

This issue is applicable to the CANDU 3 design. The protection system in the CANDU 3 design is based on triplicated instrumentation channels, and there is complete independence between redundant portions of the various subsystems. Lines penetrating the containment boundary are individually identified if the system is needed to mitigate accidents. Also, instrument lines penetrating the containment are identifiable when the tubing is designed for crimping as a method of isolation.

Further clarification relative to the concerns of this issue was not provided in the available documentation, however the availability of redundant portions of the protection system, including instrument sensing lines, is important to the safety of CANDU 3 plants.

6.5.13 issue 67.3.3: Improved Accident Monitoring This issue addresses several accident monitoring weaknesses apparent during a steam generator tube g rupture event at Ginna in 1982. These weaknesses included non-redundant monitoring of reactor 5 coolant system pressure; failure of the position indications for the steam generator relief and safety 06 i

.I

I valves; and limited range of the charging pump flow indicator for monitoring charging flow during accidents. These conditions make it more difficult for correct operator action in response to such I events.

This issue is applicable to the CANDU 3 design. The available CANDU 3 documentation provides limited information on plant instrumentation and the information was insufficient to address the specific weaknesses noted above. The CANDU 3 design should be thoroughly reviewed relative to accident monitoring instrumentation. Since the CANDU 3 reactor design differs greatly from U.S.

I reactors, it should be expected that the progression of an accident in a CANDU 3 plant will deviate significantly from that of a U.S. plant.

6.5.14 Issue 142: leakage Through Electrical Isolators in Instrumentation Circuits This issue addresses the potential for degradation or damage to safety-related electrical circuits caused by signal leakage through electricalisolators from non-safety circuits. Isolators are primarily used in cases where signals from safety-related systems are transmitted to non-safety control or display equipment. A safety-related circuit may be affected by the passage of smalllevels of electrical energy, depending upon the design and function or the safety system. The effects can range from degradation II to failure of single or multiple trains of safety systems resulting in failure on demand or inadvertent operation.

,I l

( This issue is applicable to the CANDU 3 design. The available CANDU 3 documentation does not include any information on electrical isolators for instrumentation circuits, however the avoidance of l

I adverse effects on instrumentation from electrical isolator leakage is important to the safety of CANDU 3 plants.

1 l 6.5.15 Issue 160: Spurious Actions of Instrumentation Upon Restoratica of Power This issue is currently being prioritized. As a consequence, a description of the issue was not readily l available for our review. The issue title indicates that the issue will be directly applicable to the CANDU 3 design since this issue appears to be generic to all nuclear power plants. The issue's applicability will also depend upon the priority ranking assigned.

I l I 97 I

O o

6.5.16 Issue HF5.1: Local Control Stations The objective of Task HF5 was to develop guidelines to ensure that the man-machine interface is adequate for the safe operation and maintenance of nuclear power plants. This issue focuses on local control stations, auxiliary operator interfaces. and eraunciator systems, including remote shutdown panels, local diesel generator panels, and local ECCS panels. Staff work on this issue was curtailed when the potential risk reduction was found to be considerably lower than previously anticipated.

This issue is applicable to the CANDU 3 design since the design most certainly includes a variety of these local control stations. The evaluations, which determined that the potential risk reduction did not justify continued work, did not evaluate the CANDU 3 design. In light of the uniqueness of the CANDU 3 design relative to U.S. plants and the apparent increased level of automation (Issue I.D.1),

the issue should be applied to the CANDU 3 design to ensure the same low potential for risk reduc' ion that was found for U.S. plants is also found for the CANDU 3 design.

6.5.17 Generic Letter 80-25": Engineering Safety Feature (ESF) Reset Controls This generic letter addresses possible adverse effects of Engineering Safety Feature (ESP) reset controls.

E In particular, several instances were discovered at plants in which a reset of previously actuated ESF W equipment would retum the equipment to its original (non-emergency) configuration. This generic letter directs licensees to evaluate the effects of ESF reset signals on safety-related equipment, and to describe appropriate corrective actions in cases where ESF reset signals cause equipment items to leave their emergency con 0gurations.

This issue is applicable to the CANDU 3 design in a manner similar to its applicability to a U.S. plant.

Like LWRs, it will be important at CANDU 3 reactors that ESF reset signals do not remrve previously actuated safety related equipment items from their emergency configuration. The available documentation does not contain sufficient information to address the concems of this generic letter.

6.6 Quality Assurance issues l

6.6.1 Issue I.F.2(2): Include QA Personnelin Review and Approval of Plant Procedures This issue requires the inclusion of QA personnel in the review and approval of plant operational maintenance and surveillance procedures, and quality-related procedures associated with design, 98 I

5

I I construction, and installation. Systems important to safety must be designed, fabricated, and maintained at a level equivalent to their safety importance.

This issue is applicable to the CANDU 3 design, however, the available CANDU 3 documentation does not provide information related to the review or approval of procedures. The involvement of QA personnel in the development of various maintenance, surveillance, design, construction, and installation procedures is important to the overall safety of CANDU 3 plants.

6.6.2 Issue I.F.2(3): Include QA Personnel in All Design, Construction Installation, Testing, and Operation Actidties his issue requires the inclusion of QA personnel in all activities involved in plant design, construction, installation, preoperational and startup testing, and operation. Systems important to safety must be designed, fabricated, and maintained at a level equivalent to their safety importance.

This issue is applicable to the CANDU 3 design, however, the available CANDU 3 documentation does not provide information related to the involvement of QA personnel in plant activities. The involvement of QA personnel in activities related to plant design, construction, installation, I preoperational and startup testing, and operation is important to the overall safety of CANDU 3 plants.

6.6.3 Issue I.F.2(9): Clarify Organizational Reporting levels for the QA Organization This issue requires the clarification of the organizational reporting levels for the QA organization. To adequately address the goals of the QA program, the QA program must be independent of the performing organization. Further, the QA organizarice, uust have the confidence and the ear of higher management so that QA concems will be heard and acted upon. Therefore, organizational reporting levels must be clearly identified.

I This issue is applicable to the CANDU 3 design, however, the available CANDU 3 documentation does not provide information related to the OA organization. The structure of the OA organization is important to the overall safety of CANDU 3 plants.

I 6.6.4 Generic letter 88-15": Electric Power Systems - Inadequate Control Over Design Processes I This generic Ictter was issued to inform licensees about various types of electrical system problems that have been identified at commercial reactors. These problems include degraded voltage conditions, 99 I

O O

loading of diesel generators in excess of their design rating, inadequate circuit breaker coordination, and inadequate fault current interruption capability. These problems have occurred primarily beca.use of inadequate control over the design process. ,

This issue is applicable to the CANDU 3 design in a manner similar to its applicability to a U.S. plant.

Like LWRs, it is important that the CANDU 3 electrical system be appropriately designed and constructed to provide reliable sources of power to mitigate potential accidents. The available documentation does not contain sufficient information to address the concerns of this generic letter.

6.7 Radiation Protection issues 6.7.1 Issue II.B.3: Post-Accident Sampling This issue addresses the design and operation of the reactor coolant and containment atmosphere sampling line systems. Post-accident samples would provide radionuclides that are indicators of the degree of core damage. Personnel must have the capability to promptly obtain a sample under accident conditions without incurring a radiation exposure to any individualin excess of 3 rem to the whole body or 18-3/4 rem to the extremities. Sufficient design features or shielding should be provided to meet the criteria. Radiological spectrum analysis facilities must have the capability to promptly quantify certain radionuclides that are indicators of the degree of core damage.

' Itis issue is applicable to the CANDU 3 design, however the available CANDU 3 documentation does I

not provide details of their post-accident sampling system. It was stated that effluent discharge paths can be monitored and sampled during postulated accidents ('ITR-423, Section 2.6.5).

6.7.2 issue Ill.D.3.1: Radiation Protection Plans This issue focuses on improvements to worker radiation protection programs through better defming criteria and responsibility for these programs. The establishment of a radiation protection plan as a guiding document for implementing procedures has been proposed as a method for formalizing commitment to specific perfonnance criteria. The safety significance lies in the reduction of occupational exposure.

This issue is applicable to the CANDU 3 design in the same manner that it is applicable to a U.S. plant.

The CANDU 3 design includes features that will mmmuze radiation exposure. The buildings in the CANDU 3 plant design are laid out to assist in the necessary segregation of radioactivity and other 100 e

i I hazards from the personnel and the population during normal operations. Radiation control zones j are defined and physicalbarriers are provided to direct movement of cont:minated material or persons I from contaminated to clean zones.

I i

I I 1 I

'I

'I I

i 101 I -

t

I 7.0 APPLICABLE SITED DESIGN OR OPERATING PLANT ISSUES l

l l

The issues grouped in this section are safety issues that are either related to the plant site or surrounding area or to the operation and management of the plant but are not directly related to a standardized plant design. Since information regarding the resolution of these issues was virtually unavailable in the conceptual design documentation, that was technically reviewed for this study, individual applicability reports were not written for these issues. These issues are listed in tables.

7.1 Sited Design Issues  ;

1 The sited design issues deal primarily with offsite electrical power systems and emergency plannmg.

I The overall plant safety is dependent upon the reliability of the offsite power system. Risk assessments usually specify the loss-of-offsite pe,wer as an accident scenario initiator, but the resolution of offsite power reliability concerns require a design:::ed electrica? power grid. Emergency plannmg issues deal with surrounding area population distributions and loccl governments. Other issues involve local weather conditions. These issues are listed in Table 7.1.

Table 7.1: Issues Applicable to Sited Designs I issue Title (NRC Safety Priority Ranking - Legend in Appendix E) m.A.I.1(1) Implement Action Plant Requirements for Promptly Improving Licensee Emergency I m.A.1.1(2)

Preparedness (I)

Perform an Integrated Assessment of the Implementation (NOTE 3b) m.A.I.2(3) Near-Site Emergency Operations Facility (I) m.A.I.3(1) Workers (NOTE 3b) 5.A.1.3(2) Public (NOTE 3b) m.A.2.1(2) Conduct Public Regional Meetings (I) m.D.2.3(C Develop Procedures to Disenmmate Between Sites / Plants (NOTE 3b) m.D.2.3(2) Disenmmate Between Sites and Plants That Require Consideration of Liquid Pathway Interdiction Techniques (NOTE 3b) m.D.2.3(3) Establish Feasible Method of Pathway Interdiction (NOTE 3b) 111.D.2.3(4) Prepare a Summary Assessment (NOTE 3b)

A-35 Adequacy of Offsite Power Systems (NOTE 3a)

B-70 Power Grid Frequency Degradation and Effect on Primary Coolant Pumps (NOTE 3b)

I 103 I .

O O

Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

I 51 Proposed Requirements for hnproving the Reliability of Open Cycle Service Water Systems (NOTE 3a) 88 Earthquakes and Emergency Planning (NOTE 3b) 103 Design for Probable Maximum Precipitation (NOTE 3a)

GL-80-94 Emergency Plan 7.2 Operating Plant Issues The plant operations and management issues addressed a variety of areas. These include: plant procedures for performing routine maintenance, collecting reliability data and providing feedback, and control room access; the administration of training and qualification of reactors operators and plant personnel, plant drills, and reporting; and plant decommissioning. These issues are listed in Table 7.2.

Table 7.2: Issues Applicable to Operating Designs I

Issue Title (NRC Safety Priotity Ranking - Legend in Appendix E)

I.A.1.1 Shift Technical Advisor (1) 1.A.I.2 Shift Supervisor Admuustrative Duties (I) 1.A.13 Shift Mannmg (I)

I.A.1.4 Long-Term Upgrading (NOTE 3a)

I.A.2.1(1) Qualifications - Experience (I) 1.A.2.1(2) Training (I) 1.A.2.1(3) Facility Certification of Competence and Fitness of Applicants for Operator and Senior Operator Licenses (I) 1.A.2.2 Training and Qualifications of Operations Personnel (NOTE 3b) 1.A.23 Administration of Training Programs (I)

I.A.2.S Plant Drills (NOTE 3b)

I.A33 Requirements for Operator Fitness (NOTE 3b) 1.A3.4 Licensing of Additional Operations Personnel (NOTE 3b)

LA.4.2(4) Review Simulators for Conformance to Criteria (NOTE 3a)

I.C.2 Shift and Rehef Turnover Procedures (I) 104 5

s

I Issue Title (NRC Safety Priority Ranking - Legend in Appendix E)

I.C.3 Shift Supervisor Responsibilities (1) 1.C.4 Control Room Access (I) 1.C.5 Procedures for Feedback of Operating Experience to Plant Staff (I)

I.C.6 Procedures for Verification of Correct Performance of Operating Activities (I)

I.C.7 NSSS Vendor Review of Procedures (I)

I.C.8 Pilot Monitoring of Selected Emergency Procedures for Near-Term Operating License Applicants (I)

I.C.9 Long-Term Program Plan for Upgrading of Procedures (NOTE 3b)

I.G.1 Training Requirements (I) 1.G.2 Scope of Test Program (NOTE 3a)

II.B.4 Training for Mitigating Core Damage (I)

II.C.4 Reliability Engineering (NOTE 3b)

II.K.3(3) Report Safety and Relief Valve Failures Promptly and Challenges Annually (I)

B44 Decommissioning of Reactors (NOTE 2) 4 End-of-Life and Maintenance Criteria (NOTE 3b) 75 Generic Implications of ATWS Events at the Salem Nuclear Plant (NOTE 3a) 102 Human Error in Events involving Wrong Unit or Wrong Train (NOTE 3b) 145 Actions to Reduce Common Cause Failures (NOTE 1)

HF4.1 Inspection Procedure for Upgraded Emergency Operating Procedures (NOTE 3b)

HF8 Maintenance and Surveillance Program (NOTE 3b)

GL-80-28 Examination Of Containment Liner Penetration Welds GL-8055 Possible Loss Of Hotline With Loss Of Off-Site Power GL-80-101 Inservice Inspection Programs GL-89-15 Emergency Response Data System I 105

I .

I

8.0 REFERENCES

8.1 CANDU Technology Documents

1. CANDU 3 Technical Description. Revision 3,74-01371-TED-001, September 1989.

2. CANDU 3 Technical Outline. Revision 11, June 1992.

3. E.S.Y. Tin, editor, "CANDU 3 Conceptual Safety Report," Revision 0,1989.

4. P.J. Allen, et.al., "CANDU 3 Conceptual Probabilistic Safety Assessment," 74-03660-AR-001, Rev. O,1989, Proprietary.

5. D. Pendergast, editor,"The Technology of CANDU Loss-of-Coolant Accidents,"'ITR-276, February 1991.

6. E. G. Price, editor, "The Technology of CANDU FucI Channels," TTR-291, January 1991.

I 7. R. K. Nakagawa, 'The Technology of CANDU On-Power Fueling," TTR-305, January 1991.

8. A. R. Khan and P. Archer, "The Technology of CANDU Shutdown Systems," TTR-306, I February 1991.

9. J. W. D. Anderson, editor, "Ihe Technology of CANDU Source Term Calculation,"

1TR-384, July 1992.

10. J. W. D. Anderson, et al, "CANDU 3 and U.S. NRC Requirements; Equivalent Safety Issues: Containment Design,"1TR-411, October 1992.

11. M. Fletcher, "CANDU 3 and the U.S. NRC General Design Criteria," TTR-423, June 1992.

12. R. L Ferguson and M.H. Fletcher," Comparison of CANDU 3 with NRC Positions for Evolutionary Light Water Reactor (LWR) Certification Issues in SECY-90-016," TTR-429, June 1992.  ;

i

13. I. Charak and P. H. Kier, "CANDU Reactors, Their Regulation in Canada, and the  !

Identification of Relevant NRC Safety Issues," Argonne National Laboratory, June i l

1993,

19. J.R. Wolfgang, et. al., " Systems Analysis of the CANDU 3 Reactor," NUREG/CR-6065, ORNL/TM-12396, June 1993.

20. AECL," Unique Aspects of the CANDU 3 Design," Atomic Energy of Canada Limited, June 1989.

21. AECL-9559, " Overview of the Technical Basis for the Safety of CANDU Reactors," 1988

22. M. S. Quraishi, 'CANDU 3 Containment Node-Link Mod 91s," 74-03500-AR-002, J

Atomic Energy of Canada Limited, Revision 0/89-02-10, Proprietary.

I 107 i

I

E up

23. M. A. Cormier," Containment Node-Link Model for the CANDU 3 Design," 74-68400-i AR-004, Atomic Energy of Canada Limited, Revision 0/90-05-04, Proprietary.

24. C. E. Ells, W. Evans, "The Pressure Tubes in the CANDU Power Reactors," The Canadian Mining and Metallurgical Bulletin,1981 July (AECL-7344).

25. E. G. Price, "Febrication, inspection, and Properties of Current Production Pressure Tubes,"

AECL- CANDU Report TDVI-380, July 1982.

26. B.H. Mcdonald and B.N. Hanna, " Integrated Aerosol and Thermalhydraulics Modelling for CANDU Safety Analysis," AECL-10167, August 1990.

27. G.1. Hadaller, G. H. Archinoff, and E. Kohn, "CANDU Fuel Bundle Behavior Dunng Degraded Cooling Conditions", 4th Annual Conference of the Canadian Nuclear Society, Montreal, June 1983.

28. E. Kohn, G.1. Hadaller, R. M. Sawala, G. L Archinoff and S. L. Wadsworth, "CANDU Fuel Deformation During Degraded Cooling - Experimental Results", Canadian Nuclear Society Conference, June 1985.

29. S. D. Grant and J. M. Hopwood, "The Effect of Fuel Heat Transfer on Early Void Production Following a Large Pipe Break in CANDU Reactors", Canadian Nuclear Society Simulation Symposium, Winnipeg, Manitoba, April 1988.

30. P. G. Guls? , Prediction of Pressure Tube Integrity for Large Loss-of-Coolant Accident in L JDU", American Nuclear Society,1987 Winter Meenng, Los Angles, Ca, November IS-19,1987.

31. V.1. Nath and Kohn, "High Temperature Oxidation of CANDU Fuel During a LOCA", Proceedings of the Fifth Intemational Meeting on Thermal Nuclear Reactor Safety, Karlsruhe, 9-13 September,1984, Kraftwerk Union Report 17K 388011, December 1984.

32. Dolbey, M.P., " CIGAR - An Automated Inspection System for CANDU Reactor Fuel Channels," ASME 8th International Conference on NDE in the Nuclear Industry, Orlando, Florida, November 1988.

33. Kenchington, J.M., Ellis, P.J., and Meranda, D.C.,"An Overview of the Development of Leak Detection Monitoring for Ontario Hydro Nuclear Stations," Proc. of the Sth Annual Conference, Canadian Nuclear Society, St. John, NB,1987.

34. Tenankore, K.N., A.C. Vikis, G.M. Frescura, and J. Blyth, " Canadian Program on the Behavior of Reactor Containment Atmospheres during Postulated Accidents," The 2nd International Conference on Containment Design and Operation, Toronto, Ontario, October 14-17,1990.

8.2 Canadian Regulatory Documents

35. AECB Regulatory Document R-7, Requirements for Containment Systems for CANDU Nuclear Power Plants," February 21,1991. l

36. AECB Regulatory Document R-8, " Requirements for Shutdown Systems for CANDU Nuclear Power Plants," February 21,1991.

108 er

I

37. AECB Regulatory Document R-9, " Requirements for Emergency Core Cooling Systems for CANDU Nuclear Power Plants," February 21,1991. '

38. AECB Regulatory Document R-10,"The Use of Two Shutdown Systems in Reactors."

January 11,1977.

39. AECB Regulatory Document R-77, " Overpressure Protection Requirements for Primary Heat Transport Systems in CANDU Power Reactors Fitted with Two Shutdown Systems," October 20,1987.

40. AECB Consultative Document C-6," Requirements for the Safety Analysis of CANDU Nuclear Power Plants," June 1980.

8.3 Canadian Standards Association (CSA) Standards

41. CAN3-A23.3-M84," Design of Concrete Structures for Buildings."

42. CAN3-N287.1-M91, " General Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

43. CAN3-N287.2-M91," Material Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

44. CAN3-N287.3-M82, " Design Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

45. CAN3-N287.4-M92, " Construction, Fabrication, and Installation Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants." ,

46. CAN3-N2S7.5-M81, ' Testing and Examination Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

I 47. CAN3-N287.6-MSO," Pre-Operational Proof and Leakage Rate Testing Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

I 48. CAN3-N287.7-M80, "In-Service Examination and Testing Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

49. CAN3-N289.1-80," General Requirements for Seismic Qualification of CANDU Nuclear Power Plants."

50. CAN3-N289.2-M81, " Ground Motion Determination for Seismic Qualification of CANDU Nuclear Power Plants."

51. CAN3-N289.3-M81," Design Procedures for Seismic Qualification for CANDU Nuclear Power Plants."

52. CAN3-N289.4-MS6," Testing Procedures for Seismic Qualificaticn of CANDU Nuclear Power Plants."

53. CAN/CSA-N285.0, " General Requirements for Pressure-Retaining Systems and Components in CANDU Nuclear Power Plants."

I 109

E-8.4 USNRC Regulations and Other Review References S4. 10 CFR Part 52.47," Contents of Applications," January 1,1991.

55. NUREG-0933,"A Prioritization of Generic Safety Issues," U.S. Nuclear Regulatory Comnussio .

Revision 16, November,1993.

56. C.J. Shaffer, et.al., "CANDU 3 Containment Performance and Consequences," SEA 93-704 A:3, May 15,1994.

57. 10 CFR Part 50, Appendix A, January 1,1991.

GDC 2, " Design Bases for Protection Against Natural Phenomena."

GDC 16, " Containment Design." ,

GDC 54, " Piping Systems Penetrating Containment."

GDC 56, " Primary Containment Isolation."

58. Generic Letter No. 79-58, NRC Letter to All Operating Water Reactors, "ECCS Calculations on Fuel Cladding," November 9,1979.

59. Generic Letter No. 79-69, NRC Letter to All Operating Water Reactors, " Cladding Rupture, g Swelling and Coolant Blockage as a Result of a Reactor Accident," December 20,1979. Ei

60. Generic Letter No.80-106, NRC Letter to All Pending Operating Licensees and Construction 1 Permit Applicants and to All Licensees of Plants Under Construction /' Report on ECCS ,

Cladding Models, NUREG-0630," November 28,1979.

I

61. Generic letter No. 80-12, NRC Letter, "IED 80-04 Analysis of a PWR Main Steam Line Break with Continued Feedwater Addition," February 8,1980.

62. Generic Letter No. 83-11, NRC Letter to All Operating Reactor Licensees, '1.icensee 3, Qualification for Performing Safety Analyses in Support of Licensing Actions," February 8, g!

1983.

63. Generic Letter No. 794)7, NRC Letter, " Seismic (SSE) and LOCA Responses (NUREG-0484),"

February 21,1979. l 1

64. R.K. Mattu," Methodology for Combining Dynamic Responses," NUREG-0484, Revision 1, May 3 gj 1980.

65. Generic Letter No. 82-28, NRC Letter to All Licensees of Operating Westinghouse and CE PWRs (Except Arkansas Nuclear One - Unit 2 and San Onofre Units 2 and 3), " Inadequate Core Cooling Instrumentation System," December 10,1982.

I' i

66. Generic Letter No. 84-21, NRC Letter to All Pressurized Water Reactor Licensees and Applicants for an Operating License, "Long Term Low Power Operation in Pressurized Water  !

Reactors," October 16,1984.  ;

67. Memorandum to James M. Taylor, "SECY-93-087 - Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor (ALWR) Design," July 21,1993.

68. Generic Letter No. 80-96, NRC Letter to Northwest Nuclear Energy Company, " Fire Protection," November 14,1980.

110 I'

I

=

t r .

69. 10 CFR Part 50.48, " Fire Protection," January 1,1991.

70. 10 CFR Part 50, Appendix R, " Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1,1979," January 1,1991.

I 71. Policy Issue, " Evolutionary Light Water Reactor (LWR) Certification Issues and Their Relationships to Current Regulatory Requirements " SECY-90-016, January 12,1990.

72. Memorandum to James M. Taylor, "SECY-90-016 - Evolutionary Light Water Reactor (LWR)

I Certification issues and Their Relationships to Current Regulatory Requirements," June 26, 1990.

73. Generic Letter No. 81-12, NRC Letter to All Power Reactor Licenses with Plants Licensed Prior to January 1,1979, " Fire Protection Rule (45 FR 76602, November 19,1980)," February 20,1981.

74. Generic letter No. 80-05, NRC Letter, "IEB 79-01b Environmental Qualification of Class 1E I 75.

Equipment," January 14,1980.

Generic Letter No. 80-13, NRC Letter to Operating License Applicants, " Qualification of Safety-Related Electrical Equipment," February 21,1980.

76. Generic Letter No. 80-83, NRC Letter to All Licensees of Operating Plants and Applicants for Operating Licensees and Holders of Construction Permits, " Environmental Qualification of I Safety-Related Equipment," October 1,1980.

77. Generic Letter No.80-104, NRC Letter to All Licensees of Operating Plants and Applicants I for Operating Licenses and Holders of Construction Permits," Orders on Environmental Qualification of Safety-Related Electrical Equipment," November 26,1980. .

I 78. Generic Letter No. 82-09, NRC Letter to All Power Reactor Licensees, Applicants for an Operating License, NSSS Vendors and Reactor Vendors, " Environmental Qualification of Safety-Related Electrical Equipment," April 20,1982.

79. Generic Letter No. 80-88, NRC Letter to All Operating Pressurized Water Reactor Licensees,

" Seismic Qualification of Auxiliary Feedwater Systems," October 21,1980.

I 80. Generic Letter No. 88-05, NRC Letter to All Operating PWRs and Holders of Construction Permits for PWRs," Boric Acid Corrosion of Carbon Steel Reactor Pressure Boundary," March 17,1988.

81. 10 CFR Part 50.34(f), " Additional TMI-Related Requirements " January 1,1991.

82. Generic Letter No. 80-98, NRC Letter, "IEB 80-24: Prevention of Damage Due to Water Leakage inside Containment," November 21,1980.

83. Generic Letter No. 92-08, NRC Letter to All Holders of Operating Licenses or Construction Permits for Nuclear Power Reactors, "Thermo-Lag 330-1 Fire Barriers," December 17,1992.

84. Generic Letter No. 89-18, NRC Letter to All Holders of Operating Licenses or Construction Permits for Nuclear Power Plants, " Resolution of Unresolved Safety Issue A-17, ' Systems Interactions in Nuclear Power Plants', " September 6,1989.

I 111 I

E

85. Generic Letter No. 79-36, NRC Letter to All Power Reactor Licensees (Except Humboldt Bay),

" Adequacy of Station Electric Distribution Systems Voltages," August 8,1979.

86. Generic Letter No. 80-35, NRC Letter to Vermont Yankee Nuclear Power Corporation, "Effect '

of a DC Power Supply Failure on ECCS Performance," April 25,1980.

87. Generir. Letter No. 88-20, NRC Letter to All Licensees Holding Operating Licenses and Condruction Permits for Nuclear Power Reactor Facilities, " Individual Plant Exammation fr / Severe Accident Vulnerabilities - 10 CFR 50.54(f)," November 23,1988.

88. Generic Letter No. 80-25, NRC Letter, "IEB 80-06: Engineering Safety Feature (ESF) Reset Controls," March 13,1980.

89. Generic Letter No. 88-15, NRC Letter to All Power Reactor Licensees and Applicants," Electric Power Systems - Inadequate Control Over Design Processes," September 12,1988.

I I

I I

E Il I

I.

m I.  :

~~

I I

I APPENDIX A 1

ISSUES NOT APPLICABLE TO CANDU 3 DESIGN r

I I Table of Contents Sectwn hgg A.1 Issues / Letters Specific to BWR Technology A-3 A.2 Issues / Letters Specific to Technology of Particular FWR Vendor A-6 I A.3 Issues / Letters Specific to Component / Process / Analysis Not Included in CANDU 3 Design A-7 A.4 Issues Specific to TMI-2 A-8 A.5 Issues Issued to Operating Plants Without Apparent Adaptability to Future Plants A-8 A.6 Issues Apply to Regulatory Staff or NRC Research A-8 A.7 Issues / Letters Apply to Specific Manufacturer or Model of Component A-10 A.8 Issues Applies to a Specific Plant A-10 A.9 Letters Not Directly Associated with Nuclear Power A-10 List of Tables A.1 Non-Applicable Issue / Letter Distribution A-3 I

I

I APPENDIX A ISSUES NOT APPLICABLE TO CANDU 3 DESIGN I This appendix lists safety issues and generic letters determined to be non-applicable to the CANDU 3 design for a variety of reasons. These issues and letters are categorized by those reasons. The numerical distribution is provided in Table A.I.

I Table A.1: Non-Applicable Issue / Letter Distribution I Reason for Determination Safety Issues Generic Letters Totals Specific to BWR Technology 38 64 102 Specific to Technology of Particular PWR Vendor 38 24 62 Component / Process / Analysis Not included in CANDU 3 6 8 14 Specific to TMI-2 2 2 Operating Plants Without Adaptability to Future Plants 7 7 Applies to Regulatory Staff or NRC Research 77 77 I Applies to Specific Manufacturer /Model of Component 2 7 9 Applies to a Specific Plant 1 1 Letters Not Directly Associated with Nuclear Power 3 3 Totals 171 106 277 I A.1 Issues / Letters Specific to BWR Technology ILK 3(13) Separation of HPCI and RCIC System Initiation Levels I II.K3(14) Isolation of Isolation Condensers on High Radiation II.K3(15) Modify Break Detection Logic to Prevent Spurious Isolation of HPCI and RCIC Systems I II.K3(16) Reduction of Challenges and Failures of Relief Valves - Feasibility Study and System Modification 11.K3(17) Report on Outage of ECC Systems - Licensee Report and Technical Specification i

I Changes ILK 3(18) Modification of ADS Logic - Feasibility Study and Modification for increased Diversity for Some Event Sequences I

II.K3(19) Interlock on Recirculation Pump Loops I ILK.3(21) Restart of Core Spray and LPCI Systems on Low Level - Design and Modification A-3 I

E O

II.K3(22) Automatic Switchover of RCIC System Suction - Verify Procedures and Modify Design II.K.3(24) Confirm Adequacy of Space Cooling for HPCI and RCIC Systems II.K3(27) Provide Common Reference Level for Vessel Level Instrumentation II.K3(28) Study and Verify Qualification of Accumulators on ADS Valves II.K.3(29) Study to Demonstrate Performance of Isolation Condensers with Non-Condensibles II.K3(44) Evaluation of Anticipated Transients with Single Failure to Verify No Significant Fuel g Failure 3 ILK 3(45) Evaluate Depressurization with Other Than Full ADS ILK 3(46) Response to 1.ist of Concerns from ACRS Consultant II.K.3(57) Identify Water Sources Prior to Manual Activation of ADS A-6 Mark I Short-Term Program (fonner USI)

A-7 Mark I Long-Term Program (former USI)

A-8 Mark 11 Containment Pool Dynamic Loads Long-Tenn Program (former USI)

A-16 Steam Effects on BWR Core Spray Distribution A-39 Determination of Safety Relief Valve Pool Dynamic Loads and Temperature Limits A-42 Pipe Cracks in Boiling Water Reactors (former USI) g B-10 Behavior of BWR Mark III Containments E B-19 Thermal-Hydraulic Stability B-48 BWR Control Rod Drive Mechanical Failures B-55 Improved Reliability of Target Rock Safety Relief Valves C-8 Main Steam Line Leakage Control Systems 6 Separation of Control Rod from its Drive and BWR High Rod Worth Events 12 BWR Jet Pump Integrity B 25 Automatic Air Header Dump on BWR Scram System 3 40 Safety Concems Associated with Pipe Breaks in the BWR Scram System 41 BWR Scram Discharge Volume Systems 50 Reactor Vessel Level Instrumentation in BWRs 61 SRV Line Break inside the BWR Wetwell Airspace of Mark I and 11 Containment S6 Long Range Plan for Dealing with Stress Corrosion Cracking in BWR Piping 101 BWR Water Level Redundancy 151 Reliability of Recirculation Pump Trip During an ATWS GL-78-08 Enclosing NUREG-0408 RE Mark 1 Containments, And Granting Exemption From GDC 50 And Enclosing Sample Notice GL-78-09 Multiple-Subsequent Actuations Of Safety / Relief Valves Following An Isolation Event CL-78 32 Reactor hptection System Power Supplies GL-76-39 Forwarbg of 2 Tables of Appendix 1, Draft Radiological Effluent Technical Specifications, BWR, And NUREG-0133 GL-78-41 Mark II Generic Acceptance Criteria For Lead Plants GL-79-12 ABVS - Enclosing Letter To GE, With NUREG-0460, Vol. 3 GL-79-13 Schedule For Implementation And Resolution Of Mark 1 Contair ment Long Term Program GL-79-23 NRC Staff Review Of Responses To I&E Bulletin 79-08 GL-79-27 Operability Testing Of Relief And Safety Relief Valves GL-79-38 BWR Off-Gas Systems - Enclosing NUREG/CR-0727 GL-79-48 Confirmatory Requirements Relating to Condensation Oscillation Loads For The Mark I Containment Long Term Program GL-79-57 Acceptance Criteria For The Mark 1 Containment Long Term Program GL-80-03 BWR Control Rod Failures GL-80-04 IEB 80-01 Operability Of ADS Valve Pneumatic Supply GL-80-06 !ssuance Of NUREG-0313, Rev 1, " Technical Report On Material Selection And Processing Guidelines For BWR Coolant Pressur GL-80-17 Modifications To Boiling Water Reactor Control Rod Drive Systems A-4 5

a

I I GL-80-27 IEB 80-07 BWR Jet Pump Assembly Failure GL-80-29 Modifications To Boiling Water Reactor Control Rod Drive Systems GL-80-41 Summary Of Meetings Held On April 22 &23,1980 With Representatives Of The Mark I Owners Group GL-80-50 Generic Activity A-10 BWR Cracks GL-80-54 IEB 80-14 Degradation Of Scram Discharge Volume Capability

'E GL-80-62 TMI-2 Lessons Learned 3 GL-80-63 IEB 80-17 Failure Of Control Rods To insert During A Scram At A BWR GL-80-64 Scram Discharge Volume Design GL-8046 IEB 80-17 Supplement 1 Failure Of Control Rods To Insert Durmg A Scram At A BWR GL-80-68 IEB 80-17 Supplement 2 Failures Revealed By Testing Subsequent To Failure Of Control Rods To Insert During A Scram At A  :

GL-80-70 IEB 80-19 Failures Of Mercury-Wetted Matrix Relays In RPS Of Operating Nuclear Power Plants Designed By GE GL-80-78 Mark I Containment Long-Term Program GL-80-79 IEB 80-17 Supplement 3 Failures Revealed By Testing Subsequent To Failure Of I Control Rods To Insert During A Scram At A GL-80-84 BWR Scram System GL-80-91 Odyn Code Calculation I GL-80-95 Generic Activity A-10 GL-80-107 BWR Scram Discharge System GL-80-111 IEB 80-17 Supplement 4, Failure Of Control Rods To Insert During A Scram At A BWR GL-81-03 Implementation of NUREG-0313, Technical Report on Material Selection & Processing I GL For BWR Coolant Press Boundary Piping GL-81-08 Odyn Code GL-81-09 BWR Scram Discharge System I GL-81 11 BWR Feedwater Nozzle and Control Rod Drive Retum Line Nozzle Cracking (NUREG-0619)

GL-81-13 SER For GEXL Correlation For 8X8R Fuel Reload Applications For Appendix D I Submittals of The GE Topical Report GL-81-18 BWR Scram Discharge System-Clarification of Diverse InstmmentationRequirements GL-81-20 St.fety Concems Associated With Pipe Breaks in The BWR Scram System GL-81-24 Multi-Plant Issue B-56 Control Rods Fail To Fully Insert I GL-81-30 Safety Concems Associated With Pipe Breaks in the BWR Scram System GL-81-32 NUREG-0737, Item II.K.3.44-Evaluation of Anticipated Transients Combined With Single Failure i I GL-81-34 Safety Concems Associated With Pipe Breaks b the BWR Scram System GL-81-35 Safety Concems Associated With Pipe Breaks in the BWR Scram System GL-81-37 ODYN Code Reanalysis Requirements l

i i

GL-82-24 Safety Relief Valve Quencher Loads: BWR MARK Il and III ContainmentsGL-82-27 I Transmittal of NUREG-0763 - Guidelines For Confinnatory In-Plant Tests of Safety-Relief Valve Discharge for BWR Plants GL-83-05 Safety Evaluation of " Emergency Procedure Guidelines, Revision 2,* June 1982 I GL-83-08 Modification of Vacuum Breakers on Mark I Containments GL-83-18 NRC Staff Review of the BWR Owners' Group (BWROG) Control Room Survey Program I GL-83 36 NUREG-0737 Technical Specifications GL-84-07 Procedural Guidance for Pipe Replacement at BWRs GL-84-11 Inspections of BWR Stainless Steel Piping GL-84-23 Reactor Vessel Water Level Instrumentation in BWRs GL-86-01 Safety Concems Associated With Pipe Breaks In The BWR Scram System GL-87-05 Rqst Add'l Info Assessment ... Degradation Of Mark I Drywells l

A-5  !

I

E is !

GL-88-01 NRC Position on IGSCC in BWR Austenitic Stainless Steel Piping E'

GL-89-11 Resolution Of Generic Issue 101 ~ Boiling Water Reactor Water Level Redundancy" GL-89-16 Installation Of A Hardened Wetwell Vent GL-88-01 NRC Position on Intergranular Stress Corrosion Cracking (IGSCC) in BWR Austenitic Stainless Steel Piping GL-89-10 Consideration of Valve Mispositioning in Boiling Water Reactors g GL 92-04 Resolution of the issues Related to Reactor Vessel Water Level Instrumention in BWTs 3 Pursuant to 10 CFR S0.54(f)

A.2 Issues / Letters Specific to Technology of Particular PWR Vendor H.E.5.1 Design Evaluation ILE.5.2 B&W Reactor Transient Response Task Force g ILK 1(17) Trip PZR Level Bistable so That PZR Low Pressure Will Initiate Safety Injection 5 II.K.1(18) Develop Procedures and Train Operators on Methods of Establishing and Maintaining Natural Circulation g ILK 1(19) Describe Design and Procedure Modifications to Reduce Likelihood of Automatic PZR E PORV Actuation in Transients ILK 1(20) Provide Procedures and Training to Operators for Prompt Manual Reactor Trip for LOFW, TT, MSIV Closure, LOOP, LOSG Level, and LO PZR Level ILK 1(21) 1>rovide Automatic Safety-Grade anticipatory Reactor Trip for LOFW, TT, or Significant Decrease in SG Level II.K.1(22) Describe Automatic and Manual Actions for Proper Functioning of Auxiliary Heat 3 Removal Systems When FW System Not Operable l, II.K.1(23) Describe Uses and Types of RV LevelIndication for Automatic and Manual Initiation Safety Systems II.K2(1) Upgrade Timelines and Reliability of AFW System II.K.2(2) Procedures and Training to Initiate and Control AFW Independent of Integrated '

Control System II.K2(3) Hard-Wired Control-Grade Anticipstory Reactor Trips l, ILK.2(4) Small-Break LOCA Analysis, Procedures and Operator Training 5 II.K2(5) Complete TMI-2 Simulator Training for All Operators ILK.2(6) Reevaluate Analysis for Dual-Level Setpoint Control g II.K.2(7) Reevaluate Transient of September 24,1977 g II.K2(9) Analysis and Upgrading of Integrated Control System ILK 2(10) Hard-Wired Safety-Grade Anticipatory Reactor Trips II.K.2(11) Operator Training and Drilling '

ILK 2(13) Thermal-Mechanical Report on Effect of HPI on Vessel Integrity for Small-Break LOCA With No AFW II.K2(14) Demonstrate That Predicted Lift Frequency of PORVs and SVs Is Acceptable 3 ILK 2(15) Analysis of Effects of Slug Flow on Once-Through Steam Generator Tubes After l Primary System Voiding ILK.2(16) Impact of RCP Seal Damage Following Small-Break LOCA With Loss of Offsite Power ILK 2(17) Analysis of Potential Voiding in RCS Dunng Anticipated Transients ILK.2(19) Benchmark Analysis of Sequential AFW Flow to Once-Through Steam Generator ILK 2(20) Analysis of Steam Response to Small-Break LOCA That Causes System Pressure to Exceed PORV Setpoint g ILK.2(21) LOFT L3-1 Predictions 3 II.K.3(9) Proportional Integral Derivative Controller Modification ILK 3(10) Anticipatory Trip Modification Proposed by Some Licensees to Confine Range of Use g to High Power Levels g ILK 3(12) Confirm Existence of Anticipatory Trip Upon Turbine Trip A-6 I.

I I A-4 CE Steam Generator Tube Integrity (former USI)

B&W Steam Generator Tube Integrity (former USI)

A-5 I A-10 69 73 BWR Feedwater Nozzle Cracking (former USI)

Make-Up Nozzle Cracking in B&W Plants Detached Thermal Sleeves CE PORVs I

84 99 RCS/RHR Suction Line Valve Interlo:k on PWRs 115 Enhancement of the Reliability of Westinghouse Solid State Protection System GL-78-26 Excessive Control Rod Guide Tube Wear I GL-78-34 Reactor Vessel Atypical Weld Material GL-79-18 Westinghouse Two-Loop NSSS GL-79-22 Enclosing NUREG-0560,

• Staff Report On The Generic Assessment Of Feedwater I Transients In PWRs Designed By B&W GL-79-49 Summary Of Meetings Held On 9/18-20/79 To Discuss Potential Unreviewed Safety Question On Systems Interaction For B&W P1 GL-80-18 Crystal River 3 Reactor Trip From Approximately 100% Full Power I GL-80-20 Actions Req From OL Applicants Of NSSS Designs By W and CE Resulting From NRC B&O Task Force Review Of TMI2 Accident GL-80-33 Actions Req. From OL Applicants Of B&W Designed NSSS Resulting From NRC B&O I Task Force Review Of TMI2 Accident GL-80-69 IEB 80-18 Maintenance Of Adequate Minimum Flow Erough Centrifugal Charging Pumps Following Secondary Side Helb GL-80-71 IEB 80-20 Failures Of Westinghouse Type W-2 Spring Return To Neutral Control Switches GL-80-77 Refueling Water Level GL-83-09 Review of Combustion Engineering Owners' Group Emergency Procedures Guideline I Program GL-83-22 Safety Evaluation of " Emergency Response Guidelines" GL-83-23 Safety Evaluation of "Em ergency Procedure Guidelines" I GL413-31 Safety Evaluation of "Abi.ormal Transient Operating Guidelines" GL-844)4 Safety Evaluation of W Topical Reports On Elimination of Postulated Pipe Breaks in PWR Primary Main Loops GL-8549 Technical Specifications For Generic Letter 83-28, Item 4.3 I GL-85-10 Technical Specification For Generic Letter 83-28, Items 4.3 and 4.4 GL-85-16 High Boron Concentrations GL-SS-20 Resolution Of Generic Issue 69:High Pressure Injection /Make-up Nozzle Cracking In I Babcock And Wilcox Plants GL-8645 Implementation Of TW Action Item II.K.3.5, " Automatic Trip Of Reactor Coolant Pumps" GL-86-06 Implementation Of TMI Action Item II.K.3.5, " Automatic Trip of Reactor Coolant I Pumps" GL-86-13 PotentialInconsistency Between Plant Safety Analyses and Technical Specifications GL-93-04 Rod Control System Failure and Withdrawal of Rod Control Cluster Assemblies,10 CFR 50.54(f)

A.3 Issues / Letters Specific to Component / Process / Analysis Not Included in CANDU 3 Design A-11 Reactor Vessel Materiais Toughness (former USI)

B-54 Ice Condenser Containments C-2 Study of Containment Depressuri'.ation by Inadvertent Spray Operation to Determine Adequacy of Containment External Design Pressure A-7 I

E O

C 10 Effective Operation of Containment Sprays in a LOCA 87 Failure of HPCI Steam Line Without Isolation 95 Loss of Effective Volume for Containment Recirculation Spray GL-79-43 Reactor Cavity Seal Ring Generic Issue GL-79-55 Summary Of Meeting Held On October 12,1979 To Discuss Responses To IE Bulletins79-05c And HPI Termination Criteria GL-80-19 Resolution Of Enhanced Fission Gas Release Concern GL-80-21 IEB 80-05 Vacuum Condition Resulting In Damage To Chemical Volume Control System Holdup Tanks GL-80-43 IEB 80-13 Cracking In Core Spray Spargers GL-81-21 Natural Circulation Cooldown GL-82-03 High Bumup MAPLHCR Limits GL-84-09 Recombiner Capabi'ity Requirements of 10 CFR S0.44(c)(3)(ii)

A.4 Issues Specific to FMI-2 II.H.1 Maintain Safety of TMI-2 and Minimize Environmental Impact II.H.2 Obtain Technical Data on the Conditions inside the TMI-2 Containment Structure A.5 Issues Issued to Operatin5 Plants Without Apparent Adaptability to Future Plants I.F.2(6) Increase the Size of Licensees' QA Staff II.E.4.4(1) Issue f.etter to Licensees Requesting Limited Purging g II.E.4.4(2) Issue Letter to Licensees Requesting Information on Isolation Letter 3 II.E.4.4(3) Issue Letter to Licensees on Valve Operability II.K.1(13) Propose Technical Specification Changes Reflecting Implementation of All Bulletin items III.D.3.3(1) Issue Letter Requiring Improved Radiation Sampling Instrumentation 125.I.3 SPDS Availability A.6 Issues Apply to Regulatory Staff or NRC Research I. A.2.6(1) Revise Regulatory Guide 1.8 I.A.2.6(2) Staff Review of NRR 80-117 LA.2.6(4) Operator Workshops I.A.2.6(5) Develop Inspection Procedures for Training Program LA.2.7 Accreditation of Training Institutions I.A.3.1 Revise Scope of Criteria for Licensing Examinations LA.3.2 Operator Licensing Program Changes I.A.4.1(1) Short-Term Study of Training Simulators 3 I.A.4.1(2) Interim Changes in Training Simulators l LA.4.2(1) Research on Training Simulators I.A.4.2(2) Upgrade Training Simulator Stedards LA.4.2(3) Regulatory Guide on Training Simulators I.B.I.1(1) Prepare Draft Criteria I.B.1.1(2) Prepare Commission Paper I.B.1.1(3) Issue Requirements for the Upgrading of Management and Technical Rt. sources I.B.I.1(4) Review Responses to Determine Acce} tability I.B.1.1(5) Review Implementation of the Upgrad.ng Activities 1.B.I.2(1) Prepare Draft Criteria g 1.B.I.2(2) Review Near-Term Operating License Facilities I

A-8 5

I I LB.1.2(3) Include Findings in the SER for Each Near-Term Operating License Facility Control Room Design Standard I.D.4 I I.D.S(4)

LF.1 II.A.1 Process Monitoring Instrumentation Expand QA List Siting Policy Reformuhtion ILB.6 Risk Reduction for Operating Reactors at Sites with High Population Densities II.B.8 Rulemaking Proceeding on Degraded Core Accidents II.C.1 Interim Reliability Evaluation Program II.E.13 Updated Standard Review Plan and Develop Regulatory Guide II.E.2.2 Research on Small Break LOCAs and Anomalous Transients I' II.E.3.4 Alternate Concepts Research II.E.4.4(5) Issue Modified Purging and Venting Requirement I II.E.6.1 II.F3 II.J.4.1 Test Adequacy Study Instruments for Monitoring Accident Conditions Revise Deficiency Reporting Requirements III.A.2.1(1) Publish Proposed Amendments to the Rules I IILA.2.1(3) Prepare Final Commission Paper Recommending Adoption of Rules III.A.2.1(4) Revise Inspection Program to Cover Upgraded Requirements IILA.2.2 Development of Guidance and Criteria I IILA3.1(1) Define NRC Role in Emergency Situations III.A3.1(2) Revise and Upgrade Plans and Procedures for the NRC Emergency Operations Center llLA3.1(3) Revise Manual Chapter 0502, Other Agency Procedures, and NUREG-%10 IILA3.1(4) Preparc Comnussion Paper I IILA3.1(5) Revise Implementing Procedures and Instructions for Regional Offices III.A3.2 Improve Operations Centers IILA33(1) Install Direct Dedicated Telephone Lines I IILA33(2) Obtain Dedicated, Short-Range Radio Communication Systems IILA3.4 III.A3.5 Nuclear Data Link Training, Drills, and Tuts g IILA3.6(1) Interne:tional M IILA3.6(2) Federal IILA3.6(3) State and Local IILB.1 Transfer of Responsibilities to FEMA IILB.2(1) The Licensing Process III.B.2(2) Federal Guidance III.D.1.1(1) Review Infonnation Submitted by Licensees Pertaining to Reducing Leakage from j Operating Systems 3 IILD.13(4) Sponsor Studies to Evaluate Charcoal Adsorber IILD.2.2(1) Perform Study of Radiciodine, Carbon-14, and Tritium Behavior

,g III.D.2.4(1) Study Feasibility of Environmental Mcmitors

'g III.D.2.5 Offsite Dose Calculation Manual IILD33(2) Set Cri'eria Requiring Licensees to Evaluate Need for Additional Survey Equipment III.D33(3) Issue a Rule Change Providing Acceptable Methods for Calibration of Radiation-Monitoring Instruments IILD33(4) Issue a Regulatory Guide IV.C.1 Extend Lessons Learned from TMI to Other NRC Programs IV.E.5 Assess Currently Operating Reactors

.I IV.F.1 IV.F.2 Increased OIE Scrutiny of the Power-Ascension Test Program Evaluate the Impacts of Financial Disincentives to the Safety of Nuclear Power Plants A-28 Increase in Spent Fuel Pool Storage Capacity B-36 Develop Design, Testing, and Maintenance Criteria for Atmosphere Cleanup System Air Filtration and Adsorption Units for Engineered Safety Feature Sys A-9 I

O o

C-17 Interim Acceptance Criteria for Solidification Agents for Radioactive Solid Wastes 113 Dynamic Qualification Testing of Large Bore Hydraulic Snubbers IM Rule on Degree and Experience Requirement 155.1 More Realistic Source Term Assumptions HF1.1 Shift Staffing HF1.2 Engineering Expertise on Shift HF1.3 Guidance on Limits and Conditions of Shift Work HF4.4 Guidelines for Upgrading Other Procedures HF5.2 Review Criteria for Human Factors Aspects of Advanced Controls and Instrumentation A.7 Issues / Letters Apply to Specific Manufacturer or Model of Component I

ILK.3(11) Control Use of PORV Supplied by Control Components, Inc. Until Further Review 3 Complete E 91 Main Crankshaft Failures in Transamerica DeLaval Emergency Diesel Generators GL-80-08 IEB 80-02 !nadequate Quality Assurance For Nuclear Supplied Equipment GL-80-31 IEB 80-09 Hydramotor Actuator Deficiencies GL-80-58 IEB 80-16 Potential Misapplication Of Rosemount Inc. Models 1151/1152 Pressure Transmitters With "A" Or "D" Output Codes GL-80-92 IEB 80-21 Valve Yokes Supplied By Malcolm Foundry Company, Inc.

~

GL-80-97 IEB 80-23 Failures Of Solenoid Valves Manufactured By Valcor Engineering Corporation GL-80-112 IEB 80-25 Operating Problems With Target Rock Safety Relief Valves 3 GL-89-10 Inaccuracy of Motor-Operated Valve Diagnostic Equipment 5 A.8 Issues Applies to a Specific Plant II.K.3(20) Loss of Service Water for Big Rock Point A.9 Letters Not Directly Associated with Nuclear Power GL-77-04 Shipments of Contaminated Components From NRC Licensed Nuclear Power Facilities to Vendors & Service Companies GL-78-36 Cessation of Plutonium Shipments By Air Except In NRC Approved Containers GL-80-09 Low Level Radioactive Waste Disposal I

I I

I I

A-10 I.

I I

APPENDIX B ISSUES COVERED BY ANOTHER ISSUE OR PROGRAM I

II Table of Contents l

Section fagg lI B.1 NUREG-0933 Issues Designated by NRC as Covered by Another Issue B-3 B.2 Issue Covered by Another Issue as It Applies to CANDU 3 B-6

. I B.3 C .neic Letter Covered by NUPJG-0933 Issue B-7 I D.4 Generic Letter Covered by Another Generic Letter B-8

!I i List of Tables B.1 Distribution of Duplicate Coverage Issues and Letters B-3

I I

I I

I ,

I I APPENDIX B ISSUES COVERED BY ANOTHER ISSUE OR PROGRAM This appendix lists safety issues and generic letters determined to be covered by another issue or program. These issues and letters are categorized by reason for that determination. The numerical distribution is provided in Table B.1.

i Table B.1: Distribution of Duplicate Coveuge Issues and Leiters i

I Reason for Determination Safety Issues Generic Letters Totals NRC Designated Duplicate Coverage of NUREG-0933 Iuue 148 148 Issue Covered by Another Issue as It Applies to CANDU 3 4 4 Generic Letter Covered by NUREG-0933 Issue 67 67 ,

Generic Letter Covered by Another Generic Letter 11 11 I Totals 152 78 230 i

B.1 NUREG-0933 Issues Designated by NRC as Covered by Another Issue I I.A.2.6(3)

I.B.I.1(6)

I.B.I.1(7)

Revise 10 CFR 55 Prepare Revisions to Regulatory Guides 1.33 and 1.8 Issue Regulatory Guides 1.33 and 1.8 l ILA.2 Site Evaluation of Existing Facilities II.B.7 Analysis of Hydrogen Control l ILC.3 Systems Interaction II.E.2.1 Reliance on ECCS i II.E.3.2 Systems Reliability II.E.3.3 Coordinated Study of Shutdown Heat Removal Requirements ILE.3.5 Regulatory Guide I ILH.3 II.J.3.1 II.J.3.2 Evaluate and Feed Bsck Information Obtained from nfI Organization and Staffing to Oversee Design ar.d Construction Issue Regulatory Guide II.K1(1) Review n{I-2 PNs and Detailed Chronology of the TMI-2 Accident I !LK1(2) Review Transients Similar to TMI-2 That Have Occurred at Other Facilities and NRC Evaluation of Davis-Besse Event l

II.K1(3) Review Operating Procedures for Recogruzmg, Preventing, and Mitigating Void j I II.K1(4)

ILK 1(5)

Formation in Transients and Accidents Review Operating Procedures and Trainmg Instructions Safety-Related Valve Position Description l

l ILK 1(6) Review Containment Isolation Initiation Design and Procedures

,g B-3

'I i -- .. .

B a

ILK.1(7) Implement Positive Position Controls on Valves nat Could Compromise of Defeat AFW Flow II.K1(8) Implement Procedures That Assure Two Independent 100% AFW Flow Paths II.K1(9) Review Procedures to Assure That Radioactive Liquids and Gases Are Not Transferred out of Containment Inadvertently ILK 1(10) Review and Modify Procedures for Removing Safety-Related Systems from Service ILK 1(11) Make All Operating and Maintenance Personnel Aware of the Seriousness and Consequences of the Erroneous Actions Leading up to, and in Early Phases of II.K1(12) One-Hour Notification Requirement and Continuous Communications Channels II.K1(14) Review Operating Modes and Procedures to deal with Significant Amounts of Hydrogen II.K1(15) For Facilities with Non-Automatic AFW Initiation, Provide Dedicated Operator in Continuous Communication with CR to Operate AFW ILK 1(16) hnplement Procedures nat Identify PZR PORV "Open" Indications and Hat Direct Operator to Close Manually at " Reset" Setpoint II.K1(24) Perform LOCA Analyses for a Range of Small-Break Sizes and a Range of Time lapses Between Reactor Trip and RCP Trip  ;

ILK 1(25) Develop Operator Action Guidelines <

ILK 1(26) Revise Emergency Procedures and Train ROs and SROs II.K1(27) Provide Analyses and Develop Guidelines and Proceaures for Inadequate Core Cooling Conditions j i

ILK 1(28) Provide Design That Will Assure Automatic RCP Trip for All Circumstances Where I

Required i ILK 2(8) Continued Upgrading of AFW System ILK 2(12) Transient Analysis and Procedures for Management of Small Breaks ILK 2(18) Analysis of Loss of Feedwater and Other Anticipated Transients ILK 3(4) Review and Upgrade Reliability and Redundancy of Non-Safety Equipment for i Small-Break LOCA Mitigation II.K3(6) Instrumentation to Verify Natural Circulation I II.K.3(8) Further Staff Consideration of Need for Diverse Decay Heat Removal Method 3 Independent of SGs 3 II.K3(23) Central Water Level Recording ILK 3(26) Study Effect on RHR Reliability of Its Use for Fuel Pool Cooling  ;

ILK.3(32) Provide Experimental Verification of Two-Phase Natural Circulation Models ILK.3(33) Evaluate Elimination of PORV Function ILK.3(34) Relap-4 Model Development ILK 3(35) Evaluation of Effects of Core Flood Tank Injection on Small-Break LOCAs II.K3(36) Additional Staff Audit Calculations of B&W Small-Break LOCA Analyses II.K3(37) Analysis of B&W Response to Isolate Small-Break LOCA ILK.3(38) Analysis of Plant Response to a Small-Break LOCA in the Pressurizer Spray Line II.K.3(39) Evaluation of Effects of Water Slugs in Piping Caused by HPI and CFT Flows ILK.3(40) Evaluation of RCP Seal Damage and Leakage Dunng a Small-Break LOCA ILK 3(41) Submit Predictions for LOFT Test L3-6 with RCPs Running II.K.3(42) Submit Requested Information on the Effects of Non-Condensible Gases II.K.3(43) Evaluation of Mechanical Effects of Slug Flow on Steam Generator Tubes i ILK.3(47) Test Program for Small-Break LOCA Model Verification Pretest Prediction, Test Program, and Model Verification g II.K3(48) Assess Change in Safety Reliability as a Result of Implementing B&OTF 3 Recommendations ILK 3(49) Review of Procedures (NRC)

ILK.3(50) Review of Procedures (NSSS Vendors) l II.K3(51) Symptom-Based Emergency Procedures E

=;

I ILK.3(52) Operator Awareness of Revised Emergency Procedures II.K.3(53) Two Gjerators in Control Room I IIK3(54) Simulator Upgrade for Small-Break LOCAs ILK.3(55) Operator Monitoring of Control Board II.K.3(56) Simulator Training Requirements III.D.2.2(2) Evaluate Data Collected at Quad Cities I III.D.2.2(3) Determme the Distribution of the Chemical Species of Radioiodine in Air-Water-Steam Mixtures IILD.2.2(4) Revise SRP and Regulatory Guides A-30 Adequacy of Safety-Related DC Power Supplies A-32 Missile Effects A-34 Instruments for Monitoring Radiation and Process Variables During Accidents B-4 ECCS Reliability B-6 Loads, Load Combinations, Stress Limits B-14 Study of Hydrogen Mixing Capability in Containment Post-LOCA B-16 Protection Against Postulated Piping Failures in Fluid Systems Outside Containment I B-18 B-24 B-32 Vortex Suppression Requirements for Containment Sumps Seismic Qualification of Electrical and Mechanical Equipment Ice Effects on Safety-Related Water Supplies B-34 Occupational Radiation Exposure Reduction B-51 Assessment of inelastic Analysis Techniques for Equipment and Components B-52 Fuel Assembly Seismic and LOCA Responses B-57 Station Blackout B-67 Effluent and Process Monitoring Instrumentation B-69 ECCS Leakage Ex-Containment B-71 Incident Response I B-73 C-3 C-13 Monitoring for Excessive Vibration Inside the Reactor Pressure Vessel Insulation Usage Within Containment Non-Random Failures Design Check and Audit of Balance-of-Plant Equipment I

5 8 Inadvertent Actuation of Safety Injection in PWRs 9 Reevaluation of Reactor Coolant Pump trip Criteria 11 Turbine Disc Cracking I 16 18 19 BWR Main Steam Isolation Valve Leakage Control Systems Steam Line Break with Consequential Small LOCA Safety implications of Nonsafety Instrument and Control Power Supply Bus I 26 27 28 Diesel Generator Loading Problems Related to SIS Reset on Loss of Offsite Power Manual vs. Automated Actions Pressurized Thermal Shock 31 Natural Circulation Cooldown 32 Flow Blockage in Essential Equipment Caused by Corbicula 33 Correcting Atmospheric Dump Valve Opening Upon Loss of Integrated Control System 37 Steam Generator Overfill and Combined Primary and Secondary Blowdown 39 Potential for Unacceptable Interaction Between the CRD System and Non-Essential l Control Air System  ;

42 Combination Primary / Secondary System LOCA I

l 44 Failure of Saltwater Cooling System )

46 Loss of 125 Volt DC Bus 48 LCO for Class IE Vital Instrument Buses in Operating Reactors I 49 52 Interlocks and LCOs for Redundant Class 1E Tie-Breakers SSW Flow Blockage by Blue Mussels B-5 I

E e

54 Valve Operator-Related Events Occurring During 1978,1979, and 1980 56 Abnormal Transient Operating Guidelines as Applied to a Steam Generator Oven '.1 Event 60 Lamellar Tearing of Reactor Systems Structural Supports 62 Reactor Systems Bolting Applications 65 Probability of Core-Melt Due to Component Cooling Water System Failures 67.2.1 Integrity of Steam Generator Tube Sleeves 67.3.1 Steam Generator Overfill 67.3.2 Pressurized Thermal Shock 67.3.4 Reactor Vessel Inventory Measurement 67.4.1 RCP Trip 67.4.2 Control Room Design Review 67.4.3 Emergency Operating Procedures 3 67.6.0 Organizational Responses g 67.7.0 Improved Eddy Current Tests 67.8.0 Denting Criteria 67.9.0 Reactor Coolant System Pressure Control 68 Postulated Loss of Auxiliary Feedwater System Resulting from Turbine-Driven Auxiliary Feedwater Pump Steam Supply Line Rupture 77 Flooding of Safety Equipment Compartments by Back-flow Through Floor Drains 3 96 RHR Suction Valve Testing 3 97 PWR Reactor Cavity Uncontrolled Exposures 114 Seismic-Induced Relay Chatter g 122.1.a Failure of Isolation Valves in Closed Position g 122.1.b Recovery of Auxiliary Feedwater 122.1.c Interruption of Auxiliary Feedwater Flow 125.1.2.a Need for a Test Program to Establish Reliability of the PORV 125.I.2.b Need for PORV Surveillance Tests to Confirm Operational Readiness 125.L2.d Capability of the PORV to Support Feed-and-Bleed 125.ILI.b Review Existing AFW Systems for Single Failure g 156.3.5 Automatic ECCS Switchover g 156.4.1 RPS and ESFS Isolation 156.4.2 Testing of the RPS and ESFS HF33 Develop Criteria for Nuclear Power Plant Simulators HF3.4 Examination Requirements HF4.3 Criteria for Safety-Related Operator Actions HF4.5 Application of Automation and ArtificialIntelligence l HF5.3 Evaluation of Operational Aid Systems 3 HF5.4 Computers and Computer Displays HF6.1 Develop Regulatory Position on Management and Organization HF6.2 Regulatory Position on Management and Organization at Operating Reactors CH2.2 Accidents at Low Power and at Zero Power CH2.3A Control Room Habitability B.2 Issue Covered by Another issue as It Applies to CANDU 3 B-63 Isolation of Low Pressure Systems Connected to the Reactor Coolant Pressure Boundary 131 Potential Seismic Interaction involving the Movable In-Core Flux Mapping System Used in Westinghouse-Designed Plants 166 Adequacy of Fatigue Life of Metal Components 168 Environmental Qualification of Electrical Equipment B-6 I

=

l i

l B.3 Gencic Letter Covered by NUREG-0933 Issue Gb77-07 Reliability Of Standby Diesel Generator Units GL-79-17 Reliability Of Onsite Diesel Generators At Light Water Reactors CL-79-20 Cracking In Feedwater Lines GL-79-42 Potential Unreviewed Question On Interaction Between Non-Safety Grade Systems I And Safety Grade Systems GL-79-46 Containment Purging And Venting During Normal Operation - Guidelines For Valve Operability I GL-79-53 ATWS GL-79-54 Containment Purging And Venting During Normal Operation Gb80-05 IEB 79-01b Environmental Qualification Of Class 1E Equipment Gb80-13 Qualification Of Safety Related Electrical Equipment I

Gb80-14 LWR Primary Coolant System Pressure Isolation Valves l GL-80-16 IEB 7941b Environmental Qualification Of Class IE Equipment GL-80-46 Generic Technical Activity A-12 Fracture Toughness I Gb80-47 Additional Guidance On " Potential For Low Fracture Toughness And Lammar Tearing On PWR SG & Reactor Coolant Pump Suprts GL-80-82 IEB 79-01b Supplement 2 Environmental Qualification Of Class IE Equipment I Gb80-83 Environmental Qualification Of Safety-Related Equipment GL-80-89 IEB 79-01b Supplement 3 Environmental Qualification Of Class 1E Equipment GL-80-104 Orders On Environmental Qualification Of Safety Related Electrical Equipment GL-80-105 Implementation Of Guidance For USI A-12, Potential For Low Fracture Toughness I And Lamellar Tearing On Component Supports Gb80-113 Control Of Heavy Loads Gb81-04 Emergency Procedures And Training For Station Blackout Events I GL-81-07 Control of Heavy Loads GL-81-14 Seismic Qualifications for Auxiliary Feedwater Systems GL-81 16 NUREG-0737 Item I.C.1 SER on Abnormal Transient Operating Guidelines (ATOG)

I Gb81-19 Thermal Shock to Reactor Pressure Vessels Gb81-28 Steam Generator Overfill Gb81-40 Qualifications of Reactor Operators GL-82-09 Environmental Qualification of Safety Related Electrical Equipment GL-83-10A Resolution of TMI Action item II.K.3.5.," Automatic Trip of Reactor Coolant Pumps" GL-83-10B Resolution of TMI Action Item II.K.3.5., " Automatic Trip of Reactor Coolant Pumps" Gb83-10C Resolution of TMI Action Item II.K.3.5., " Automatic Trip of Reactor Coolant Pumps" GL-83-10D Resolution of TMI Action item ILK.3.5.," Automatic Trip of Reactor Coolant Pumps" GL-83-10E Resolution of TMI Action item II.K.3.5., " Automatic Trip of Reactor Coolant Pumps" GL-83-10F Resolution of TMI Action Item II.K.3.5., " Automatic Trip of Reactor Coolant Pumps" GL-83-24 TMI Task Action Plan Item 1.G.1, "Special Low Power Testing and I Training," Recommendations for BWRS GL-83-28 Required Actions Based on Generic Implications of Salem ATWS Events GL-83-35 Clarification of TMI Action Plan Item II.K.3.31 I Gb8341 Fast Cold Starts of Diesel Generators GL-84-13 Technical Specification for Snubbers GL-84-15 Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability GL-8542 Staff Recommended Actions ... Regarding Steam Generator Tube Integrity I GL-85-05 Inadvertent Boron Dilution Events GL-85-12 Implementation Of TMI Action Item II.K.3.5, " Automatic Trip Of Reactor Coolant Pumps Gb85-22 Potential For Loss Of Post-LOCA Recirculation Capability Due To Insulation Debris Blockage B-7

l EI o1 GL-86-02 Technical Resolution of Generic Issue B Thermal Hydraulic Stability GL-86-09 Technical Resolution of Generic Issue B-59, (n-1) Loop Operation in BWRs and PWRs GL-87-02 Verification of Seismic Adequacy of MecharJeal and Electrical Equipment In Operating Reactors (USI A-46)

GL-87-03 Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors (USI A-46)

GL-87-06 Periodic Verification Of Leak Tight Integrity Of Pressure Isolation Valves '

GL-87-12 Loss of Residual Heat Removal While The Reactar Coolant System is Partially Filled GL-88-03 Resolution of Generic Safety Issue 93, " Steam Binding of Auxiliary Feedwater Pumps" GL-88-11 NRC Position on Radiation Embrittlement Of Reactor Vessel Materials And Its impact On Plant Operations GL-88-14 Instrument Air Supply System Problems Affecting Safety-Related Equipment GL-88-17 Loss of Decay Heat Removal (

GL-894)6 Task Action Item I.D.2 - Safety Parameter Display System - 10 CFR 50.54 (f)

GL-89-08 Erosion / Corrosion-Induced Pipe Wall Thinning GL-89-10 Safety-Related Motor-Operated Valve Testing And Surveillance GL-89-13 Service Water System Problems Affecting Safety-Related Equipment GL-89-18 Resolution Of Unresolved Safety Issues A-17," Systems Interactions In Nuclear Power Plants" GL-89-19 Request For Actions Related To Resolution Of Unresolved Safety Issue A-47, "...,"

Pursuant To 10 CFR 50.54(f)

GL-90-06 Resolution of Generic Issues 70, "PORV and Block Valve Reliability," and 94,

" Additional LTOP Protection for PWRs" GL-91-06 Resolution of Generic Issue A-30," Adequacy of Safety-Related DC Power Supplies,"

Pursuant to 10 CFR 50.54(f)

GL-91-07 GI-23, " Reactor Coolant Pump Seal Failures" and Its Possible Effect on Station Blackout GL-91-11 Resolution of GIs 48, "LCOs..1E Vital Inst. Buses," and 49, " Interlocks . . Tie Breakers,"

Pursuant to 10 CFR 50.54 GL-91-17 Generic 9fety Issue 29, " Bolting Degradation or Failure in Nuclear Power Plants" GL-92-02 Resolu' ion of Generic Issue 79, "Unanalyzed Reactor Vessel (PWR) Thermal Stress Durinr, Natural Convection Cooldown" GL-92-01 Reactor Vasel Structural Integrity GL-93-06 Research Results on Generic Safety Issue 106, " Piping and the Use of Highly Combustible Gases in Vital Areas" B.4 Generic Letter Covered by Another Generic Letter GL-79-24 Multiple Equipment Failures In Safety-Related Systems GL-79-62 ECCS Calculations On Fuel Cladding GL-79-63 Upgraded Emergency Plans GL-79-66 AdditionalInformation RE 11/09/79 Letter On ECCS esiculations GL-79-67 Estimates For Evacuation Of Various Areas Around Nuclear Power Reactors GL-79-69 Cladding Rupture, Swelling & Coolant Blockage As A Result Of A Reactor Accident GL-80-42 IEB 80-12 Decay Heat Removal System Operability GL-80-108 Emergency Plannmg GL-81-12 Fire Protection Rule (45 FR 76602,11/19/80)

GL-86-16 Westinghouse ECCS Evaluation Models g GL-83-28 Required Actions Based on Generic Implications of Salem ATWS Events g I

e.e g

APPENDIX C ISSUES OF NON OR LOW SAFETY PRIORITY I l I Table of Contents Sectmn fagg q C1 Licensing Issues C-3 I C2 Regulatory Issues C-7 C.3 EnvironmentalIssues C-7 C4 Low Priority Issues C-7 C.5 Issues Dropped From Further Consideration C-8 l

! C6 Administrative Generic Letters C-10 C.7 Analytical Support Requests for Data and Information C-14 C.8 Regulatory Guidance C-15 C.9 Regulatory Document Transmitta! Letters C-17 C10 No Record of This Generic Communication Ever Being Issued C-19 List of Tables C.1 Distribution of Non and Low Priority Issues and Letters C-3 I

l l

APPENDIX C ISSUES OF NON OR LOW SAFETY PRIORITY This appendix lists safety issues and generic letters determined to be either non-safety related or of a low safety priority. These issues and letters are categorized by the reason for that determination. The numerical distribution is provided in Table C.I.

Table C.1: Distribution of Non and Low Priority Issues and Letters I Reason for Determination Safety Issues Generic Letters Totals Licensing issues 156 156 Regulatory Issues 17 17 Environmental Issues 15 15 Low Priority Issues 32 32 issues Dropped From Further Consideration 98 98 Administrative Generic Letters 153 153 Analytical Support Requests for Data and Information 16 16 Regulatory Guidance 105 105 Regulatory Document Transmittal Letters 51 51 No Record of This Generic Communication Ever Being Issued 20 20 Totals 318 345 663 C.1 Licensing Issues I.A.2.4 NRR Participation in Inspector Training I.A.3.5 Establish Statement of Understanding with INPO and DOE I.A.4.3 Feasibility Study of Procurement of NRC Training Simulator I IA4.4 I.B.1.3(1)

Feasibility Study of NRC Engineering Computer Require Licensees to Place Plant in Safest Shutdown Cooling Following a Loss of Safety Function Due to Personnel Error Use Existing Enforcement Options to Accomplish Safest Shutdown Cooling I 1.B.I.3(2) 1.B.1.2(3) 1.B.2.1(1)

Use Non-Fiscal Approaches to Accomplish Safest Shutdown Cooling Verify the Adequacy of Management and Procedural Controls and Staff Discipline I.B.2.1(2) Verify that Systems Required to be Operable are Properly Aligned 1.B.2.1(3) Follow-up on Completed Maintenance Work Orders to Assure Proper Testing and Retum to Service C-3

.1 O

I.B.2.1(4) Observe Surveillance Tests to Determine Whether Test Instruments are Properly Calibrated I.B.2.1(5) Verify that Licensees Are Complying with Technical Specifications I.B.2.1(6) Observe Routing Maintenance

!.B.21(7) Inspect Terminal Boards, Panels, and Instrument Racks for Unauthorized Jumpers and Bypasses I.B.2.2 Resident inspector at Operating Reactors I.B.23 Regional Evaluations I.B.2.4 Overview of Licensee Performance I.D.5(5) Dirturbance Analysis Systems I.D.6 Technology Transfer Conference I.E.1 Office for Analysis and Evaluation of Operational Data I.E.2 Program Office Operational Data Evaluation g I.E3 Operational Safety Data Analysis E I.E.4 Coordination of Licensee, Industry, and Regulatory Programs 1.E.5 Nuclear Plant Reliability Data System I.E.6 Reporting Requirements I.E.7 Foreign Sources I.E.8 Human Error Rate Analysis II.B.5(1)

II.B.5(2)

Behavior of Severely Damaged Fuel Behavior of Core Melt B'

3 II.B.5(3) Effect of Hydrogen Burning and Explosions on Containment Structure II.F.5 Classification of Instrumentation, Control and Electrical Equipment II.H.4 Determine Impact of TMI on Socioeconomic and Real Property Values II.J.1.1 Establish a Priority System for Conducting Vendor Inspections H.J.1.2 Modify Existing Vendor Inspection Program II.J.13 Increase Regulatory Control Over Present Non-Licensees H.J.1.4 Assign Resident inspectors to Reactor Vendors and Architect-Engineers II.J.2.1 Reorient Construction Inspection Program  ;

II.J.2.2 Increase Emphasis on Independent Measurement in Construction Inspection Program gl II.J.23 Assign Resident Inspectors to All Construction Sites g, III.C.1(1) Review Publicly Available Documents  !

III.C.1(2) Recommend Publication of AdditionalInformation ,

III.C.1(3) Program of Seminars for News Media Personnel l m.C.2(1) Develop Policy and Procedures for Dealing With Briefing Requests m.C.2(2) Provide Training for Members of the Technical Staff III.D.2.4(2) Place 50 TLDs Around Each Site g III.D.2.6 Independent Radiological Measurements 5 m.D3.2(1) Amend 10 CFR 20 IU.DJ.2(2) Issue a Regulatory Guide a m.D3.2(3) Develop Standard Performance Criteria g m.DS.2(4) Develop Method for Testing and Certifying Air Purifying Respirators m.D3.5(1) Develop Format for Data To Be Collected by Utilities Regarding Total Radiation  ;

Exposure to Workers m.D3.5(2) Investigative Methods of Obtaining Employee Health Data by Nonlegislative Means l Ill.D3.S(3) Revise 10 CFR 20 j IV.A.1 Seek Legislative Authority 3I IV.A.2 IV.B.1 Revise Enforcement Policy Revise Practices for issuance of Instructions and Information to Licensees l ;l IV.D.1 NRC Staff Training IV.E.1 Expand Research on Quantification Safety Decision-Making j IV.E.2 Plan for Early Resolution of Safety issues C-4 4 m

I I IV.E.3 Plan for Resolving Issues at the CP Stage Resolve Generic Issues by Rulemaking IV.E.4 I IV.C.1 IV.G.

IV.G.3 Develop a Public Agenda br Rulemaking Periodic and Systematic Reevaluation of Existing Rules Improve Rulemaking Procedmes IV.G.4 Study Altematives for Improved Rulemaking Process IV.H.1 NRC Participation in the Radiation Policy Council V.A.1 Develop NRC Policy Statement of Safety V.B.1 Study and Recommend, as Appropriate, Ehmmation of Nonsafety Responsibilities I V.C.1 V.C.2 V.C.3 Strengthen the Role of Advisory Committee on Reactor Safeguards Study Need for Additional Advisory Committees Study the Need to Establish an Independent Nuclear Safety Board I V.D.1 V.D.2 V.D3 Improve Public and Intervenor Participation in the Hearing Process Study Construction-During-Adjudication Rules Reexamine Comnussion Role in Adjudication v.D.4 Study the Reform of the Licensing Process I N E.1 V.T.1 V.F.2 Study the Need for TMI-Related Legislation Study NRC Top Management Structure and Process Reexamme Organization and Functions of the NRC Offices I V.F.3 V.F.4 Revise Delegations of Authority to Staff Clarify and Strengthen the Respective Roles of Chairman, Comnussion, and Executive Director for Operations V.F.5 Authonty to Delegate Emergency Response Functions to a Single Commissioner I V.G.1 V.G.2 Achieve Single Location, Long-Term Achieve Single Location, Interim A-19 Digital Computer Protection System I A-20 A-27 B-3 Impacts of the Coal Fuel Cycle Reload Applications Event Categorization I B-7 B-11 B-13 Secondary Accident Consequence Modeling Subcompartment Standard Problems Marviken Test Data Evaluation B-15 CONTEMPT Computer Code Maintenance I B-20 B-21 B-23 Standard Problem Analysis Core Physics LMTBR Fuel B-25 Piping Benchmark Problems B-27 Implementation and Use of Subsection NF B-29 Effectiveness of Ultimate Heat Sinks B-30 Design Basis Floods and Probability B-31 Dam Failure Model B-33 Dose Assessment Methodology B-35 Confirmation of Appendix I Models for Calculations of Releases of Radioactive I B-49 B-62 Materials in Gaseous and Liquid Effluents from Light Water Cooled Power Inservice Inspection Criteria and Corrosion Prevention Criteria for Containments Reexamination of Technical Bases for Establishing SLs, LSSSs, and Reactor Protection I B-72 C-14 System Trip Functions Health Effects and Life Shortening from Uranium and Coal Fuel Cycles Storm Surge Model for Coastal Sites C-15 NUREG Report for Liquid Tank Failure Analysis 67.5.1 Reassessment of Radiological Consequences 67.5.2 Reevaluation of SGTR Design Basis C-5 I

E 67.10.0 Supplemental Tube Inspections 111 Stress Corrosion Cracking of Pressure Boundary Ferritic Steels in Selected Environments 126 Reliability of PWR Main Steam Safety Valves 133 Update Policy Statement on Nuclear Plant Staff Working Hours 136 Storage and Use of Large Quantities of Cryogenic Combustibles On Site 147 Fire-Induced Alternate Shutdown Control Room PanelInteractions 148 Smoke Control and Manual Fire-Fighting Effectiveness HF2.1 Evaluate Industry Training HF2.2 Evaluate INPO Accreditation HF2.3 Revise SRP Section 13.2 HF3.1 Develop Tob Knowledge Catalog HF3.2 Develop License Examination Handbook HF3.5 Develop Computerized Exam System HF4.2 Procedures Generation Package Effectiveness Evaluation HF7.1 Human Error Data Acquisition HF7.2 Human Error Data Storage and Retrieval HF7.3 Reliability Evaluation Speciahst Aids HF7.4 Safety Event Analysis Results Applications CH1.1A Symptom-Based EOPs CH1.1B Procedure Violations CH1.2A Test, Change, and Experiment Review Guidelines CHl.2B NRC Testing Requirements CH1.3A Revise Regulatory Guide 1.47 CH1.4A Engineered Safety Feature Availability CHl.4B Technical Specifications Bases CH1.4C Low Power and Shutdown CH1.5 Operating Staff Attitudes Toward Safety CH1.6A Assessment of NRC Requirements on Management CH1.7A Accident Management g CH2.1A Reactivity Transients l CH2.3B Contamination Outside Control Room CH2.3C Smoke Control CH2.3D Shared Shutdown Systems CH2.4A Firefighting With Radiation Present CH3.1A Containment Performance CH3.2A Filtered Venting g CH4.1 Size of the Emergency Plannmg Zones 3 CH4.2 Medical Services CH4.3A Ingestion Pathway Protective Measures CH4.4A Decontamination CH4.4B Relocation CH5.1A Mechanical Dispersal in Fission Product Release CH5.1B Stripping in Fission Product Release CHS.2A Steam Explosions CH5.3 Combustible Gas CH6.1A The Fort St. Vrain Reactor and the Modular HTGR 3 CH6.1B Structural Graphite Experiments 3 CH6.2 Assessment I

I

I I C.2 Regulatory Issues I A-23 B-50 B-53 Containment Leak Testing Post-Operating Basis Earthquake Inspection Load Break Switch B-59 (N-1) Loop Operation in BWRs and PWRs C-4 Statistical Methods for ECCS Analysis C-5 Decay Heat Update C-6 LOCa Heat Sources 59 Technical Specification Requirements for Plant Shutdown when Equipment for Safe Shutdown is Degraded or Inoperable 108 BWR Suppression Pool Temperature Limits I 112 119.1 119.2 Westinghouse RPS Surveillance Frequencies and Out-of-Service Tunes Piping Rupture Requirements and Decoupling of Seismic and LOCA Loads Piping Damping Values Decoupling the OBE from the SSE I

119.3 119.4 BWR Piping Materials 119.5 Leak Detection Requirements 139 Thmning of Carbon Steel Piping in LWRs 155.2 Establish Licensing Requirements for Non-Operating Facilities C.3 Environmental Issues A-33 NEPA Review of Accident Risks B-1 Environmental Technical Specifications B-2 Forecasting Electricity Demand B-28 Radionuclide/ Sediment Transport Program B-37 Chemical Discharges to Receiving Waters B-38 Reconnaissance Level Investigations I B-39 B-40 B-41 Transmission Lines Effects of Power Plant Entrainment on Plankton Impacts on Fisheries B-42 Socioeconomic EnvironmentalImpacts

.I B-43 B-44 Value of Aerial Photographs for Site Evaluation Forecasts of Generating Costs of Coal and Nuclear Plants B-45 Need for Power - Energy Conservation B-46 Cost of Alternatives in Environmental Design C-16 Assessment of Agricultural Land in Relation to Power Plant Siting and Cooling System Selection C.4 Low Priority Issues I.F.2(1) Assure the Independence of the Organization Performing the Checking Function I.F.2(4) Establish Criteria for Determining QA Requirements for Specific Classes of Equipment LF.2(5) Establish Qualification Requirements for QA and QC Personnel I 1.F.2(7)

I.F.2(8)

Clarify that the QA Program is a Condition of the Construction Permit and Operating License Compare NRC QA Requirements with Those of Other Agencies

!.F.2(10) Clarify Requirements for Maintenance of "As-Built" Documentation -

I I.F.2(11) Define Role of QA in Design and Analysis Activities C-7

.I n

E

=

II.D.2 Research on Relief and Safety Valve Test Requirements II.E.2.3 Uncertainties in Performance Predictions IILD.2.1(1) Evaluate the Feasibility and Perform a Value-Impact Analysis of Modifying l Effluent-Monitoring Design Criteria E IH.D.2.1(2) Study the Feasibility of Requiring the Development of Effective Means for Monitoring and Sampling Noble Gases and Radioiodine Released to the Atmosph III.D.2.1(3) Revise Regulatory Guides A-21 Main Steamline Break Inside Containment - Evaluation of Environmental Conditions for Equipment Qudification A-38 Tornado Missiles D-1 Advisability of a Seismic Scram 35 Degradation of Internal Appurtenances in LWRs 71 Failure of Resin Demineralizer Systems and Their Effects on Nuclear Power Plant Safety 80 Pipe Break Effects on Control Rod Drive Hydraulic Lines in the Drywells of BWR Mark I and II Containments 81 Impact of Locked Doors an Barriers on Plant and Personnel Safety 89 Stiff Pipe Clamps 90 Technical Specifications for Anticipatory Trips 92 Fuel Crumbling During LOCA g 107 Main Transformer Failures 3 122.3 Physical Security System Constraints 125.H.14 Remote Operation of Equipment Which Must Now be Operated Locally 127 Maintenance and Testing of Manual Valves in Safety-Related Systems 138 Deinerting of BWR Containment Upon Discovery of RCS Leakage 144 Scram Without a Turbine / Generator Trip 149 Adequacy of Fire Barriers 152 Design Basis for Valves That Might be Subjected to Significant Blowdown Loads 154 Adequacy of Emergency and Essential Lighting 156.3.6.2 Emergency DC Power l C.5 Issues Dropped From Further Consideration I.A.2.6(6) Nuclear Power Fundamentals II.F.4 Study of Control and Protective Action Design Requirements III.D.1.1(2) Review Information on Provisions for Ixak Detection HI.D.1.1(3) Develop Proposed System Acceptance Criteria j IH.D.1.2 Radioactive Gas Management i IH.D.1.3(1) Decide Whether Licensees Should Perform Studies and Make Modifications IH.D.1.3(2) Review and Revise SRP HLD.1.3(3) Require Licensees to Upgrade Filtration Systems III.D.1.4 Radwaste System Design Features to Aid in Accident Recovery and Decontamination A-14 Flaw Detection A-18 Pipe Rupture Design Criteria l A-22 PWR Main Steamline Break - Core, Reactor Vessel and Containment Building 3

Response

A-37 Turbine Missiles B-8 Locking Out of ECCS Power Operated Valves B-22 LWR Fuel B-47 Inservice Inspection of Supports-Classes 1,2,3, and MC Components  ;

B-65 lodine Spiking B-68 Pump Overspeed During LOCA C-8

I I C-9 RHR Heat Exchanger Tube Failures D-2 Emergency Core Cooling System Capability for Future Plants I 1.

2.

7.

Failures in Air-Monitoring, Air-Cleaning, and Ventilating Systems Failure of Protective Devised on Essential Equipment Failures Due to Flow-Induced Vibrations I 10 13 17 Surveillance and Maintenance to TIP Isolation Valves and Squib Charges Small Break LOCA from Extended Overheating of Pressurizer Heaters Loss of Offsite Power Subsequent to a LOCA 21 Vibration Qualification of Equipment I 30 34 38 Potential Generator Missiles - Generator Rotor Retaining Rings RCS Leak Potential Recirculation System Failure as a Consequence of Ingestion of containment >

j Paint Flakes or Other Fine Debris 3 53 Consequences of a Postulated Flow Blockage Incident in a BWR 55 Failure of Class IE Safety-Related Switchgear Circuit Breakers to Close on Demand 58 Inadvertent Containment Flooding I 63 67.5.3 72 Use of Equipment Not Classified as Essential to Safety in BWR Transient Analysis Secondary System Isolation Control Rod Drive Guide Tube Support Pin Failures I 74 76 85 Reactor Coolant Activity Limits for Operating Reactors Instrumentation and Control Power Interactions Reliability of Vacuum Breakers Connected to Steam Discharge Lines Inside BWR I

Containments 98 CRD Accumulator Check Valve Leakage 100 OTSG Level 104 Reduction of Boron Dilution Requirements I 109 110 117 Reactor Vessel Closure Failure Equipment Protective Devices on Engineered Safety Features Allowable Time for Diverse Simultaneous Equipment Outages I 123 125.L1 Deficiencies in the Regulations Governing DBA and Single-Failure Criteria Suggested by the Davis-Besse Event of June 9,1985 Availability of the Shift Technical Advisor 125.I.2.c Need for Additional Protection Against PORV Failure 125.I.4 Plant-Specific Simulator 125.I.5 Safety Systems Tested in All Conditions Required by DBA 125.I.6 Valve Torque Limit and Bypass Switch Settings 125.L7.a Recover Failed Equipment 125.I.7.b Realistic Hands-On Training 125.L8 Procedures and Staffing for Reporting to NRC Emergency Response Center 125.ILI.a Two-Train AFW Unavailability I 125.ILI.c NURECr0737 Reliability Improvements 125.ILI.d AFW/ Steam and Feedwater Rupture Control System /ICS Interactions in B&W Plants j l

125.IL2 Adequacy of Existing Maintenance Require.nents for Safety-Related Systems I 125.IL3 125.IL4 125.11.5 Review Steam /Feedline Break Mitigation Systems for Single Failure Thermal Stress of OTSG Components

'Ihermal-Hydraulic Effects of Loss and Restoration of Feedwater on Primary System l

I 125.IL6 125.IL8 Components Reexamine PRA Estimates of Core Damage Risk from Loss of All Feedwater Reassess Criteria for Feed-and-Bleed Initiation 125.IL9 Enhanced Feed-and-Bleed Capability 125.IL10 Hierarchy of Impromptu Operator Actions 125.IL11 Recovery of Main Feedwater as Altemative to Auxiliary Feedwater C-9 I

E 125.IL12 Adequacy of Training Regarding PORV Operation 125.11.13 Operator Job Aids 129 Valve Interlocks to Prevent Vessel Drainage During Shutdown Cooling 132 RHR Pumps Inside Containment 137 Refueling Cavity Seal Failure 140 Fission Product Removal Systems g 141 Large-Break LOCA With Consequential SGTR 3 150 Overpressurization of Containment Penetrations 155 3 Improve Design Requirements for Nuclear Facilities 155.4 Improve Criticality Calculations 155.5 More Realistic Severe Reactor Accident Scenario 155.6 Improve Decontamination Regulations 155.7 Improve Deconurussioning Regulations 156.1.1 Settlement of Foundations and Buried Equipment 156.1.2 Dam Integrity and Site Flooding 156.13 Site Hydrology and Ability to Withstand Floods 156.1.4 Industrial Hazards 156.1.5 Tomado Missile 156.1.6 Turbine Missiles 156.2.1 Severe Weather Effects on Structures 156.2.2 Design Codes, C-iteria, and Load Combinations 156.2 3 Containment Design and Inspection 156.2.4 Seismic Design of Structures, Systems, and Components 3 156 3.1.1 Shutdown Systems 5 1563.1.2 Electrical Instrumentation and Control 1563.2 Service and Cooling Water Systems 15633 Ventilation Systems 1563.4 Isolation of High and Low Pressure Systems 1563.6.1 Emergency AC Power 156 3.8 Shared Systems 161 Use of Non-Safety-Related Power Supplies in safety-Related Circuits ,

164 Neutron Fluence in Reactor Vessel C.6 Administrative Generic Letters GL-77-05 Nonconformity of Addresses of Items Directed to the Office of Nuclear Reactor Regulation '

GL-78-01 Correction To Letter Of 12/15/77 GL-78-04 GAO Blanket Clearance For Letter Dated 12/09/77 GL-78-05 Intemal Distribution Of Correspondence - Asking For Comments On Mas Mailirg g, System 3, GL-78-06 Internal Distribution Of Generic Letters - Asking For Comments On Mass Mailing System GL-78-07 Intemal Distribution Of License Amendments - Asking For Comments On Mass Mailing System GL-78-12 Notice Of Meeting Regarding " Implementation of 10 CFR 73.55 Requirements And j Status Of Research..." l GL-78-17 Corrected Letter On Heavy Loads Over Spent Fuel i GL-78-18 Corrected Letter On Heavy Loads Over Spent Fuel GL-78-23 Manpower Requirements For Operating Reactors ,

GL-78-24 Model Appendix I Technical Specifications And Submittal Schedule For BWRs l GL-78-25 Model Appendix I Technical Specifications And Submittal Schedule For PWRs C-10

=

I I GL-78-28 Forwarding pages omitted from 07/11/78 letter GL-78-29 Notice of PWR Steam Generator Conference I GL-78-31 Notice of Steam Generator Conference Agenda GL-78-33 Meeting Schedule And Locations For Upgraded Guard Qualification GL-78-35 Regional Meetings To Discuss Upgraded Guard Qualifications g GL-78-37 Revised Meeting Schedule & Locations For Upgraded Guard Qualifications 3 GL-78-40 Training & Qualification Program Workshops GL-78-42 Training and Qualification Program Workshops GL-79-01 Interservice Procedures For Instructional Systems Development - Tradoc I GL-79-04 Referencing 4/14/78 Letter-Modifications to NRC Guidance " Review and Acceptance Of Spent Fuel Pool Storage And Handling" GL-79-05 Information Relating To Categorization Of Recent Regulatory Guides By The I Regulatory Requirements Review Committee GL-79-16 Meeting RE 1mplementation Of Physical Security Requirements GL-79-19 NRC Staff Review Of Responses To I&E Bulletins 79-06 and 79-06a GL-79-26 Upgraded Standard Technical Specification Bases Program GL-79-31 Submittal Of Copies Of Response To 6/29/79 NRC Request GL-79-35 Regional Meetir.gs To Discuss impacts On Emergency Planning GL-79-44 Referencing 6/29/79 Letter Re Multiple Equipment Failures I GL-79-47 Radiation Training GL-79-50 Emergency Plans Submittal Dates GL-79-64 Suspension Of All Operating Licenses GL-79-68 Audit Of Smau Break LOCA Guidelines I GL-80-23 Change Of Submittal Date For Evaluation Time Estimates GL-80-26 Qualifications Of Reactor Operators GL-80-44 Reorganization Of Functions And Assignments Within ONRR/SSPB I GL-80-52 Five Additional"IMI-2 Related Requirements - Erata Sheets To 5/7/80 Letter GL-80-53 Decay Heat Removal Capability GL-80-59 Transmittal Of Federal Register Notice RE Regional Meetings To Discuss I Environmental Qualification Of Elec. Equipment GL-80-61 TMI-2 Lessons Learned GL-80-67 Scram Discharge Volume GL-80-74 Notice Of Forthcoming Meeting With Representatives Of EPRI To Discuss Program  !

For Resolution Of USI A-12, Fracture Tough GL-80-75 Lessons Leamed Tech Specs GL-80-76 Notice Of Forthcoming Meeting With GE To Discussed Proposed BWR Feedwater Nozzle Leakage Detection System GL-80-80 Preliminary Clarification Of TMI Action Plan Requirements GL-80-81 Preliminary Clarification Of TMI Action Plan Requirements - Addendum To 9/5/80 Letter I GL-80-85 Implementation Of Guidance From USI A-12 " Potential For LOW Fracture Toughness And 1.amellar Tearing On Component Support GL-80-86 Notice Of Meeting To Discuss Final Resolution Of USI A-12 I GL-80-87 Notice Of Meeting To Discuss Status Of EPRI-Proposed Resolution Of The USI A-12 Fracture Toughness issue GL-80-99 Technical Specification Revisions For Snubber Surveillance GL-80-100 Appendix R to 10 CFR 50 Regarding Fire Protection-Federal Register Notice I GL-80-102 Comnussion Memorandum And Order Of May 23,1980 (Referencing IEB 79-01b Supplement 2 - q.2 & 3 - Sept 30,1980)

GL-80-103 Fire Protection - Revised Federal Rer;ister Notice I GL-80-110 Periodic Updating Of FSARS GL-8101 Qualification of Inspection, Examination, Testing and Audit Personnel C-11 I

E

=

GL-8106 Periodic Updating of Final Safety Analysis Reports (FSARS)

GL-81-15 Environmental Qualification of Class 1E Electrical Equipment-Clarification of Staffs Handling of Proprietary Information E GL-81-23 INPO Plant Specific Evaluation Reports 3 GL-81-23A INPO Evaluation Reports GL-81-25 Change in Implementing Schedule For Submission and Evaluation of Upgraded g Emergency Plans g GL-81-27 Privacy and Proprietary Materialin Emergency Plans GL-81-29 Simulator Examinations GL-81-36 Revised Schedule for Completion of TMI Action Plan Item II.D.1, Relief and Safety l Valve Testing 5 GL-82-01 New Applications Survey GL-82-13 Reactor Operator and Senior Reactor Operator Examinations g GL-82-14 Submittal of Documents to the NRC E GL-82-18 Reactor Operator and Senior Reactor Operator Rect. dication Examinations GL-8219 Submittal of Copies of Documentation to NRC-Copy Requirements for Emergency Plans and Physical Security Plans GL-82-30 Filings Related to 10 CFR 50 Production and Utilization Facilities GL-82-38 Meeting to Discuss Developments for Operator Licensing Examinations GL-82-39 Problems With Submittals of Subsequet Information of CURT 73.21 For Licensing g Reviews 3 GL-83-01 Operator Licensing Examinatioa Site Visit GL-83-04 Regional Workshops Regarding Supple nent I to NUREG-0737, Requirements For Emergency Response Capahiny GL-83-06 Certificates and Revised Fonnat For P: actor Operator and Senior Reactor Operator Licenses  :

GL-83-12 1ssuance of NRC FORM 398 - Personal Qualifications Statement - Licensee ll GL-83-12A Issuance of NRC FORM 398 - Personal Qualifications Statement - Licensee 3l GL-83-17 Integrity of Requalification Examinations for Renewal of Reactor Operator and Senior l Reactor Operator Licenses g GL-83-19 New Procedures for Providing Public Notice Concerning issuance of Amendments To E Operating Licenses GL-83-20 Integrated Scheduling for Implementation of Plant Modifications GL-83-21 Clarification of Access Control Procedures for Law Enforcement Visits GL-83-40 Operator Licensing Examination GL-83-43 Reporting Requirements of 10 CFR 50, Sections 50.72 and 50.73, and Standard Technical Specifications 3 GL-83-44 Availability of NUREG-1021," Operator Licensing Examiner Standards" g;'

GL-84-01 NRC Use Of The Terms *Important To Safety" and " Safety Related" GL-84-02 Notice of Meeting Regarding Facility Staffing GL-84-03 Availability of NUREG-0933,"A Prioritization of Generic Safety Issues" ,

GL-84 05 Change to NUREG-1021, " Operator Licensing Examiner Standards" GL-84-06 Operator and Senior Operator License Exammation Criteria For Passing Grade GL-84-08 Interim Procedures for NRC Management of Plant-Specific Backfittinf l GL-84-10 Admmistration of Operating T(sts Prior to Initial Criticality 5 GL-84-17 Annual Meeting to Discuss Recent Developments Regarding Operator Training, Qualifications, and Examinations g GL-84-18 Filing of Applications for Licenses and Amendments g GL-84-19 Availability of Supplement I to NUREG-0933,"A Prioritization of Generic Safety Issues" GL-84-20 Scheduling Guidance for Licensee Submittals of Reloads That Involve Unreviewed Safety Questions C-12 5

I I Gb85-04 Operating Licensing Exammations GL-8547 Implementation of Integrated Schedules for Plant Modifications I GL-85-08 10 CFR 20.408 Termination Reports - Format Gb85-15 Information On Deadlines For 10CFR50.49, "EQ Of Electric Equipment important To Safety At Npps" I Gb85-17 Availability Of Supplements 2 and 3 Yo NUREG-0933, "A Prioritization Of Generic Safety Issues" G b 85-18 Operator Licensing Examinations GL-85-19 Reporting Requirements On Primary Coolant Iodine Spikes I GL-86-03 Applications For License Amendments GL-8641 Policy Statement On Engineering Expertise On Shift GL-86-08 Availability of Supplement 4 to NUREG-0933, "A Prioritization of Generic Safety I GL-86-11 Issues" Distribution of Products Irradiated in Research Reactors GL-86-14 Operator Licensing Examinations Gb86-17 Availability of NUREG-1169, " Technical Findings Related to Generic Issue C-8, BWR MSIC Leakage And Treatment Methods" Gb8701 Public Availability Of The NRC Operator Licensing Examination Question Bank GL-87-04 Temporary Exemption From Provisions Of The FBI Criminal History Rule For I Temporary Workers GL-87-07 Information Transmittal of Final Rulemaking For Revisions To Operator Licensing - 10 CFR55 And Confirming Amendments GL-87-08 Implementation of 10 CFR 73.55 Miscellaneous Amendments and Search Requirements I GL-87-09 Sections 3.0 And 4.0 of Standard Tech Specs on Limiting Conditions For Operation And Surveillance Requirements Gb87-10 Implementation of 10 CFR 73.57, Requirements For FBI Criminal History Checks I GL-87-13 Integrity of Requalification Examinations At Non-Power Reactors GL-87-14 Operator Licensing Examinations GL-87-15 Policy Statement On Deferred Plants I GL-8841 Distribution of Gems Irradiated In Research Reactors GL-88-06 Removal Of Organization Charts From Technical Specification Admuustrative Control Regmrements GL-88-08 Mail Sent or Delivered To The Office Of Nuclear Reactor Regulation I Gb88-09 Pilot Testing of Fundamentals Examination Gb88-13 Operator Licensing Examinations GL-88-18 Plant Recc rd Storage On Optical Disks I Gb88-20 Initiation Of The Individual Plant Examination For Severe Accident Vulnerabilities -

10CFR 50.54 GL-8943 Operator Licensing National Examination Schedule GL-89-05 Pilot Testing Of The Fundamentals Exammation I GL-89-12 Operator Licensing Examination GL-89-17 Planned Admuustrative Changes To The NRC Operator Licensing Written Examination Process I GL-89-22 Potential For increased Roof Loads...Due To Recent Change In Probable Maximum Precipitation Criteria...

GL-89-23 NRC Staff Responses To Questions Pertaining To implementation Of 10 CFR Part 26 l

I Gb90-01 Request for Voluntary Participation in NRC Regulatory Impact Survey GL-9042 Alternative Requirements for Fuel Assemblies in the Design Features Section of Technical Specifications l Gb88-20 Accident Management Stratagies for Consideration in the Individual Plant Examination Process Gb89-10 Results of the Public Workshops C-13 I

E as GL-89-10 Availability of Program Descriptions GL-90-07 Operator Licensing National Examination Schedule Gb90-08 Simulation Facility Exemptions E Gb89-10 Consideration of the Results of NRC-Sponsored Tests of Motor-Operated Valves E GL-91-03 Reporting of Safeguards Events GL-91-04 Changes in Technical Specification Surveillance Intervals to Accommodate a 24-Month a Fuel Cycle I Gb88-20 Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities Gb91-12 Operator Licensing National Examination Schedule $

5 GL-91-14 Emergency Telecommunications GL-91-15 Operating Experience Feedback Report, Solenoid-Operated Valve Problems at U.S.

Reactors 3 GL-91-19 Information to Addressees Regarding New Telephone Numbers for NRC Offices g Located in One White Flint North GL-92-03 Compilation of the Current Licensing Basis: Request for Voluntary Participation in Pilot Program Gb92-05 NRC Workshop on the Systematic Assessment of Licensee Performance (SALP)

Program Gb92-06 Operator Licensing National Examination Schedule g Gb92-07 Office of Nuclear Reactor Regulation Reorganization 3 Gb92-09 Limited Participation By NRC in the IAEA International Nuclear Event Scale GL-93-01 Emergency Response Data System Test Program GL-9342 NRC Public Workshop on Commercial Grade Procurement and Dedication GL-93-05 L;ne-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing During Power Operation >

GL-93-08 Reloaction of Technical Specification Tables Of Instrument Response Time Limits C.7 Analytical Support Requests for Data and Information Gb77-06 Enclosing Questionaire Relating to Steam Generators GL-78-02 Asymmetric Loads Background & Revised Request For AdditionalInformation GL-7843 Request For Information On Cavity Annulus Seal Ring GL-78-15 Request For Information On Control Of Heavy Loads Near Spent Fuel '

GL-78-16 Request For Information On Control Of Heavy Loads Near Spent Fuel Pools GL-79-25 Information Required To Review Corporate Capabilities Gb80-15 Request For Additional Management And Technical Resources Information g GL-80-32 Information Request On Category 1 Masonry Walls Employed By Plants Under CP and E OL Review GL-80-60 Request For Information Regarding Evacuation Times ,

Gb80-65 Request For Estimated Construction Completion And Fuel Load Schedules Gb82-22 Congressional Request for Information Concerning Steam Generator Tube Integrity GL42-25 Integrated IAEA Exercise for Physical Inventory at LWRS GL-33-39 Voluntary Survey of Licensed Operators E Gb89-21 Request For Information Concerning Status Of Implementation of Unresolved Safety 5 Issue (USI) Requirements Gb90-04 Request for Information on the Status of Licensee Implementation of GSIs Resolved g With imposition of Requirements or CAs E GL-91-13 Request for Info Related to the Resolution of GI 130, " Essential Service Water System Failures at Multi-Unit Sites' I

C-14

E r C.8 Regulatory Guidance l

GL-77-02 Fire Protection Functional Responsibilities GL-78-10 Guidance On Radiological Environmental Monitoring GL-78-11 Guidance on Spent Fuel Pool Modifications

' Gie79-06 Contents Of The Offsite Dose Calculation Manual GL-79-08 Amendment to 10 CFR 73.55 Gle79-09 Staff Evaluation Of Interim Multiple-Consecutive Safety-Relief Valve Actuations GL-79-28 Evaluation Of Semi-Scale Small Break Experiment GL-79-34 New Physical Security Plans (FR 43280-285)

GL-79-37 Amendment To 10 CFR 73.55 Deferral From 8/1/79 to 11/1/79 GL-79-40 Follow-up Actions Resulting From The NRC Staff Reviews Regarding 'Ihe TMI-2 Accident GL-79-41 Compliance With 40 CFR 190, EPA Uranium Fuel Cycle Standard GL-79-51 Follow-up Actions Resulting From The NRC Staff Reviews Regarding The TMI-2 . . .

Accident GL-79-52 Radioactive Release At North Anna Unit 1 And Lessons Leamed GL-79-56 Discussion Of Lessons Leamed Short Term Requirements Gb79-60 Discussion Of Lessons Leamed Short Term Requirements GL-79-61 Discussion Of Lessons Learned Short Term Requirements Gb79-70 Environmental Monitoring For Direct Radiation

{ GL-80-02 Quality Assurance Requirements Regarding Diesel Generator Fuel Oil Gb80-30 Clarification Of The Term " Operable" As It Applies To Single Failure Criterion For Safety Systems Required By TS Gb80-34 Clarification Of NRC Requirements For Emergency Response Facilities At Each Site

- GL-80-36 IEB 80-10 Contamination Of Non-Radioactive Svstem And Resulting Potential For Unmonitored, Uncontrolled Release To Envir GL-80-37 Five Additional TMI-2 Related Requirements To Operating Reactors GL-80-38 Summary Of Certain Non-Power Reactor Physical Protection Requirements GL-80-39 IEB 80-11 Masonry Wall Design

~

GL-8045 Fire Protection Rule GL-80-48 Revision To 5/19/80 Letter On Fire Protection

- GL-8049 Nuclear Safeguards Problems Gb80-51 On-Site Storage Of Low-Level Waste '

- GL-80-56 Commission Memorandum And Order On Equipment Qualification

~

GL-80-72 Interim Criteria For Shift Staffing Gb80-73 " Functional Criteria For Emergency Response Facilities", NUREG-0696 GL-80-93 Emergency Preparedness GL-80-109 Guidelines For SEP Soil Structure Interaction Reviews GL-81-02 Analysis, Conclusions and Recommendations Concerning Operator Licensing GL-81-10 Post-TMI Requirements For The Emergency Operations Facility

- GL-81-17 Functional Criteria for Emergency Response Facilities L G t.81 22 Engineering Evaluation of The H.B. Robinson Reactor Coolant System Leak on 1/29/81 GL-81-26 Licensing Requirements for PendinC Construction Permit and Manufacturing License Applications Gb81-38 Storage of Low Level Radioactive Wastes at Power Reactor Sites Gb81-39 NRC Volume Reduction Policy

[ .

GL-82-02 Commission Policy on Overtime Gb82-04 Use of INPO See-in Program GL-82-05 Post-TMI Requirements GL-82-10 Post-TMI Requirements C-15

en GL-82-12 Nuclear Power Plant Staff Working Hours GL-82-16 NUREG-0737 Technical Specifications GL-82-17 Inconsistency of Requirements Between 50.54(T) and 50.15 g GL-82-20 Guidance for Implementing the Standard Review Plan Rule 3 GL-82-21 Fire Protection Audits GL-82-23 Inconsistency Between Requirements of 10CFR 73.40(D) and Standard Tech Specs For Performing Audits of Sadeguards Contin GL-82-32 Draft Steam Generator Report (SAI)

GL-82-33 Supplement I to NUREG-0737 - Emergency Response Capabilities GL-83-02 NUREG-0737 Technical Specifications GL-83-07 The Nuclear Waste Policy Act of 1982 GL-83-13 Clarification of Survell. Req's for HEPA Filters and Charcoal Absorber Units In STD.

Tech Specs on ESF Cleanup Systems GL-83-14 Definition of " Key Maintenance Personnel," (Clarification of Generic Letter 82-12)

GL-83-15 Implement. of Reg. Guide 1.150, " Ultrasonic Testing of RX Vessel Welds During Preservice & Inservice Examinations, REV.1 GL-83-26 Clarification Of Surveillance Requirements For Diesel Fuel impurity Level Tests i

GL-83-27 Surveillance Intervals in Standard Technical Specifications GL-83-30 Deletion of STD. Tech Spec Surveillance Requirement 4.8.1.1.2.d.6 For Diesel Generator l

Testing GL43-32 NRC Staff Recommendations Regarding Operator Action for Reactor Trip and ATWS CL-83-33 NRC Positions on Certain Requirements of Appendix R to 10 CFR 50 GL-83-37 NUREG-0737 Technical Specifications GL-83-42 Clarification to GL 81-07 Regarding Response to NUREG-0612, " Control of Heavy '

Loads at Nuclear Power Plants" GL-84-12 Compliance W 10CFR61 and Implementation of Rad Effluent Tech Specs, Attendant Process Control Program GL44-14 Replacement and Requalification Training Program GL-84-16 Adequacy of On-Shift Operating Experience for Near Tenn Operating License  !

l Applicants GL44-24 Cert of Compt to 10CFR50.49, Eq of Electric Equipment important to Safety for Npps GL45-01 Fire Protection Policy Steering Committee Report GL45-03 Clarification of Equivalent Control Capacity for Standby Liquid Control Systems GL-85-06 Quality Assurance Guidance for ATWS Equipment That Is Not Safety-Related GL-85-14 Commercial Storage At Power Reactor Sites Of Low Level Radioactive Waste Not Generated By The Utility GL-86-10 Implementation of Fire Protection Requirements E GL46-12 Criteria for Unique Purpose Exemption From Conversion From The Use of Heu Fuel 3 GL-86-1$ Info . . Compliance W10CFR50.49 "Eq of Electric Equipment important to Safety For Nuclear Power Plants" GL-87-11 Relaxation in Arbitrary Intermediate Pipe Rupture Requirements GL-88-02 Integrated Safety Assessment Program II (ISAP II)

GL48-07 Modified Enforcement Policy . 10 CFR 50.49, " Environmental Qualification Of Electrical Equipment important To Safety" GL-88-10 Purchase of GSA Approved Security Containers GL48-12 Removal of Fire Protection Requirements From Technical Specification GL48-16 Removal Of Cycle-Specific Parameter Limits From Technical Specifications g GL-88-19 Use Of Deadly Force By Licensee Guards To Prevent Theft Of Special Nuclear g Material GL-S9-01 Implementation Of Programmatic And Procedural Controls for Radiological Effluent Technical Specifications GL-89-02 Actions To Improve The Detection Of Counterfeit And Fraudulently Marketed C-16 I

L_ _ _ . _ _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _

I I Products Gb89-04 Guidance On Developing Acceptable Inservice Testing Programs I GL-89-07 Power Reactor Safeguards Contingency Plannmg For Surface Vehicle Bombs GL-89-07 Fower Reactor Safeguards Contingency Flanmng For Surface Vehicle bombs GL-89-09 ASME Section III Component Replacements I GL-8914 Line-Item Improvements In Technical Specifications - Removal Of 3.25 Limit On Extending Surveillance Intervals GL-89-20 Protected Area Long-Term Housekeeping GL-90-03 Relaxation of Staff Position in Generic Letter 83-28, Item 2.2 Part 2 " Vendor Interface I for Safety-Related Components" GL-90-03 Relaxation of Staff Position in Generic Letter 83-28, Item 2.2 Part 2, " Vendor Interface for Safety-Related Components GL-90-05 Guidance for Performing Temporary Non-Code Repair of ASME Code Class 1,2, and 3 Piping Gb90-09 Alternative Requirements for Snubber Visual Inspection Intervals and Corrective Actions Gb91-01 Removal of the Schedule for the Withdrawal of Reactor Vessel Material Specimens From Technical Specifications GL-91-02 Reporting Mishaps involving LLW Forms Prepared for Disposal I GL-91-05 Licensee Commercial-Grade Procurement and Dedication Programs GL-91-08 Removal of Component Lists From Technical Specifications GL-91-09 Modification of Surveillance Interval .. Electrical Protection Assemblies in Power Supplies .. Reactor Protection System I GL-91-10 Explosives Searches at Protected Area Portals GL-91-16 Licensed Operators' and Other Nuclear Facility Personnel Fitness For Duty Gb91-18 Information . . Regarding Two NRC . . [IPs] On Resolution of Degraded and I Nonconforming Conditions and On Operability GL-90-02 Altemative Requirements for Fuel Assemblies in the Design Features Section of Technical Specifications I GL-93-03 Verification of Plant Records GL-93-07 Modification of the Technical Specification Administrativve Control Requirements For Emergency and Security Plans C.9 Regulatory Document Transmittal Letters GL-77-01 Intrusion Detection Systems Handbook I GL-77-03 Transmittal of NUREG-0321, "A Study of the Nuclear Regulatory Comnussion Quality Assurance Program" GL-77-08 Revised Intrusion Detection Systems Handbook and Entry Control Systems Handbook GL-78-13 Forwarding of NUREG-0219 I Gb78-14 Transmittal Of Draft NUREG-0219 For Comment GL-78-19 Enclosing Sandia Report SAND 77-0777, "Barner Technology Handbook" GL-78-20 Enclosing "A Systematic Approach To lhe Conceptual Design Of Physical Protection I Systems For Nuclear Facilities" Gb78-21 Transmitting NUREG/CR-0181 Concerning Barrier & Penetration Data Needed For Physical Security System Assessment i

l GL-78-22 Revision To Intrusion Detection Systems And Entry Control Handbooks And Nuclear I Safeguards Technology Handbook GL-78-27 Forwarding of NUREG-0181 GL-78-30 Forwarding of NUREG-0219 GL-78-38 Forwarding Of 2 Tables Of Appendix I, Draft Radiological Effluent Technical Specifications, PWR, and NUREG-0133 C-17 I

.E GL-79-92 Transmitting Rev. To Entry Control Systems Handbook (SAND 77-1033)& Intrusion Detection Handbook (sand 76-0554),& Barrier Pen GL-79 03 Offsite Dose Calculation Manual l Gb79-10 Transmitting Regulatory Guide 2.6 For Comment 5 GL-79-11 Transmitting " Summary of Operating Experience With Recalculating Steam Generators, January 1979" NUREG-0523 GL-79-14 Pipe Crack Study Group - Enclosing NUREG-0531 & Notice GL-79-15 Steam Generators-Enclosing Summary Of Operating Experience With Recirculating Steam Generators, NUREG-0523 GL-79-21 Enclosing NUREG/CR 0660," Enhancement Of On Site Emergency Diesel Generator Reliability" Gb79-29 Transmitting NUREG-0473, Revision 2, Draft Radiological Effluent Technical Specifications g GL-79-30 Transmitting NUREG-0472, Revision 2, Draft Radiological Technical Specifications l Gb79-32 Transmitting NUREG-0578, "TMI-2 Lessons Learned" Gb79-33 Transmitting NUREG-0576 - Security Training And Qualification Plans GL-79-39 Transmitting Division 5 Draft Regulatory Guide & Value Impact Statement GL-79-45 Transmittal Of Reports Regarding Foreign Reactor Operating Experiences GL-79-65 Radiological Environmental Monitoring Program Requirements - Enclosing Branch Technical Position, Revision 1 GL-80-01 NUREG-0630 " Cladding, Swelling And Rupture - Models For LOCA Analysis" GL-80-10 1ssuance Of NUREG-0588," Interim Staff Position On Equipment Qualifications Of Safety-Related Electrical Equipment GL-80-11 IEB 80-03 Loss Of Charcoal From Standard Type II,2 Inch, Tray Absorber Cells GL-80-22 Transmittal Of NUREG-0654 " Criteria For Preparation And Evaluation Of Radiological Emergency Response Plans And Prepared GL-80-24 Transmittal Of Information On NRC " Nuclear Data Link Specifications" GL-80-40 Transmittal Of NUREG-0654 " Report Of ne B&O Task Force"And Appropriate NUREG-0626 " Generic Eval Of FW Transient And Sbl GL-8047 Further Commission Guidance For Power Reactor Operating Licenses NUREG-0660 g And NUREG-0694 g Gb80-90 Post nil Requirements, NUREG-0737 GL-80-106 Report On ECCS Cladding Models, NUREG-0630 Gb81-05 Information Regarding The Program For Environmental Qualification Of Safety-Related Electrical Equipment Gb82-07 Transmittal of NUREG-0909 Relative to the Ginna Tube Rupture Gb82-08 Transmittal of NUREG-0909 Relative to the Ginna Tube Rupture g Gb82-11 Transmittal of NUREG-0916 Relative to the Rcstart of R.E. Ginna Nuclear Power Plant 3 Gb82-25 NUREG-0744, REV.1 - Pressure Vessel Material Fracture Tcughness Gb83-16 Transmittal of NUREG-0977 Relative to the ATWS Events at Salem Generating Station, Unit NO.1 GL-83-16A Trawnittal of NUREG-0977 Relative to the ATWS Events at Salem Generating Station, Unit NO.1 GL-83-38 NUPIG-0965, "NRC Inventory of Dams" l GL-85-11 Comoletion of Phase II of " Control Of Heavy Loads At Nuclear Power Plants" 2 NUPIG-0612 GL-85-13 Transmittal Of NUREG-1154 Regarding The Davis-Besse Loss Of Main And Auxiliary Feedwater Event GL-86 07 TransmittrJ of NUREG-1190 Regarding The San Onofre Unit I Loss of Power And Wate- Hammer Event Gb87-16 Traramittal of NUREG-1262, " Answers To Questions On implementation Of 10 CFR 55 On Operators' Licenses" C-18 t

=;

I I GL-89-13 Service Water System Problems Affecting Safety-Related Equipment GL-88-20 Completion of Containment Performance Improvement Program and Forwarding of I CL-89-01 Insights for Use in the IPE for SAV NUREG-1301 and 2 "Offsite Dose Calculation Manual Guiduce: Standard Radiological Effluent Controls for PWRs and BWRs" I GL-87-02 Transmits SSER No. 2 on SQUG Generic Implementation Procedure, Revision 2, as Corrected February 14,1992 (GIP-2)

C.10 No Record of This Generic Communication Ever Being issued GL-79-59 (No Title)

GL-80-07 Information Regarding The Program For Environmental Qualification Of I Safety-Related Electrical Equipment GL-8131 Small Break LOCA Confirmatory Integral Systems Experiments for B&W Designed Plants GL-81-33 Technical Specification for Station Batteries Multiplant Action I GL-82-06 RTD Response Time Determination GL-82-15 Nuclear Plant Staff Working Hours GL-82-29 NUREG/CR-2980 I GL-82-31 NUREG-0737 Technical Specifications GL-82-34 SECY 82-111 Modification of Vacuum Breakers & Mark I Containments GL-82-35 (No Title)

GL-82-36 Assignment of Authority to Regions for Nonpower Reactors Amendments and I Licensing Activities GL-82-37 NUREG-0737 Tech Specs GL-83-03 Regulatory Guide 1.150, " Ultrasonic Testing of Reactor Vessel Welds During I Pre-Service and Inservice Examinations" GL-83-10 (No Title)

GL-83-25 Issuance of NRC Form 398 Personnal Qualifications Statement - Licensee I GL-83-29 (No Title)

GL-83-34 Important to Safety GL-84-22 10 CFR 20.408 Termination Reports - I ormat GL-85-21 (No Title)

I GL-92-01 Reactor Vessel Structural Integrity I

I I

I I

C-19 I

il lI lI lI APPENDIX D SAFEIY ISSUE AND GENERIC LETTER INDEX ,

l 1 I

!I I

I I

I I

I l I

I I

I I

I I APPENDIX D SAFEIY ISSUE AND GENERIC LETTER INDEX I This appendix list all of NUREG-0933 safety issues in the order found in the document and all of the NRR Generic Letters by date along with their database indicators which rpecify their assigned applicability rating and subject classification. The indicator follows the identification of each issue / letter. Each indicator consists of a numerical digit from 0 to 6 and a alphabetic letter. The numerical digit indicates the applicability rating and the letter indicated the subject classification.

The applicability ratings are:

0 Non or Low Safety 1 Duplicate Coverage 2 Not-Applicable to CANDU 3 I 3 4

5 Sited or Operated Design Standardized Design Conceptual Design 6 Unique Considerations Subject Classifications for applicability ratings of 3,4,5, or 6:

a Reactor b Heat Transport Systems I d f

g Containment Quality Assurance Balance of Plant I i j

k Seismic Safety Analysis and Emergency Operating Procedures Systems and Reliability Engineering and Risk Assessment 1 Radiation Protection n Instrumentation and Control o Site and Surrounding Area r Personnel and Operations Subject classification for applicability rating of 2:

a BWR Technology b Particular PWR Vendor e Component / Process / Analysis Not Included in CANDU 3 Design I d e

f TMI-2 issued to Operating Plant Without Apparent Adaptability Applies to Regulatory Staff or NRC Research I g h

i Applies to Specific Manufacturer or Model of Component Applies to Specific Plant Not Directly Associated With Nuclear Power I

I I .

E e

Subject Classification for applicability rating of 1:

a NUREG-0933 Issue Designated by NRC as Covered by Another Issue g b Issue Covered by Another Issue as It Applies to CANDU 3 3 e Generic Letter Covered by NUREG-0933 Issue Generic I.etter Covered by Another Generic Letter d

I Subject Classification for applicability rating of 0:

a Licensing Issue b Regulatory issue g c Environmental Issue g' d Low Priority Issue e Dropped from Further Consideration f Administrative Generic Letter g Analytical Support Requests for Data and Information h Regulatory Guidance i Regulatory Document Transmittal Letters j No Record of This Generic Communication Ever Being Issued I

I' I

I I

I I

I I

I

I I 2 1 1.A.I.1 1.A.1.2 3r 3r 53 54 I.B.2.3 1.B.2.4 Oa Da I 4 5

3 1.A.13 I.A.1.4 I.A.2.1(1) 3r 3r 3r 55 56 57 I.C.1(1)

I.C.1(2)

!.C.1(3) 6j 6j 6j 3r 58 I.C.1(4) 6j I

6 I.A.2.1(2) 7 I.A.2.1(3) 3r 59  !.C.2 3r 8 I.A.2.2 3r 60 I.C.3 3r 9 1.A.23 3r 61 I.C.4 3r 10 1.A.2.4 Da 62 I.C.5 3r 11 1.A.2.5 3r 63  !.C.6 3r 12 1.A.2.6(1) 2f 64 I.C.7 3r 13 I.A.2.6(2) 2f 65 I.C.8 3r 14 I.A.2.6(3) la 66 I.C.9 3r 15 I.A.2.6(4) 2f 67 1.D.1 6n 16 1.A.2.6(5) 2f 68 1.D.2 Sn I 17 18 19 I.A.2.6(6) 1.A.2.7 1.A.3.1 Oc 2f 2f 69 70 71 I.DJ I.D 4 I.D.5(1)

Sn 2f 4n I 20 21 22 I.A3.2 I.A3.3 1.A3.4 2f 3r 3r 72 73 74 I.D.5(2) 1.D.5(3) 1.D.5(4) 4n 4n 2f 23 1.A3.5 Da 75 I.D.5(5) Da I 24 25 I.A.4.1(1)

I.A.4.1(2) 2f 2f 2f 76 77 78 I.D.6 I.E.1 I.E.2 Da Da Oa 26 I.A.4.2(1) 27 I.A.4.2(2) 2f 79 I.E3 Da l l  !

l 2S I.A.4.2(3) 2f 80 I.E.4 Da 29 1.A.4.2(4) 3r 81 1.E.5 Da 82 I 30 I.A.4.3 Da 1.E.6 Da 31 I.A.4.4 Da 83 1.E.7 Oa 32  !.B.I.1(1) 2f 84 1.E.8 Da 33 I.B.1.1(2) 2f 85 1.F.1 2f 34 I.B.I.1(3) 2f 86 1.F.2(1) Od I

35 1.B.I.1(4) 2f 87 I.F.2(2) 4f 36 1.B.I.1(5) 2f 88 I.F.2(3) 4f 37 1.B.1.1(6) la 89 I.F.2(4) Od l l la

'E 38 1.B.1.1(7) 90 I.F.2(5) Od 2e 39 I.B.1.2(1) 2f 91 I.F.2(6) 40 I.B.1.2(2) 2f 92 1.F.2(7) Od I 41 42 I.B.1.2(3)

I.B.13(1) 2f Da 93 94 95 1.F.2(8) 1.F.2(9)

Od 4f Od 43 1.B.13(2) Da I.F.2(10)

I 44 45 46 I.B.13(3)

I.B.2.1(1) 1.B.2.1(2)

Da Da Da 96 97 98 I.F.2(11) 1.G.1 I.G.2 Od 3r 3r 99 II.A.1 2f I 47 I.B.2.1(3) Da 48 I.B.2.1(4) Da 100 II.A.2 la 49 1.B.2.1(5) Da 101 II.B.1 Sb 50 I.B.2.1(6) Da 102 II.B.2 5d I 51 52 1.B.2.1(7)

I.B.2.2 Da Da 103 104 II.B3 II.B.4 41 3r D-5 I

I 105 II.B.5(1) Ca 157 II.J3.1 la I

106 II.B.5(2) Da 158 II.J3.2 la 107 II.B.5(3) Da 159 II.J.4.1 2f 108 II.B.6 2f 160 II.K.1(1) la 109 II.B.7 la 161 II.K.1(2) la 110 II.B.8 2f 162 II.K.1(3) la g 111 II.C.1 2f 163 II.K.1(4) la 3 112 II.C.2 4k 164 II.K.1(5) la j 113 II.C3 la 165 II.K.1(6) la i 114 II.C.4 3r 166 II.K.1(7) la 115 II.D.1 4b 167 !!.K.1(8) la )

116 II.D.2 Od 168 II.K.1(9) la 117 II.D3 (n 169 170 II.K.1(10) la la l3 5

lip II.E.1.1 4k II.K.1(11) 119 II.E.1.2 4k 171 II.K.1(12) la 120 II.E.13 2f 172 II.K.1(13) 2e g 121 II.E.2.1 la 173 II.K.1(14) la la 5

122 II.E.2.2 2f 174 II.K.1(15) 123 II.E.23 Od 175 !!.K.1(16) la 124 II.EJ.1 4k 176 II.K.1(17) 2b 125 II.E3.2 la 177 II.K.1(18) 2b 126 II.E33 la 178 II.K.1(19) 2b 127 II.E3.4 2f 179 II.K.1(20) 2b g 128 II.E3.5 la 180 II.K1(21) 2b 3 129 II.E.4.1 4d 181 II.K.1(22) 2b 130 II.E.4.2 4k 182 II.K.1(23) 2b g la 131 132

!!.E.43 5d 2e 183 184 II.K1(24)

II.K1(25) la 5

II.E.4.4(1) 133 II.E.4.4(2) 2e 185 II.K.1(26) la 134 II.E.4.4(3) 2e 186 II.K.1(27) la 135 II.E.4.4(4) 5d 187 II.K.1(28) la 136 II.E.4.4(5) 2f 188 II.K2(1) 2b 137 II.E.5.1 2b 169 II.K.2(2) 2b g 138 II.E.5.2 2b 190 II.K.2(3) 2b E 139 II.E.6.1 2f 191 II.K.2(4) 2b 140 II.F.1 4n 192 II.K.2(5) 2b 141 II.F.2 6n 193 II.K.2(6) 2b l 2b =

142 II.F3 2f 194 II.K.2(7) 143 II.F.4 Oe 195 II.K.2(8) la l 144 !!.F.5 Oa 196 II.K.2(9) 2b g 145 II.G.1 4k 197 II.K.2(10) 2b 3 146 II.H.1 2d 198 II.K.2(11) 2b 147 II.H2 2d 199 II.K.2(12) la 148 II.H.3 la 200 II.K.2(13) 2b 149 II.H.4 Oa 201 II.K.2(14) 2b 150 II.J.1.1 Oa 202 II.K.2(15) 2b 151 II.J.1.2 Oa 203 II.K.2(16) 2b l 152 II.J.13 Da 204 II.K2(17) 2b 5 153 II.J.1.4 Oa 205 II.K.2(18) la 154 II.J.2.1 Da 206 II.K.2(19) 2b g 155 II.J.2.2 Oa 207 208 II.K.2(20) 2b 2b 5

156 II J.23 Da II.K.2(21)

D-6 l

,I l

il 209 210 IIK3(1)

II.K3(2) 5b 4b 261 262 II.K3(53)

II.K.3(54) la la 211 II.K3(3) 3r 263 IIK3(55) la ll

a 264 IIK3(56) la 212 II.K3(4) la 213 II.K3(5) 6n 265 II.K.3(57) 2a lg 214 H K 3(6) la 266 III.A.I.1(1) 3o g 215 II.K3(7) 4k 267 IH.A.I.1(2) 3o 216 II.K3(8) la 268 III.A.I.2(1) Sn 217 II.K3(9) 2b 269 III.A.I.2(2) Sn ll W

218 219 II.K3(10)

II.K3(11) 2b 2g 270 271 III.A.1.2(3)

III.A.I.3(1) 3o 3o l

220 II.K.3(12) 2b 272 III.A.13(2) 3o .

l 2f I 221 II.K3(13) 2a 273 III.A.2.1(1) 222 11.K3(14) 2a 274 Ill.A.2.1(2) 3o j 223 IIK3(15) 2a 275 Hl.A.2.1(3) 2f 1 224 IIK3(16) 2a 276 III.A.2.1(4) 2f 225 II.K3(17) 2a 277 III.A.2.2 2f l 2f

! 226 II.K3(18) 2a 278 III.A3.1(1) I 227 II K.3(19) 2a 279 III.A3.1(2) 2f lg l 228  !!.K3(20) 2h 280 III.A3.1(3) 2f 3 229 IIK3(21) 2a 281 III.A.3.1(4) 2f 230 II.K.3(22) 2a 282 III.A.3.1(5) 2f

<g 231 II.K3(23) la 283 III.A3.2 2f 2f g 232 II.K3(24) 2a 284 III.A33(1) 2f i

233 11K3(25) Sk 285 III.A33(2) 234 II.K3(26) la 286 III.A3.4 2f I 235 236 237 II.K3(27)

II.K3(28)

II.K.3(29) 2a 2a 2a 287 288 289 III.A3.5 III.A3.6(1)

III.A3.6(2) 2f 2f 2f tg 238 II.K3(30) 6j 290 III.A3.6(3) 2f IH.B.1 2f 3 239 240 II.K3(31) 6j la 291 292 III.B.2(1) 2f II.K.3(32) 241 II.K3(33) la 293 IH.B.2(2) 2f i 242 IIK3(34) la 294 III.C.1(1) Da l 243 IIK3(35) la 295 III.C.1(2) Oa l 244 IIK3(36) la 296 III.C.1(3) Da jI 245 246 247 II.KJ(37)

H.K3(38)

IIK3(39) la la la 297 298 299 III.C.2(1)

III.C.2(2)

ID.D.I.1(1)

Da Da 2f l

248 11K3(40) la 300 III.D.I.1(2) De I 249 250 II.K3(41)

IIK3(42) la la la 301 302 303 ID.D.1.1(3)

Ill.D.I.2 III.D.13(1)

De De De 251 IIK3(43)

I 252 253 254 IIK3(44) 11K3(45)

IIK3(46) 2a 2a 2a 304 305 306 III.D.13(2)

IH.D.13(3)

III.D.13(4)

Oe De 2f la 307 III.D.1.4 De I 255 256 257 II.K3(47)

II.K3(48)

II.K3(49) la Ia 308 309 IH.D.2.1(1)

III.D.2.1(2)

Od Od i 258 11.K3(50) la 310 III.D.2.1(3) Od l

, 259 II.K3(51) la 311 IH.D.2.2(1) 2f l 260 la 312 III.D.2.2(2) la j H K 3(52) k D-7 I

e

E e

313 III.D.2.2(3) la 365 V.F.3 Da 314 III.D.22(4) la 366 V.F.4 Oa 315 III.D.23(1) 3o 367 V.F.5 Da 316 IH.D.23(2) 3o 368 V.G.1 Da 317 III.D.2.3(3) So 369 V.G.2 Oa 318 III.D.23(4) So 370 A-1 6b g 319 III.D.2.4(1) 2f 371 A-2 4b g 320 IH.D.2.4(2) Oa 372 A-3 4b 321 III.D.25 2f 373 A-4 2b 322 III.D.2.6 Oa 374 A-5 2b ,

323 III.D3.1 41 375 A-6 2a 324 III.D3.2(1) Da 376 A-7 2a 325 III.D.3.2(2) Da 377 A-8 2a g 326 III.D.32(3) Da 378 A-9 6j g 327 III.D3.2(4) Da 379 A-10 2b 328 III.DJ3(1) 2e 380 A-11 2c 329 IH.D.33(2) 2f 381 A-12 4b 330 III.D.33(3) 2f 382 A 13 4b 331 III.D33(4) 2f 383 A-14 Oe 332 III.D.3.4 Sn 384 A 15 4b E

333 III.D3.5(1) Da 385 A-16 2a 3 334 III.D3.5(2) Da 386 A-17 4k 335 III.D.3.5(3) Da 387 A-18 Oe a 336 IV.A.1 Oa 388 A-19 Da g 337 IV.A.2 Oa 389 A-20 Da 338 IV.B.1 Oa 390 A-21 Od 339 IV.C.1 2f 391 A-22 Oe l

340 IV.D.1 Da 392 A-23 Ob a 341 IV.E.1 Oa 393 A-24 Sk 342 IV.E.2 Da 394 A-25 Sk 343 IV.E3 Da 395 A-26 4b 344 IV.E.4 Da 396 A-27 Da 345 IV.E.5 2f 397 A-28 2f 346 IV.F.1 2f 398 A-29 Sg l 347 IV.F.2 2f 399 A-30 la e 348 IV.G.1 Da 400 A-31 5k 349 IV.G.2 Oa 401 A-32 la g 350 IV.G3 Oa 402 A-33 Oc 3 351 IV.G.4 Oa 403 A-34 la 352 IV.H.1 Da 404 A-35 3o 353 V.A.1 Oa 405 A-36 5g 354 V.B.1 Da 406 A-37 Oe 355 V.C.1 Da 407 A-38 Od 356 V.C.2 Oa 408 A-39 2a l 357 V.C3 Da 409 A-40 6i 5 358 V.D.1 Da 410 A-41 6i 359 V.D.2 Da 411 A-42 2a g 360 361 V.D.3 V.D.4 Da Da 412 413 A-43 A-44 Sk Sk 5

362 V.E.1 Da 414 A-45 Sk 363 V.F.1 Da 415 A-46 Si l 364 V.F.2 Oa 416 A-47 4n W D-8 I

=

I

' I 417 418 A-48 A-49 6d Sb 469 470 B-51 B-52 la la I 419 420 421 B-1 B-2 B-3 Oc Oc Da 471 472 473 EL53 B-54 B-55 Ob 2c 2a B4 la 474 B-56 4k I

422 423 B-5 4d 475 B-57 la 424 B-6 la 476 B-58 4k 425 B-7 Oa 477 B-59 Ob I 426 427 428 B-8 B-9 B-10 Oe 4d 2a 478 479 480 B-60 B-61 B-62 4b 4k Oa I 429 B-11 Oa 481 B-63 lb' 430 B-12 5d 482 B-64 3r 431 B-13 Da 483 B-65 De 432 B-14 la 484 B-66 4n 433 B-15 Da 485 B-67 la 434 B-16 la 486 B-68 Oe 435 B-17 4k 487 B-69 la 436 B-18 la 488 B-70 3o ll 489 B-71 la 5 437 B-19 2a 438 B-20 Oa 490 B-72 Oa 491 B-73 la I

439 B-21 Oa 440 B-22 Oe 492 C-1 4n 441 B-23 Oa 493 C-2 2c 442 B-24 la 494 C-3 la I 443 444 445 B-25 B-26 B-27 Da 4d Oa 495 496 497 C4 C-5 C-6 Ob Ob Ob 498 C-7 4b I 446 B-28 Oc 447 B-29 Da 499 C-8 2a 448 B-30 Oa 500 C-9 Oe 449 B-31 Oa 501 C-10 2c I 450 451 452 B-32 B-33 B-34 la Oa la 502 503 504 C-11 C-12 C-13 4k 4b la I 453 454 455 B-35 B-36 B-37 Da 2f Oc 505 506 507 C-14 C-15 C-16 Oa Oa Oc 456 B-38 Oc 508 C-17 2f I 457 458 B-39 B-40 Oc Oc 509 510 511 D-1 D-2 D-3 Od De Sa 459 B41 Oc I 460 461 462 B42 B-43 B44 Oc Oc Oc 512 513 514 1.

2.

3.

De De 4n 463 B-45 Oc 515 4. 3r 464 B46 Oc 516 5. la 465 B47 Oe 517 6. 2a 466 B-48 2a 518 7. De I 467 468 B-49 B-50 Oa Ob 519 520 8.

9.

la la D-9 I

E' a'

521 10. De 573 62. la 522 11. la 574 63. De 523 12. 2a 575 64. 4n E 524 13 De 576 65. la 5 525 14. 6b 577 66. 5b 526 15. 4b 578 67.2.1 la g 527 16. la 579 67.3.1 la g 528 17. De 580 67.3.2 la 529 18. la 581 67.3.3 4n 530 19. la 582 67.3.4 la l W

531 20. 4n 583 67.4.1 la 532 21. De 584 67.4.2 la 533 22. Sa 585 67.4.3 la 3 534 23. 5k 586 67.5.1 Oa 3i 535 24. 5k 587 67.5.2 Da 536 25. 2a 588 67.5.3 Oe 537 26. la 589 67.6.0 la 538 27. la 590 67.7.0 la 539 28. la 591 67.8.0 la 540 29, 4b 592 67.9.0 la E 541 30. De 593 67.10.0 Oa 5<

542 31. la 594 68. la 543 32. la 595 69. 2b E 544 545 33.

34.

la De 596 597 70.

71.

4k Od 5'

546 35. Od 598 72. De 547 36. 5k 599 73. 2b 548 37. la 600 74. De 549 38. De 601 75. 3r 550 39. la 602 76. De 3 551 40. 2a 603 77. la 5 552 41. 2a 604 78. 4b 553 42. la 605 79. 4b 554 43. 4k 606 80. Od 555 44. la 607 81. Od 556 45. 4n 608 82. 6g ,

557 46. la 609 83. 4k g1 558 47. 5k 610 84. 2b 5l 559 48. la 611 85. De 560 49. la 612 86. 2a g 613 87. 2e 561 50. 2a

88. So E

562 51. 3o 614 563 52, la 615 89. Od l

564 53. De 616 90. Od 565 54. la 617 91. 2g I 566 55. De 618 92. Od )

567 56. la 619 93. 4k g!

568 57. 4k 620 94. 4b g!

569 58. De 621 95. 2c I 570 59. Ob 622 96. la 571 572 60.

61.

la 2a 623 624 97.

98.

la De ll

=

l D-10 ,

s,

= 1

I I 625 626 99.

100.

2b De 677 678 125.114 125.II.5 Oe Oe I 627 628 629 101.

102.

103.

2a 3r So 679 680 681 125.II.6 125.II.7 125.11.8 Oe 4k Oe

^

630 104. De 682 125.11.9 Oc 631 105. 5k 683 125.11.10 De 632 106. 4g 684 125.II.11 Oe f

1 633 107. Od 685 125.II.12 Oe 634 108. Ob 686 125.11.13 Oe 635 109. De 687 125.II.14 Od l 636 110. De 688 126. Da

~

637 111. Da 689 127. Od 638 112. Ob 690 128. 4k

~

639 113. 2f 691 129. De p 640 114. la 692 130. 5k j 641 115. 2b 693 131. Ib L 642 116. 6j 694 132. De

( 643 117. De 695 133. Da

[ 644 118. 4d 696 134. 2f 645 119.1 Ob 697 135. 4b 646 119.2 Ob 698 136. Da 647 119.3 Ob 699 137. De 648 119.4 Ob 700 138. Od j 649 119.5 Ob 701 139. Ob L 650 120. 4k 702 140. De 651 121. 6d 703 141. De b 652 122.1.a la 704 142. 4n 653 122.1.b la 705 143. 5k

^

654 122.1.c la 706 144. Od i 655 122.2 Sk 707 145. 3r I

656 122.3 Od 708 146. 4g 657 123. De 709 147. Da

]

i

~

658 659 660 124.

125.I.1 125.I.2.a 5k De la 710 711 712 148.

149.

150.

Da Od De 661 125.I.2.b la 713 151. 2a 662 125.I.2.c Oe 714 152. Od 663 125.I.2.d la 715 153. 5k 664 125.1.3 2e 716 154. Od 665 125.I.4 Oe 717 155.1 2f 666 125.I.5 De 718 155.2 Ob L 667 125.1.6 De 719 155.3 Oe l 558 125.I.7.a De 720 155.4 Oe a 669 125.I.7.b De 721 155.5 Oe 670 125.I.8 Oe 722 155.6 De

~

671 125.II.1.a Oe 723 155.7 Oe 672 125.II.1.b la 724 156.1.1 Oe

[ 673 125.II.1.c Oe 725 156.1.2 Oe L, 674 125.II.1.d Oe 726 156.1.3 Oe 675 125.11.2 Oe 727 156.1.4 Oe 676 125.11.3 Oe 728 156.1.5 Oe D-11 E

1 E!

729 156.1.6 Oe 781 HF7.2 Oa Il j 730 156.2.1 De 782 HF73 Da l 731 156.2.2 De 783 HF7.4 Oa l 732 156.23 Oe 784 HF8 3r 5 733 156.2.4 De 785 CH1.1A Oa l 734 1563.1.1 Oe 786 CH1.1B Oa g' 735 1563.1.2 Oe 787 CH1.2A Oa g 736 1563.2 Oe 788 CH1.2B Oa 737 15633 Oe 789 CH1.3A Oa 738 156.3.4 Oe 790 CH1.4A Oa l B

739 1563.5 la 791 CH1.4B Oa 740 1563.6.1 Oe 792 CH1.4C Oa 74 1 1563.6.2 Od 793 CH1.5 Oa g 742 156 3.8 Oe 794 CH1.6A Oa l 743 156.4.1 la 795 CH1.7A Oa 744 156.4.2 la 796 CH2.1A Oa 745 156.6.1 4k 797 CH2.2 la 746 157 6d 798 CH23A la 747 158 4k 799 CH23B Oa 748 159 4k 800 CH23C Oa l 749 160 4n 801 CH23D Oa 5 750 161 Oe 802 CH2.4A Oa 751 162 4g 803 CH3.1A Oa g 752 163 5b 804 CH3.2A Oa g 753 164 De 805 CH4.1 Oa 754 165 4k 8% CH4.2 Oa 755 166 lb 807 CH43A Oa l

756 167 4g 808 CH4.4A Oa e 757 168 lb 809 CH4.4B Oa 758 HF1.1 2f 810 CH5.1A Da g 759 HF1.2 2f 811 CH5.1B Oa 3 760 HF1.3 2f 812 CH5.2A Oa 761 HF2.1 Da 813 CH53 Da 762 HF2.2 Oa 814 CH6.1A Oa 763 HF2.3 Da 815 CH6.1B Oa 764 HF3.1 Oa 816 CH6.2 Da 765 HF3.2 Oa 1 GL-77-01 Oi g 766 HF33 la 2 GL-77-02 Oh 3 767 HF3.4 la 3 GL-77-03 Oi 768 HF3.5 Da 4 GL-77-04 2i g 769 HF4.1 3r 5 6

GL-77-05 GL-77-%

Of 5

770 HF4.2 Da Og 771 HF43 la 7 GL-77-07 Ic 772 HF4.4 2f 8 GL-77-08 Oi l.

a 773 HF4.5 la 9 GL-78-01 Of 774 HF5.1 4n 10 GL-78-02 Og 775 HF5.2 2f 11 GL-78-03 Og g 776 HF53 la 12 GL-78-04 Of 5 777 HF5.4 la 13 GL-78-05 Of 778 HF6.1 la 14 GL-78-06 Of 779 HF6.2 la 15 CL-78-07 Of l

=

780 HF7.1 Da 16 GL-78-08 2a D-12 I

m

il 17 GL-78-09 2a 69 70 GL-79-19 GL-79-20 Of le 18 GL-78-10 Oh ll

e 19 20 GL-78-11 GL-78-12 Oh Of 71 72 CL-79-21 GL-79-22 Oi 2b 21 GL-78-13 Oi 73 GL-79-23 2a lg 22 GL-78-14 Oi 74 GL-79-24 Id lg 23 GL-78-15 Og 75 GL-79-25 Og 24 GL-78-16 Og 76 GL-79-26 Of l 25 GL-78-17 Of 77 GL-79-27 2a l

26 GL-78-18 Of 78 GL-79-28 Oh 27 GL-78-19 Oi 79 GL-79-29 Oi 28 GL-78-20 Oi 80 GL-79-30 Oi

!g 29 GL-78-21 Oi 81 GL-79-31 Of GL-79-32 l3 30 GL-78-22 GL-78-23 Oi Of 82 83 GL-79-33 Oi Oi

! 31 l 32 GL-78-24 Of 84 GL-79-34 Oh 33 GL-78-25 Of 85 GL-79-35 Of l

! 34 Gb78-26 2b 86 GL-79-36 4k 35 GL-78-27 Di 87 GL-79-37 Oh ll

5 36 37 GL-78-28 GL-78-29 Of Of 88 89 GL-79-3S GL-79-39 2a Oi l 38 GL-78-30 Oi 90 GL-79-40 Oh lg 39 GL-78-31 Of 91 GL-79-41 Oh lg 40 GL-78-32 2a 92 GL-79-42 Ic l 41 Gb78-33 Of 93 Gb79-43 2c 42 Gb78-34 2b 94 GL-79-44 Of 43 Gb78-35 Of 95 GL-79-45 Oi lI 44 45 GL-78-36 GL-78-37 2i Of 96 97 GL-79-46 GL-79-47 Ic Of 46 GL-78-38 Oi 98 GL-79-48 2a iI 47 48 GL-78-39 GL-78-40 2a Of 99 100 GL-79-49 Gb79-50 2b Of 49 GL-78-41 2a 101 GL-79-51 Oh I 50 51 52 GL-78-42 GL-7941 GL-79-02 Of Of Oi 102 103 104 GL-79-52 Gb79-53 GL-79-54 Oh Ic Ic I 53 54 55 GL-79-03 GL-79-04 GL-79-05 Oi Of Of 105 106 107 GL-79-55 GL-79-56 GL-79-57 2c Oh 2a 56 GL-79-06 Oh 108 Gb79-58 6j I 57 58 GL-79-07 GL-79-08 6i Oh 109 110 GL-79-59 GL-79-60 GL-79-61 Oj Oh Oh 59 Gb79-09 Oh 111 I 60 61 62 GL-79-10 GL-79-11 GL-79-12 Oi Oi 2a 112 113

?14 GL-79-62 GL-79-63 GL-79-64 Id Id Of I 63 GL-79-13 2a 115 GL-79-65 Oi 64 GL-79-14 Oi 116 GL-79-66 Id 65 GL-79-15 Oi 117 GL-79-67 Id 66 GL-79-16 Of 118 Gb79-68 Of Id

[I 67 68 GL-79-17 GL-79-18 Ic 2b 119 120 GL-79-69 GL-79-70 Oh D-13 I

E

=

121 GL-80-01 Oi 173 GL-80-53 Of 122 GL-80-02 Oh 174 GL-80-54 2a 123 GL-80-03 2a 2a 175 176 GL-80-55 GL-80-56 3r Oh E'

3 124 GL-80-04 125 GL-80-05 1c 177 GL-80-57 Oi 126 GL-80-06 2a 178 GL-80-58 2g g 127 GL-80-07 Oj 179 GL-80-59 Of g 128 GL-80-08 2g 180 GL-80-60 Og 129 GL-80-09 2i 181 GL-80-61 Of 130 GL-80-10 Di 182 GL-80-62 2a l 131 GL-80-11 Oi 183 GL-80-63 2a 5 132 GL-80-12 6j 184 Gb80-64 2a 133 GL-80-13 Ic 185 GL-80-65 Og g 134 GL-80-14 Ic 186 GL-80-66 2a g 135 GL-80-15 Og 187 Gb80-67 Of 136 GL-80-16 Ic 188 GL-80-68 2a 137 GL-80-17 2a 189 GL-80-69 2b l 190 GL-80-70 2a =

138 GL-80-18 2b 139 GL-80-19 2c 191 GL-80-71 2b 140 GL-80-20 2b 192 GL-80-72 Oh B

141 GL-80-21 2c 193 GL-80-73 Oh 3 142 GL-80-22 Oi 194 GL-80-74 Of 143 GL-80-23 Of 195 GL-80-75 Of g 144 Gb80-24 Oi 196 GL-80-76 Of g 145 GL-80-25 4n 197 GL-80-77 2b 146 Gb80-26 Of 198 GL-80-78 2a 147 GL-80-27 2a 199 GL-80-79 2a 148 GL-80-28 3r 200 GL-80-80 Of 149 Gb80-29 2a 201 Gb80-81 Of 150 GL-80-30 Oh 202 GL-80-82 Ic g 151 GL-80-31 2g 203 Gb80-83 le g 152 GL-80-32 Og 204 GL-80-84 2a 153 GL-80-33 2b 205 Gb80-85 Of 154 GL-80-34 Oh 206 GL-80-86 Of 155 GL-80-35 4k 207 GL-80-87 Of 156 GL-80-36 Oh 203 GL-80-88 Si 157 GL-80-37 Oh 209 GL-80-89 Ic g 158 GL-80-38 Oh 210 GL-80-90 Oi g 159 GL-80-39 Oh 211 GL-80-91 2a 160 GL-80-40 Oi 212 GL-80-92 2g a 213 Gb80-93 Oh 161 162 Gb80-41 GL-80-42 2a Id 214 GL-80-94 3o 5

163 Gb80-43 2c 215 GL-80-95 2a 164 GL-80-44 Of 216 GL-80-96 Sg 165 GL-80-45 Oh 217 GL-80-97 2g 166 GL-80-46 Ic 218 GL-80-98 4d 167 GL-80-47 le 219 GL-80-99 Of g 168 GL-80-48 Oh 220 GL-80-100 Of g 169 GL-80-49 Oh 221 GL-80-101 3r 170 GL-80-50 2a 222 GL-80-102 Of 171 GL-80-51 Oh 223 GL-80-103 Of 172 GL-80-52 Of 224 GL-80-104 Ic D-14

I 225 226 GL-80-105 GL-80-106 le Oi 277 278 GL-82-03 GL-82-04 2c Oh 227 Gb80-107 2a 279 GL-82-05 Oh

-I 228 Gb80-108 Id 280 GL-82-06 GL-82-07 Oj 229 GL-80-109 Oh 281 01 GL-80-110 Of 282 GL-82-08 01 I

230 231 GL-80-111 2a 283 GL-82-09 Ic 232 GL-80-112 2g 284 GL-82-10 Oh 233 Gb80-113 Ic 285 Gb82-11 Oi I' 234 235 236 Gb81-01 Gb81-02 GL-81-03 Of Oh 2a 286 287 288 GL-82-12 GL-82-13 GL-82-14 Oh Of Of Ic 289 GL-82-15 I Gb81-(M 237 Oj 238 Gb81-05 Oi 290 GL-82-16 Oh 239 GL-81-06 Of 291 GL-82-17 Oh 240 Gb81-07 Ic 292 GL-82-18 Of I 241 242 243 Gb81-08 Gb81-09 GL-81-10 2a 2a Oh 293 294 295 GL-82-19 GL-82-20 GL-82-21 Of Oh Oh I 244 245 246 GL-81-11 GL-81-12 GL-81-13 2a Id 2a 296 297 298 GL-82-22 GL-82-23 GL-82-24 Og Oh 2a 247 GL-81-14 Ic 299 Gb82-25 Og I 248 249 Gb81-15 Gb81-16 Gb81-17 Of 1c Oh 300 301 302 Gb82-26 Gb82-27 Gb82-28 Oi 2a 6n 250 I 251 252 253 Gb81-18 GL-81-19 GL-81-20 2a Ic 2a 303 304 305 GL-82-29 GL-82-30 GL-82 31 Oj Of Oj 2c 306 GL-82-32 Oh I

254 GL-81-21 255 Gb8122 Oh 307 GL-82-33 Oh 256 Gb81-23 Of 308 GL-82-34 Oj 257 GL-81-23A Of 309 Gb82-33 Oj 258 Gb81-24 2a 310 GL-82-36 Oj 259 GL-81-25 Of 311 GL-82-37 Oj 260 GL-81-26 Oh 312 GL-82-38 Of 261 GL-81-27 Of 313 GL-82-39 Of I- 262 Gb81-28 le 314 315 GL-83-01 GL-83-02 Of Oh 263 GL-81-29 Of 264 GL-81-30 2a 316 GL-83-03 Oj I 265 266 GL 81-31 Gb81-32 GL-81-33 Oj 2a 317 318 319 Gb83-04 GL-83-05 GL-83-06 Of 2a Of 267 Oj I 268 269 270 GL-81-34 GL-81-35 Gb81-36 2a 2a Of 320 321 322 GL-83-07 GL-83-08 GL-83-09 Oh 2a 2b Gb81-37 2a 323 Gb83-10 Oj I

271 272 GL-81-38 Oh 324 GL-83-10A Ic 273 GL-81-39 Oh 325 Gb83-10B Ic 274 GL-81-40 1c 326 GL-83-10C Ic I 275 276 GL-82-01 GL-82-02 Of Oh 327 328 GL-83-10D Gb83-10E Ic Ic D-15 I

E O

329 GL-83-10F Ic 381 GL-84-16 Oh 330 GL-83-11 6j 382 GL-84-17 Of 331 GL-83-12 Of 383 GL-84-18 Of g 332 Gb83-12A Of 384 Gb84-19 Of g, 333 GL-83-13 Oh 385 GL-84-20 Of 334 GL-83-14 Oh 386 GL-84-21 Sa 335 GL-83-15 Oh 387 Gb84 22 Oj 336 GL-83-16 Di 388 GL-84-23 2a 337 GL-83-16A Oi 389 Gb84-24 Oh 338 GL-83-17 Of 390 Gb85-01 Oh 339 GL-83-18 2a 391 GL-85-02 Ic 340 GL-83-19 Of 392 GL-85-03 Oh 341 Gb83-20 Of 393 GL-85-04 Of g 342 GL-83-21 Of 394 GL-85-05 Ic g 343 Gb83-22 2b 395 Gb85-06 Oh 344 GL-83-23 2b 396 GUS5-07 Of 345 GL-83-24 Ic 397 GL-85-08 Of 346 GL-83-25 Oj 398 GL-85-09 2b 347 GL-83-26 Oh 399 GL-85-10 2b 348 GL-83-27 Oh 400 GL-85-11 Oi g 349 Gb83-28 Ic 401 GL-85-12 Ic 3 350 GL-83-29 Oj 402 GL-85-13 Oi 351 Gb83-30 Oh 403 Gb85-14 Oh 352 GL-83-31 2b 404 Gb85-15 Of 353 GL-83-32 Oh 405 GL-85-16 2b 354 Gb83-33 Oh 406 GL-85-17 Of 355 Gb83-34 Oj 407 GL-85-18 Of l

356 GL-83-35 le 408 GL-85-19 Of a 357 GL-83-36 2a 409 GL-85-20 2b 358 GL-83-37 Oh 410 GL-85-21 Oj g 359 GL-83-38 Oi 411 GL-85-22 Ic g 360 GL-83-39 Og 412 GL-86-01 2a 361 Gb83-40 Of 413 Gb86-02 Ic 362 GL-83-41 Ic 414 GL-86-03 Of 363 GL-83-42 Oh 415 GL-86-04 Of 364 GL-83-43 Of 416 GL-86-05 2b 365 GL-83-44 Of 417 GL-86-06 2b 366 GL-84-01 Of 418 GL-86-07 Oi 367 GL-84-02 Of 419 GL-86-08 Of 368 GL-84-03 Of 420 GL-86-09 Ic 369 GL-84-04 2b 421 GL-8640 Oh 370 Gb84-05 Of 422 GU86-11 Of 371 GL-84-06 Of 423 GUS6-12 Oh 372 GL-84-07 2a 424 GL-86-13 2b 373 GL-84-08 Of 425 GL-86-14 Of 374 GL-84-09 2c 426 GL-86-15 Oh 375 GL-84-10 Of 427 GL-86-16 Id g 376 GL-84-11 2a 428 GL-86-17 Of g 377 GL-84-12 Oh 429 Gb87-01 Of 378 GL-84-13 Ic 430 GL-87-02 Ic 379 GL-84-14 Oh 431 Gb87-03 Ic 380 GL-84-15 Ic 432 GL-87-04 Of D-16 s

a

433 GL-87-05 2a 485 GL-89-19 Ic 434 GL-87-06 Ic 486 GL-89-20 Oh ,

435 GL-87-07 Of 487 GL-89-21 Og 436 Gb87-08 Of 488 GL-89-22 Of 437 GL-87-09 Of 489 GL-89-23 Of 438 Gb87-10 Of 490 GL-90-01 Of 3 439 GL-87-11 Oh 491 Gb90-02 Of 440 Gb87-12 Ic 492 GL-90-03 Oh 441 GL-87-13 Of 493 GL-88-20 Of 442 GL-87-14 Of 494 GL-89-13 Oi 443 GL-87-15 Of 495 GL-90-04 Og 444 GL-87-16 Oi 496 GL-90-03 Oh 497 GL-89-10 I

445 Gb88-01 2a Of 446 Gb88-02 Oh 498 GL-90-05 Oh 447 GL-88-03 Ic 499 Gb90-06 Ic 448 GL-88-04 Of 500 Gb88-20 01 I 449 450 451 GL-88-05 GL-88-06 GL-88-07 4b Of Oh 501 502 503 GL-89-10 GL-90-07 GL-90-08 Of Of Of I 452 453 454 GL-88-08 GL-88-09 GL-88-10 Of Of Oh 504 505 5%

GL-89-10 Gb90-09 GL-91-01 Of Oh Oh 455 GL-88-11 1c 507 Gb91-02 Oh 456 GL-88-12 Oh 508 GL-91-03 Of 457 GL-88-13 Cf 509 GL-91-04 Of 458 CL-88-14 Ic 510 Gb91-05 Oh I 459 460 461 GL-88-15 GL-88-16 GL-88-17 4f Oh Ic 511 512 513 GL-91-06 GL-91-07 Gb91-08 Ic Ic Oh 514 Gb91-09 Oh I

462 GL-88-18 Of 463 GL-88-19 Oh 515 GL-88-20 Of 464 GL-88-20 4k 516 Gb91-10 Oh 465 GL-88-20 Of 517 GL-91-11 Ic I 466 467 468 GL-89-O' GL-89-02 GL-89-03 Oh Oh Of 518 519 520 GL-89-01 GL-91-12 Gb91-13 Oi Of Og I GL-91-14 469 GL-89-04 Oh 521 Of 470 GL-89-05 Of 522 GL-91-15 Of 471 Gb89-06 Ic 523 Gb91-16 Oh 472 GL-89-07 Oh 524 GL-91-17 le 473 GL-89-07 Oh 525 GL-91-18 Oh 474 GL-89-08 Ic 526 Gb91-19 Of 475 Gb89-09 Oh 527 GL-88-01 2a 476 GL-89-10 Ic 528 GL-89-10 2a 477 GL-89-11 2a 529 GL-92-01 Oj 478 GL-89-12 Of 530 GL-92-02 1c 479 GL-89-13 Ic 531 GL-92-01 1c I 480 481 GL-89-14 GL-89-15 Oh 3r 532 533 GL-92-03 GL-87-02 GL-90-02 Of Oi Oh 482 GL-89-16 2a 534 I 483 484 GL-89-17 GL-89-18 Of Ic 535 536 GL-92-04 GL-92-05 2a Of D-17 I

E

=

537 GL-92-06 Of 538 GL-83-28 Id 539 GL-92-07 Of 540 GL-92-08 4g 541 GL-92-09 Of 542 GL-93-01 Of 543 GL-93-02 Of 544 GL-93-CM 2b 545 GL-89-10 2g 546 GL-93-05 Of 547 GL-93-03 Oh i 548 GL-93-06 Ic 549 GL-93-07 Oh  ;

550 GL-93-08 Of I:

1 I

I I

I I

I I

D-18

4 a "'

4 - --. - m. --

I >

i I

i APPENDIX E NRC SAFETY PRIORITY RANKING DESIGNATIONS i

1 1

I i

I

~

I ,

3 I

I I

l

)

h L

1

I APPENDIX E NRC SAFETY PRIORITY RANKING DESIGNATIONS The NRC safety priority rankmgs used in NUREG-0933 are provided in Table E.1 for reader I~ convenience.

i Table E.1: NRC Safety Priority Ranking Ranking Description I NOTE 1 Possible Resolution Identified for Evaluation NOTE 2 Documented Resolution Available NOTE 3a Resolution Resulted in Establidunent of New Regulatory Requirements NOTE 3b Resolution Did Not Result in New Regulatory Requirements I NOTE 4 Issue to be Prioritized in the Future NOTE 5 Not a Generic Safety issue but Resources Assigned for Completion I HIGH High Safety Priority MEDIUM Medium Safety Priority LOW Low Safety Priority DROP Issue Dropped as a Generic Issue I Resolved TMI Action Item with Implementation of Resolution Mandated by NUREG-0737 LI Licensing Issue El Environmental Issue RI Regulatory Issue S Issue Covered in an NRC Program Outside the Scope of NUREG-0933 I l I

I e.3 g

I