ML20128F246

From kanterella
Jump to navigation Jump to search
Provides Rept W/Annotations Re Facility.Concludes That Facility Can Be Operated W/O Endangering Health & Safety of Public Flooding Potential at Site Due to Probable Max Hurricane & Inservice Insp Program
ML20128F246
Person / Time
Site: Millstone Dominion icon.png
Issue date: 11/24/1969
From:
US ATOMIC ENERGY COMMISSION (AEC)
To:
Advisory Committee on Reactor Safeguards
Shared Package
ML20125A422 List:
References
FOIA-92-198 NUDOCS 9212080290
Download: ML20128F246 (103)
v • d • e


Text

i ~ .c s .n - s. -. sydG4Yi&hWh?' $ *1A:4E t O * * ?~ ~?*~ ?M?~'~~M~* , : .w. : :6 :a

\ .' ,

  • ., j

.0FFICHAL USE ONLY-  ;

Docket No. 50-245 Novetsber 24, 1969

. % ~~

w/ , .)wdv ^ ' of 'A l

&jdy [ ,_

/w A

  • WM(.p s )' , / 2 -
  1. 4 '

Report to CRB g gud. #

,$,s.au.,.,}on[.w&,d..jh%

,f 1 * &ta,sh wsatf+4*4 N Ysg.. .

. . i ,

MILLSTONE

~

. ty ,p e ' ortif* .s t - 1 PO W , i

'4;M' $ % * *Y'gfj ,

,, y ep . ' &qA . . !AL o$ v 04L N t'*C$*

4 ,g w, z u,).< <l40% Awami i

'

  • i,'$'

Y, 4, /

'l

,fg titAV- .% 3 .* i l' -

AW Commit see W SW v am V <

,, J j g j 4 ,44j f ~ 4.*

_ y- Ago r _), s 4. gf.*59 ft:!y ,' - 4 ~,' ., +

< fg- ( '

d4 l, I f.*Jy

  • Abu 1 f ,

u 000f ?~ CPSf ' .g.y ? . h ' j,'f A'MJ93 *.-

s, .

N01 / Ls y -

NQM Y ns_ __,/ g) . )g, I tELW y j

'*l* U' W _

w. u.U nu aham . . s!, .3~ .u f(l

)/ ~ g *>

Q h W,,j fa tk idd'u nf<p ).- Yf al M' W l '

Sys .d.u at: : .... c d d E -

Y y.hault le s l lAh oj Ah l' ' '*/ [*" ^ " ' ' ~

,i,o e.a%J.vd n, uak O w w tf M 11 .,

,c3- CIn ?? weA W%b .

{ ?, , . -

Af ~ kNil4A4A<*J <?- Y '

.[

f.13 - U.S.J'A N f(/> N$ ') bf:'"'

Atomic Energy Commission ._ f /AfP Y ,'

p

Division of Beactor Licensing // p.li 4'it st/i 'ttt'

' ' P

  • ~

.f

- s. . , .

9212000290 920611 G,i~

~

/,

PDR FOIA. dAf- /

LAWRENC92-198 iPDR- - -.

AAMk t I OFFHCHAL USE ONLL ABSTRACT The results of our safety evaluation of the Hillstone Nuclear Pwer Station, Unit 1, are presented in this report. At the request of the applicant, the present evaluation is based on the design power level of 2011 Hwt and includes all applicable matters related to plant design features and proposed operation includin6 accident analyses.

In many respects Millstone is identical to Dresden Unita 2 and 3, and therefore the results of the Dresden reviev vere used for a comprative evaluation of the Millstone facility. The design features which differ were evaluated h detail. These included full load rejection capability, the feedvater coolant hi6h pressure injectico system, the gas-turbine generator, the containment heat removal capacity, and the dual-purpose Terget Rxk safety / relief valves. The Technical Specifications will be structured to be consistent with those of Dresden Unit 2 with due consideration for unique Millstone safety features.

We conclude that the Hillstone Plant can be operated without endangering the health and safety of the public. Issuance of the provisional operating license vill require ccxcpletion of plant construction as confirmed by the Division of Compliance. This is enticipated to be around June 1970.

OFFHC!AL~USE~ONLP

. =: :.: zu = xw.-.c:z:. = . 'm. . :w ~ . .: -  :. .:.t:= x :n n?bx!:i.~:::.f'. .i t.

AFFHCHAL-USE ONLY,  ;

i TABLE OF COWENTS i B.st

1.0 INTRODUCTION

AND SUWARY 1 ,

2.0 BACKGROUND

k 2.1 0eneret 4 2.2 Recent Changes 9 i 30 SITE AND ENVIRONMENT 10 31 Site Description 10 .

32 Meteorology- 11 I

^

3 3 Hydrology and Flooding '12

'T 3.4 Geology and Seiamology 15-35 Environmental Considerations 15 l

4 '. 0 REACTOR CORE DESIGN lo 50 RfACTOR COOLANT SYSfEM 18 51 ceneral 18 52 Vibration Testing 19 5 3 Safety and Relief Valves 20 54 Inservice Inspection 24 l 55 Main Steam Piping 25 5.6 Primary System Leak Detection -26 ,

5 7 Conclusions 27 ,

6.0- CONTAINMENT SYSTEMS _ 28 6.1 General Structural- Design ' 28 6.2 Design Basis- Accident 30-6.3 Containment Hechanical Design 30 .

l i.

L 1-

-OFFHCHAL7USE-ONLY u

. + . , . , , . . . , - . . , . . . - . . . . ,~ - - _ - -

. , . , . . , , _ . a m,a.;,w w a., 6 w %o w,,%v a. u 1:3&f%..::n z e z .:; ~. .;.;; & y g..

4 enTW W

-OFFHCHAL USE ,ONLY 6.4 Inerting 6.5 M Radiolytic Hydrogen Control 31 66

6.8 33 Conclusions

7. 0 33 EMERGENCY CORE COOLING SYSTEM 7.1 34 Ceneral 1 7.2 35 Subsystem Description
7. 3 35 Integrated ECCS Operation
7. 4 35 Conclusion 7.5 38 Containment Cooling 8.0 39 INSTRUMENTATION, CONTROL AND A 8.1 39 General #

8.2 UXILIARY ELECTRIC MS PWER SYS kh j.

Full Load Rejection Featur es kk i

8. 3 Feedwater Coolant Injectio l 8.4 k5 8.5 BWR Instrumentation Generi n System (FWCI)k0 Installation CriteriaReactor Protection System 50

&c Problem l.

8.6

8. 7 Auxiliary ElectricstemsPower Sy Engineered 59 Safety l s

F 9.0 Environmental Testing  !

61 '

AUXILIARY SYSTEMS '

9.1 66 General 9.2 68 '

Service Water System 9.3 68

  • I (TBCCW and TBSCW) Turbine hailuing Cooling er Systems 68 Wat 9.4 Spent Fuel Storage Pool 69

'9.5 Liquid Radwaste System 71 T3 11 "Q(({,11h U

, "*"*~. ~

. t GFMCHAL USE.ONLY__

tus 10.0 STEAM-TO-POWER CONVERSION SYSTEM 74 10.1 General 74 10.2 Full Load Rejection Capability 74 11.0 ACCIDENT ANALYSES 78 I 12.0 CONDUCT OF OPERATIONS 80 12.1 Organization 80 12.2 Startup Organization 81 12.3 Training 82 12.4 Plant Staff Qualifications 83 12.5 Preoperational and Startup Tests 83 12.6 Operating Procedures 84 12.7 Review and Audit 84 12.8 Emergency Preparedness 87 12.9 Industrial Security 89 13.0 QUALITY ASSURANCE 91 14.0 TECHNICAL SPECIFICATIONS 92 15.0 ACRS MATTERS 92 16.0 CONFORMANCE TO GENERAL DESIGN CRITERIA 94

17.0 CONCLUSION

94 iii COFFHCHAL USE ONLY -

- . ,- -- .ps,.. -

m--,-y ---s- a:--, - - - --

.,.. .. , . - i. . e. , r ~ ww . . .u , , ,22 . ..

n 1 QEEHGAL-USE ONLY ,

f.ist of Tables

?.ag 2.1 Major Differences Between Dresden, Monticello 5 and Millstone Facilities 2.2 List of knendments 7 7.5 Effects of Containment Heat Removal 41 Capacity on Containment _

11.0 Potential Offsite Detes 79 B

iv 1FFHCHAL USE ONLT'

- nn+ . .

n m s v ua w ew tub u- t - c', <

. ~  ::::.s : L.. m Y '" '

l' OFFHQAL-USE-ONLY 4

1.0 INTRODUCTION

AND

SUMMARY

This report to the Ceaunittee contains the results of our safety evaluation regarding the request by the Connecticut Light and Power Ccapany, Hartford Electric Light Ccareny, Western Massachusetts Electric Compny and Millstone Point Company for a provisions 1-operating license for Unit 1 of the Millstone Nuclear Power Station (Millst one) . Following Dresden Unit 2, the Millstone Unit 1 is the next large GE.BWR plant utilizing , jet pumps and augmented emergency core cooling to be considered fcr a provisicraal operating license (POL).

The construction permit review of therest and hydraulic design aspects was based on an initial power level of 1727 Hwt; subsequently, GE-l introduced its new critical heat flux correlation which provides the basis for considering operation of Unit 1 at the design power level of 2011 Mvt. As requested by the applicant, our review of the overall plant performance including the capability of the-engineered safety i

features and the radiological consequences of accidents is based on a i power level- of 2011 Mwt, 'which will be- the licensed power level.

The Millstone _ application for construction was submitted after the Dresden 2 application but before the time of the Dresden 3 applica.

tion. Consequently, in many respects Millstone is identien t to Dresden and we have used the results of our Dresden evaluation as a foundation for the Millstone reviev. The Millstone applicant has l

followed the results of the Dresden review and has voluntarily  :

incorporated a number of applicable design changes including, for -

-GFRGAL USE ONLT'

_ .~ .. a:.ca n ~ .:: . : .x . . . . , --- .-- - ;

1

  • I j

.DFFHCHAb USE-ONLY l

example, the AC-interlock in the auto-relief system, the sealing of l the corner rooms in the reactor building at the lowest elevation and the provision of flow-biased flux scram. The design' features which are different frca Dresden were evaluated in detail; these features ine*uded full load rejection capability and associated 100%. --

bypara valves, high pressure coolant injection capability provided by the feedvater system, and associated emergency power supplied by a gas-turbine generator, and the dual-purpose Tsraet Rock safety-relief va lve s .

We have also evaluated the facility design with respect to the ACRS concerna characterized as the "a-p" items. In addition, statements in the Committee's letters following its prior review of Unit 1 and applicable asterisked items identtiied in other ACRB reports were considered in our review.

Feview of the final aspects of construction, including special nondestructive testing of components in the pressure boundary, operator licensing examinations and review of plant procedures are being under.

taken by the Division of Compliance and by our Reactor; Operations group.

Satisfactory resolution of all matters vill be required before a provi-sional operating license is insura.

We are continu.ng our review of the Technical Specifications for Millstone and a reasonably final draft will be provided to the Committee f its information prior to the December ACRS meeting.

l L OFFHCHAL'USE ONLY ~

l

'~ ~ *.  :.. .;;. z:: : : * : .. L G:Lu:.nA';

, i QFFHCHAL USE ONLY-3 On the basis of our review, we conclude that, fo11 wing deyepg of a final set of Techni_ cal Spe,g[f{,pations, satisfactory coropletion

~

of requisite constructico and preoperational tests, and a favorable report fran the Committee, we vill be prepared to izotice our intent to issue a POL to the applicants for Hillstone Fuelear Pwer Station.

We underatend that fuel loading for the Millstone plau+, is scheduled for June 1970.

1 OFFHCHAL USE ONLY^

c- . " ;n,

-, . .a. .w. . . = -. ,

, H w;&nwiw.&&:wxyu%%.. - = gag,myzz

. r- '

.30FMGAErUSEGEY 4

2.0 BACKCP.00ND 2.1 General nie Millstone Unit 1, Monticello, and Dresden Units 2 and 3 f acilities are the initial large BWR units involving internal jet pumps to be i

placed into operation. These units are similar in design features and have been supplied by General Electric Company under turnkey contracts to the respective applicants. The nuclear steam supply systems of these plants were designed and manufactured by GE with Ebasco as the A&E at Millstone under contract to GE.

%e principal architectural features and physical arrangement of various systems of the Millstone facility are similar to those of Dresden 2/3.

The significant differences between these plants are summarized in Table 2.1 and discussed in appropriate sections of this report.

one principal difference listed in the table regarding containment cooling capability reflects a reduction in heat exchanger espacity to approximately one-half that indicated in the construction permit appli-cation. This change directly affects the overall capability of the emergency cooling systems and is evaluated in Section 7.3.2 of this report.

Table 2.2 lists the information sources provided as amendments to the application for a facility license.

._OFFHCHAL USE ONLY-

- s 5

I TABLE 2.1 '

MAJOR DIFFERENCES BET'JEEN DRESDEN, MONTICELLO A'iD MILLSTONE FACILITIES -

Item Dresden 2/3 Monticello Millstone Reactor ^ Power Level (Mwt) 2527 1670 2011 bq Reactor Operating 1000 1000 1035 bti :T q Pressure - psig

%j .

_g__3 -- -,

t==s d

tG b TJ i'

Reactor Vessel Fabricated by B&W using k Construction Electroslag Weld Process Field-fabricated by Chicago Bridge Fabricated by Coebustion Engineering usinc Con- I' f and Iron Company ventional Methods ,',, T c

D 'C -

Safety and Relief 8 spring-loaded N Valves - Number and 5 electromatic 4 spring-loaded 4 Target Rock 2 spring loaded 3 Target Rock dual-

[

g Type dual purpose purpose safety / relief Q

<l 2 --

safety / relief M

4

,' i !

t & gi

!!l Full Load Rejection and NO NO TES i  ;~,

/

l Retain Station Load

I Capability "

fE Turbine Bypass Capacity 40% of rated steam 15% of rated steam N flow 105% of rated steam flow (y flov Onsite Emergency Power 2 diesel-generators 2 diesel-genera- 1 diesel-generator 1

(1 is shared)' tors 1 gas-turbine-generator l

t i Table 2.1 (cont'd) 1 4

Item Dresden 2/3 Monticello Millstone High Pressure Coolant I steam-turbine-driven- 1 steam-turbine- Class I feedwater train Injection Capability pu=p -

driven-pu=p including condensate tank, condensate, booster, and feedvater pu=ps :I j +l i!

s 57 x 10 6 40 x 10 6 I

Containnent Cooling Ex 102 x 10 6 '.

! h Capacity - each loop h Cij .(BTU /hr)  % .I ciji .

= s, 4 em b Rear-t r Core Isolation 1 isolation condenser 1 steam-turbine- 1 isolation condenser ' '

- Coo.ing System- driven-pump f a P Reactor Building Reinforced Poured Con- Reinforced Poured Reinforced Poured Concrete

{

g Construction crete to Refueling Floor Concrete to Walls to Roof g and Steel Wall Panels to Refueling Floor g Roof and Steel Vall

'Q Panels to Roof lE z

P- F q: 64 y ,

a 1,

Ii 8

n.. .= ,a .... .. ~. , _w% .

.T -mJ w. J; .:'MrA. ' b4. 25 %. M_r.** o "~*~%-**'*~~*

l,,u "..*w_t ow + w

  • s
  • w__..._...._'m.._.. -

m ,__ .. a .., _

p7101 A?nZW ON!;T' 1

I Alil C .'. J 1,ljST fl,F, APil:N,0Ql:N;lji

'll i.l.STi t*:1.ITNIT 1 Amendment No. Ila t e lice ' d Subject

'i 1/1h/0H Anplication for operatinc license including Vols. 1, 11 nad III of the PSAR.

6 S/6/68 Appendix B of the PSAR, entitled "l'reoperational and Startup Tests."

7 h / ."i / 6h Corpor.sie and financial informatlon.

tl 4 /10 / t.H ( l ) llev i a4ed pm,ex l'o r FSAll, and ( 2 )

Appendix C of Ihe FNAH, "10 CrIierla Comparinon."

9 II/4/hH "An%er 4 to ouestions - I!esponse to Al:C-lett"r dated .fuly 17, 196H "

10 12/6/68 Proposed Technical Specifications.

11 1/29/64 Appervlix F to PSAR, " Quality Assuranco Report."

12 3/4/69 Revised parcs for FSAR.

13 3/13/64 Appendix D, " Containment Report" and Appendlx E. " Pressure Vessel Report" to the FSAR.

14 4/l/69 "Anwers to tioest lon*4 -

Res pons,e to Al:C letter dated lacremher 11,-1968 "

l 's / / 'i/ 69 ' (l) Nid i L lon. I iniormation in response to Al:C letter slated 12/11/68,.

(?) inlormat lon in response to Al:0 letter dateil 2/19/69,

( !) Informatinn in response to ARC let ter dated 1/16/69, and-(4) revined pares to FSAR.

4DFFHCHAL~USE ONbYm

. 8--

Amendment No. Date Rec'd Subject 16 9/4/69 (1)" Answers to Questions - Response to AEC letter dated May 1, 1969,"

(2) revisions to Amendment 15 17 10/6/69 " Answers to Questions - Response to AEC letter dated July 25, 1969."

18 11/4/69 Supplemental information on va.*tous facility design matters.

19 11/14 /69 Additional infomstion to clarify certain subject matter in-previous amendments including seismic design.

as p ect%

20 11/24/69 Applicant's proposed Technical Specifications.

4BFFHCHAL-USE-ONLY

n. 2 ..

u .: .. n w .. x . _===e=:x= .=

OFMCHAL USE ONLY ,

9 2.2 Recent Changen As a result of our review and evaluation of Dresden tinits 2 and 3, certain changes vere made to the facility. Because of the similarity of the 411 stone facility, the applicant informed us that similar actions <ould be taken at Millstone. These actions are as follows:

(a) The reactor building corner rooms vill be sealed.

(b) An interlock on auto-relief vill be added.

(c) A seismo6raph vill be installed.

(d) A flow biased-flux.acram vill be provided.

(e) Provisions to reduce further the likelihood of pipe whip l in the drywell vill be included.

(f) Vibration testing of unique core internals with instrumenta-tion vill be performed during the power ascension test program.

(g) Separation and redundancy capabilities of the standby gas treatment system will be provided.

(h) The adequacy of the seismic design and analysis of safety system instrumentation vill be confirmed.

(1) The reliability of valve actuators in containment environment has been confirmed on the basis of test data.

(j) Analysis was made by the applicant to show that an accidental fuel cask drop into the fuel storage pool does not result in catastrophic failure of the pool; i.e., a sudden and substantial loss tot pool water.

(k) Electrical and instrumentation provisions made include split' bus, non-ambiguout testability and diversity of signals..

(1) Puel surveillance requirements vill be described in the Technical Specifications.

AFFECT 4 RUSE ONLY  :

m-

-OFFlkCHAL USE ONLY-30 SITE AND ENVIhotNEffT 31 site Description Millstone Point is a narrcw peninsula of land jutting into Long Island Sounc, approximately three miles vest of New London, Connecticut.

The area of the site is appraximately 500 acres, and approximately one-third of the boundary abuts Long Island Sound.

The shorteot distance from the reactor to the site boundary is 2100 feet; the ventilation stack is only 1,665 feet frcan this point. The distance frczn these structures to the nearest reridential lot are 2,900 and It,575 feet , res pectively. Other activities onsite ip,ude a small Naval Pesearch Laboratory (six employees) on the v" .ge of the quarry, a desalination pilot plant (1h employees) on the emet side of the point, and two neighborhood ball prks along the extrerte eastern border, approxi-mately 15 miles free the reactor. These activAties will be permitted to continue under arrangements which make the uCe of these , facilities subject to the health and safety requirements of the site owners. In addition, the main line of the. New Haven and Hartford Railroad passes through the site 0 5 mile north of the reactor.

Adjacent to the east side of the site is a beach community of k0 homes which has the une of the beach property botveen it and the site on Jordan Cove. Contractural arrangements do nct permit the erecticx1 of dwellin6s on this beach property. SLnce the beach lies in the predomi-nant vind direction, it has received special attention in the location

-OFFECHAL USE ONLY-

. L . .

. :2 r u. D = a  : -

-OFFHCHAllrUSE ONLY -

i of environmental monitoring stations. Across Jordan Cove are the villages L? Pl*asure Beach, Seaside, and Orest Neck, with a combined l

totml population of 1,264 in 1960. To the vest and northwest across i Nientic Bay are a number of villeges at a distance of apprezimately two '

miles. These include Niantic, with a population of 2,788 in 1960, and a number of beach communities on Binck Point having an aggregate popula-I tion of approximately 1,000. The distance to the nearest edge of a ,

population center is 3 2 miles to New London, with e - population of 34,182 in 1960. The total population within six miles of the site was 62,546 in 1960, and this is expected tc double within the next 40 years.-

On this basis, the tw population distance is calculated to be 2 3 miles, and the 1970 total population within this distance is estimated to be 6,600.

32 Meteor ology Data were taken during 1966 and 1967 on a twer with wind and temperature instrurents at 32 feet and 152 feet above sea level. These data'have been analyzed to obtain joint frequency distributions of stability, vind direction and vind speed. The results indicate that very stable condia tions exist 27% of the time, with an average vind speed of 8.6 aph.

During these conditions, the vind b1ws 25% af the time in a single 22-1/2 degree sector.

The frequency for this sector (WSW) is 17% for all conditions. Effluents' '

vill be carried to the site boundaries 38% of the time, and across the adjacent -

Jorden Cove or Niantic Bay an additional 304 of the time. ,

OFFHCHAL USE ONLY- -

_%p, 9,.. 9m < m,msi+sy eiJ.m>--w= -=e-. ,,i. w e g ge-ry,-d_

-g',,4 -g

x .a - . . ' . n .. . ~.:=::::** ' WWW"W"$%2t2! A,bN t2122.2L~.*'2%K .:..-?

AFFHCHAL USE ONLY Combining the sea breeze fumigation model with the data measured at the tower, the applicant finds that it is possible -to have fumigation conditions with on-shore vinds approximately 25% the time.. Based on these data, it is assumed fcr the purpose of calcuisting doses frm accidents that there ne fumigation conditions with a vind speed of two meters per second for the first four a during any accident a nalyzed. Such a condition occura approxir ..ty two percent of the (otal time at this site. We have received cmments on the meteorological program from our consultants in the Weather Bureau that substantiate tu mode l. -

The onsite data also form an adequate basis for calculating the stack emission limit for routine gaseous releases. The applicant has proposed a limit of 1.'4 curies per second, but the dose isopleths on Figure A-1 of the FSAR indicate that only 0 9 curie per second is , justified by their analysis. We anticipate that corrections for the contribtition due to fumi Bation at short distances, which the applicant did not use in his r

milysis, vill reduce the limit by an additional. factor of 2 to approxi-matelv 0.4 curie /sec. The final n+m^ -' ri:- li.it-ri he developed

_ _ , , ~ ~-

, in to # anical Specifications.

, _= -

33 Hydrclogy and Plooding The two nearest vella , which serve the forty-house community northeast of the site jare approximately 3/4 mile frm the reactor (onsite). Hovever, there is a well defined drainage divide between the reactor and this -

lootion mich will prevent any accidental spills from ever reaching them.

. Located f. to six miles frm the facility are a' number of large reecryoirs t .rving New London, Groton, and Norwich. Tuare is no potential

-OFFHCHAh-USE,0NhY- ,

+: .2. L - . : ' : _. -. Jr.. . . .

AFFHCHAL USE ONLY~

for contamination of municipal water supplies during normal operation.

In case of rainout onto one of the reservoirs following the DBA, our calculations indicate that the nuclide concentrations would not exceed 10 CFR 20. We have discussed the problem of potential contamination of reservoirs in the context of emergency planning with the applicant and conclude that the applicant's plans to notify state and local offici 's are adequate. However, we believe that the applicant should continue to work with the state to develop a complete emergency plan that would be followed in the event that *t ;;;;,, 4 L _ ; n ^-- N ted.,

We have discussed this entter with the applicant and be has indicated that similar plans are already being developed for the Connecticut Yankee theility and that he will also develop such plans for the Millstone facility.

We conclude that the applicant has been responsive to our concerns and we vill continue to fbilow the development of the plans thru the Division of Compliance inspection program.

Current velocity and volume flows have been studied in Twotree Island Channel off Millstone Point. In addition, a tracer study was conducted in the area of Long Island Sound near Millstone Point to provide direct estimates of the dilutions to be expected for effluents as they move 1"to Jordan Cove and NLantic Bay. The tracer studies iridicated that the main stream of the effluent would pass northwest across Niantic Bay on flood tide, and southeast across Jordan Cove on the ebb tide. The minimum observed dilutions in these plumes at their maximum extent during a SFFHCHAirUSE-ONLY --

. - = e c w = = w =e m m = === w.e .==

OFFHCHAL USE-ONLL single tidal cycle were 32 off Whito Point on the eastern shore of Jorden Cove, and 18 at a point near the center of Niantic Bay.

Subsequent tidal cycles diffuse the plume northward in a sideways fr.shion toward the highway bridges along the north shores of these bodies of water. Thus , th'e dilution factor at the mouth ' of the Niantic River is approximately So, and that at: the bridge over Jordt n Cove is approximately 32. The studies- provided a guide for locating environmental monitoring stations at points of high concentration, and indicated that enough dilution would occur to offset reconcentration processes occurring in the environment. The Millstone environmental monitoring program vill confirm that the reconcentration processes have been conservatively accounted for in setting the release limits.

The applicant ha' ccrupleted ananalysis of flooding at the site due to the probable maximum burricane. This analysis followed the_ guide--

lines given in HUR-97. Wave runup effects were also calculated by the methods obtained from CERC. Our preliminary review of these analyses -i indicated that the appluant has utilized the proper optimization techniques .to produce the highest flood levels obtainable in this ,

i manner. However, confirmation of the conservatism of -the analysea bv our consultants at CERC has not been received at' this time. If the analysis presented is confirmed by CERC,19-foot flood protection provided on critical facilities and equipment in this plant will be acceptable. This matter vill be discussed orally with the Committee at.the December meeting.

-OFFECHAL USE ONLY

,-# - ne . , m,  ; ,. , ,u  ; 3+5 . n >4

. . .. g _

OFFHSAtrUSE-ONLY-34 glory and Seismology The general area is one having a history of lowyintensit earthquakes.

The facility was designed on the basis of acct;lerations f 00 c 7g and 017g for the operating and design basis earthquakes

, respectively. Observa -

tions of the load bearing bedrock and ;.absequent re i v ew by the applicant and Western Geophysical Research, Inc. , during the conutru ti c on of the facility have confirmed the original conclusions regardi ng the suitability of this site for a nuclear facility.

35 Environmental Considerati_ons The preoperational environmental monitoring program es six includ stations for air particulates and terrestrial samples

, seven marine stations ,

ud 18 gamma background stations.

Reports on the data collected have been supplied to the Ccxnmission and other interestedsixagencies months every for the past two years.

In addition, a marine ecology study was conducted in en effort to obtain population and food cycle data

. The results are summarized in the FSAR vhich indicate that the greatest n a for pote ti l reconcentration of radioactivity in the environment is in th of Niantic Bay and River. e seallops The operational monitoring program which is included i jy .//I n the Millstone y)

Technical Specifications vill require the same number of stations, with #

Iome minor adjustments in location to monitor the pre areas found in '

analysis for gaseous effluent releas es.

tiot* Rectramend -

Tran tL:. Fish and Wildlife Service of the U. S ' of' :

. Department 4c Interior have been incorporated ict.. the program .

Our review of the sampling locations, frequency, and methods of analysis led us to conclude that the program proposed by the applicant is acceptabl e with respect to monitoring the radiological effects of plant operati on on the environs. I 9FRGAL USE ON"V

m __ _ _ . _ _ --

0FFHCHAL USE ONLY

-1c-14 . 0 REAC'IOR CORE DESIGN As with the Dresden 2/3 facilities, tLt Mt.1 stone Unit 1 design power level for the construction permit was t&d on APED-3892, " Burnout Limit Curves for Boiling Water Heset.sf r %1 in 1962. The appli-cent now proposes to operate at theraal pov~r ytrels up to 2011 Mvt (652 Hve net) based on data contained in APED-5286, " Design Basis for Critical Heat Flux Condit19ns in Boiling Water Reactors," issued in 1966. I The application of this design basis for the Millstone Station operating conditions, including expected fuel performance and the effects of 4 transients, is consistent with the design basis of Dresden 2/3 The nuclear core design and control features of the Millstone and Dresden:

facilities are sufficiently similar to accept the Millstone design on theS basis of our previous reviews. The analytical modele , nuclear data ,' and design characteristics of Millstone Unit 1 are the same as-those for

~

Dresden Unit e 2 and 3 Reactor power level is controlled by both control rods. and recirculation flow. A liquid poison in,)ection- system provides a backup--reactivity _

shutdown capability in the event that the- control rod system is-unavailable T

for reactor shutdown for any reason. A rc.d worth minimizer is-' provided to teck up' procedural: controls which limit. rod worths. -Each of.these.

design features;is similar to corresponding features provided at.

Dresden2/3 t

- Passive engineered safety ;;eatures have been provided in the Millstone facility to mitigate the consequences of' potential accidents. These-include the main steam line flow restrictors, control rod . velocity

-OFFHCLAL USE ONLY-

+ . .. -. ::

. ~.

. w .

...~~.+. . . ~ . - . . ~ . _ ~

OFFECHAL USE ONLY -

limiters, and a control rod housing support structure .

On the basis of our previous review of these features on other facilities , we conclude that they are adequate and vill serve to mitigate the consequences of highly unlikely accidents.

We therefore onclude that the nuclear, thermalraulic and core hyd design aspects and the described passive engineered saf t e y features of i

Millstone Unit 1 are adequately supported and acceptable .

l g77, , , ,, _- - - _ - -

~

l AFFHCHAL USE ONLY~

50 REACTOR COOIANT SYSTD4 51 ceneral The reactor coolant system includes the reactor vessel, the recirculation system, the main steam piping, the safety and relief valves and the isolation condenser. The reactor coolant system is similar to the Dresden 2/3 design previously considered for an operating license in that the reactor vessel was designed to Section III of the ASME Code. The recirculation system contains twenty jet pumps and the safety valve capacity is designed to Section III of the ASME Code considering the effects of reactor scram to prevent system over_pressuri-zation. __The effects of blevdown forces on the internals have been reviewed previously on the Dresden facility and the results are applicable for the Millstone facility. Differences between the Dresden and Millstone designs have been evaluated and the results indicate that the effects of the differences are not significant. The princi l al reactor coolant system difference between the Dresden 2/3 and Millstone plants are the utilization of dual-purpose Target Rock relief / safety valves and utiliza-tion of the feedvater system as an engineered safety feature for high pressure coolant injection in the Millstone system. These features vere given particular attention in our review and are discussed in this report; Target Rock valves in Section 5 3 2 and feedvater coolant injection in Section 7.0, A minor difference is that the operating pressure of the Millstone reactor coolant system is 1035 psig as compared to the 1000 psig of Dresden 2/3 These matters have been reviewed by us and found to be acceptable with regard to safe operation of the Millstone facility.

bUbbhHbY

.Enei%shuc c:scwietme-OFRCHAL USE ONLY' The seismic analysis of the recirculatipo system was performed by the equivalent static coefficient method. A lumped mass mathematical model was used to determine the periods of vibration and the mode shapes.

Response of the piping system was then determined by spectral accelera-tion techniques.

On the Asis of our review of the information submitted by the applicant, summarized above, we find ,the design criteria and design limits for the recirculatico system acceptable. The use of the equivalent static coef-ficient method for' the seismic analysis of this system is presently un5r

__ .- ~-

review by our seismic design consultant. Our final acceptance of the system as installed is, therefore, dependent on our consultant's confirma-tion & the adequacy of the analytical techniques used to execute the design.

The report of Dr. Newmark vill be provided to the Committee prior to the n __

December ACRS meeting.

52 Vibration Testing The reactor internals were analyzed to determine the capability to with-stand flow-induced vibration. In addition, vibration measurements will be made during the startup test period. In discussing these measurements the applicant states that the reactor internals vibration test program scheduled for Millstone 1 is intended only to prove those ccxnponents which represent a significant design departure from those previously tested in other plants. We agree with this apprcach. Accordingly, the instrumentation for the program at Millstone 1. will be installe d to obtain specific data on the shroud, steam separatori: and jet pumps.

1FFidAL USET0 MEN -

"JFFHCHAL USE ONLY -

As of this time confirming data from vibration tests at the reference plants for Millstone 1 (Dresden 2, Oyster Creek and Nine Mile Point) have not been made available for our evaluation. Assuming that no major design problems are indicated by these reference plant tests, the proposed Millstone 1 test program is adequate to provide vibraticx2 data necessary to assure that there are no excessive vibratory forces or motions of the unique features described above.

53 Safety and Relief Valves 531 General Overpressure protection for the Millstone reactor vessel is provided by two functional types of valves, safety and relief. The safety valves ,

two in number, are a balanced, spring-loaded type that are similar to these used at Dresden 2/3 and other BWR plants. These valves are located on the main steam lines inside primary containment and discharge directly into the dryvell atmosphere. Individual valve capacity is approximately 6h0,000 lbs/hr, or slightly more than 8% of rated steam flow. The set-point of these spring-loaded safety valves is 1240 + 12 psig.

In addition to the valves indicated above, overpressure protection for the Millstone reactor vessel is provided by three dual-purpose Target Rock valves described below since they are used for the first time at the Millstone and Monticello facilities.

532 Target Rock valves The- dual-purpose Target Rock valve consists of two main sections. The pilot valve section is a self-actuated relief valve that senses pressure through a bellows arrangement to provide main valve functional action.

Figure 51 shows an assembly of the valve.

~

OFFHCHAL USE ONLY

rm.e .

  • I 'd<?/2 f#2[DN"[i$ bh.,2)1,'O C fM. *

' ' f / 2 'I'. , ~

r 0 EJ .L G - 1 A L~

e "

1 U S E - O , N L,,Y_m A llLFI MI:N'l * +

1(14M(rlM AlH- G A l* j g g j ,j ,o ws A C'l O A'l O R i eq e DONNET d' D ELLOWS i

ll:m \' LEAKAG E I' N ALARM PORT s [.. C ';{222p .,,1h pr i?

i 1* RELOAD SECOND S*1 AGlh d,$'f Q ^-  ! $

Si'A C Nit

/ '1*lLOT PRELOAD=

PISTON L' 'f\ -

SECOND STAGE s. , s C

\

g' _en=-d -;:. ..

AND

/ : ADJUSTMENT SET POINT l>R El,O AD SPRING g g ' -l _

._, .g k SPRING SECOND STAGEm N $b ^

~

DISC (closed) Q 'D

/ A/"7 f'- PILOT STEM MAIN val.VE m\. -^e YOKE PORTION s . -

ILOT VA LVE PRE 1.OAD SPRING s  ; 4 MAIN V ALVEm ' N ---- ' n s N PISTON \I ' " O -PILOT VALVE

\ s @., \'s DISC (closeed)

MAIN VALVE -

\ .;g%;;,f'?J'p' PISTON ORIFICE \ s d2. (

\ %

r' q d-

\[kI OTj SENSING

\-

\

y\ r , xs M, x xxo__

\4 MAIN VAI.VE N DISC (closed) NN N

j l

INLET N '

\\\\\')

N N

N I N

\

k

\

V HIGH PRESSURE FLUID OUTLET  !

FIGURE 5.1: TARGET ROCK VALVE SCllEMATIC (CLOSED)

- --O F F I C I A L USE ONLY

0FRCHAL USE ONLY ,

The functional operation is described in detail in Amendment No.14 A pressure switch is installed on the valve to detect and alarm in the event that the bellows develop a leak. The main valve section is a steam line pmssure-operated, reverse seated globe valve which, when actuated by the pilot valve, provides the pressure relief function.

These valves are self-actuating at the set relieving pressure and also are pilot operated which permits remote manuel or automatic relief at pressures below the setpoint. For this latter function, each valve contains an air-powered diaphragm actuator espable of opening the valve and holding it open. This automatic depressurir,ation feature is directly associated with the provisions for emergency core cooling, and our review and evaluation of the auto-relief function is presented in Section 7 0 of this report.

These valves are also installed on the main steam lines inside the

~

dryvell and each valve discharges through its individual pipeline directly into the pressure suppression pool. Each Target Rock valve has an overpressure relieving capacity of approximately 800,000 lbs/hror somewhat more than 10% of rated steam flow. The setpoint of these valves is 1o95 +_ 12 psig.

The Target Rock safety / relief valve has had code approval for conformance with the requirements of Article 9,Section III of the ASME Code.

l

-OFHCLAL USE ONLL

(y....

. . . . _ - - . ~ - . ~ .~- .. . . . . - . .

OFFHCHAL USE ONLY 5.3.3 Conclusion The applicant provided analysis of pressure transients resulting from a turbine-trip scram, a flux scram and a pressure scram in the FSAR and Amendment No. 14. Also included in that amendment is the summary technical information required by code in accordance with ASME Section III, N910.2. That report presents the results of the effect of various valve f ailures on peak vessel pressure following a turbine trip and no bypass valve operation. The results of these analyses show that the Code limit of 1355 psia peak vessel dome pressure is not exceeded even should one valve fail to operate. We conclude that the safety and relief valve systems, when supplemented by the reactor protection sys-tem, provide adequate protection against overpressurization of the reactor coolant boundary.

The consequences of failures in the reactor protection system were not evaluated in detail for the Millstone facility. However, on the tesis of a p elimi-tbet because of the 100% bypass capability and GsP g nary myiew,itappears t'

9 d assuming that offsite power is available, the plant could survive,without h

p 18damageaturbine-tripwithoutensuingscram.

y The entire matter relating

[V3 -

to the reliance placed on the reactor protection system during anticipated transients is the subject of a review between us and the major manufac-turers. The matter has been discussed with the applicant who has indicated to us that appropriate changes that may result from the outcome of the study would be implemented on the Millstone f acility. This position is the same as that taken for the Dresden facility and is acceptable to us.

TFFHCHAL USE ONLY l

.. . . . - - . - . = . - . -

-OFRCHAL USE ONLY_,

5.4 Inservice Inspection The applicant has proposed an inservice inspection program following the Draft ASME Code for Inservice Inspection of Nuclear Reactor Coolant Systems (N 45 Committee) as closely as possible. We are presently developing the inservice inspection requirements for the Technical Specifications. We intend to requi e an inservice inspection program at Millstone Unit 1 equivalent to that at Dresden Units 2 and 3 The program vill include main oteam and feedvater lines and fluid-carrying engineered safety features in the dryvell as well as the primary coolant system. Because of desi 6n differences between the Millstone facility and the Dresden plant, it may

- ~

-. ~

not be practical in terms of personnel exposure and accessibility to inspect the recirculation lina in1-t end cut!:t e--Imide eM the pressure vessel support skirt. We discussed these matters with the appli-cant and indicated that we would consider the entire inservice inspection program during the Technical Specifications review and would require a responsive action that would include attention to these inspection areas.

We plan to require that before plant operation, appropriate consideration is given to providing sufficient access capability for inservice inspection of certain of these items ,r that an adequate technical basis is established to either exclude or defer these components frm the program.

The total program vill be reviewed after the first five years of plant operation and a revised program vill be developed which, as in Dresden, vill include consideration of cm ponents and systems outside the dryvell.

Subject to resolution of the recirculation nozzle veld and support skirt matters described above, we conclude that the inservice inspection program is adequate for initial plant operation.

-OFRCHAL-USE ONLY-~

. : . a s.ee. . .

  • cs. =5,#- -v4, . ._,,,..n.,.

- ~ . ~

. ...- ~.. ,

. t . .

a OFFEEAL4JSE43EY

.9 3 ..

5.5 Main Steam Piping The main steam piping from the reactor vessel to the turbine stop valve was designed to the USAS B31.1.0-1967 Code for Pressure Piping. The applicant has stated his intention to hydrostatically test all piping in the system to 1-1/4 times the design pressure.

In addition to the basic design requirements imposed by the B31.1.0 code, a seismic analysis was performed by the equivalent static coefficient method. The stresses calculated by this method, when combined with the stresses calculated to result f rom normal operating loads, and Operating Basis Earthquake loads are within the Code allowables. Similarly, the combined stresses from operating loads plus Design Basis Earthquake loads are well within the yield strength of the piping material.

We find the above stress limits acceptable. The details of application of the equivalent static coefficient analysis for this plant and system

~~

are now under review by our seismic design consultant. We will report the results of this review of the analytical techniques employed to the Committee at- the December meetin6-In addition to any inspections required by the code, all ciretauferential butt velds in this piping will be 100 percent radiographed, and all circu=-

ferential welds from the reactor vessel to the second isolation valve will also be inspected using either magnetic particle or liquid penetrant techniques. The standards for the radiography are given as ASTM E71, E186, and E280 with discontinuity types A through C of severity level 2 OFFECHAL USE ONLY

._ , f f ;&fMPf: yf f3.f " ~ E"f ' ~ 7 Q*3:.

,OFRGAh"USE-ONL%

~In-being acceptable. The standards for the magnetic particle and liquid penetrant inspections are given as paragraphs N626 and N627 of Section III of the ASME Boiler and Pressure Vessel Code, respectively. We find this inspection program acceptable.

The four 20-inch diameter steam lines are provided with a containment isolation valve on each side of the containment barrier. The valves '

are identical to the one tested by GE at the Stateline Station. The ,

results of the tests are reported in the GE topical report APED-5750,

" Design and Performance of General Electric Boiling Water Reactor-Main Steam Line Isolation Valves." Our preliminary review, including-that' conducted on Oyster Creek and Nine Mile Point, indicates that valve operability under accident conditions has been adequately demonstrated.

5.6 Primary System Leak Detection This system is based on monitoring leakage flows to an equipment-drain tank and a floor drain sump; in addition, the temperature of the_ primary containment air conditioner coolant coil- effluent is monitored. The water level of the sumps and the rise in air conditioner coil effluent:

temperature are translated into primary coolant-system leakage. In addition, sample lines for-inerting control are proposed-to improve leak detection capability inside the drywell. We plan to require the applicant to evaluate the performance of the system during the :first year of Millstone Unit 1 operation and to improve the'1eak detection capability utilizing more fully the air- sampling system if the :results of the evaluation program warrant such action. We will also be guided by the outcw-of similar programs in effect at the Oyster Creek, Nine Mile Point and WROKLTUSE ONLY-

~OFFHGAL USE ONLY_,

the Dresden facilities. We have concluded that the system is adequate for initial plant operation because in our opinion the leakage potential-from f ailed piping or components appears small during this phase of-operation.

5,7 Conclusions On the basis of our review of the reactor coolant system, which considered the similarities between the Millstone and Dresden 2/3 depigns, and an in-depth review of the noted differences, we conclude that the system will perfom adequately its intended functions under normal and accident conditions.

43FFHQAL USE ONLY -

,OFFHCHAL USE ONLY, 6.0 C0!(fAlNMENT SYSTEMS 6.1 General Structural Design The containment structural design for Millstone Unit 1 is similar to that for Oyster Creek, Nine Mile Point, and Dresden Units 2 and 3 The foundation conditions vere reviewed at the construction permit stage, and it ves concluded that the bedrock would provide a suitable foundation.

For the construction permit it was agreed that the plant be designed for an Operating Basis Earthquake (OBE) of 0.07g and a Design Basis Earthquake (DBE) of 0.17g maximum horizontal ground acceleration. A review of the facility structural design perameters by us and our seismic design con-sultants has resulted in a judgment that the plant is capable of a safe shutdown under DBE conditions and of generally withstanding the effects of an earthquake of nearly one-half the DBE.

The facility has been evaluated by the applicant for its resistance to a tornado with 300 mph (rotational) and 60 mph (translational) velocities and a negative preasure of 2 5 psi. Under these conditions , the appli-cant's analysis indicates that the plant is capable of achieving safe shutd own . A negative outward pressure of 3 psi in 3 seconds, which is a current design requirement developed after the Millstone Unit 1 construc-tion permit was issued , vould result in some damage to Class I structures, but vould not atfect the safety or shutdown capabilities of the reactor system.

- OFFHCHAL USE ONLY

y ,

x-

, . ....w +. s o nu . -  ;;M14swgG y , =mgagi?:;+.. , ~ ~ p .

. . .:.. . n t ,

. s

-OFFHCHKUUSE~ONItY-The reactor building superstructure from the operating floor to the roof has poured, reinforced concrete 12" thick walls instead of the usual metal siding. The roof is 1-1/2" deep corrugated metal-decking with built-up roofing. The wells have sufficient capacity to withstand the postulated tornado vinds, and the roof vill act as a blow-out pressure relieving system under the assumed 3 psi outward tornado pressure. Other aspects of damsge to the fuel pool _are discussed in Section 9'.h.

Missiles that could be generated by the tornado were considered by the applicant. These included 2" x 4" x 12' boards, a 7" x 9" x 8' cross tie and an 1800 pound compact car traveling at 200 mph'. We conclude that safe shutdown ccrobility _of the plant would not be affected by -

potential damage that could result from postulated tornado-driven missiles, since these missiles either would not penetrate regions of the reactor -

building that house essential equipment for shutdown or else redundant equipnent is separated to preclude common failure.

We have concluded that the facility is adequately protected a6ainst

, tornad oes .

The applicant has stated that a strong-motion recording seismograph vill be installed. The exact location has not yet been specified. The applicant has agreed to inform us where the unit vill = be -located v Feision has been-made. We are vorking with our consultants > and with the Committee to develop criteria in this regard and-we vill review the applicant's plan in . comparison with the current _ status of this study to assure-that--a meaningful location is selected.

-OFFHCHAL USE ONLY

i,mu n .  ::.s w x,'vyau e ,. w w - + , w -_ m m t .o

  • s n ; .+ ~V . - ~

AFFHGAirUSE ONLY The detailo of the connection of the reactor pressure vessel to the top of the concrete support vell were carefully evaluated _and found acceptable as was the case for Nine Mile Point and Dresden 2 and 3 The seismic design for the facility, particularly for the Class I pipin systems, is still being discussed with the applicant and our seismic

- ~ ~ , '

design consulta_nts. VeM11 report on the status-and/or resolution of this ' item at the meeting with the ACRS.

6.2 Design Basis Accident The loss-of-coolant accident produces the cuhulated dryvell and suppression chamber peak blowdown pressures of 43 psig and 25 psig, respectively. These peak pressures occur after the instantaneous severance of a 28-inch recirculation line (equivalent break area equal-to 5.8 ft )2 with the equalizer line open between the recirculation loops.

The applicant's analytical methods are the same as those for Dresden 2/3, Oyster Creek and Nine Mile Point and have been checked against the results.

of the Moss Land

  • ng tests. Because of the similarity in design approaches, ve conclude that the primary containment system design is acceptable.-

6.3 Containment Mechanical Design __

The design, fabrication, and inspection of .the primary containment vessel was in accordance with the- ASME Code , Section III-B. Some cracks which occurred in containment velds at Monticello resulted in an investigation at Millstone. to determine _ vhether they were also present there. .It_vas concluded that the Monticello cracks were due. to field deviation _ from.

required procedures for maintaining proper temperatures during velding,'-

and that adequate inspection and certification had been present at Millstone to preclude such crack-development conditions.

-OFFHCHAL USE ONLY

JFRCHAL-USE ONLYu-Analyses by the applicant have indicated that there are no missiles which can penetrate the containment. However, as in the Dresden, Oyster Creek and Nine Mile Point plants , full containment protection against the effects of pipe whip has not been provided for all dryvell piping. Only the recirculation system has been provided with restraints. The applicant concluded that certain breaks in the main steam lines and the feedwater lines could result in failure of containment integrity as a result of pipe whip. While reMnts are desirable, we have concluded for Millstone, as ve had for Dresden 2/3, that the lack of restraints on these lines is acceptable at this time because (1) the lines are to be adequately inspected prior to opera-tion, (2) significant parts of the lines are included in the inservice inspection plan, and (3) leak detection capability in the dryvell is provided .

6.4 Inerting Recent WR plants, Dresden Unit 2, Oyster Creek and Nine Mile Point, were required to maintain an inert atmosphere within the containment in order to preclude potential burning of hydrogen released frttn metal-vater reactions following a loss-of-coolant accident (LOCA). Inerting will provide increased margins against burning.

Such actions would also be of significant benefit with respect tc hydrogen evolved by radiolysis following a LOCA by extending the time available to effect actions to cope with the gas evolution.

i L

0FRCHAL USE ONLY

~"

Q..:yqqx.,<quimjsQj.jhggll1 L .

-;q uq ._

y9.i xw s

.pw .a:.

L;5 g m n . , . .

.n

.....aan 4@x .q . ; . .-

. . . _ _ x _. -

  • ' OFFHCHAH;iUSE~ONET i

The- applicant has stated to us that he does not believe that inerting is required on the basis of his predicted effectiveness of the emergency core cooling system and hindrance to inspection inside the drywell.- Because we find little margin in the GE-BWR containment design to accomodate a metal-water reaction that would not lead to a flammable mixture of hydro-gen in the containment-(1.e., about 1% metal-water reaction would lead to a flammable mixture) and-because we are not' wholly convinced on the operational problems associated with the utilities actions to enter-the drywell during plant operation to inspect for leakage, we intend to require that an inert atmosphere be maintained for the Millstone Unit 1.'- -

However, we plan to review periodically the requirements for inerting of the containment.

6.5 Radiolytic Hydrogen Control Our evaluation of the need for post-LOCA hydrogen control. which we. intend to discuss in detail with the Committee in the near future, indicates to us that the radiolysis problem is more severe for the BWR than for the PWR type of containment. In view of this, we have advised the applicant that, in our opinion, the accumulating information on this problem area is providing evidence of-an increasingly conclusive nature that a valid; -

safety concern exists. Further, consistent with the position;taken oni ,

n ~

Diablo Canyon 2, we believe that' containment venting may not be acceptable as the primary means of post-LOCA hydrogen control and therefore that- c other systems.may-need to'be developed to cope with the' hydrogen accumulation problem to minimize, to the lowest practical extent,.any release to the public. Resolution of this' matter will continue on'a _

genege_bpaaf e Mwer, bf 1: 2=2 cf cur cc cerne and p^eelb4e.-requirs%

ments.

10FFHOAt-USE-ONL"i- -

~... my-

, m;' . p.m ,,_.- e ; ,, . .

. . ~ ~ .

  • ry

.=z ' '

)

~ .:_,_. .

_ i JFSHCHAL-USE ONLY-6.6 Primary Containment Leak Rate Testing The allowable primary containment leak rate and associated testing fre-quency will be established in the Technical Specifications. Our accident analyses (Section 11.0) indicate that leak rates of abcut 3% of the primary containment volume per day would not result in doses exceeding 10 CFR Part 100 guidelines for the design basis loss-of-coolant accident (LOCA). We expect that a Technical Specification limit of an accident leak rate of about 1.5% at a pressure of 43 psig will be selected to preserve the margin in the containment design basis leakage and to provide an adequate margin with regard to the health and safety of the general public in the unlikely event of a major LOCA.

6.7 Secondary Containment The Millstone reactor building provides the secondary containment function similar to Dresden 2/3. An adjunct to the function of the reactor building is the standby gas treatment system. This system is designed to minimize the release of radioactive materials to the environment during a loss-of-coolant accident or whenever a high level of radioactivity exis ts in the reac tor build i.ng. We have reviewed the requirements for physical, electrical and instrument separation of the redundant gas treat-ment trains. We will require that the control and electrical system meet the single failure criterion of IEEE-279 and discu;sions in this regard are given in Section 8.0. The applicant stated in Amendment 18 that the design of the standby gas treatment system will meet the single failure criteria both electrically and mechanically, including a fire l

barrier between the trains. We consider this acceptable.

-OFFHCHAL USE OMhY-

.,, . . .. ,.,s...w, .; ~u.J.12,dM&Gaae.w> . '

OFFHCHAL USE ONLY The reactor building leakage test program will be based upon the programs developed for Oyster Creek, Nine Mile Point and Dresden 2/3 facilities.

This program will demonstrate via the standby gas treatment system that a vacuum at least equivalent to 1/4" of water can be maintained over a range of various external meteorological conditions.

6.8 Conclusions On the basis of our evaluation, we conclude that the primary and secondary containment systems are acceptable.

JFFEGAEUSE4NLY

^^

,w . , - i , .u . m.: . -

n..,v, 5 . m ,n .t , a ; ;,&p .w

  • .h . ,a

._DEHCHAL-USE ONLY

~35-7.0 EMERGENCY CORE COOLING SYSTEM 7.1 General The emergency core cooling system (ECCS) for the Millstone facility con-sists of two core spray loops, the feedwater coolant injection (FWCI) subsystem, the low pressure coolant injection (LPCI)/ containment cooling subsystem and the automatic pressure relief (auto-relief) subsystem These subsystems can be operated from either onsite or of fsite electrical power systems. The feedwater system has been evaluated to meet Class I structural requirements to qualify as an engineered safety feature. The power for the FWCI can be provided from ei';her offsite sources or the onsite emergency power gas-turbine-generator.

7.2 Subsystem Description 7.2.1 Core Spray and LPCI Two independent core spray systems and a core flooding system are provided as low pressure core cooling systems. These systems are similar to those previously reviewed and found to be acceptable.for the Dresden Units 2 and 3 facilities. We conclude that they are acceptable for the Millstone facility.

7.2.2 Feedwater Coolant Injection High pressure coolant injection capability on the Dresden facility was provided by a steam turbine driven pump whereas on Millstone, the applicant 1

-OFFHCHAL USE ONLY

~

g-ABRCHAL USE ONLY-proposed to upgrade the f eedwater system (WCI) to provide the same func-tional capability. The major components of the FWCI system consist of 3 one-half capacity condensate pumps, 3 one-half capacity condensate booster pumps, 2 (total of 3 are installed) one-half capacity feedwater pumps, feedwater heaters in two stages, and the feedwater system piping. Th piping configuration is similar to that of the normal BWR plant in that each pumping stage feede into a common header in moving to the next stage.

The reactor feedwater pumps feed into the vessel through two feedwater lines, each of which branch into two nozzle penetrations in the reactor pressure vessel. The power for the WCI is aligned in two separate pumping trains. We consider this a highly reliable system because it is part of the normal operating feedwater equipment and because of its seismic design capabilities.

The applicant's answer II-A-4 in Amendment 14 provides information to show that individi.al components of the FWCI meet Class I requirements although some WCI components were originally purchased to Class II requirements.

These components and piping have been evaluated and analyzed to deter-mine that they meet Class I requirements.

An onsite gas-turbine-generator is provided to supply emergency power for the WCI. This power supply is nominally rated at 12 Ne which is more j titan the combined power load (i.e. , 10.8 Ne) associated with the total ECCS equipment loads.

f on the basis of our review, we conclude that the FWCI system is acceptable as a high pressure coolant injection system.

-O!FRCHAL USE ONLY -

. g .s , ., . u . .~n , . . .. . u .m .v. '

, . :. ~ a y - ,.g . , u . . , . u. ,, .s . w . . ... w 1. a...; v

. a m.mm ,_ . __ : . .m m a.uwan 2.r. s ;m.- -

OFFHCHAL USE ONLY_,

723 Automatic Pressure Rel g The auto-relief valves provided in the Millstone Unit I consist of ,

three Target Rock dual-purpose safety / relief valves as discussed in Section 5 3 2 of this report. The functional rasponse of these valves (for pressure relief in order to enable operation of the low pressure systems , i.e. , core spray and/or LPCI) is simike to that of the electro-matic vcives protided at the Dresden 2/3, Oyster Crt- and Nine Mile Point pla nts . Remote actuation of the Target Rock valve for blowdown is accomplished by air pressure applied to a second stage disc which results in opening the main valve without affecting the pilot valve.

The applicant has provided analyses of the effect on peak clad temperatures associated with the loss-of-coolant break spectrum that results from proper operatico of only 2 of the 3 valves. Although all three valves are programced to operate, these analyses show that, as in the overpressure protection case ,

only two valves are required to operate to assure that fuel clad temperatures do not exceed about 2000 F and that fLel rod perforations do not occur over the small break range of the order of 0.1 ft 2, The applicant stated that an interlock will be provided that vill prevent actuation of the auto-relief system ( ARS) until it is assured that low pressure core cooling capability is available. - On the basis of our review of the functional and mechanical features of the ARS, we conclude that the automatic s

pressure relief system considered for the Milletone facility in conjunction with the low pressure core cooling subsystems, would assist in providing effective emergency core cooling in the unlikely event of a coolant loss accident.

Our evaluation of the instrumentation and control aspects of the ARS is discussed in Section 8.

~ OFFHCHAL USE ONLY .

m -

,5, , - . , , ,,

WFHCHAL USE ONLY 73 htegrated ECCS Operation For small liquid breaks up to about 0.18 ft 2, the WCI can supply sufficient coolant to depressurize the vessel and cool the core, depending only on either the LPCI or core spray for long-term recirculation. For liquid breaks between 0.18 and 0.22 ft2, the depressurizing function of the WCI in conjunction with the coulant makeup function of either the LPCI or the core spray subsystem crovide adequate core cooling.

As e backup to the WCI, the three safety / relief valves are designed to function as an automatic vessel depressurization system when actuated by a coincidence of low-low reactor vessel water level and hiah dryvell cressure.

For liquid breaks larger than about 0.2 ft where no depressurization essistance is required, the core spray subsystem in combination with the LPCI subsystem is designed to teminate adequately the cladding temperature transient.

In order to provide protection against simultaneous flooding of the ECCS pumps that would result from a non-isolable break, we have required and the applicant has agreed ( Amendment 17) to provide sealing of the penetrations into the pump compartments and to provide water-tight doors at entrances. The Millstone design als o includes the provisions for collection of minimal leakage via the reactor building sumps and associated pumps.

The applicant provided ECCS performance analyses based on computer codes developed by General Electric and reviewed for the Dresden Unit 2 facility.

-OFFHCHAL USE ONLY

;= -'

- . . ~ = =u.w wa-.

~ '

.-OFFHCML USE ONLY

-?. 9 -

The results- of these analyses indicate that fuel clad temperatures do not exceed 0

approximately = 2000 F over the entire break spectrum. The Driaden Unit 2 results vece found to be directly applicable to the Millstone facility.

74 Conclusion

'rk have concluded that the design of the ECCS will (a) limit the peak clad.

temperature to well below the clad melting temperature, (b) limit the fuel clad-water reaction to less than one percent of the total clad mass, (c) terminate the temperature transient before the core geometry necessary for core cooling is lost and before it is ;o embrittled as to fail upon quenching, and (d) reduce the core temperature and remove core decay heat for an extended period of time.

75 Containment Cooling The epplicant has modified the design of the containment cooling system presented in the construction permit application. The present installation

+

has two heat cxchangers ( one per loop,) and e1rch-hop has a heat removal capacity of ab 0 x 106BTU /hr e pred to 80 x10 BTU 6 /hr proposed at the CP stage.

( '

This reduction in heat removal capacity" r6quiriis placing greater reliance on the heat capacity of the torus water to store core energy prior to transfer to the ultimate heat sink. This results in higher pool temperatures.since the heat input exceeds heat removal rate for a period of about 11 Uurs following - ,

a loss-of-co lont accident. Increased torus water temperature is an additional' concern since-it can effect the performancg of ttg emergency core cooling and ,

  • /

containment cooling pumps and heat exchangers, A significant concern is__

7 the potential for degradation of pump performance owing_ to a decreare in

~

available net positive suction head'(NPSH) caused by a decrease in the subcooling contribution. 'NPSH must be achieved by relying on elevated containment-pressure.

-OFFHCHAL USE ONLY

lc.;;- _ . .

I

~OFMCHAL USEONLY--

The effeet if heat-exchanger-heat-removal capacity and NPSil was evaluated and we found that the containment cooling heat exchanger capacity for other BWR plants (i.e., Dresden 2/3, Oyster Creek and Nine Mile Point) was adequate so that reliance on containment ptessure for NPSli was not required.

At Millstone Unit 1 the reduction in heat exchanger sizing necessitates reliance on containment pressure to assure adequate NPSil. ,An interlock to prevent contaitunent spray actuation is included in the design of engineered safety features to prevent inadvertent pressure reduction below the* required for NPSil. Questions on the matter of reduced containment hest removal capacity were submitted to the applicant. and answered in Amendmerits Nos. 9,16 and 18.

For the design basis accident and using one heat removal system, the tempera *ure of the torus water exceeds the equipment design temperature (i.e., 165'F) of certain ECCS components by about 35'r for about 28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br />.

The ECCS components which vera designed for 165'T are the core spray and LPCI containment cooling pumps and the contain^ent cooling heat exchangers.

The following Table 7.5 is a summary of the resulting temperatures and time that an elevated containment pressure is required to assure that NPSil requireents are satisfied. Thc data are based on the requirement that the operator not use the containment spray system.

-OFFECHAL USE ONLY l

M- = ::: '. x -smnr. ~ ~

O.. .FFHCHAL USE ONL%-

. TABLE 75_

EFFECTS OF CONTAINMENT llEAT REMOVAL CAPACITY M CONTAINMENT Approximate Maximum Time Interval liest Removal Torus Water That Containment Capacity Temperature Pressure is Required (BTU /hr) ('F) (hrs) 33 x 106 203 $$

(one loop) 66 x 106 170 11 (two loops)

NOTES:

(1) Basis of above capacity is one LPCI and one service water pump l' Per loopi with one LPCI and two serygce wat6r pumps per loop, the heat removal capacity is 40 x 10 BTU /hr.

(2) Equipment design temperature is 165'F.

(3) Initial torus water temperature is 105'F.

(4) If initial torus water temperature was about 90'F, the re9ults for the one-loop case would not change significantly! however,.

the two-loop case would result in a maximum temperature of about 165'F.

1FFHCHAL USE ONLY

. c. .

, n . . . , .

=u.~ wwmn . r ~

JFFDCHAL USE ONLY 42- 5 In response to our concerns regarding the effects on equipment operability with the high torus water temperatures and the degree of reliance on containment pressure to assure adequate NPSH, the applicant provided additional information in Amendment No. 18. The information included the results of further analyses to demonstrate the adequacy of the Millstone design by considering the effects of system degradation assuming various combinations of equipitent malfunctioning or being inoperable. We have reviewed these results and conclude that with two heat exchangers (i.e., both loops) operable, it is possible to degrade system performance to one 1.PCI and one service water pump operating per loop and still not exceed significantly the equipnent design features and not rely completely on containment pressure for NPSH; i.e., the maximum temperature is about 170*F and the containment pressure required is about 4 peig.

Establishing the requirement that continued plant operation be allowed as long as both cooling loops are operable provides assurance that high water temperatures would not reasonably be expected. The applicant stated that although the ECCS equipment design temperature vas 165'F sufficient margin was available so that equipment operability could be assured even if the temperature increased to about 200*F. It is on this basis that the applicant believes that any one heat removal loop is adequate and that a requirement for both loops to be operable as a limiting condition for operation is overly conservative.

We have considered the applicant's analysis and agree that it does suggest margin beyond design. However, the applicant's analve4- M: c , b w. -

completed. Recognizing the complexity of the ECCS and the reliance placed OFFHCHAL USE ONLY

j . . , . - . . . -.

l rOFFHCHAL USE ONLY -

~42 on its proper operation, we do not believe that a permissible orerating mode can be established that knowingly would allow continuing plant operation with only one heat removat loop operable that, in ^,. event of an accident, could lead to a situation that requires egalpment to operate beyond its design temperature. In Amendment 19, the applicant han stated that the confirming information to conclude that the system can satisfactorily withstand the higher temperatures will be available about January 1970. This information, however, is only of a confirmatory nature to demonstrate that some margin beyond design is available.

We vill require in the Techn. cal Specifications that both heat exchangers be operable as a limiting condition for continuing plant o pe a ti on. In the event that only one heat removal triop is operable, the plant would have to te shutdom within 2h hours. Vc telect the 24-hour interval so that acme operator action during this time could be taken to evaluate and possibly correct the fault For further margin, we would also limit the initial torus water tempera.

ture to 90cF and set the containment sprey interlock at a pressure of 5 psig rather than the 10 psig originally proposed by the applicant.

We conclude that the foregoing actiauLyLLL-seault in an__anceptable containment heat. removal s) stem for the Millstone facility.

'l OFFHQAL USE ONLY u

. . - . . _. .. m . . .

i OFFHCHAL USE ONLY -

44-8.0 INSTRLHENTATION. CONTROL AND AUXILI ARY ELECTRIC POWER SYSTEMS 8.1 General l

The instrumentation, control and auxiliary electric power systems have  ;

i been evaluated against the Commission's General Design Criteria (GDC) and/or the Proposed IEEE Criteria for Nuclear Power Plant Protection Systems (IEFP 279) dated August 28, 1968. A comparative review was made with the Dresden Nuclear Power Station, Units 2 and 3. The reactor pro- l tection instrumentation and control systems as well as the instrumentation which initiates and controls the engineered safety features were found to  !

I be functionally the same except for design features unique to the  ;

Millstone application. Our report is limited to the unique features of the Millstone design and to the BWR generic problem areas first identi-fled in the Dresden Units 2 and 3 evaluation. Specifically, these areas are

a. Full Load Rejection Feature
b. Feedwater Coolant Injection System (FWCI)
c. BWR Instrumentation Generic Problem Areas
d. Reactor Protection System and Engineered Safety Feature Installation Criteria ,
e. Auxiliary Electric Power Systems
f. Environmental Testing During the course of our evaluation, we had several meetings with the applicant and his representatives. Two of these meetings were devoted to the review of elementary diagrams. In addition, a visit was made to the site on September 24 and 25, 1969, for the purpose of observing the physical arrangement and installation of the instrumentation, control, and auxiliary electric power systems.

-OFFHCHAL USE ONLY

iSCdl E- #'

  • " :MMMdt i r"- ~ ~ + ~ ~ * - - - , 9 ' "*

CFFHCHAL USE ONLY-

~45-8.2 Full Load Rejection Features The full load rejection feature, in order to succeed, la dependent upon the satisfactory operation of the following actions of the reactor pro-tection and control systems:

a. Delay Turbine Control Valve Fast Closure Reactor Trip
b. Rod Select Insert
c. Averarc "- er Range Monitor Trip Setdown f rom 120% to 90%

Loss of load ic ?Ms n Le m ' the reactor protection system sensors i

monitoring for turou .antrol valve fast closure. These sensors con-sist of four pressure .4wi':ches which monitor the turbine acceleration relay piston oil pressure. Turbine control valve fast closure results from the operation of the acceleration relay which directly responds to -

the turbine acceleration produced by the loss of load. Loss of oil pressure on the acceleration relay brings about the operation of a pilot valve on the control valve relay which results in dumping the oil. Loss of oil results in closing of the control valves. In addition, this action results in the operation of the bypass valve relay which causes the bypass valves to open quickly.

The turbine control valve fast closure reactor trip is delayed 0.1 second to permit the bypass valves to open. There are two groups of bypass valves each containing five valves. The valves in each group are con-nected by a common cam shaf t such that the valves are operated in sequence.

The second and third valve in each group have a limit switch which provides an input to the reactor protection syctem. Thess input signals are used to

-OFFIICllAL USE ONLY

4FFHCHAL USE ONLY '

i bypass the control valve fast closure reactor trip (if bypass valves open in less than 0.1 second). Additionally, this bypass and the turbine control valve f ast closure reactor trip are both bypassed below 45% of the rated steam flow.

Our review of elementary diagrams of the turbine control valve fast closure circuits revealed that provisions for sensor testing had not been included and that the independence of the four instrument channels has been compromised by connection to a single reset switch. The appli-cant has, as a result of our expressed concern, agreed to modify his design to make provisions for testing of these channels during operation and to modify his design to maintain the independence between these channels. .

The turbine control valve f ast closure reactor trip signals are used to initiate the Select Rod Insert and automatic setdown of the APRM trip level from 120% to 90% after a delay of 30 seconds. - . . . -

Select rod insert is a control system used for the automatic insertion of a preassigned group of about 20 control rods. Millstone will operate with two basic control rod sequences in order to optimize fuel utiliza-tion. The rods assigned to the select rod insert system will be selected so that adequate power reduction will result regardless of previous reactor operating history. Additionally, in order to minimize control rod I

l exchanges following a select. rod insert, the selected rods will be those l

vhich are the last in the sequence to be withdrawn in going up to power.

'~ OFFHCHAL USE ONLY ,

1 i

m~

~OFFECHAL USE ONLY-Our review of elementary disgrams of the select rod insert system revealed no areas of design which compromised the reactor protection system with which it is connected. As stated above, the selected rods are inserted by de-energiaing their respective scram solenoids by opening their circuit to the utral)us. The reactor protection system effects a reactor trip by opening the circuit on t electrically) side of the scram sole- _

noids. We conclude that the select rod insert system does not adversely affect the redundancy or independence of the reactor protection system and also does not impair the provisions for testing the protection system.

The automatic setdown of the APRM trip icvel from 120% to 90% of design power is initiated after a 30-second time delay by turbine control valve fast closure signals. This setdown is provided to ensure that thermal limits will not be exceeded following load rejection during the subsequent feedwatertransientrer.ultingfromadecreaseinfeedwaterheating.

Protection against fuel damage is provided by the setdown whether or not the select rod insert system is successful.

Our review of elementary diagrams of the APRM trip setdown feature revealed that the independence of subchannels within each dual logic trip channel of the reactor protection system has been unduly compromised.

~

The compromise of reactor protection system independence stems from the use of the turbine control valve fast closure signals via auxiliary relays from both subchannels of a trip channel to effect setdown in the three APRM channels assigned to that trip channel. The applicant has subsequently modified his design to satisfy his protection system design criteria and the criteria of IEEE 279.

~ OFFHCHAL USE ONLY

,DFFECHAL USE ONLY ,

~48-8.3 Feedwater Coolant Injection Sys_ tem (WCI)

Feedwater flow is normally provided by two of three 50% capacity con-densate pumps which take auction from the condenser het well. Discharge from these pumps is routed through auxiliary equipment (steam packing exhausters, steam jet air. ejector inter and af ter condensers, and con-densate demineralizers) to three 50% capacity condensate booster pumps.

"No of the three condensate booster pumps supply the required suction pressure for the reactor feed pumps through two parallel strings of low pressure feedvater heaters. Two of three 50% capacity feed pumps supply water to the reactor via a parallel arrangement of control valves and high pressure heaters.

Feedwater to the reactor is normally regulated by a three-element controller. The controller receives signals from reactor water level, steam flow, and feedwater flow transmitters and acts on the feedwater control valves to maintain a predetermined level in the vessel. Each of these signals is recorded, and high and low reactor vessel water level are annunciated in the control room. The level signalc are independent of like signals in the reactor trip system.

The applicant has modified the design of the feedwater system so that the feedwater train can be employed as a high pressure coolant injection system as part of the ECCS as described in Section'7.0.

The equipment required to function in the WCI mode is arranged in two strings, A and B. Each of these strings consists of one condensate pump,

~

-OFFECHAL USE ONLY

OFFHCHAL USE ONLY, one condensate booster pump, one reactor feed pump, and a control valve.

A selector switch counted on the control panel in the control room is provided to preselect equipment string A or B for automatic initincion.

Automatic initiation of the FWC1 is by eitaer low reactor water level or high containment pressure signals. These parameters are each monitored by four channels of instrumentation. Signals from the four instruments monitoring a parameter are arranged in a one-out-of-two-taken-twice logic scheme. These initiating signals also effect (1) the transfer of the feedwater controller from level to flow regulacion which prevents pump runout as reactor pressure decays, and (2) tha initiation of the emergency condensate transfer pump. This pump transfers water from the condensate storage tank to the condenser hot well. Further, reactor-vessel high water level signals initiate automatic closure of the feedwater regulating valves to protect against over-filling of the reactor vessal. Two high water level instrument channels are provided for this purpose and are arranged to trip control valves on a one-out-of-two logic scheme. Additionally, automatic initiation of FWCI is dependent upon the presence of permissive signals indicating that sufficient water inventory exists in the condenser, that electrical power is available on buses 1 and 3 and that condensate pump start switch is in the " auto" position. Loss of feedwater flow is annunciated in the control room.

The FWCI initiation and control signals described above are arranged in a single trip logic matrix which a energized from a 125 volt battery sys-tem. The FWCI system is capable of operation with loss of offsite pcwer by the provision of an onsite gas-turbine generator. The operation of the gas-turbine generator is described in a subsequent section of this report.

OFFHCHAL USE ONLY -

JEEHCHAL-USE ONLY, The WC1 system is not of itself designed to meet the single failure criterion. However, it is intended to be functionally redundant to the Automatic Relief System (ARS) in conjunction with the core spray or LPCI systems. Our review of the control and protection circuitry of the FWCI system has indicated that the design is capable of meeting the system's functional requirements, is testable and is independent from the ARS, Additionally, preoperational testing will provide assurance that this system meets its functional requirements with the system automatically operated from offsite and onsite power sources. We conclude that this design is acceptable.

8.4 BWR Instrumentation Generic Problem Areas 8.4.1 Flow-Biased Flux Reactor Trip Six Average Power Range Monitor (APRM) instrument channels are provided for continuous iconitoring and indication of reactor power and.to supply trip signals to the reactor protection system. As a result of our expressed concern, the applicant has modified his design to provide reactor trip signals which are automatically biased by reactor coolant recirculation flow. In the Millstone design, the fixed high flux reactor trip is replaced by the flow-biased reactor trip and a recirculation flow inoperative reactor trip. We understand that this is the manner in which this requirement was incorporated into Dresden, Nine Mile Point and Oyster Creek designs. We have reviewed this design with regard to (1) the instrumentation which monitors recirculation flow and provides the flow bias input to the APRM channels and (2) the fact that recircu-lation flow inoperative reactor trip does not meet protection system criteria.

-OFFECHAL USE ONLY

SFFHCHAbMSE-ONb"f The applicant has stated that his design is such that single failures will not negate the ability to trip the reactor at the 120% or 90% high flux levels. Further, he states that except for the flow bias instrumentation, the design meets the requirements of IEEE 279. This exception is the name as that identified and accepted in Dresden, Nine Mile Point and Oyster Creek. We conclude, f rom a review of elementary diagrams, that a clamping circuit added to each APRM will assure a reactor trip at the 120% or 90% high flux level in the event of recirculation flow instru-mentation failures. This design change also contains provisions for testing at power.

I The applicant was requested to provide the bases which necessitated adding the recirculation flow inoperative trip to the reactor protection system. We were advised that this reactor trip is being deleted from the design because the aforementioned clamping circuits, designed to IEEE 279, make the backup protection provided by this trip unnecessary. We agree and conclude that the flow-biased reactor trip circuitry is acceptable.

8.4.2 Rod Block Monitor (RBM)

The RBM is designed to initiate a rod block under the worst permitted bypass and detector failures to prevent local fuel damage during single rod withdrawal errors starting with any permitted power and flow condi-tion. The RBM consists of two channels of instrumentation which are-effective only during rod selection and movement above 30% power. The Dresden Units 2 and 3 review identified single failures which would preclude rod block action when required. The consequence of failure OFFHCHAL'USE ONLY"

-OFFilCllAL USE-ONLY l i

of the RitM is evaluated and documented in the Dresden Units 2 and 3 application and is applicable to H111 stone. This evaluation shows that during reactor operation with certain limiting control rod patterns, the withdrawal of a designated single rod could result in one or more fuel rods with HCilFR's less than 1.0. As in the case of Dresden, the judgment was made (1) that the limiting rod patterns are unique, (2) that during operation with such patterns, testing of the Rl5H system prior to with-drawal of such rods and on a daily basis thereafter will provide adequate assurance against improper rod withdrawals, k'e will include the same conditions in the Hi11 stone' Technical Specifications.

8.4.3 Containment Spray Actuation The containment spray system consists of the same components as the LPCI plus the additional valves and piping required to direct cooling water into the containment spray headers. These components are arranged in two loops and the controls for each loop are located in the same logic matrix associated with its corresponding 1.PCI loop. The admission valves for each loop are manually initiated by a switch in the control room.

The remote manual controls for these valves are inter 1Nked so that opening is not possible unless primary containment pressure is above a preset level and reactor water level inside the core shroud is above 2/3 core height. Our review of these interlocks. revealed that single failures could result in the loss of both containment spray loops as well as pre-vent termination of the flow in one loop when high containment pressure is reduced. Additi mally, a single failure could result in the initiation of a single loop prior to the core being adequately covered (f ailure of the 2/3 core shroud level interlock).

- OFFilCHAL USE DNLY~-

  1. - - .- ,- , . _ - - - - . - _ . . , _ - - . ~ - , . -- s.. , - ..

~_= --

OFFHCHAL USE ONLY ,

~53-The applicant has revised the design of this instrumentation. Our review of the elementary diagrams of this revised design revealed thatt

a. Initiation logic has changed from two-out-of-two per loop to a one-out-of-two-taken-twice logic per loop. This corrects the protlem concerning initiation of the containment spray system,
b. Single failures remain which would prevent a single loop from being shut down either manually or automatically. The inability to shut down a containment spray loop in the presence of single failures will result in the loss of NPSl! on the low pressure cooling system pumps as discussed in Section 7.5. The appli-cant was advised to modify his design to preclude this problem. The applicant maintsins that his design is not required to meet the single failure criterion._ This problem remains unresolved. We vill report orally to the Comittee concerning our continuing di_scussions with the applicant in this regard.
c. Single failures remain which would permit the initiation of a loop with the water level in the core below the 2/3 core shroud level. We do not consider that this failure mode is required to be corrected; however, because of our con-cern on the NPSil matter, inadvertent actuation of the containment spray must be prevented by suitable design modifications (per item b above).

_OFFHCHAL USE ONLY~

e

OFFHCHAlL~USE~ONLY'

d. This revised circuitry did not include the provisions for testing the sensors. The applicant has agreed to incorporate test jacks, test lights, and alarms in his design of contain-ment spray initiation sensor circuitry.

8.4.4 Diversity in Initiation of Core Spray and LPCI The inputs for initiating the core spray system and its functionally redundant and diverse counterpart, the LPCI system, are derived from signals which are a direct measure of the desired variables. The pumps for these systems are started by diverce (high containment pressure or low-low water level) signals. The admission valves of both systems, however, are operated by the same non-diverse but redundant reactor low pressure signals. These low pressure signals also compromise the independence of the core spray and LPCI systems. The applicant has agreed to provide equipment diversity in the form of two different types of pressure sensing devices. This design change is the same as that proposed and accepted during our review of Dresden Units 2 and 3.

8.4.5 Auto-Relief System (ARS)

A. Pressure Interlock The applicant has revised the design of the ARS to provide an inter-lock which will prevent automatic initiation unless the low pressure core cooling systems are available. This interlock function receives input signals from six pressure evitches monitoring the discharge' pressure of the six pumps (two core spray pumps and each of the four LPCI pumps) such that one switch monitors one pump.- The circuitry

-OFFHCHAL USE ONLY

1 OFFHCHAL USE ONLY ,

~55-is arranged such that the operation of any one switch (one pump i

operating) will permit the automatic initiation of the ARF. A review of the elementary disgrams revealed that single failures in this interlock function will not prevent automatic initiation of the ARS. Ilowever, single failures will result in automatic initiation with none of the low pressure core cooling systems available. Additionally the design does not incorporate provi-sions for the testing of these added sensors.

The applicant states that the design of this pressure interlock satisfies his design criteria in that single active component failures will not negate the purpose of this function. lie has been advised that we require that this pressure interlock be capable of performing its intended function in the presence of any single failure (single failure as defined in IEEE 279), and that the design incorporate provisions for sensor testing. This problem remains unresolved.

B. ARS Manual Initiation The applicant has modified the design of the ARS to make manual initia-tion immune to single component failures. To provide this. capability,

covisions were made to automatically and independently provide each relief valve with-an alternate source of 125 vde control power upon.

loss of the preferred source. This is accomplished by the provision.

of a preferred 125 vde source monitor relay for each valve. Loss of the preferred power source will de-energize the relay, open the

.__OFFHCHAL USE ONLY 5

e

, , 4FFfC1 AL USE ONLY circuit from the preferred source and then complete the circuit to the alternate source. This same modification has been incorporated in each of the two automatic initiation logic matrices.

Our review of the elementary diagrama did not reveal any area which causes us concern except to ensure that the relay monitors are in fact the type which function to " break before make." The applicant has subsequently confirmed that the proper relay is being used in this design.

The justification and/or reasons for using single component failure criterion as a basis for this design is addressed in Section 8.4.9 of this report.

C. Safety Valve Mode of Operation The safety valve mode of operation of each Target Rock safety / relief valve is dependent on the integrity of a bellows for satisfactory operation. The integrity of each bellows is monitored by a pressure switch. Leakage in the bellows is sensed by the pressure switch which causes an alarm in the control room. The pressure switches and the

-associated relays do not contain provisions for testing d g ug plant operation., Addi_tionallp _ single f ailures could negate the annunciating-circuits. The applicant's response to our concern is to require testing only during shutdown /refuelings. -The applicant has been advised that we require a non-ambiguous and a more frequent means to assure the availability of these valves for the overpressure opera-tion. We will report orally to the Committee in this regard.

8.4.6 Testability of Engineered Safety Feature Instrumentation The design of the engineered safety feature circuitry did not include provisions for unambiruous periodic testing. The applicant has provided

,.O F P'I C I~A L U S'E O N CY

QFFHCHAL USE ONLL in the design of the emergency core cooling system instrumentation (f.PCI, core spray, WCI and ARS) permanently installed test jacks, test lights, and alarms. These added features will facilitate periodic testing, and reduce the need to use clip leads or to disconnect wiring. 1:ven with these features, urembiguous periodic testing remains heavily dependent on written procedures. These procedures are scheduled to be completed just prior to core loading. Ilowever, preliminary procedure will be

. . - ~

available in time for preoperational testing. We will request the

~ _ ___

Division of Compliance to review these procedures to assure that random raults are detectable during periodic testing.

8.4.7 Reactor Building (RB) Ventilation _. Isolation Isolation of the RB ventilation system and initiation of the Standby Cas Treatment System (SGTS) can be acutated by (1) the radiation monitors located in the ventilation t-Jaust plenum, or (2) the area monitors located above and to the side of the refueling pool. Two monitors are provided in each of these areas. Isolation of the IW ventilation system and initiation of the SGTS occurs on one of two upscale trip or two down-scale trips from either set of monitors. Our review of the elementary diagrams revealed that the monitors located in.the RB vent exhaust plenum as well as those located over the refueltr4 pc.o1 are protected against single failures and are capable of being tested during operation. This design te similar o that proposed and accepted in our Dresden Units 2 and 3 review.

8.4.8 Standby Ces Treatment System (SCTS)

The SCTS consists of two separate and redundant full capacity filter /

absorber / fan units. The major components are shown in Figur'e V-3.1 of

-OFFilCIIAL USE ONLY -

OFFHCHAL USE ONLY ._

g-the FSAR. This system is provided to maintain a small negative pressure (0.25 inch) in the reactor building under isolation conditions to minimize ground level release of airborne radioactivity. The operation of this system is initiated by either low water level, high containment pressure, or high radiation signals. The radiation monitors providing these signals are described in Section 8.4.7 of this report.

Our review of elementary diagrams reveals that although each equipment train is physically and electrically separate from the other, the control instrumentation of one equipment train is not independent of the other.

$ntheproposeddesign,anequipmentchainisdependentuponthefailure of its redundant counterpart for initiation add operation. The appli-cant was advised that the lack of control instrumentation independence-creates undue vulnerability to single failures. Further, he was advised that the design should be changed to satisfy the same basic pgnciples of independence required in the reactor protection system.

The apgicant has agreed to design the instrumentation and controls to

~~-.___.___

provide independence and satisfy the requirements of IEEE 279. We will report orally to the Committee concerning the schedule for submission of

m. _

these design changes. We anticipate no problems with regard to this design.

8.4.9 Single Failure Criterion The applicant lists in the design basis for engineered safety feature initiation and control instrumentation the requirement that no single component failure shall prevent a protective action. The definition of single component failures, as we interpret it, does not agree withJ he single failure criterion defined in IEEE 279.-The applicant has been

_- -~ _

requested to identify all reactor protection and engineered safety

- OFFHCHAL USE ONLY

,..._,....,...._ _____________.m___.______ _ ._.___________._m______.______J

SFFECHAL USE ONLY,

-$9-  !

features instrument systems to which the single component failure applies-  ;

and to provide justification for taking exception to IEEE 279. The applicant has agreed to submit this information in a forthcoming amend-

, . . _ . . - - - ~~- -

ment. Further, we are led to believe that all protection systems, when one considers functional redundancy, meet the single failure criterion of IEEE 279. If this is confirmed in the forthcoming amendment, this matter vill be resolved. Otherwise, each system will have to be re-evaluated to determine its ef fect on estety. We will report orally to the Committee in this regdrd.

8.5 Reactor Protection System (RPS) and Engineered Safety Features (ESP)

Installation Criteria

'Ihe applicant has documented his criteria for the installation of the f

RPS and ESF. We conclude from our review of these criteria that if properly implemented, the probability of loss of redundant channels from a single cause such as fire will be acceptably low. These criteria include identification of safety related circuits and components from like items not related to safety.

Our site visit, however, revealed that the physical and electrical installation of certain RPS instrument sensors located in the turbine butiding differed frba those sensors located in the reactor building.

In one inatance, the installation of the cont,.r_ol valve fast closure sensors does not satisfy our understanding of the applicant's design -

criteria.

< OFFHCHAL USE ONLY p , --

w

~

_ OFFECllAL USE ONLY ~ ,

3 I

The installation of the control valve fast closure sensors is considered

,_ ,unace"9t able siAqe.we cannot conclude that the installation is protected against a single common fault or event. The function of these sensors is discussed in Section 8.2. These sensors were observed to be mounted in an enclosure somewhat smaller than one cubic foot in size and located at the front end of the turbine. Within this enclosure, the four switches are mounted on a vertical steel plate of about 5/8 inch in thickness.

Two switches are mounted on each side of the plate. The cables and sensing lines to these sensors were not installed; however, it is evident they would all have to be within inches of each other.

The applicant has agreed to modify the installation of these sensors to provide greater assurance against their failure from a single common event. We will request the Division of Compliance to assure that this installation meets the stated criteria and is satisfactory.

0FFHCHAL USE ONLY l

, - , . - . . - - , _ _ _ _ , . . . . ,...-_m. ,e.,_. . . , . . ..-_..e ,,, --.. ,_ _ , , . ..s- . - . - . , . . . . c, m, # -, ,

-OFFHCHAL USE ONLY ,

8.6 Auxiliary Electric Power Systems 8.6.1 Offsite Fwer offsite power for Millstone Unit i vill be supplied from the plant 345 kV switchyard, and from a 27.6 kV line independent of the switchyard.

Pwer is supplied to the switchyard by two 345 kV lines on soprate twers which share a common right-of way for a distance of about 10 miles. The sepration provided between towers along the common right-of-way is documented in the FSAR. Each of the 345 kV lines independently has the cafecity to supply sufficient power for all safe shutdown or engineered safety feature loads. The 27.6 kV line is on a separate right-of-vey and has the espeity equivalent to the diesel generator. This 27 6 kV line normally serves to transmit peaking pwer frorn the cosite gas-turbine generator to the network. The auxiliary power requirement is provided frcru the Northeast Utilities network and the Northeast Power Coordinating Council.

Load f1w and stability studies made in 1965 and 1966, and continuing studies made subsequent to this time assure that the 345 kV New England system (which includes Northeast Utilities) and the transmission ties to New York State are adequate to protect against the loss of load, including M111 stone's offfite. power sources, for the loss of Millstone Unit 1 or other major addition to the New England Network.

Initially, the offsite transmission systems vill be teminated at the station switchyard in a simple two main bus- configuration. Later, however, with the construction of Unit 2, the switchyard vill be converted into a breaker-and--

one-half arrangement. The switchyard breaker and . switch controla are not specifically designed to meet the single failure criterion. A single battery OFFHCHAL USE ONLY

1 OFFICIAL USE ONLY .

system, located in the switchyard, is used to supply the control and power requirements for the actuation of these breakers and switches. The applicant stated that the loss of voltage is annunciated in the control room and that operating personnel are trained to effect local (at the switchyard) circuit breaker operations in accordance with an approved procedure . Ve conclude thot the aforsmentioned provisions and the applicant's stated maintenance procedures that there is adequate assurance against undetected failures and that repairs can be readily effected in this system.

Additionally, offsite power can be ,nde available manually from the 27.6 kV line via the shutdown transformer independent of the 345 kV switchyard.

As a result, we conclude that the addition of a redundant switchyard battery system would not add significantly to public health and safety and need not be required for this application.

From the switchyard, a 3k5 kV overhead line connects to the Unit's stcrtup transformer located et the turbine building approximately one mile away.

This transformer steps the voltage down to h160 volts and to connected to the station's 4160 volt essential buses. The second source of offsite power is derived from the 27.6 kV line and shutdown tron.fermer described previously. The secondary winding of the shutdown transformer is conneettd to the h160 volt buses.

Power to the station is supplied by the startup transformer during startup and normal shutdown and by the Unit's auxiliary transformer during normal opera tion . Upon a unit trip, an automatic fast transfer to the startup transformer vill occur. Inability of this transformer to suppir auxiliary power is annunciated and results in the initiation of the onsite power sources. Power from the shutdown transformer is made available by operator action O'Sm the control room.

- ^ - P r I '0-I-A-Ir-U -S- B N -Ir-Y-- - -

--OFFECHAL USE ONLY' Our review of the offsite power system reveals that the design does not ,

completely satisfy the requirements of GDC 39 The area of non-compliance

.A. s p is that oprator action is required s make the redundant offsite power source available to the essential buses. We believe that this is not sufficiently significant to safety to require redesign and therefore l conclude that the existing design is adequate.

8.6.2 Onsite Power As originally designed, the onsite auxiliary power system did not utilitc the split bus concept. The redundant gas-turbine generator vos connected to the essential buses only upon loss of the diesel generator. Further, the independence of these onsite power sources vos compromised by automatic switching schemes which allowed the essential buses to be served by both sources.

The design van subsequently modified to incorporate the split bus arrangement.

The h160 volt loads are assigned to seven bus sections. Two of these buses and their associated 480 volt load centers supply power to all engineered safety features neept the Feedvater Coolant Injection System. This latter system, because of its extremely high power requirements is assigned to three other buses.

A diesel generator and a gas-turbine generator provide onsite power to the essential buses. The diesel generator is assigned to automatically power only one of the two essential buses. The diesel is rated at 2664 kW . continuous.

The required loads, two hours subsequent to a DBA, total 2291 kW for the diesel generator. This load is limiting and well within the continuous rating.

of the diesel. The diesel starts automatically and is ready to accept load

~

OFFHCHAL USE ONLY

m OFFHCHAL USE ONLY after ten seconds upon initiation by either of the low reactor veter level, high containment pressure, or loss (or potential loss) of offsite pcVer. The diesel generator is separate and independent of the gas-turbine generator with respect to physical location, cooling systems, air start systems, control and sequential loading circuits and fuel supplies. The onsite diesel fuel storage especity is sufficient to run the diesel fully 1dued for 6.4 days without the need for resupply. Bedundant fuel oil transfer pumps are provided to maintain the required level in the diesel day tanks.

A gas-turbine generator is provided as a redundant source of onsite power to the diesel generator. The gas-turbine generator is a commercially available emergency power unit consisting of a modified GE-J-79 jet engine, a 12 MW turbine-generator and exciter, and a central control and switchgear reckage. This generator supplies 60 cycle, 4160 volt power. The unit is located in a seismic Class I building separated from the turbine building by a roadway. Connection between this generator and the h160 volt auxiliary buses .is made by underground cables and conduit. This unit vill be used to provide utility peaking power as well as serve as an emer6ency onsite source of power.

To be a suitable source of onsite emergency power, this unit must reliably start and be capable of-accepting loads in 45 seconds. It was stated during our site visit, that the unit has been used in utility peaking operations' and that construction tests tsve shown that the unit accepted loads consistently within 42 seconds. The applicant ;4s prcrided starting reliability data and

, OFFECHAL USE ONLY

JFFHCHAL USE Oh ,

analyses which support the capability of this generstor to quickly accept and/or sustain the loss of assigned toeds. Because of the fact that this is the first time a gas-turbine generator has been proposed as a source of onsite emergency power, the applicant is committed to the perfornance of preoperational tests to verify the ability of this unit to pwer the TWCI-and serve as source of power redundant to the diesel generator. Additionally, use of this unit for utility peaking villbe limited by the Technical Specifice-tions.

Jet fuel for the gas-turbine generator in stored in two 25,000 sullon tanks.

Two fuel pumps are provided, one a-c and the other is a-c or d-c powered.

We required that the minimum onsite fuel supply for the . jet engine be at least two days which we find acceptable since it is at least equivalent to that considered on other plants previously reviewed for operating licenses and' because the fuel is readily available in the New London area to replenish -

the supply on a reasonable time basis.

The operator has control, both physically and administrative 1y speaking, of the gas-turbine generator. The gas-turbine generator controls are such '

that whether it is shutdown or being used for utility peaking, an accident signal or loss of auxiliary power vill automatically override operator set conditions and shed all peaking loads.

Two (125 y and 2h v) d-c power systems are provided. These systems are insulated from ground and each _is provided with a ground detection system to annunciate the first- ground. All batteries are mounted on racks designed to withstand the maximum ~ earthquake. Each system,-as.velt as the redundant counterparts within each system, are physically _ and electrically

- OFFHCHAL USE ONLY ,

i OFFECHAL USE ONLY-- -

separated from the others. The redundant 125 volt battery systems, as originally designed, vere interconnected by automatic transfer switches. i

. This design unnecessari.y compromised independence and was susceptible l t

to failure from single common events. The applicant has s6 reed to provide l manually controlled switches in lieu of the autcunstic switches. We conclude f that this change provides further assurance that no single failure in the  ;

125 y battery system vill result in the complete loss of any protection {

function and is, therefore, considered adequate.

We conclude that, because of the capacity and redundancy provided and the

- 11stive independence of the redundant features, the onsit e power systems meet ODc 39 and are acceptable.

Environmental Testing i

A study was made by the applicant to determine whether the electrical equipment used in the reactor protection and engineered safety features could perform their design functions in an accident environmer.t.

The electrical equipnent located in containment that must function _ consists of a.c electric motor-operated valves with their associated operators and  :

electrical cabling, and solenoid actuator for main steam isolation and' ARS valves. Test resulta provided' in the FSAR shcw that these components are capable of performing their functinn in an accident environment. We conclude that this equipment is s_atisfactory for use in this application.

r 5

^

OFFECHAL USE ONLY

7 .r _ _-_ _ _, _

7-OFFHCIIAL USE ONLY-The instruments inside containment tha t, must function are limited to the sensors used for the reactor vater level measurements. Test results included in the FSAR show that the sensors remain operable and maintain their required accuracy during and subsequent to rapid depressuri-r.ation of the vessel. We conclude that this instrumentation is satisfactory for this a pplication.

The applicant has proposed a program for assuring that Class I instrumentation meets seismic requirements. Our review of the original program plan submitted in the FSAR found it to be incomplete in scope since such vital Class I systems as Standby Gas Treatment, Containment Isolation, and Emergency Electric Power are not included. The applicent has been requested to__reglemine tha ama ne the prnerra.ta. include all Class I systems. The applicant has agreed to add the above men {oned system and all balance of plant ~~

protection systems.

OFFHCHAL USE ONLY l

4DFFHCHAL USE ONLY~

-f8-9.0 AUXILIARY SYSTEMS 9,1 General We have reviewed the following auxiliary systems and have found. them to-he acceptable for then intended purposes (a) Reactor Shutdown Cooling System (b) Reactor Cleanup System (c) Makeup Water System (d) Instresent and Service Air System (e) Fire Protection System (f) Emergency Service Water System (g) Reactor Building Closed Cooling Water System Our review of the Service Water and Turbine Building Cooling Water Sys-tems, which are unique in design to Millstone, is discussed in the following ' '

us to this report. The radvaste r '!.' and the effects of failures in the spent fuel storage pool are also included.

9.2 Service Water System _

T:e service water system (saline)provides the heat sink for the following intermediate cooling water systems: the reactor building closed cooling water system (RBCCW), turbine building closed cooling water system _(TBCCW),

makeup water evaporators, diesel generator cooling system, and turbine building secondary cooling water system (TBSCW). Since the diesel generator and TBSCU are n e e ded in the e ve n t of an accident and are designed to Class 1* seismic criteria, the service water system was designed as Class I. The intake structure which houses t*te service water as well as the emergency service water, main circulating

  • Class I - Structures and equipment whose failure could cause significant release of radioactivity or which are vital to a safe shutdown of the plant and the removal of decay heat.

i 4FFECHAL USE ONLY -

r- ,

OFFEHAtrUSE#AC water, diesel and electric fire and emergency service water pumps was originally designed as a Class II* structure. The applicant has subse-quently reanalyzed the seismic design and has concF t d, and we agree, that it does meet Class I seismic criceria for thtne tions of the intake structure which house equipment needed in case of an accident.

9.3 Turbine Building Cooling Water Systems (TBCCW and TBSCW)

Since Hillstone Unit 1 uses part of the feedwater system as the feedwater coolant injection system (WCIS), provisions were made to cool the various pumps and motors _of this system during an accident. The applicant chose to split the single turbine building closed cooling water systems found on other BWR's into two separate loops, both used during normal opera-tion but only one, the turbine building secondary cooling water system i (TBSCW), a Class I system, needed during an accident or abnormal occurrence.

The turbine building closed cooling water system provides coolant for the following components: recirculation pump motor-generator sets, main generator, main turbine oil coolers, evaporator pumps, generator load cooler, and priming pumps. Three 50% capacity, 4500 gpm pumps, and three one-third capacity heat exchangers are provided in this system. This syste:n is not needed during abnormal or accident conditions.

The turbine building secondary cooling water system (Class I) supplements the turbine building closed cooling water system (Class II) during normal conditions, but operates independently _during accident conditions. It utilizes two 1800 gpm pumps; each pump is a 100% capacity unit delivering

  • Class II - Structures and equipment which are not essential to the contain-ment of radioactivity or safe shutdown of the plant or removal of decay heat.
OFFECHAL USE ONLF M'f--ye e'Wi'

~ '

OFFHesAL USE6LY_.

demineralized water to two 50% capacity heat exchangers. Heat loads on this system include: condensate pump motors, plant air compressors,-

condensate pump oil coolers, reactor feed pump oil coolers, sample coolers, and space coolers for reactor building equipment areas. These areas house the cleanup pump, recirculation pump M-G, core spray /LPCI pumps, control rod drive hydraulic pump, condensate and feed pump, diesel-generator er! "ontrol room air-conditioning.

During abnormal or accident conditions, the full capacity of the pumps and heat exchangers is not required. In addition, the turbine building secondary cooling water system power requirements can be supplied by

  • either of the two emergency power generating units. Therefore, the failure of one cooling water pump would have no long-term effects during an abnormal or accident condition. However, should the system fail completely, the principal effect would be the increase in temperature in the diesel-generator room, core spray pump rooms, and control room.

During an accident or abnormal condition, the diesel-generator room doors could be opened to provide natural circulation in the area. This could be supplemented by the use of portable fans; the normal flow of air through this area is approximately 2000 cfm. Therefore, there are no serious effects on the diesel-generator as a result of a long-term outage of the turbine building secondary cooling water system.

Under abnormal or accident conditions, the heat load in the control room is minimal with operation of vital instrumentation. Except for operator comfort, no serious' problems would result from the loss of the air-conditioning units.

OFFHCHAL USE ONLY

w

^ "

OFRCHAL USE ONLY The applicant has performed analyses which demonstrate that loss of the turbine building secondary cooling veter to the spce cooler in the core spray /LPCI pump rooms over an extended period would not result in loss of the core and containment cooling capability. With loss of the space coolers the applicant's calculations show that the pump room air temperature vould attain an equilibrium temperett e of approximately 1560F. The applicant has provided a statement from its vendor that the equipment in the corner roans can perform its required function with an ambient ' temperature of 1560F, and other accident conditions for en extended period of time. The i

~;

applicant has agreed to ' confirm his analytical assumptions and technique _a_

by running the LTCI and core spray motors without corner room coolina during the course of the startup and preoperation testa.

We have recently learned that the TBSCWS also provides cooling to the ECCS pump-motor bearings. The applicant has indicated that there is no safety concern with this arrangement and will confirm this conclusion with the results of a failure mode and effects analysis and other supporting information. We vill continue to discuss this matter with the applicant and will report orally to the Committee at the December meeting.

On the basis of our review and subject to satisfactory completion of the confirma_ tory tests , we conclude that the turbine building secondary coolant veter systems are acceptable.

94 Spent Fuel Storage Pool The pool cooling system transfers the decay heat from the spent fuel assemblies to the reactor bui'iding closed cooling water system. The filtering and demineralir.ation system removes impurities frcm the pool veter. The maximum nomal; heat ,1 cad _ for the cooling .- system is about

, ,s ,

- t_ 4 .

OFRCHAL USE ONLY

4FFECHAL41SF.LORIJ -

7.84 x 106 BTU /hr. Additional cooling capacity can be provided via a spool piece connection to the reactor shutdown cooling system in the event it becomes necessary to remove a full core from the reactor.

We have reviewed the results of an analysis by the applicant of the consequences of dropping a loaded fuel cask into the fuel pool. -Our review indicates that the reinforced concrete floor would not fail cata-strophically.

Estimated leakages through crack paths that could develop would be within the fuel pool makeup system capacity. The applicant has also proposed a procedure for periodic inspection and load testing of the crane.

Cask travel over the fuel racks in the pool or over the reactor vessel will be procedurally prohibited.

We have, concluded that the design and procedure,s provide reasonable assurance that the accidental dropping of the cask will not result in unacceptable loss of water from the pool or damage fuel.

Fuel element damage due to missile penetration into the spent fuel storage area has been considered as a matter of safety significance on recent ~I plants.

The walls of the reactor building in the region of the fuel pool are of poured-in-place concrete about 12 inches in thickness. This aspect provides an additional amount of protection to the fuel against external missiles, it does not, however, preclude all_such missiles since the roof is not concrete. Damage could be caused by tornadoes as well as by dropping the' fuel shipping cask.

While we do not presently have firm design requirements on means to cope

,m with all possible failure modes, we recognize the safety importance of

-OFFECHAL USE ONLY ,

l

-OFFHCH4&USE-OHbY'

-/3-the matter and are developing criteria for fuel storage facility design on a-general basis for all plants. When this generic study _is complete, addi-tional measures may be_ identified as necessary to protect the Millstone fuel storage pool. _._ --

c We conclude that the spent fuel storage pool is acceptable for this facility at this time.

9.5 Liquid Radwaste System The Millstone liquid radwaste system is functionally identical to pre-viously reviewed BWR's; i.e. , Dresden 2/3, Nine Mile Point, and Oyster Creek. Because all liquid wastes are collected, sampled and discharged at one point on a batch basis, inadvertent discharge of high activity _ wastes is unlikely.

The Technical Specifications will include requirements for separate isotopic and tritium analyses to be periodically performed that will confirm the predicted constituents of the released waste. In addition, the applicant's environmental program, as outlined in the Technical Specifications, will' assure that the effects of reconcentration in the environment are included' in Millstone operating considerations.

The radwaste building is a Class I' seismically designed structure, unlike the Monticello facility, and it is highly unlikely that any spill would escape to the environs in the event of an earthquake.

The only outdoor tank which is part of the radwaste system is the waste surge tank. During startup, the waste surge tank is used'to hold low-activity wastes, such as hydrotest water, control rod drive coolant, and thermal expansion water until the liquid waste system can handle them. Although this tank has a retention curb to. confine any spill, the-activity limit that will be set in _the Technical Specifications will assure- that the complete release of the contents. of this tank would not exceed 10 CFR Part 20 limits.

We conclude that the design of the radwaste system is acceptable.-

-OFFHCHAL~USE ONLY -

4FFECUAL USE-ONLY 10.0 STEAM-TO-POWER CONVERSION SYSTEM 10.1 General The Millstone Unit 1 is the first of the current BWR plants designed with capability for full load rejection without scram. Based on our reviev of the response of the plant to anticipated events, such as single equipment-malfunctions or single operator errors, we conclude that the MCHFR will remain greater than one; i.e. , fuel f ailure will not result f rom anticipated transients.

General Electric uses an analytical model to predict the transient behavior of the plant including those transients that can be induced by malfunctions of power conversion equipment. The model simulates the entire reactor system and includes: neutronics, heat transfer and control systems ; e.g.,

pressure regulator, feedwater control, and turbine speed control.

The results of the program provide data on the gross behavior of the system; e.g., average neutron flux, and average clad surface heat flux.

These results are- then used to calculate the peak heat fluxes and the resulting MCHFR. On the basis of our review, we find that the model and l calculated results are reasonable. Assurance-that the predicted transient l -

response will be within acceptable limits will be derived from actual measurements during the facility power' ascension program.

10.2 - Full Load Rejection Capability 10.2.1 Sys tem- Des crip tion The essential components in the steam-to-power conversion system at K111 stone are basically like those at Dresden 2/3 and other operating

__OFFHCHAL USE ONLY

M, yS7 pp 4-y -steq u q7~m .a nr.u BWR's, with refinements and special equipment added to enable the system to drop to plant load without scram of the reactor. The turbine controls include four main stop and four control valves, tvo bypass steam chests each containing five bypass valves, a speed governor and overspeed governor and two initial pressure regulators. The turbine bypass valves, a total of ten, discharge directly to the main condenser, and the system is designed to pass 105% of the rated steam flow. The principal refine-ments made to the basic BWR system to provide full load rejection capability consist of added bypass valve and main condenser capacities, while the special equipment added to the system consists of the Select-Rod-Insert (SRI) feature and appropriate control instrumentation including scram delay and flux scram setdown. These control features are described in detail in Amendment 16 in answer to question D-3.

The function of these features is graphically illustrated in the following simplified diagram which is reproduced from ir. formation supplied by the applicant in Amendment 16, 10.2.2 System Evaluation The performance of the system as a result of failures of components in the system has been evaluated and those results have been provided by the applicant. Included in the transients analyzed are (1) loss of electrical load, (2) loss of load with failure of SRI, (3) loss of load with bypass failure, (4) turbine trip. (5) turbine trip with bypass failure or instantaneous loss of main condenser vacuum, (6) closure

of main steam line valves, (7) pressure regulator malfunctions (8) feed-l water control malfunction ranging from loss of all feedwater to maximum 4FRCHAUUECTEP

]6

  • 1 E

-O M

b O

- y_

ac .

CC ' '3 O=

~

M M

w V1 W E

> w -

-J

<- > c a

> # o M M L

g M C y y[~

sm gM uA w

J .o. o * --

AM A A' as 85 ms a E

.84

- wg

- x< c-E 4 O I p<yo - G d

9 54'~ E E g -

w .m; '

n. I o z-o, E-W O

US w W~

z

' >_s W ac.

.ic > h. .O

>C M

y, o -

w a.

(w J s-q;;;p .-

.MZ w>E m

<5 m .wa' a wm . ,,J -

p n. CD u Q -d o J J:  !

go o 2 , C2g-.' -D' s

E$N '"- ,:

n g g ,.

we ge we Em aw o A *A mW w ,

K' lq/

3 p Lg  ; -

>w .yu- us b.

(n .. D

w. g -Wc O m :_

E OO oG WS

<.? a.

-M 4

0 F F'1 J 1-A L USE " O ' N t-Y -

.DNEE%1-U8&ONbP y i.

flow, (9) inadvertent full opening of the bypass valves associated with operating conditions ranging from 50% to full power, and (10) inadvertent SRI function followed by power demand increase while in automatic flow control mode. The results of these analyses show that the Millstone system response is comparable to the Dresden 2/3 system response in cases not involving full load rejection. These results are also true for

~

failure of any of the special equipment (i.e., SRI, scram delay, scram set-down) necessary for the full load rejection capability. In all transients where the design of the Millstone system provides for continued power generation to carry plant loads, the result on the reactor system is comparably less severe than with the Dresden 2/3 system.

10.2.3 Conclusion A comprehensive startup test program for the power conversion system is scheduled. Particular areas of concern with respect to the power con-version system are transients associated with; main steam line valve closure, feedvater controller malfunctions, pressure regulator malfunctions, _

and turbine and ganerator trips. These transients will be induced at various reactor power levels up to 2011 Mwt, including specifically the test of full load rejection capability. We have reviewed the startup test program and conclude that the results of these tests will form a suitable basis to assess the response of the actual plant to all anticipated transients.

.-OFFECHAUUSE ONLY

DFFEfrAL1SE-ONLY -

. - g_

11.0 ACCIDENT ANALYSES Four major postulated accident situations were considered as design basis accidents to assess the adequacy of the Unit 1 engineered safety features to control the possible escape of fission products from the facility.

The design basis accidents analyzed weret (1) control-rod-drop, (2) refueling, (3) steam-line-break, and (4) loss-of-coolant accidents. In addition, we examined postulated accidents which could result from pipe or component ruptures within emergency core cooling subsystems such as the core spray, LPCI, and FWCI systems. Our evaluation of these accidents showed that effective core cooling would be maintained and that the resultant radiological consequences were significantly less than those calculated for the design basis accidents.

The assumptions and results of our analyses of the design basis accidents are consistent with and similar to those of Dresden 2/3, and the doses which we have calculated using these conservative assumptions are summarized in Table 11.0.

On the basis of our evaluation, the radiological doses that could result from these postulated design basis accidents are well within the guideline values given in 10 CFR Part 100.

In addition to dose calculations based on TID 14844 fission product release fractions, our review included evaluations of control room shielding, filter capabilities, and critical parts of the ECCS pumps to withstand this source term.

We conclude that these systems and components can adequately perform their function under the indicated source term assumptions.  !-

i DFFHCHAL USE ONLY - 4 l

~ '

<OFFECHAL-USE GdLY_

TABLE 11.0 POTENTIAL OFFSITE DOSES (RDf)

Two Hours 0 Total Accident 0 Site Boundary Low Population Zone Accident Thyroid Whole Body Thyroid Whole Body control Rod Drop 3 41 8 <1 Refueling (l) 7 1 2 < 1.

Steam Line Break (2) 10 <1 2 41 Loss of Coolant (3) 126 5 155 4 NOTES:

(1) Assumes damage to all pins in one fuel assembly.

(2) On the basis of 5-second valve closure time.

(3) On the basis of Tech Spec primary containment assumed constant leak rate of 1.5 percent. As in Dresden 2, we plan to include in the Tech Specs a limit of 11.5 cf/tr at a pressure of 25 psig for any one valve. We plan also to require the applicant to study means to further reduce the leakage from these valves.

OFFECHAL USE ONLY~

ONfETAirBSE6LY, 12.0 CONDUCT OF OPERATIONS 12.1 Organization Millstone Unit 1 will be operated by a staff of approximately 63 employees divided functionally into three groups reporting to the Plant Superintendent.

The Operations Group consists of 26 men divided into five S-man shif ts reporting to the Operations Supervisor. For normal operation, the appli-cant proposes a shif t crew consisting of a Shif t Supervisor, Supervising Control Operator, Control Operator and two Auxiliary Operators. The Shift Supervisor and Supervising Control Operator will qualify for Senior Operator Licenses while the Control Operators and several of the Auxiliary Operators will receive Operator Licenses.

Plant maintenance activities will be performed by a crew of approximately 11 people divided into two sections, each headed by a foreman reporting to the Maintenance Supervisor. Activities relating to maintenance of mechani-cal equipment will be performed by six mechanics. A foreman and two electricians will provide maintenance coverage on electrical-mechanical equipment.

An onsite Technical Group of 16 people under the direction of the Technical Supervisor will provide technical support in the areas of Chemistry and Health Physics, Instrumentation and Control,and Reactor Engineering.

Three Instrument Control Technicians will perform maintenance, calibration and testing activities on the plant instrumentation and control systems.

WMGAL4JSE ONLY ,

BFFEGMLJJSEENLY These technicians will report to the Instrument and Control Engineer. All-chemistry and radiation protection work will be performed by the Chemist, Health Physicist and three technicians, all of whom report to the Chemistry and Health Physics Engineer.

The Reactor Engineer and two assistants will monitor reactor performance and assist in the evaluation of reactor operating data.

We conclude that the operating staff is of sufficient size and functionally organized to operate the station satisfactorily during commercial operation.

12.2 Startup Organization Although Millstone Point Company, owner, has the overall responsibility for safe operation of the plant, General Electric Company will coordinate and be responsible for the preoperational and startup test programs. During this phase of operation, CE supervisory personnel will provide the technical direction for Millstone operating personnel.

A parallel operating organization composed of GE personnel in the positions of Operations Manager, Operations Superintendent, Shift Supervisors, Test Coordinators, Test Directors and other technical support personnel will be provided. It is expected that approximately six GE and 14 MPC personnel will be licensed as Senior Operators prior to fuel loading.

We have reviewed this organization including the experience resumes of the personnel who are to fill the responsible positions. We conclude that the startup organization will provide adequate coverage in terms of experience and senior operator requirements- during the initial testing and startup phase of operation.

-OFFHCENEUSE OliLY-

-OFFHCElsi USi&ONLY -

12.3 Training The Millstone Plant staff will have completed a six-phase training program prior to fuel loading.

The initial phase, conducted at Renssalaer Polytechnic Institute, was 13 weeks in duration and consisted of academic training and laboratory experiments.

The second phase, attended primarily by supervisory personnel, consisted of three nonths on-the-job training at either Humboldt Bay or Big Rock Point Plants. Personnel gained work experience while participating in the day-to-day operations at the plant. A four-week-course conducted by General Electric design and system engineers in San Jose, California, pro- '

vided Millstone personnel with the technical details regarding specific plant features. The technical support personnel attended a 12-week course given by General Electric in the areas of Fuel Management, Radiochemistry, Radiation Protection, and Instrumentation and Control. A 12-week course was attended by operating personnel at the General Electric simulator at' Morris, Illinois.

The final phase of training will be conducted at the Millstone site in three sections: The first section will encompass a review of mathematics, reactor physics, plant systems and radiation protection; the second section will involve the participation of the plant staf f in the preparation of the plant technical specifications, operating procedures, preoperational test procedures and operating manuals; and the final section, expeci.ed to be DFFFCHAEUSE~ONLT

. _ . _ ._ _ _ _ _ _ . . _. . _ ~

-OFFECHAL USE4HLL completed approximately eight weeks prior to fuel loading,will involve the active participation of the operating crews in conducting the pre-operational test program.

We conclude that the training received by the Millstone staff is suffi-cient to provide the experience and background necessary for safe plant operation.

-12.4 Plant Staff Qualifications The combination of experience, education and training of the plant staff as outlined in Amendment 14 is considered adequate to provide the neces-sary level of overall competence for plant operations.

12.5 Preoperational and Startup Tests The applicant has proposed a five-phase test program in the following areas:

Preoperational Tests, Open-Vessel Tests Heatup Tests, Power Tests and Warranty Tests.

General Electric and its vendors are responsible for the preparation of the test procedures. The procedures must be reviewed and approved by_

representatives of the applicants, General Electric Company and Ebasco.

In addition, the Millstone Nuclear Review Board will review the testing program with respect to nuclear safety aspects. Criteria for acceptance or satisfactory completion of tests are contained in the individual test procedures. Approval of the completed tests requires the signatures of senior GE, vendor and Millstone personnel.

OFFECHAL USE ONLY -

i ne w -- n .

  • . kEmnagnnTlIGuM 00mCTO5W

-BL-The preparation and review of preoperational and startup test procedures will be completed prior to _ performanM-the test program. Review of these procedures is being undertaken by the Division of Compliance. We conclude that this program for initial startup and power ascension is acceptable.

12.6 Operating Procedures Written operating procedures will be prepared to cover plant startup, normal operation, shutdown and refueling. Each procedure will contain precautionary measures, subsystem requirements and detailed check-off lists. Additional procedures covering annunciator alarms, radiation con-trol, system surveillance, . maintenance, checkout and calibration of instrumentation will be prepared and coordinated between the operations, maintenance and technical groups. All procedures will be reviewed by the 5

Plant Operations Review Committee (PORC) and approved by either the Plant Superintendent or Assistant Plant Superintendent.

We conclude that the mechanism outlined for preparation, review, approval and implementing procedure changes 1s satisfactory.

12.7 Review and Audit Millstone Point Company has formed two review and audit committees to assure compliance with the terms of the operating license and safe opera-tion of the station.

The onsite Plant Operations Review Committee is advisory to the Station Superintendent. The membership consists of the Station Superintendent, Assistant Station Superintendent, Operations Supervisor, Technical Supervisor, and Maintenance Supervisor, or their designated alternates.

JFFHCHAL USE ONLY-i

-OFMCIALUSE ONLY-

~85-The responsibilities of the Review Committee will be tot (a) Review and approve all company and station orders related to the station license.

(b) Review and approve all station operating, maintenance, abnormal and emergency procedures and changes thereto; and any other proposed procedures which affect nuclear safety or involve the license or technical specifications.

(c) Review and approve all proposed tests and experiments which involve nuclear hazards not previously approved.

(d) 5.eview and approve for submission to the Nuclear Review Board proposed changes to the operating license, Technical Specifi-cations or Final Safety Analysis Report.

(e) Review and approve proposed changes or modifications to plant systems or equipment.

(f) Investigate instances, abnormal occurrences or exceeding a safety limit and recommend corrective action in writing to the Chairman of the Nuclear Review Board for actior.

(g) Review plant operation to detect potential safety hazards.

(h) Perform special reviews and investigations and prepare reports as requested by the Chairman of the Nuclear Review Board.

An offsite review and audit committee, the Nuclear Review Board, will con--

sist of a minimum of six persons which will be advisory to the President of The Millstone Point Company. As a group, the members will collectively provide expertise in: reactor operation, reactor engineering, chemistry OFRCHAL USE ONLY

DFMCHAL USECHLY

- S (,-

and radiochemistry and/or environmental monitoring, metallurgy and radiation damage, instrumentation and control, radiological safety,_ mechanical and electrical systems and any other appropriate speciality required by the unique characteristics of the facility.

The Chairman, Vice Chairman and other members will be appointed by the President of The Millstone Point Company or his designee. At least one member will not be an employee of Northeast Utilities Service Corporation (NUSCO) or its affiliated companies.

The Review Board will meet on call of the Chairman or as requested by individual members. A minimum meeting frequency of semiannually.has been specified with a quorum consisting of either the Chairman or Vice Chairman plus three other members.

The responsibilities of the Nuclear Review Board will be to (a) Review and approve for submittal to the AEC proposed changes to the station operating license Technical Specifications, unreviewed saf ety questions and the Final Safety Analysis Report.

(b) Perform at least semiannual audit of station operations to verify that terms and conditions of applicable licenses and regulations are met.

(c) Review and approve proposed changes or modifications to plant systems or components referred to the Board by the Plant Operations Review Committee.

(d) Review minu:es of meetings of the Plant Operation Review Committee.

OFFHCHAL USE ONLY

43FFHCHAL USE ONLT*

(e) Investigate abnormal occurrences or exceeding a safety limit.

(f) Review and approve all changes to the Radiation Emergency Plan.

(g) Review and approve all items referred to it by the Plant Operations Review Committee or Station Superintendent.

'Je conclude that the composition, method of reporting and overall competency of the Millstone Point review and audit committees are satisfactory.

12.8 Emergency Preparedness Hillstone Point Company has prepared a three-phase plan for dealing with incidents involving significant release of radioactive materials.

Phase I defines the immediate action to be taken by shift personnel in the event alarms are received from specific Area Radiation Monitors or the Emergency Core Cooling System is activated. Actions include the assembly of all non-station personnel in specified areas for monitoring and release, preliminary site monitoring survey action to ascertain magnitude of release and coordinated action of shift and other station personnel to minimize further damage.

Phase II encompasses the evaluation of plant conditions and the severity of the incident by referring to plant instrumentation and site surveys.

During this phase, a determination is made as to whether or not offsite assistance is required depending on weather conditions and other data.-

-OFFECHAL USE ONLT~~

'OFFHCHAL USE 014Uf-

-no-Phase III is initiated if circumstances indicate a potential hazard exists to the public. The Connecticut State Police, State Health Depart-ment, U. S. Coast Guard and New York Operations Office of the AEC will be notified that assistance is required.

The State Police will establish roadblocks and institute other protective measures as determined by the Emergency Duty Officer. U. S. Coast Guard personnel will ensure no boating traffic approaches within one mile of the plant. NYOO-AEC personnel through the Radiological Emergency Assistance Team will provide additional monitoriog capability and will be available to the Millstone, state and local officials for advice and consultation.

In the event Millstone personnel need medical assistance, medical arrange-ments have been formalized for the treatment of injured and/or contaminated personnel at Lawrence and Memorial Hospitals. Decontamination facilities have also been arranged for at Electric Boat Company. In addition, Electric Boat Company personnel may be used to supplement health physics and radiation monitoring teams as necessary.

Specific provisions have been included in the plan for the assembly, monitoring, release and/or treatment of construction workers assigned at the site for work on Millstone Unit 2.

We conclude that the plan as described in Amendment 14 is acceptable and affords reasonable protection to the public in the-event of an offsite radioactive release. However, as discussed in Section 3.3 of this report, we conclude that the applicant should develop the program with the state and local officials to cope with the possibility of contaminating reservoirs following a major accident.  :

OFFEHAL USE ONLY

~

OFFHCHAL USE-ONLY 6,-

12.9 Industrial Security The act of sabotage by either a dissident group or a disgruntled indi-vidual, if properly planned and performed, could lead to violation of one of several fission product barriers much the same as considered in a design basis accident. It is unlikely that a random action would lesd to an accident resulting in the release of significant quantities of fission products principally because of the many levels of in-depth protection already incorporated in the plant design. These include protection against missiles, shielding requirements (resulting in massive concrete barriers), physical separation of vital engineered safety features, design provisions against the effects of natural phenomena, compliance with Criterion No. 11 (relating to remote shutdown capability), and redundancy of essential electrical and mechanical systems. These inherent design features collectively provide a significant measure of protection against the effects of sabotage at the Millstone facility.

We believe that the foregoing measures would not completely prevent sabotage by someone intent on such an action. It is probable that many acts could be easily committed that would affect the availability of the facility; however, we consider it highly unlikely for a large-scale act of industrial sabotage at the facility to occur that would affect the health and safety of the general public.

i Measures to preclude unauthorized entry into the Millstone 1 site will include an eight-foot-high cyclone fence topped with barbed wire surrounding the reactor and associated facilities, controlled gate access, closed cir-cuit television and guards. Public tours of the facility are not planned.

OFFECHAL USE ONLY

.0FMCHAL USE ONLY-

~f,-

Gates and doors to Unit I will be locked and access control will be by Unit 1 personnel, During the night, the main gate will be remote-contrciled by Unit 1 personnel with the aid of television, while during the day, the gate vill be guard-controlled. In addition, during all shifto, Unit 1 personnel vill patrol to detect the presence of unauthorized individuals and to detect physical changes in facility components.- _

During Unit 2 construction, valls will be erected at locations where construction activities are in progress adjacent to Unit 1 facilities.

These areas are limited to the common control room, turbine-generator deck area and locker room.

We conclude that the applicant has taken reasonable precautions to minimize the entry into the facility by unauthorized personnel both during normal operation and while Unit 2 is under construction.

.DFFECHAL USE ONLY

^ '

-OFiFHCHAL-USE-ONLL 91-13.0 QUALITY ASSURANCE Our review of the Quality Assurance (QA) program for the Millstone Nuclear Power Station Unit I was based on (1) information submitted in the appli-cation including Amendment 9 and Appendix F of the FSAR, and (2) informa-tion from the Division of Compliance regarding implementation of the QA program including reports of actual hardware and construction deficiencies.

The contractural arrangements between Hillstone Point Company and General Electric Company are such'that GE had complete responsibility, under Millstone Point Company, for the design and construction of Millstone Unit 1, including the matters for controlling and assuring quality.

Under the turnkey contract arrangement, the applicant did not participate directly in a significant manner in the QA program activities. This arrange-ment is similar to that used on other turnkey projects, including the Dresden 2/3 and Oyster Creek projects.

A number of construction-phase deficiencies in Unit No.1 have been iden-tified 'oy the Division of Compliance. Among these are problems with crecks in the jet pump castings, a defective casting in the recirculation system pump suction valve bonnet, and incomplete quality assurance records in a number of areas relating to vendor supplied equipment.

The defective jet pump castings have been replaced and the applicant'has been continuing with corrective actions relative to the remaining specifically identified deficiencies.

.0FFECHAL USE ONLY

4FFHCHAL USE ONLY -

In addition to the activities being undertaken to correct remaining deficiencies, the applicant and GE are presently conducting a review of records relating to pumps, valves, piping and fittings associated with the primary coolant pressure boundary to assure that the latest applicable non-destructive testing requirements are being met. These actions will be completed prior to plant power operation..

We conclude that the actions and plans when satisfactorily implemented and when verified by the Division of Compliance will assure an acceptable and adequate level of quality for the Millstone Unit 1 facility.

14.0 TECHNICAL SPECIFICATIONS We are currently reviewing the Technical Specifications proposed by The Hillstone Point Company in Amendment 20. The technical content of the.

Technical Specifications will be quite similar to those developed for Dresden Unit 2. A reasonably final draft'of the significant matters in-cluded in the Technical Specifications will be available for the Committee prior to the December meeting.

15.0 ACRS MATTERS As was the case for Dresden Units 2 and 3, our review of the provisional operating license application for the-Millstone facility included the 16-items identified by the Committee which have come to be known as the "a - p" items. We find that the applicant has provided sufficient information to permit us to conclude that each matter has been adequately resolved. Although all have been considered, we report on the last item since it identifies the. items for further review.

. OFFECHAL -USE ONLY

OFFKCHAL USE ONLY

p. Identification of items requiring individual review aft _e_r_

licensing We consider the following items will be included in those requiring continued review af ter issuance of the provisional operating license:

- Further investigation on a state-of-the-art basis to study ways and means to improve primary system leakage and fuel failure detection capabilities.

- A continuing review of improved inservice inspection techniques including components external to the dry-well .

- We have approached the problem regarding radiolytically generated hydrogen on an industry-wide basis. Each of the major manufacturers of sater reactors has presented results of studies to date and has outlined programs for further aM1ytical and experimental investigation related to the problem.

- A program to study and develop means to further reduce the potential for leakage from main steam line isolation valves.

- The potential for common mode failure in the Reactor Protection System.

- A study regarding the potential consequences of failures of the reactor protection system in the event of antici-pated transients.

- OFFECHAL USE OHLY

-OFRCHAL USE ONLY-16.0 CONFORMANCE TO GENERAL DESIGN CRITERIA When the construction permit for Millstone Unit I was issued, the plant design compared favorably with the Commission's 27 Criteria published for comment on November 22, 1965. However, we have reviewed _ the facility as constructed for conformance to the current 70 General Design Criteria.

We find that the plant's inherent features and capability provide a basis for reasonable assurance that the facility- design meets the intent of the current criteria.

17.0 CONCLUSION

Subject to the resolution of the following matters, we conclude that Millstone Unit 1 can be operated without endangering the health and safety of the public:

- 'looding potential at the site due to probable maximum hurricane (Section 3.3)

- inservice inspection program with regard to the recirculation nozzle welds and the vessel support skirt (Section 5.4)

- adequacy of analytical methods used for the seismic design of the facility including Class I piping (Section 6.1)

- single failure protection for the auto-relief interlock and containment spray instrumentation and control system (Section 8.0)

As discussed in Section 6.4, the applicant is opposed to inerting the containment; however, we will require that the containment atmosphere be.

inerted during plant operation. We plan to review periodically the requirements for inerting of the containment.

OFFECHAL USE ONLY' t

- . OFFECHAL USE ONLY-Contingent on a f avorable report from the Committee, we' plan to publish notice in thy Federal Register of our intent to issue a provisional operating license to The Millstone Point Company, et al. Actual issuance of the license would follow satisf actory completion of plant- construction as confirmed by preoperational tests and inspection by the Division of Compliance. We anricipate this a tion to occur about June 1970.

f I

i

. OFFECEAL USE ONLY

.---._- - ~ .. - . _ ._ - - - - .. - -- - -

Oli I

Jts: esth i 11/25/69 Frelest: Milletone #1 j,ta t us Pol. Revtow Ch roneleare May 19, 1964 Cemetreetten Fermit 1.eeed .

Merek 20, 1964. F84R Rese19ed )

novemeer 20, 1969, sebsemmittee Vietto tite i June 17, 1970, sahedsled imot imedias Date j Discuaslast Milletone #1 to a enell sised SWE with a doetge (otreteh) power of 2011 4eit. The power demetty to the some es with prenden 2, abent 40 kw/l, and the heele deelse to the omes as the Dresden 2 3 unite.

Dortes the CP review, the Actq identified fleeding protection and stack desige se spoeial ette related quesdw. Fleed levels are att11 being discoseed, several malque features are laserperated in the M111steme #1 deelyn. For .

example, this will be the first operattag remeter with e Seleet Red 1meert Systeel this system having been added einse the construction Permit review.

This pleet has the ability to tolerate a felt need generater trip witbeet ecramming by virtue of 105 steen bypen,e capacity and the 381.

Resulte of neugeber 29. 1969 sih Timit

1. Overall plant cemetructies une 95 semplete, with the turbine buildhas further alens them the reester building.

) 2. scheduled feel needleg date is June 1970.

3. Several items are sereselved between App 11eemt and Staff (see beles). ,
4. Emergency plane need further discuemica.
5. N sabe%ctos semeleded that the project should be revleued by the Acts to December.

froe IRL laserLla Ad2R

1. N following seem to be enroselved between App 11seet and staff i
a. Detalle af Tosh spese, p. 2
b. Steak emisetem limit, p. 12
c. Fleed level, pi 14
d. Keenevise taspeetten, p. 24
e. Redlelyste questies, p. 12
i. NPSE and emergemey seeling Pa tagraturae, p. 39 i 3 single -failusse la oestaiw sprey loop. p.13 Fil.E : Millstone #1 project file & 116th Meetina File omet > . ACRS.. , , . . , _ . .. . . . . . , ,

sunmr > JEllard:emb ,,,,_ _,, . . . . _ . . . . . . - k . ..

out > - 11/.25/69 _. h==...==..

.......___ m.z. ,

(:=.

, , u .., ,.

~~ ~ _ .

n,m m.m... . m m. . ., . . o . 4

.m.,, g ,

,.-,.--.y,--.. -

  • _ -,, - , .....n _ . . , r.w-...-,,,3.w.,..,.,v.,w.,w., ...,.,.,--,m,w-y,,,r,ym,yr,--w,.,.,,,,--n,,-%myw, ,.,--,..w,.7,,

1

. i i

i Milletsee #1 11/25/69 j

h. stasia failures is safety relief valve stare system, p. 36  !
1. The defiatties of stacle fatteres as applied to asF's initiatise and sentret imetrumentaties, p. 3 4
j. Turbine centret volve feet cleente eeneers le voacceptable, p. 60 l
2. IS eddities to the weresolved areas, review seems to be insamplete re-garding the followings l
e. $peetal IDE of Frteary eempeneste, operater liseasing easso, and review d plant precedures are being undertakaa, p. 2
b. smergency pleas for moerty reeerestre, p.13
s. Neumerk's anstyete (not yet resolved), p. 19
d. seiende analyste of the steen liane, p. 25 '
e. Setomogrsph toeatten, p. 29
f. plant setenta design, p. 30
g. Raester buildies leakage testing program, p. 34
h. Test precedures for tar stremitry, p. 57 '
i. Ibesign ef imetruneetatles and eestrete fer $eandby Gee Treatment System, p. $$
j. Sefamis des Aga ef Class I tastrummetatiem, p. 67
k. Additteest safety woesures for feel storaan peel, p. 73 '
1. proeperat1'ael and startup test procederee, p. 84
m. Operating proceduree (apparently met yet written), p. 44 t

1

3. The staff atatos thet Milleteen #1 is ready for Acts review.

e o e omes > . . . . . .. . . . . _ .. . . . . . . . . .. . . . .. . . . . . . . . . .

sumwt > . . . . . . . . . . ........ . . . . .. . . . _ . . . . . . . . . . .

ons ,. . . . . . . . . . . . . . . . . . . - . . . _ . . . . . . . . . . . _ . . . . . . . . . . . . . . . ,

,brm AFC.8th (Rev 940 g , ,mg g ,,, .,,,

. - -., , - , . - , n , n... ,, , - .n.. ,- , - . , . , , -

Retrieved from "https://kanterella.com/w/index.php?title=ML20128F246&oldid=3463962"