ML20132C076
Text
"
g .
(
,/
l N 0 3 1984 l
i MEMORANDUM FOR: Thomas H. Hovak, Assistant Director for Licensing. DL FR0ti: R. Wayne Houston, Assistant Director for Reactor Safety, DSI
SUBJECT:
BEAVER VALLEY UNIT 2 DRAFT SER Plant Name: Beaver Valley Unit 2 ,
Docket No.: 50-412 Licensing Stage: OL Responsible Branch: Licensing Branch f3 Project Manager: L. Lazo Review Branch: Reactor Systems Branch Review Status: Awaiting Information Enclosed is part of the Reactor Systems BrancFs' input to the draft SER for BV-2. RSB Sections 5.2.2, 5.4.7, and 6.3 are included.
Section 15 of the draft SER will be forwarded by May 18, 1984.
0.+11nalSignsd Dr R. '.'>ryt: Mr:t:.i R. Wayne Houston, Assistant Director .
for Reactor Safety.
Division of Systems Integration
Enclosure:
DISTRIBUTION As stated Docket File RSB Rdg.
cc (w/o enc.): R. Mattson RSB Plant RSB S/Ls Elantz G. Knighton Lantz Rdg.
L. Lazo LMarsh BSheron AD/RS Rdg.
CONTACT: E. Lantz, x27839 I4
$0s1%s@ # J
- PREVIOUS CONCURP.ENCE SHEET ON FILE WITH RSB..
" "22
- RSB:DSI RSB:DSI RSB:DSI />DkS: l "LM&Eh"' "BShdF6ii 'f"AQHobston l
"M["~ ' ~
m2,j..Elsntiids"
- "'"i . 5/ 3/ 84 * ..;5/3/84* ,,, 5/3/84* ..[.5/jf84 , , ,, ,
(
s MEMORANDUM FOR: Thomas M. Novak, Assistant Director for Licensing, DL FROM: R. Wayne Houston, Assistant Dintetor for Reactor Safety, DSI
SUBJECT:
BEAVER VALLEY UNIT 2 DRAFT SER Plant Name: Beaver Valley Unit 2 Docket No.: 50-412 .
Licensing Stage: OL ;
Responsible Branch: Licensing Branch f3 Project Manager: L. Lazo '
Review, Branch: Reactor Systems Branch Review Status: Awaiting Information . - . .
Enclosed is part of the Reactor Systems Branch's input to the draft SER for BV-2. RSB Sections 5.2.2, 5.4.7, and 6.3 are included.
. +
R. Wayne Houston, Assistant Director for Reactor Safety, ,
Division of Systems Integration cc(w/oenc.): RSB S/Ls DISTRIBUTION R. Mattson Docket File G. Knighton RSB Rdg.
L. Lazo RSB Plant Etantz Lantz Rdg.
LMarsh CONTACT: E. Lantz, x27839 BSheron AD/RS Rdg.
""'"*! RSB 051. . .!RSB:DS1.g,.3..R I. .. ..ADRS : DS I... . . . . . . . . . . . . . . . . . . . . . . . . . . . .................
~'"* EL .
$[:cs. LMarsh. .l.BSh n. . i..RWHouston. .. . . . . . . . . . . . . . . . . . . . .... .............
""*! 5/ ./84. .5/.5/84. h
..).5/../84.. . 5/.. ../84. . . .. .. . . . . . . . . . . . . . . . . . . ... . .. ........
I
(
a 5 REACTOR COOLANT SYSTEM 5.1 Summary Description
- 5. 2 Integrity of Reactor Coolant Pressure Boundary
, 5.2.1 Compliance with ASME Code and Code Cases 5.2.2 Overpressure Protection .
Overpressure protection for Beaver Valley Unit 2-has been reviewed in accordance with SRP 5.2.2 (NUREG-0800). Conformance with the acceptance criteria, except as noted, formed the basis for the staff's conclusion that the design of the facility for overpressure protection is acceptable.
The reactor coolant pressure boundary (RCPB) is protected from overpressuri-zation by three safety relief valves and three power-operated relief valves in ,
combination with the reactor protection system and operating procedures. This I combination of features provides overpressurization protection in accordance with the criteria of GDC 15; the ASME Code,Section III; and 10 CFR 50, Appen- '
dix G. These criteria ensure RCPB overpressure protection for both power opera-tion and low temperature operation (startup and shutdown). Following is a dis-cussion of overpressure protection for each mode of operation. l 5.2.2.1 Overpressure Protection During Power Operation Overpressure protection during power operation is provided by the pressurizer spray system, three power-operated relief valves (PORVs), and three spring- l loaded safety relief valves (SRVs), all of which are connected to the pressurizer.
The pressurizer spray system it designed to maintain the reactor coolant system (RCS) pressure below the PORY relief setpoint of 2335 psig during normal design ,
04/11/84 5-1 BEAVER VALLEY SER INPUT SEC 5
- l 4
(
The PORVs are sized to prevent actuation of a high pressurizer pressure reactor trip at 2410 psig for all design transients up to and including the design step load decrease with steam dump. The PORVs also limit undesirable openings of the SRVs. l I
1 The SRVs provide the final overpressure protection during power operation.
l l
The PORVs and SRVs are both safety grade, and they are designed in accordance with ASME Code,Section III. Periodic testing and inspection are performed in accordance with Section XI of the Code. In FSAR Chapter 14 the applicant states that the safety relief valves will be checked and adjusted as a prerequisite to
) the initial test program in accordance with RG 1.68 Revision 2. In response to ;
NUREG-0737 Item II.D.1, the applicant states that valves and piping configura-i tions, similar to those at Beaver Valley Unit 2, have been tested in the ~
Electric Power Research Institute (EPRI) safety and_ relief valve test program.
The evaluation of the applicant's compliance with II.D.1 is included in SER Section 3.9.3. In response to NUREG-0737 Item II.D.3, the applicant states 1
1 that the PORV status and safety valve status will be indicated in the control room. The evaluation of the applicant's compliance with II.D.3 is included in l SER Section 7.5.
Each SRV has a relieving capacity of 345,000 pounds of saturated steam per hour at 2485 psig. Each PORV has a relieving capacity of 210,000 pounds of saturated steam per hour at 2335 psig. The combined capacity of two of these three safety valves is adequate to prevent the pressurizer pressure from exceeding the ASME Boiler and Pressure Vessel Code,Section III limit of 110% design pressure following the worst reactor coolant system pressure transient. This is identi-fied to be a complete loss of steam load from full power without a direct reac-tor trip.and with concurrent loss of main feedwater. This event was analyzed ,
with no credit taken for the automatic steam dump system, automatic rod control, i cr auxiliary feedwater and with no credit taken for signals generated by a tur-bine trip, which would normally trip the reactor. The reactor is assumed to be tripped by high pressurizer pressure, overtemperature AT, or high pressurizer water level signals. The analysis for this case takes no credit for the pres-surizer spray system, the pressurizer PORVs, or steam dump, but it does take credit for the operation of the steam generator safety valves.
04/11/84 5-2 ,
BEAVER VALLEY SER INPUT SEC 5
- -. - _ _ _ = _ _ _ . - _
m g
j There are five of these Code safety valves in each of the three secondary loops. They have a combined relieving capacity of 13.4x108 pounds of steam per hour with one of the valves stuck closed. This is fifteen percent more than the rated capacity of 11.6x106 lb/hr and is sufficient relieving capacity for the secondary system.
The above analyses were performed with a full plant simulation. This included the reactor coolant system with an explicit reactor vessel, hot leg, pres-surizer with an explicit surge line, primary side of the steam generator, reac-tor coolant pump, cold leg, and the secondary side of the steam generator.
These were modeled using the LOFTRAN digital computer program, which has been reviewed by the staff and found acceptable.
5.2.2.2 Overpressure Protection During Low-Temperature Operation The criteria for overpressure protection during low-temperature operation of the plant are in BTP RSB 5-2.
Low-temperature overpressure protection is primarily provided by two of the !
three pressurizer PORVs. These two have their opening setpoints automatic-
. ally adjusted as a function of reactor coolant temperature. The reactor coolant temperature measurements will be auctioneered to obtain the lowest value. This temperature will be translated into a PORV setpoint curve that will adequately account for the lag in the temperature change of the reactor vessel and for possible single failures in the auctioneering system, so the system pressure will always be below the maximum allowable pressure. This PORV setpoint curve shall be periodically updated, as shall be specified in the bases for the tech-nical specifications, to ensure that the stress intensity factors for the reactor vessel at any time in life are lower than the reference stress intensity factors as specified in 10 CFR 50, Appendix G.
The system logic will first annunciate at a predetermined low RCS temperature to alert the operator to arm the system. Another alarm on the main control board will annunciate whenever the measured pressure approaches, by a 1
04/11/84 5-3 BEAVER VALLEY SER INPUT SEC 5 l l
(
predetermined amount, the reference pressure. On further increase of the mea-sured pressure, an actuation signal will be transmitted to the PORVs to miti-gate the pressure transient.
The applicant has performed low-temperature overpressure transient analyses to determine the maximum pressure for the postulated worst case mass input and heat input events.
The mass input transient analysis was performed assuming the inadvertent actuation of a high head safety injection pump, which pressur-izes the RCS. The heat input analysis was performed for an incorrect reactor coolant pump start assuming that the RCS was water solid at the initiation of the event and that a 50*F mismatch existed between the RCS (250*F) and the secondary side of the steam generators (300*F). These temperatures were assumed because at lower temperatures the mass input ca'se is limiting. The results of these analyses show that the allowable limits will not be exceeded.
The applicant will provide PORV setpoint values Tat'er, and the staff will re-port its evaluation of these in a supplement to this SER.
An acceptance criterion for Item II.G.1 of NUREG-0737 is that the PORVs and associated block valves have safety grade emergency power supplies. Section 8.3 of the SER provides a discussion of Beaver Valley Unit 2's compliance with this criterion.
As a backup to the low-temperature overpressure protection system, both inlet lines to the residual heat removal (RHR) system have a pressure relief valve, which is designed to relieve the combined flow of two charging pumps (i.e. ,
high head safety injection pumps) at the set pressure of the relief valves.
These RHR relief valves provide overpressure protection after the RHR system is put into operation and the RHR suction isolation valves are open at an RCS pressure'of less than 425 psig.
Assuming a single failure of one of the two PORVs, and taking no credit for the RHR system relief valves, the low temperature overpressure protection system can relieve the capacity of only one HHSI/ charging pump and maintain pressure below the Appendix G limits. Thus operating procedures will require the removal of power from all HHSI/ charging pumps that are not required to be operable. To prevent an accidental overpressurization by an accumulator discharge, operating i
04/11/84 5-4 -
BEAVER VALLEY SER INPUT SEC 5
^
procedures will stipulate that the accumulator isolation valves shall be closed when the RCS pressure is below the safety injection (SI) unblock set point, and ,
that after they are closed their operating power shall be removed. To prevent i
overpressurization due to an excessive temperature differential between the RCS cnd an isolated steam generator, there will also be restrictions on the conditions under which a reactor coolant pump may'be started. We will require l
4 technical specifications on these three items. !
l 5.2.2.3 Conclusions l
i Subject to the generation of a conservative PORV setpoint curve and appropriate l Technical Specifications, the staff concludes that the overpressure protection i system meets the relevant criteria of GDC 15 and is, therefore, acceptable. '
Conformance to Appendix G to 10 CFR 50 criteria will be confirmed when the PORV
~
l setpoint curve is found acceptable. This conclusion is based on the following:
The overpressure protection system prevents overpressurization of the RCPB i under the most severe transients and limits reactor pressure during normal cperational transients. Overpressurization protection is provided by three safety valves. These valves discharge to the pressurizer relief tank through .
O common header from the pressurizer. The safety and power-operated relief valves in the primary system, in conjunction with the steam generator safety ,
and atmospheric steam dump valves in the secondary system, and the reactor protection system, will protect the primary system against overpressure.
The peak primary system pressure following the worst transient is limited to the ASME Code allowable value (110% of the design pressure) with no credit taken for nonsafety grade relief systems. The Beaver Valley Unit 2 plant was assumed to be operating at design conditions (102% of rated power) and the reactor is shut down by a high pressurizer pressure trip signal. The cal-culated pressure is less than 110% of design pressure.
i Overpressure protection during low-temperature operation of the plant is pro-vided by two PORVs and RHR suction relief valves in conjunction with adminis-trative controls.
l 04/11/84 5-5 BEAVER VALLEY SER INPUT SEC 5
a i {
i I
-The applicant has met GDC 15 and 31. Appendix G criteria are expected to be met when the PORV setpoint curve is generated. In addition, the applicant has responded to Task Action Plan Items II.D.1 and II.D.3 of NUREG-0737.
i 5.4.7 Residual Heat Removal System i
The design of the residual heat removal system (RHRS) for Beaver Valley Unit 2
( has been reviewed in accordance with SRP 5.4.7 and Branch Technical Position RSB 5-1 of NUREG-0800. Conformance with the acceptance criteria, except as noted, formed the basis for the staff's conclusion that the design of the RHRS is acceptable provided that the RHRS pumps are fully qualified for con-tinuous operation in the containment environment.
The RHRS has two independent cooling trains, which are designed for a pressure ~
of 600 psig and a temperature of 400*F. Each train has a 4000 gpm pump and a heat exchanger that is designed to transfer 29 million Stu/hr to the component cooling water. The pumps, heat exchangers, and isolation and control' valves cre all located inside of containment. Each train of this RHRS is powered by an essential, separate, power supply. In the event of a failure of a power .
supply the licensee states that it is possible to switch the power source for the operation of isolation valves from the failed power supply to the function- !
ing one. There are safety grade flow meters and' low flow alarms connected to each of the two trains.
This RHRS operates in the following modes:
(1) Cooldown Removes heat from the RCS after the system pressure and temperature have been reduced to approximately 400 psig and 350*F, respectively, by the steam and power conversion system. Under normal conditions, with two trains operating, it will take about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to get the reactor coolant ,
temperature down to 140*F. If there is only one train operating it will take about 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> to get the reactor coolant temperature down to 212*F. I l
l 1
04/11/84 5-6 . BEAVER VALLEY SER INPUT SEC 5 l
- l
3 (2) Cold Shutdown Removes fission product decay heat to maintain cold shutdown conditions.
(3) Refueling Transfers water between the refueling cavity and the refueling water -
storage tank (RWST) at the beginning and end of the refueling operations. ,
I (4) Startup i
Acts as an alternate letdown path to control RCS pressure. In this mode the RHRS is connected to the chemical volume control system (CVCS) via the ,
low pressure letdown line.
5.4.7.1 Functional Requirements !
RSB 5-1 stipulates that the design of a plant shall be such that it can be taken to cold shutdown by using only safety grade systems and that these sys- -
tems shall satisfy GDC-1 through 5. In this regard Section 5.4.7.2.5 of the .,
/
FSAR states that the entire RHRS for Beaver Valley Unit 2 is designed as Safety ;
Class 2 with the exception of the portions that form a part of the RCS pressure .
6 boundary which are designed as Safety Class 1. Compliance with GDC 1-5 criteria l
is as follows: '
GDC-1, quality assurance aspects of safety grade systems, is evaluated in SER Section 17.1.
GDC-2, design bases for safety grade systems, is evaluated in SER Sec- i t
tion 3.2.
GDC-3, fire protection of safety grade systems, is evaluated in SER Sec-tion 9.5.1.
GDC-4, environmental and missile protection design for safety grade systems, is evaluated in SER Sections 3.11 and 3.5.
04/11/84 5-7 BEAVER VALLEY SER INPUT SEC 5 l
I~
GDC-5 is complied with because these RHRS's are not shared.
f To comply with the redundancy criteria of GDC 34 the RHRS has two independent trains.
- Leak detection for the RHRS is discussed in Section 5.2.5 of this SER.
Isolation valve and power supply redundancy are discussed under separate topics in this section. The staff has reviewed the description of the RHRS and the piping and instrumentation diagrams to verify that the system can be operated with or without offsite power and assuming a single failure. The two RHR pumps are connected to separate buses that can be powered by separate diesel generators in the event of loss of offsite power. Thus a single failure, such as that of a pump, valve, or heat exchanger, will still allow the operation of one train.
However, in the inlet of each train there are two motor-operated valves (MOVs) fc isolating the RHRS from the higher pressure RCS. The two MOVs in each train are connected to separate, Class IE, electrical buses. Thus a failure of one of the electric buses could prevent water-flow in both RHRS trains. To circumvent this single failure mode, the FSAR states that the electric power source for the MOV in each train that is not powered by the same bus as powers the pump can be transferred to the other bus. The acceptability of this trans-fer method is discussed in Section 7.6 of this SER. i l
GDC 19 states that a control room shall be provided from which actions can be taken to maintain the plant in a safe condition u'nder accident conditions, including loss of-coolant accidents. SRP 5.4.7 stipulates that the control of the RHRS be such that the cooldown function can be performed from the control room assuming a single fature of any active component, with only either onsite or offsite electric power available. Any operation required outside of the con-trol room is to be justified by the applicant.
The applicant states in FSAR Section 5.4.7.2.7 that the RHRS is designed to be fully operable from the control room for normal operation and in Section 5.4.7.2.3 that the RCS can be taken from no-load temperature and pressure to cold condi-tions with only onsite or offsite power available assuming the most limiting .
single failure.
It is also stated in Section 5.4.7.2.3 that as a backup to the isolation valves on th ECCS accumulators there are redundant, Class IE, solenoid operated valves to ensure that any accumulator may be vented, should it fail to be isolated from the RCS.
04/11/84 5-8 -
BEAVER VALLEY SER INPUT SEC 5
D
- e The cpplicant states in FSAR Section 5.4.7.2.6 that in the event of such a fail-ure, RHRS operation could be initiated by defeating the failed interlock by
_ manual actions either at the solid state protection system cabinet or at the the affected motor control center. This could cause considerable delay in initiating RHRS operation. The applicant states that during this delay the auxiliary feedwater system (AFWS) and the steam generator PORVs could be used to continue the cooldown of the plant. As described in FSAR Section 10.4.9.2 there are secondary, Category I water supplies for the AFWS. The ultimate one is the Service Water System (SWS). Once this is connected, the AFWS could be used for core cooling for on indefinetly long period of time. In the event of a large break LOCA, the ECCS in conjunction with the . recirculation coolers could b'e used to continue to cooldown of the plant while these manual actions were being taken outside of the control room. On this basis we find this action out-side of the control room acceptable.
In FSAR Section 5.4.7.1 the applicant states that the RHRs is designed to reduce the temperature of the reactor coolant from 350*F to 140*F in approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. With only one train in service it will take approximately 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> to go frim 350*F to 212*F. The cooldown time of 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> with one RHRS train is acceptable. With the stated 4-hour time for cooldown from standby to RHRS ,
conditions the Beaver Valley Unit 2 plant can be brought to cold shutdown within a reasonable period of time with or without offsite power.
5.4.7.2 RHRS Isolation Requirements The RHRS valving arrangement is designed to provide adequate protection to the RHRS from overpressuri:ation when the reactor coolant system is at high pres-sure.
There are two separate and redundant motor-operated isolation valves (MOVs) between each of the two RHRS pump suction lines and the RCS hot legs. These valves are separately, diversely, and independently interlocked to prevent valve opening until the RCS pressure falls below 425 psig. If the valves are open, they are separately, diversely, and independently interlocked to close when the RCS pressure rises above 750 psig. Each one of the four RHRS suction 04/11/84 5-9 BEAVER VALLEY SER INPUT SEC 5
MOVs is aligned to a separate motor control center. One MOV in each suction line is powered from a separate power train. Thus a single failure will not prevent the isolation of the RHRS.
The possibility of water that is trapped between the two isolaton valves at a low temperature being heated and causing an overpressurization is discussed in FSAR Amendment 3. It is concluded that the maximum obtainable pressure would be 400 psi. We find this response acceptable.
There are a motor-operated isolation valve and a check valve in each of the RHRS discharge lines. The motor-operated valve is interlocked with a pressure signal to prevent its being opened whenever the RCS pressure is greater than 425 psig and to automatically close if the RCS pressure increases to 750 psig.
The controls for the isolation of each discharge line are independent. The check valve is located in the emergency core cooling system.
The staff finds that the design of the RHRS isolation system satisfies' the criteria of Branch Technical Position RSB 5-1 and is acceptable. _
5.4.7.3 RHRS Pressure Relief Requirements
~
Overpressure protection for the RHRS is provided by a pressure relief valve in each inlet line. At its set pressure, this relief valve is designed to relieve the combined full water flow of two charging pumps. Fluid flowing through these valves goes into the pressurizer relief tank. The evaluation of the compliance of these valves with NUREG-0737 Item II.D.1 is included in SER Section 3.9.3.
In response to a question on what will alert the operator to the opening of the RHRS relief valves, the applicant responded in FSAR Amendment 3 that the cperator would be alerted by either a high pressure alarm or a high level '
alarm from the pressurizer relief tank. An outline of the procedures the operator would follow for such an event was included in the response. .We find this response acceptable.
04/11/84 5-10 .
BEAVER VALLEY SER INPUT SEC 5
n . .
4 For RHRSs with automatic isolation, Branch Technical Position RSB 5-1 criteria calls for adequate pressure relief capacity while the isolation valves are closing.
~
The applicant states in FSAR Amendment 3 that additional pressure '
relief capacity is provided by the low-temperature overpressure protection
{
system and that an evaluation to determine the adequacy of the RHRS over-
{
pressure protection system will be available by March 31, 1984. We will determine the adequacy of the RHRS pressure relief when this evaluation is 8
{
i received. ,
5.4.7.4 RHRS Pump Protection The RHRS pumps are protected from operational overheating and loss of suction }
flow by miniflow bypass lines that assure flow to the pump suction. A
- throttling valve 1 ated in each miniflow line is adjusted and locked in place during initial system alignment to ensure required miniflow at all times. A pressure sensor in each pump discharge header provides a signal for an indi-cator in the control room. A high pressure alarm is also actuated by the i pressure sensor.
There are low flow alarms to alert the operator to turn off the pumps in the event the suction isolation valves close while the discharge
[ isolation valves remain open. [
l Since both RHRS pumps are located inside of containment there is a question of whether or not this environment could cause a common mode failure. Moreover, the Equipment Environmental Qualification Table (3.11-1) in the FSAR for the RHR$ does not include the RHR pumps. For a reliable system these pumps are t going to have to be qualified for the containment environment and included in Table 3.11-1. ,
In its responses to questions, which are in FSAR Amendment 3, the applicant ,
states that proper filling and venting procedures will'be used to prevent I i.
water hammer in the RHR$ and that just prior to its initiation, the RHRS will ll be cross-connected with the Chemical Volume Control System (CVCS) to pressurize '
the RHRS. '
i a
4 i 04/11/84 5-11 BEAVER VALLEY SER INPUT SEC 5
f s
5.4.7.5 Tests, Operational Procedures, and Support Systems i
The plant preoperational and startup test program provides for demonstrating
{
the operation of the residual heat removal system in conformance with RG 1.68, as specified in SRP 5.4.7, Paragraph III.12. ,
i The adequancy of the mixing of borated water added to the RCS under natural !
circulation and the ability to cooldown Beaver Valley Unit 2 with natural circulation will be verified by referencing the results of a natural circula-tion test at a similar plant. For this type of verification a detailed comparison of the two plants is required. This must. include a comparison of the elevetions of the major components. f As stated in FSAR Section 5A.3.2, the boron that is needed to offset the decay of xenon and the increase of reactivity during co~ofdo' wn is provided by redundant, seismic Category I systems.
The staff has reviewed the component cooling water system to ensure that suf-ficient cooling capability is available to the RHR$ heat exchangers. The !
acceptability of this cooling capacity and its conformance to GDC 44, 45, and 46 are discussed in Section 9.2.'2 of this SER.
The applicant states that the RHRS is housed in a structure that is designed to withstand tornadoes, floods, and seismic phenomena, and that there are no motor-operated valves in the RHRS which are subject to flooding after a loss of coolant or steam line break accident. This area is addressed further in S;ction 3 of this SER.
C nformance with GDC 4 and the criteria in RG 1.46 for withstanding pipe whip i inside containment is discussed in Section 3.6 of this SER. The entire RHRS is located inside the reactor containment.
I The applicant, following SRP 5.4.7, Paragraph II.D.1, has demonstrated that suitable plant systems and procedures are available to place the plant in a cold shutdown condition with only offsite or onsite power available within a 04/11/84 5-12
~
4 BEAVER VALLEY SER INPUT SEC 5
reasonable period of time following shutdown, assuming the most limiting single failure.
5.4.7.6 Conclusions The RHR function is accomplished in two phases: the initial cooldown phase and the RHRS operation phase. In the event of loss of offsite power, the initial phase of cooldown is accomplished by use of the auxiliary feedwater ,
i system and the atmospheric dump valves. This equipment is used to reduce the reactor coolant system temperature and pressure to values that permit operation 3
of the RHRS. The review of the initial cooldown phas.e is discussed in Section
]
10.3 of this SER. The review of the RHR$ operational phase is discussed below. .1 4
j The RHRS removes core decay heat and provides long-term cooling following the initial phase of reactor cooldown. The scope of review of the RHRS included piping and instrumentation diagrams, failure modes and effects analysis, and design performance specifications for essential components. The review has included the applicant's proposed design criteria and design bases for the ;
s RHR$ and its analysis of the adequacy of and conformance to these criteria and l' bases.
Except for the above noted unresolved issues, the staff concludes that the design of the RHRS is acceptable and meets the relevant criteria of GDC 2, '
5, 19, and 34. This conclusion is based on the following:
(1) As stated in SER Section 3.2, the applicant has met GDC 2 with respect to Position C.2 of RG 1.29 concerning the seismic design of systems, struc-tures, and components whose failure could cause an unacceptable reduction 4 in the capability of the RHRS.
1 (2) The applicant has met the criteria of GDC 5 with respect to sharing of structures, systems, and components by stating that the RHRS is not shared with another unit, i.e., Beaver Valley Unit 1.
4 a
04/11/64 5-13 BEAVER VALLEY SER INPUT SEC 5
a; i I
=
l I
(3) Except as noted above, the applicant has met GDC 19 with respect to the main control room criteria for normal operations and shutdown and GDC 34 which specifies criteria for the residual heat removal system by meeting the regulatory position in BPT RSB 5-1. l 6
I
$1 Il n
-m o e f
i i
t i
l j
h 4
04/11/84 5-14 -
BEAVER VALLEY SER INPUT SEC 5 i
- - _ _ _ _ _ _ _ _ ___ )
, m- - - - - - - - - - - - _ - - - - _
~~
6.3 Emeroency Core Coolina System The staff has reviewed the Beaver Valley Unit 2 emergency core cooling system (ECCS) in accordance with SRP 6.3 (NUREG-0800). Each of the four areas listed in the Areas of Review section of the SRP was reviewed according to the SRP Review Procedures.
Conformance with the acceptance criteria, except as noted, below, formed the basis for concluding that the design of the facility for cmergency core cooling is acceptable.
I As specified in the SRP, the design of the ECCS was reviewed to determine that it is capable of performing all of the functions stipulated in the design ~
criteria.
The ECCS is designed to provide core coolirg as well as additional shutdown capability for accidents that result in significant depressurization of the reactor coolant system (RCS).
These accidents include mechanical fail-ure of the RCS piping up to and including the double ended break of the largest
' pipe, rupture of a control rod . drive mechanism, spurious relief valve operation in the primary and secondary fluid systems, and breaks in the steam piping.
The principal bases for the staff's acceptance of this system are conformance to 10 CFR 50.46 and Appendix K to 10 CFR 50, and GDC 2, 5, 17, 27, 35, 36, and 37.
The applicant states that the criteria will be met even with minimum engineered safeguards available, such as the loss of one emergency power bus, with offsite pcwer unavailable.
6.3.1 System Design As specified in SRP 6.3.1.2, the design of the ECCS was reviewed to determine that it is capable of performing all of the functions stipulated in the design i criteria.
The ECCS design is based on the availability of a minimum of two accumulators, one high head safety injection (HHSI)/ charging pump and one low
-head safety injection pump (LHSI) for the injection phase, and one HHSI/ charging 04/11/84 6-1 BEAVER VALLEY SER INPUT SEC 6
pump and one recirculation spray pump with their associated valves and piping for the recirculation phase. Following a postulated LOCA, passive (accumulators)
._ cnd active (injection pumps and associated valves) systems will operate. After the water inventory in the refueling water storage tank (RWST) has been depleted, long-term recirculation will be provided by taking suction from the containment sump and discharging to the RCS cold and/or hot legs. The passive accumulator system consists of three pressure vessels partially filled with borated water cnd pressurized with nitrogen gas to approximately 660 psia. Fluid level, boron concentration, and nitrogen pressure'can be remotely monitored and cdjusted in each tank. When RCS pressure is lower than the accumulator tank pressure, borated water is injected through the RCS cold legs.
The high-head injection system consists of three centrifugal charging pumps that provide high pressure injection of boric acid solution into the RCS. The high-head pumps are aligned to take suction from-the RWST for the injection phase of their operation. Low-head injection is accomplished by two centri-fugal LHSI pumps taking suction from the RWST during the short-term ECCS injection and from the containment sump during the long-term ECCS recircula-tion phase.
c The capacity of the RWST is approximately 850,000 gallons. The minimum concen-tration of boron in the RWST water is 2000 ppm. 'The applicant states in FSAR 4
Section 6.2.2.2.1 that the temperature of the water in the RWST will be main-tained between 45 and 50*F during all seasons by a heat exchanger. In response to the staff's request for additional information on the vent for the RWST, the cpplicant stated in FSAR Amendment 3 that this vent is a 12-inch-diameter stainless steel pipe attached to the highest point of the tank. There is a 180* bend .in the pipe, but there are no low points that could become clogged.
In addition, this vent line is heat traced to prevent freezing. This response is acceptable to the staff.
t j;
As specified in SRP 6.3,Section II, the ECCS is initiated either manually or .
automatically on (1) low pressurizer pressure, (2) high containment pressure, or (3) low pressure in any steamline. This meets GDC 20. The ECCS may also b'e manually. actuated, monitored, and controlled from the control room as 04/11/84 6-2 -
BEAVER VALLEY SER INPUT SEC 6
l stipulated in GDC 19. The applicant states in FSAR Section 1.8 that the ;
instrumentation in Beaver Valley Unit 2 is sufficient to allow the operating staff to ascertain plant conditions during and following a LOCA. The evaluation of this aspect of the post accident monitoring system (PAMS) is in Section 7.5 of this SER. The evaluations of other aspects of the PAMS are in Sections 6.2.5, l 9.3.2, and 11.5.
As specified in SRP 6.3,Section III.3, the available net positive suction head (NPSH) for all the pumps in the ECCS (HHSI/ charging, LHSI, and recirculation spray) has been shown to provide adequate margin by calculations performed to meet the safety intent of RG 1.1, " Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal System Pumps."
As stipulated in SRP 6.3,Section III.11, the valve arrangement on the ECCS ~
discharge lines has been reviewed with respect to. a.dequate isolation between the RCS and the low pressure ECCS. All lines to the RCS have at least two check valves in series with a normally closed isolation valve. This arrange-ment is acceptable.
~
Containment isolation features for all ECCS lines, including instrument lines (GDC 56 and the criteria in RG 1.11 " Instrument Lines Penetrating Primary Reactor Containment") are discussed in Section 6.2.4 of this SER.
In response to the staff's questions on an inspection program, operator training, and emergency procedures for dealing with debris, vortices, air entrainment and other containment sump problems the applicant stated in FSAR Amendment 3 that a response would be provided in a later amendment. This item will be considered cpen until that time.
The effects of primary coolant sources outside containment (NUREG-0737, 1
Item III.D.1) are discussed in Section 13.5.2 of this SER.
During normal operation, the ECCS lines will be maintained in a filled condi-tion. Suitable vents are provided and administrative procedures will require )
that ECCS lines be returned to a filled condition following events such as I
04/11/84 6-3 BEAVER VALLEY SER INPUT SEC 6 l
- s t
maintenance that require draining of any of the lines. Maintaining these lines ;
in a filled condition will minimize the likelihood of water hammer occurring system startup. P The safety injection lines are protected from intersystem leakage by relief valves in both suction header and discharge lines. Intersystem leakage detec-tion is described in Section 5.2.5 of this SER.
As specified in SRP 6.3,Section II.B, no ECCS components are shared between units. This meets GDC 5.
6.3.2 Evaluation of Single Failures As specified in SRP 6.3,Section II, the staff has reviewed the system descrip-tion and piping and instrumentation diagrams to' verify that sufficient core cooling will be provided during the initial injection phase with and without the availability of offsite power, assuming a single failure. The cold leg accumulators have normally open motor-operated isolation valves in the dis-charge lines. One accumulator is attached to each of the RCS cold legs.
These isolation valves will have control power removed to preclude inadvertent valve movement that could result in degraded accumulator performance. i Two active injection systems are to be available, each with two pumps operable.
The pumps in each system are connected to separate power buses and are powered from separate diesel generators in the event of loss of offsite power, in accordance with GDC 17. Thus, at least one pump in each injection train would be actuated in the event of a loss of offsite power and failure of one diesel to start. The high-head injection systems contain parallel valves in the suc-tion and discharge lines, thus ensuring operability of one train even if one valve fails to open. The low-head injection systems are normally aligned so that valve actuation is not required during the injection phase.
The engineered safety features actuation system (ESFAS) is designed to auto-tatically perform the short-term injection phase; no operator actions are required. Two separate and redundant actuation trains are provided. Each 04/11/84 6-4 .
BEAVER VALLEY SER INPUT SEC 6
~
actuation train is assigned to a corresponding electrical power train to ensure that, in the event of a single failure in the actuation logic, at least
. . _ one emergency diesel generator, one LHSI, and one HHSI/ charging pump would receive an actuation signal. There are also provisions for manual actuation, monitoring, and control of the ECCS on the main control board. This complies with SRP 6.3 and is acceptable.
After a LOCA the ESFAS will automatically initiate the transfer from the injection phase to the cold leg recirculation phase. However, the following operator actions are required to complete the transfer:
- 1. Open the cold leg isolation valve in the redundant high-head safety-injection flow path. ,
- 2. Close the isolation valves in both the common suction and discharge headers of the HHSI pumps to separate the redundant flow paths.
These operator actions are acceptable.
In this phase two of the four recirculation spray pumps, which are located in .
separate cubicles outside of containment, are automatically aligned to pump the water that will collect in the containment sump to the cold legs as well as to the inlets of the HHSI/ charging pumps. The two operable charging pumps have separate flow paths to hot leg connections. This provides the capability for backflushing through the core to prevent boron precipitation. Since recircula-tion spray coolers are used to transfer the decay heat to the service water, it also provides subcooled water to terminate boiloff. This meets the criteria of SRP 6.3 Section III.6.
To ensure a long term cooling capability, leak detection and a method for isolat-ing the leak is required. The applicant states that means are provided to detect and isolate leaks in the emergency core cooling flow path within 30 minutes.
In a study of the system, the applicant found that the largest, sudden, potential leak is the failure of a recirculation spray pump shaft seal and that this would 04/11/84 6-5 BEAVER VALLEY SER INPUT SEC 6
, f d
result in a leak rate of less than 50 gpm. This maximum leak would be detected by alarms which indicate the loss of accumulator pressure on the seal water.
._ The applicant states that if this leaking pump is isolated within 30 minutes the ECCS will still meet the minimum core cooling requirements. The staff finds this system acceptable. The evaluation of the complete Equipment and Floor Drainage System is in Section 9.3.3 of this SER.
Flooding of ECCS components inside containment following a LOCA has been evalu-ated. The applicant states that all motor-operated valves which have to change positions after the injection phase are located to prevent their vulnerability to flooding and that those valves whose spurious repositioning could result in the loss of the ECCS function have their power removed.
Based on its review of the design features and with satisfactory resolution of confirmatory items discussed above, the staff concludes that the ECCS complies with the single-failure criterion of GDC 35.
6.3.3 Qualification of Emergency Core Cooling System The ECCS design to seismic Category I criteria, in compliance with RG 1.29, and its location in structures designed to withstand a safe-shutdown earthquake and other natural phenomena, per the criteria of GDC'2, and the equipment design to Quality Group B, in compliance with RG 1.26, are discussed in Section 3.2 of this SER.
The ECCS protection against missiles inside and outside containment by the design of suitable reinforced concrete barriers, which include reinforced concrete walls and slabs (conformance to GDC 4), is discussed in Section 3.5 of this SER. The protection of the ECCS from pipe whip inside and outside of containment is discussed in Section 3.6 of this SER.
The active components of the ECCS designed to function under the most severe duty loads, including safe-shutdown earthquake, are discussed in Sections 3.9 and 3.10 of this SER. The ECCS design to permit periodic inspection in accord-ance with ASME Code,Section XI, which constitutes comp 1'iance with GDC 36, is 04/11/84 6-6
- BEAVER VALLEY SER INPUT SEC 6
._- f discussed in Section 6.6 of this SER. This meets the criteria set forth in SRP 6.3, Paragraph III.23.c.
=-
The ECCS is connected to one subsystem that serves another function. The cen- ,
l trifugal HHSI/ charging pumps are normally aligned to the chemical and volume and control system (CVCS) for maintaining the required amount and chemistry of water in the RCS and for supplying water to the seals of the reactor coolant pumps.
On an ECCS actuation signal, the system is aligned for ECCS operation cnd the CVCS function is isolated. This normal system use does not impair its capability to function in the ECCS mode.
l 6.3.4 Testing i The applicant has committed to demonstrate the operability of the ECCS by sub- ~
jecting all components to preoperational and periodic testing, per the criteria of RG 1.68, "Preoperational and Initial Startup Test Programs for Water-Cooled !
Power Reactors," RG 1.79, "Preoperational Testing of Emergency Core Cooling System for Pressurized Water Reactors," and to GDC 37.
6.3.4.1 Preoperational Tests One of these tests is to verify system actuation: namely, the operability of ;
all ECCS valves initiated by the safety injection signal, the operability of all safeguard pump circuitry down through the pump breaker control circuits, and the proper operation of all valve interlocks.
Another test is to check the cold leg accumulator system and injection line to varify that the lines are free of obstructions and that the accuaiulator check valves and isolation valves operate correctly. The applicant will perform a 1cw pressure blowdown of each accumulator to confirm that the line is clear and check the operation of the check valves.
The applicant will use the results of the preoper.ational tests to evaluate the hydraulic and mechanical performance of ECCS for delivering the flow for 3
04/11/84 6-7 BEAVER VALLEY SER INPUT SEC 6
emergency core cooling. The pumps will be operated under both miniflow (through test lines) and full-flow (through the actual piping) conditions.
- By measuring the flow in each pipe, the applicant will make the adjustments necessary to ensure that no one branch has an unacceptably low or high resist-ance.
As part of the ECCS verification, the applicant will analyze the results to ensure there are sufficient total line resistance to prevent excessive runout of the pumps and adequate NPSH under the most limiting system alignment and RCS pressure.
The applicant will verify that the maximum flow rate from the test results confirms the maximum flow rate used in the NPSH calculations und the most limiting conditions and will also confirm th,at the minimum acceptable flow used in the LOCA analysis is met by the measured total pump flow and the relative flow between the branch lines.
The staff concludes that the preoperational test program conforms to the recom-mendations of RGs 1.68 and 1.79 and is acceptable pending successful completion of the program.
Additional discussion of the preoperational test program is in Section 14 of this SER.
6.3.4.2 Periodic Component Tests Routine periodic testing of the ECCS components and all necessary support systems at power will be performed.
Valves that actuate after a LOCA are cperated through a complete cycle. Pumps are operated individually in this test on their miniflow lines except the charging pumps which are tested by their normal charging function. The applicant has stated that these tests i will be performed in accordance with ASME Code,Section XI.
i 6.3.5 Performance Evaluation I l
i The ECCS has been designed to deliver fluid to the RCS to limit the maximum fuel cladding temperature following transients and accidents that require ECCS actua-l tion. The ECCS is also designed to remove the decay and sensible heat during the recirculation mode. 10 CFR 50.46 lists the acceptance criteria for an ECCS.
These criteria include the following:
04/11/84 6-8 -
BEAVER VALLEY SER INPUT SEC 6
6 l
(1) The calculated maximum fuel cladding temperature does not exceed 2200*F.
(2) The calculated total oxidation of the cladding does not exceed 0.17 times the total cladding thickness before oxidation.
(3) The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.
(4) Calculated changes in core geometry are such that the core remains
~
amenable to cooling.
(5) After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptable low value and decay heat is removed for the extended period of time required by
, the long-lived radioactivity remaining in the core.
In addition, 10 CFR 50.46 states ECCS cooling performance shall be calculated in accordance with an acceptable model, and shall be calculated for a number of postulated loss-of-coolant accidents. Appendix K to 10 CFR 50, ECCS Evaluation Models, sets forth certain criteria and acceptable features of evaluation models.
6.3.5.1 Large-Break LOCA The applicant has examined a spectrum of large breaks in RCS piping, end these analyses indicate that the most limiting event is a cold-leg double-ended guil-lotine break with a Moody discharge coefficient of 0.4. The applicant took credit in the analysis for one train of active ECCS components and two of the 04/11/84 6-9 BEAVER VALLEY SER INPUT SEC 6
(
a three accumulators. ECCS was assumed to be initiated by low pressurizer pres-
~
sure trip. The analysis results demonstrate that adequate core cooling is pro-vided assuming the worst single failure, with no credit taken for nonsafety-grade equipment.
The large-break LOCA evaluation model used in this analysis is described in WCAP-9220. This model was approved by NRC (letter from J. F. Stolz, NRC, to T. M. Anderson, Westinghouse, dated April 29,1978) and is used in large-break LOCA analyses for Westinghouse plants. Concerns expressed in NUREG-0630 about the conservatism of fuel-cladding swelling and rupture models used in LOCA analyses have been addressed by the applicant. .
Containment parameters are chosen to minimize containment pressure so that core .
reflood calculations are conservative. Fuel rod initial conditions are chosen to maximize clad temperature and oxidation. Calcuja'tions of core geometry are carried out past the point where temperatures start to decrease. The,most limit-ing break with respect to peak clad temperature is the double-ended guillotine break in the pump discharge leg with a CD = 0.4. The peak clad temperature is 2179'F, which is below the 2200'F limit of 10 CFR 50.46. The limiting local and core-wide clad oxidation values calculated by the applicant were 7.95% and less than 0.3%, respectively.
6.3.5.2 Small-Break LOCA The LOCA sensitivity studies determined the limiting small break to be less than a 10-inch-diameter rupture of the RCS cold leg. A range of small-break analyses was presented that established the limiting break size. The analysis of this break has shown that the high-head portion of the ECCS, together with accumulators, provides sufficient core flooding to keep the calculated peak i
cladding temperature below the limits of 10 CFR 50.46.
The applicant analyzed a spectrum of small-break LOCAs. These showed that a -
3-inch-diameter break is the limiting small break, the calculated peak clad temperature is 1985'F, the maximum local zirconium-water reaction is 2.88%, and the core-wide zirconium-water reaction is less than 0.3%. ,
04/11/84 6-10 ' BEAVER VALLEY SER INPUT SEC 6
s' '
The applicant has analyzed the performance of the ECCS in accordance with the criteria set forth in 10 CFR 50.46 and Appendix K to 10 CFR 50. The staff has reviewed the applicant's evaluation, and concludes that it is acceptable.
6.3.6 Conclusions The ECCS includes the piping, valves, pumps, heat exchangers, instrumentation, >
and controls used to transfer heat from the core after a LOCA. The scope of !
review of the ECCS for Beaver Valley Unit 2 included piping and instrumentation diagrams, equipment layout, failure modes and effects analyses, and design specifications for essential components. The review included the applicant's proposed design criteria and design bases for the ECCS and the manner in which the design conforms to these criteria and bases.
The staff concludes that the design of the ECCS1s acceptable and meets the requirements of GDC 2, 5, 17, 27, 35, 36, and 37. This conclusion is based on the following:
(1) As stated in Section 3.2 of this SER the applicant has met the criteria of f GDC 2 with regard to the seismic design of nonsafety systems or portions .
thereof that could have an' adverse effect on ECCS by meeting Position C.2 of RG 1.29.
(2) The applicant has met the criteria of GDC 5 with respect to sharing of structures, systems, and components by demonstrating that such sharing does not significantly impair the ability of the ECCS to perform its safety function.
(3) The applicant has met the criteria of GDC 17 with respect to providing sufficient capacity and capability to ensure that (a) specified acceptable fuel design limits and design conditions of the RCPB are not exceeded as a result of anticipated operational occurrences and (b) the core is cooled and vital functions are maintained in the event of postulated accidents.
T 1
L 04/11/84 6-11 BEAVER VALLEY SER INPUT SEC 6
. 'o (
(4) The applicant has met the criteria of GDC 27 with regard to providing combined reactivity control system capability to ensure that under postu-lated accident conditions and with appropriate margin for stuck rods, the
" capability to cool the core is maintained, and the applicant's design meets the guidelines of RG 1.47.
(5) The applicant has met the criteria of GDC 35 in regard to abundant cooling capability for ECCS by providing redundant safety grade systems that meet the recommendations of RG 1.1.
(6) The applicant has met the criteria of GDC 36 with respect to the design of ECCS to permit appropriate periodic inspection of important components of the system.
(7) The applicant has met the criteria of GDC 37 sith respect to designing the ECCS to permit testing of the operability of the system throughout the life of the plant, including the full operational sequence that brings the system into operation.
(8) The applicant has provided an analysis of the ECCS performance using an approved analysis model th'at meets the criteria of Appendix K to 10 CFR 50 and has shown the system performance meets the acceptance criteria of 10 CFR 50.46. This includes a demonstration that the peak cladding tem-perature, maximum hydrogen generation, and long-term cooling, as calcu-
, lated with an acceptable evaluation model, are in accordance with these criteria.
04/11/84 6-12 ' BEAVER VALLEY SER INPUT SEC 6