ML20132C310
Text
-
,a NI 17 19 9 j
MEMORANDUM F0k; Thomas M. Novak, Assistant Director for Licensing Division of Licensing FROM:
R. Wayne Houston, Assistant Director for Reactor Safety Division of Systems Integration
SUBJECT:
BEAVER VALLEY UNIT ~2 SAFETY EVALUATION REPORT Plant Name:
Beaver Valley Unit 2 Do-ket No.:
50-412 Licensing Stage:
OL Responsible Branch:
Licensing Branch f3 Project Hanager:
M. Licitra Review Branch:
Reactor Systems Branch Review Status:
Awaiting Infomation The Reactor Systems Branch's input to the Beaver Valley Unit 2 Safety Evaluation Report, and its input to SALP are attached. The applicant has numbered the open issues in this SER and has proposed the following response date:
Proposed Reponse Number SER Pace Issue Date 158 5-5 PORV Setpoint values July 16, 1984 161 5-11 Qualification of RHR pumps July 16, 1984 162 5/12 Natural Circulation Test July 16, 1984 163 6-2 Containaant sump debris July 16, 1984 200 15-1 Info on individual events July 16, 1984 201 15-9 Turbine trip event July 16, 1984 C0hTACT:
E. Lantz X27839 h@l'c6dMh(o); Yb l_ c i
i i
i
_s T
'T' I
i
.. J..
.. +.
l l
e Th'omas H. Hovak +'
Proposed Reponse Number SER Pace Issue Date 202 15-11 P.eactor Coolant pump seizure July 16, 1984 203 15-13 Redundant baron dilution alams New Issue Original signed by R. Wayne Houston' R. Wayne Houston, Assistant Director for Reactor Safety Division of Systems Integration cc: w/o enclosure RSB Section Leaders H. Licitra H. Ley DISTRIBLTTION Docket File RSB R/F RSB P/F: Beaver Valley 2 Elantz R/F AD/RS Rdg.
BSheron LMarsh Elantz
- PREVIOUS CONCURRENCE ON FILE W/RSB.
DS I
'cE >I
.I. :,RSB.* :.
..DS.I. :.RS.B.*.....DSI:.RSB*.....f:
D wry Elantz :gd
,.LMarsh BSheron FifdisTon '
any,b!/5l$5'.'b7/Ibl8........
...12 84....... 07.. f. 8...
I b7
stribution Isket File
(
~
IB R/F' iB 'P/F: Beaver Valley 2
.antz R/F
.antz ta rs h' -
s sheron 13uston MEMORANDUM FOR:
Thomas H.. Hovak, Assistant Director for Licensing Division of Licensing FROM:
R, Wayne Houston, Assistant Director r Reactor Safety Divi ion of Systems Integration
SUBJECT:
BEAVER ALLEY UNIT 2 SAFETY EVALUATION REPORT Plant Name:
Beavet Valley Unit 2 Docket No.:
50-412 Licensing Stage:
^,
Resoonsible Branch:
Licensin -Branch #3 ProjectManager:
M. Licitra Review Branch:
Reactor Sys ems Branch Review Status:
Awaiting Info', tion The Reactor Systems Branch's input to the B' er Valley Unit 2 Safety Evaluation Report, and its input to SALP is attached.
R. Wayne Houston, Assistant Di tor for Reactor Safety Division of Systems Integration ec:
w/o enclosure RSB Section Leaders H. Licitra M. Ley CONTACT:
E. Lantz, 27839
.s
.D S.I.cfD...... l l'p-,.D. l....D.d: R. S.
..DS.I.:.A.D.:.RS...
g.
$/sr
'} 'o7/117sr -, "o7/"'7sr
..do747 sr ' ]
7 t
. 4..
.a.
~
5 REACTOR COOLANT SYSTEM 5.1 Summary Description 5.2 Inteority of Reactor Loolant Pressure Boundary 5.2.1 Compliance with ASME Code and Code Cases 5.2.2 Overpressure Protection Overpressure protection for Beaver Valley Unit 2 has been revieked in accordance with SRP 5.2.2 (NUREG-0800).
Conformance with the acceptance criteria, except as noted, formed the basis for the staff's conclusion that the design of the facility for overpressure protection is acceptable.
The reactor coolant pressure boundary (RCPE) is protected from overpressuri-
~~
zation by three safety relief valves and three power-operated relief valves in combinationswith the reactor protection syste,m and operating procedures.
This combination of features provides overpressurization protection in accordance with the criteria of GDC 15; the ASME Code,Section III; and 10 CFR 50, Appen-dix G.
These criteria ensure RCPB overpressure protection for both power opera-tion and low temperature operation (startup and shutdown).
Following is a dis-cussion of overpressure protection for each mode of operation.
5.2.2.1 Overpressure Protection During Power Operation Overpressure protection during power operation is provided by the pressurizer spray system, three power-operated relief valves (PORVs), and three spring-loaded safety relief valves (SRVs), all of which are connected to the pressurizer.
The pressurizer spray system is designed to maintain the reactor coolant system (RCS) pressure below the PORV relief setpoint of 2335 psig during normal design transients.
06/08/84 5-1 BEAVER VALLEY SER INPUT SEC 5
The PORVs are sized to prevent actuation of a high pressurizer pressure reactor trip at 2410 psig for all design transients up to and including the design step, I
load decrease with steam dump.
The PORVs also limit undesirable openings of the SRVs.
The SRVs provide the final overpressure protection during power operation.
The PORVs and SRVs are both safety grade, and they are designed in accordance with ASME Code,Section III.
Periodic testing and inspection are performed in accordance with Section XI of the Code.
In FSAR Chapter 14 the applicant states that the safety relief valves will be checked and adjusted as a prerequisite to the initial test program in accordance with RG 1.68 Revision 2.
In response to NUREG-0737 Item II.D.1, the applicant states that valves and piping configura-tions, similar to those at Beaver Valley Unit 2, have been tested in the Electric Power Research Institute (EPRI) safety and relief valve test program.
The evaluation of the applicant's compliance with II.D.1 is included in SER Section 3.9.3.
In response to NUREG-0737 Item II.D.3, the applicant states that the PORV status and safety valve status will be indicated in the co'ntrol room.
The evaluation of the applicant's compliance with II.D.3 is included in
~
SER Section 7.5.
Each SRV has a relieving capacity of 345,000 pounds of saturated steam per hot.r at 2485 psig.
Each PORV has a relieving capacity of 210,000 pounds of saturated steam per hour at 2335 psig.
The combined capacity of two of these three safety valves is adequate to provent the pressurizer pressure from exceeding the ASME Boiler-and Pressure Vessel Code,Section III limit of 110% design pressure follov.',g the worst reactor coolant system pressure transient., This is identi-f' c to be a complete loss of steam load from full power without a direct reac-tor trip and with concurrent loss of main feedwater.
This event was analyzed with no credit taken for the automatic steam dump system, automatic rod control, or auxiliary feedwater and with no credit taken for signals generated by a tur-bine trip, which would normally trip the reactor.
The reactor is assumed to be tripped by high pressuri2er cressure, overtemperature LT, or high pressurizer water level signals.
The analysis for this case takes no credit for the pres-surizer spray system, the pressurizer PORVs, or steam dump, cut it does take credit for the operation 01 the steam generator safety valves.
0*/11/64 5-2 EEAVER VALLEY SER INPUT SEC 5
There are five of these Code safety valves in each of the three secondary loops.
They have a combined relieving capacity of 13.4x106 pouncs of steam per hour with one of the valves stuck closed.
This is fifteen percent more than the rated capacity of 11.6x106 lb/hr and is sufficient relieving capacity for the secondary system.
The above analyses were performed with a full plant simulation.
This included the reactor coolant system with an explicit reactor vessel, hot leg, pres-surizer with an explicit surge line, primary side of the steam generator, teat-tor co-iant pump, cold leg, and the secondary side of the steam generator.
These were modeled using the LOFTRAN digital computer program, which has been reviewed by the staff and found acceptable.
5.2.2.2 Ove,rpressure Protection During Low-Temperature Operation The criteria for overpressure protection during low-temperature operation of the plant are in BTP RSB 5-2.
Low-temperature overpressure protection is primarily provided by two of the three pressurizer PORVs.
These two have their opening setpoints automatic-ally adjusted as a function of reactor coolant temperature.
The reactor coolant temperature measurements will be auctioneered to obtain the lowest value.
This temperature will be translated into a PORV setpoint curve that will adequately account for the lag in the temperature change of the reactor vessel and for possible single failures in the auctioneering system, so the system pressure l
will always be below the maximum allowable pressure.
This PORV setpoint curve shall be periodically updated, as shall be specified in the bases for the tech-l nical specifications, to ensure that the stress intensity factors for the reactor vessel at any time in life are lower than the reference stress intensit'y factors as specified in 10 CFR 50, Appendix G.
The system logic will first annunciate at a predetermined low RCS temperature to alert the operator to arrr the system.
Ancther alar:r on the main centrol bt,ard will annunciate whenever the measured pressure a;;rcaches, by a
- '11/E 5-3 EEAVER VALLEY SER IlGUT SEC 5
'S precetermined amount, the reference pressure.
On further increase of the mea-surec pressure, an act'uation signal will be transmitted to the PORVs to miti-gate the pressure transient.
The applicant has performed low-temperature overpressure transient analyses to determine the maximum pressure for the postulated worst case mass input and heat input events.
The mass input transient analysis was performed assuming the inadvertent actuation of a high head safety injection pump, which pressur-izes the RCS.
The heat input analysis was performed for an incorrect reactor coolant pump start assuming that the RCS was water solid at the initiation of the event and that a 50 F mismatch existed between the RCS (250 F) and the secondary side of the steam generators (300 F).
These temperatures were assumed because at lower temperatures the mass input case is limiting.
The results of these analyses show that the allowable limits will not be exceeded.
The applicant will provide PORV setpoint values later, and the staff will re-port its evaluation of these in a supplement to this SER.
An acceptance criterion for Item II.G.I of NUREG-0737 is that the PORVs and associated block valves have safety grade emergency power supplies.
Section 8.3 of the SER provides a discussion of Beaver Valley Unit 2's compliance with this criterion.
As a backup to the low-temperature overpressure protection system, both inlet line's to the residual heat removal (RHR) system have a pressure relief valve, which is. designed to relieve the combined flow of two charging pumps (i.e.,
high head safety injection pumps) at the set pressure of the relief valves.
These RHR relief valves provide overpressure protection after the RHR system is put inte operation and the RHR suction isolation valves.are open at an RCS pressure of less than 425 psig.
Assuming a single failure of one of the two PORVs, and taking no credit for the RHR system relief valves, the low temperature overpressure prctection system car, relieve. the capacity of only one Hn51/ charging pum: and maintain pressure i
beic-the Appendix G limits.
Thus operating precedures will require the removal of power f rom all HH5I/ charging pumps that are not required to be operable.
To prevent an accidental overpressurization by an accumulator discharge, operating r, /11/S:
5-4 EEAVER VALLEY SER INPUT SEC 5 J
procedures will stipulate that the accumulator isolation valvas shall be closed when the RCS pressure is below the safety injection (SI) unblock set point, and that af ter they are closed their operating power shall be removed.
To prevent overpressurization due to an excessive temperature differential between the RCS and an isolated steam generator, there will also be restrictions on the conditions under which a reactor coolant pump may be started.
We will require technical specifications on these three items.
5.2.2.3 Conclusions Subiect to the ceneration of a conservative PORV setpoint curve and appropriate Tect!nical Specifications, the staff concludes that the overpressure protection system meets the relevant criteria of GDC 15 and is, therefore, acceptable.
Conformance to Appendix G to 10 CFR 50 criteria will be confirmed when the PORV setpoint curve is found acceptable.
This conclusion is based on the following:
The overpressure protection system prevents overpressurization of the RCPB under the most severe transients and limits reactor pressure during norm'al operational transients.
Overpressurization protection is provided by three safety valves.
These valves discharge to the pressurizer relief tank through a common header from the pressurizer.
The safety and power-operated relief valves in the primary system, in conjunction with the steam generator safety and atmospheric steam dump valves in the secondary system, and the reactor protection system, will protect the primary system against overpressure.
The peak primary system pressure following the worst transient is limited to the ASME Code allowable value (110% of the design pressure) with no credit taken for nonsafety grade relief systems.
The Beaver Valley Unit 2 plant was assumed to be operating at design conditions (102% of rated power) and the reactor is shut down by a high pressurizer pressure trip signal.
The cal-culated pressure is less than 110% of design pressure.
Overpressure protection during low-temperature operation of the plant is pro-vided by two PORVs and RHR suttion relief valves in conjunction with adminis-trative controls.
OI/11/E4 5-5 EEAVER VALLEY SER INPUT SEC 5
f The applicant has met GDC 15 and 31.
Appendix G criteria are expected to be met'when the PORV setpoint curve is generated.
In addition, the applicant has responded to Task Action Plan Items II.D.1 and II.D.3 of NUREG-0737.
5.4.7 Residual Heat Removal System The design of the residual heat removal system (RHRS) for Beaver Valley Unit 2 has been reviewed in accordance with SRP 5.4.7 and Branch Technical Pos RSB 5-1 of NUREG-0800.
Conformance with the acceptance criteria, except as formed the basis for the staff's conclusion that the design of the
- noted, RHR5 is acceptable provided that the RHR5 pumps are fully qualified for con-tinuous operation in the containment environment.
The RHR5 has two independent cooling trains, which are designed for a pressure of 600 psig and a temperature of 400 F.
Each train has a 4000 gpm pump and a heat exchanger that is designed to transfer 29 million Btu /hr to the component cooling water.
The pumps, heat exchangers, and isolation and control valves are all located inside of containment.
Each train of this RHR5 is power'ed by an essential, separate, power supply.
In the event of a failure of a power supply the licensee states that it is possible to switch the power source for the operation of isolation valves from the failed power supply to the function-
-ing one.
There are safety grade flow meters and low flow alarms connected to each of the two trains.
This RHR5 operates in the following modes:
(1) Cooldcwn Removes heat from the RCS after the system pressure and temperature have been reduced to approximately 400 psig and 350*F, respectively, by the steam and power conversion system.
Under normal conditions, with two trains operating, it vill take about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to get the reactor coolant temperature down to 140 F.
If there is only one train operating it will take about 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> to get th' e reactor ccolant temperature down to 212"F.
t C4/11/84 5-6 BEAVER VALLEY SER INPUT SEC 5
]
(2)
Cold Shutdown Removes fission product decay heat to maintain cold shutdown conditions.
(3)
Refuelino Transfers water between the refueling cavity and the refueling water storage tank (RWST) at the beginning and end of the refueling operations.
~
(4) Startup Acts as an alternate letdown path to control RCS pressure.
In this made the RHR5 i's connected to the chemical volume control system (CVCS) via the low pressure letdown line.
5.4.7.1 Functional Requirements RSS 5-1 stipulates that the design of a plant shall be such that it can be taken to cold shutdown by using only safety grade systems and that these sys-tems shall satisfy GDC-1 through 5.
In this regard Sec; ion 5.4.7.2.5 of the FSAR states that the entire RHR5 for Beaver Valley Unit 2 is designed as Safety Class 2 with the exception of the portions that form a part of the RCS pressure boundary which are designed as Safety Class 1.
Compliance with GDC 1-5 criteria is as follows:
GDC-1, quality assurance aspects of safety grade systems, is evaluated in SER Section 17.1.
GDC-2, design bases for safety grade systems, is evaluated in SER 'Sec-tion 3.2.
GDC-3, fire protection of safety grade systems, is evaluated in SER Sec-tion 9.5.1.
GDC-4, environmental and missile protection design for safety grade systems, is evaluated in SER Sections 3.11 and 3.5.
c:.'11/E4 5-7 EEAVER VALLEY SER I' GUT SEC 5
GDC-5 is complied with because these RHRS's are not shared.
To comply with the redundancy criteria of GDC 34 the RHR5 has two independent trains.
Leak detection for the RHR5 is discussed in Section 5.2.5 of this SER.
Isolation valve and power supply redundancy are discussed under separate topics in this section.
The staff has reviewed the description of the RHR5 and the piping and instrumentation diagrams to verify that the system can be operated with or without offsite power ar.c assuming a single failure.
The two RHR pumps are connected to separate buses that can be powered by separate diesel generators in the event of loss of offsite power.
Thus a single failure, such as that of a pump, valve, or heat exchanger, will still allow the operation of one train.
However, in the inlet of each train there are two motor operated valves (MOVs) for isolating the RHR5 from the higher pressure RCS.
The two MOVs in each train are connected to separate, Class 1E, electrical buses.
Thus a failure of one of the electric buses could prevent water flow in both RHR5 trains.
To I
circumvent this single failure mode, the FSAR states that the electric power source for the MOV in each train that is not powered by the same bus as powers the pump can be. transferred to the other bus.
The acceptability of thiz trans-fer method is discussed in Section 7.6 of this SER.
GDC 19 states that a control room shall be provided from which actions can be taken to maintain the plant in a safe condition under accident conditions, including loss-of-coolant accidents.
SRP 5.4.7 stipulates that the control of the RHR5 be such that the cooldown function can be performed from the control room assuming a single faiure of any active component, with only either onsite or offsite electric power available.
Any operation required outside of the con-trol room is to be justified by the applicant.
l The applicant states in FSAR Section 5.4.7.2.7 that the RHR5 is designed to be fully operable from the control room for normal operation and in Section 5.4.7.2.3 that the RCS can be taken from no-load temperature and pressure to cold condi-tions with only onsite or offsite power available assuming the most limiting single failure.
It is also stated in Section 5.4.7.2.3 that as a backup to the isolation valves on th ECCS accumulators there are redundant, Class IE, solenoid operated valves to ensure that any accumulator may be vented, should it fail to be isolated from the RCS.
04/11/E4 5-8 BEAVER VALLEY SER INPUT SEC 5
3 The applicant states in FSAR Section 5.4.7.2.6 that in the event of such a fail-ure, RHRS operation could be initiated by defeating the failed interlock by manual actions either at the solid state, protection -system cabinet or at the the affected motor control center.' This could cause considerable delay in initiating.RHRS operation..
The applicant states Ahat'during this delay the auxiliary feedwater system (AFWS) and the steam generator PORVs could be used
{
L.
to continue the cooldown of the plant.
As described in FSAR Section 10.4.9.2 there are secondary, Category I water' supplies for the AFWS.
The ultimate one is the Service Water System (SWS).
Once this is connected, the AFWS could be used for core cooling for on indefinetly long period of time.
In the event of a large break LOCA, the ECCS in conjunction with the recirculation coolers could be used to continue to cooldown of the plant while these manual actions were being taken outside of the control room.
On this basis we find this action out-side of the control room acceptable.
In FSAR Section 5.4.7.1 the applicant states that the RHRs is designed to reduce the temperature of the reactor coolant from 350*F to 140*F in approximately 4
j 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
With only one train in service it will take approximately 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> to go from 350*F to 212*F.
The cooldown time of 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> with one RHRS train i
is acceptable.
With the stated 4-hour time for cooldown from standby to RHRS conditions the Beaver Valley Unit 2 plant can be brought to cold shutdown within a reasonable period of time with or without offsite power.
5.4.7.2 RHRS Isolation Requirements The RHRS valving arrangement is designed to provide adequate protection to the RHRS from overpressurization when the reactor coolant system is at high pres-sure.
i There are two separate and redundant motor-operated isolation valves (MOVs) between each of the two' RHR5 pump suction lines and the RCS hot legs.
These valves are separately *, diversely, and independently interlocked to prevent valve opening until the RCS pressure falls below 425 psig.
If the valves are open, they are separately, diversely, and independently interlocked to close whea the RCS pressure rises above 750 psig.
Each one of the four RHRS suction 4
06/08/84 5-9 BEAVER VALLEY SER INPUT SEC 5
l f
3~
(
MOVs is aligned to a separate motor control center.
One MOV in each suction line is powered from a separate power train.
Thus a single failure will not prevent the isolation of the RHRS.
The possibility of water that is trapped between the two isolaton valves at a low temperature being heated and causing an overpressurization is discussed in FSAR Amendment 3.
It is concluded that the maximum obtainable pressure would be 400 psi.
We find this response acceptable.
There are a motor-operated isolation valve and a check valve in each of the RHR5 discharge lines.
The motor-operated valve is interlocked with a pressure signal to prevent its being opened whenever the RCS pressure is greater than 425 psig and to automatically close if the RCS pressure increases to 750 psig.
The controls for the isolation of each discharge line are independent.
The check valve is located in the emergency core cooling system.
The staff finds that the design of the RHR5 isolation system satisfies the criteria of Branch Technical Position RSB 5-1 and is acceptable.
5.4.7.3 RHR5 Pressure Relief Requirements Overpressure protection for the RHR5 is provided by a pressure relief valve in l
each inlet line.
At its set pressure, this relief valve is designed'to relieve j
the combined full water flow of two charging pumps.
Fluid flowing through these valves goes into the pressurizer relief tank.
The evaluation of the compliance of these valves with NUREG-0737 Item II.D.1 is included in SER Section 3.9.3.
In response to a question on what will alert the operator to the opening of the RHR5 relief valves, the applicant responded in FSAR Amendment 3 that the operator would be alerted by either a high pressure alarm or a high level alarm from the pressurizer relief tank.
An outline of the procedures the' operator would follow for such an event was included in the response.
We find this response acceptable.
N/ _/84 5-10 EEAVER VALLEY SER INPUT SEC 5
For RHRSs with autcmatic isolation, Branch TGchnical Posi~ ion RSB 5-1 criteria t
ca.11s' for adequate pressure relief capacity while the isolation valves are closing.
The applicant states in FSAR Amendment 3 that this additional pre;-
sure relief capacity is provided by the low-temperature overpressure protection system 5.4.7.4 RHR5 Pump Protection The RHR5 pumps are protected fror.
perational overheating and loss of suction flow by miniflow bypass lines that ssure flow to the pump suction.
A throttling valve located in each miniflow line is adjusted and locked in place during initial system alignment to ensure required miniflow at all times.
A pressure sensor in each pump discharge header provides a signal for an indi-cator in the control room.
A high pressure alarm is also actuated by the pressure sensor.
There are low flow alarms to alert the operator to turn off the pumps in the event the suction isolation valves close while the discharge isolation valves remain open.
Since both RHR5 pumps are located inside of containment there is a question cf whether or not this environment could cause a common mode failure.
- Moreover, the Equipment. Environmental Qualification Tab.le (3.11-1) in the FSAR for the RHR5 does not include the RHR pumps.
For a reliable system _these pumps are going to have to be qualified f.nr ate r.ontainment environment and included in
" Table 3.11-1.
In its responses to questions, which are in FSAR Amendment 3, the applicant states that proper filling and venting procedures will be used to prevent water hammer in the RHR5 and that just prior to its initiation, the RHR5 will be cross-connected with the Chemical Volume Control System (CVCS) to pressurize the RHRS.
06/08/84 5-11 EEAVER VALLEY SER INPUT SEC 5
I 5.4.7.5 Tests, Operational Procedures, anc Support Systems ine plant preoperational and startup test program provices for demonstrating the operation of the resioual heat removal system in confo mance with RG 1.68, as specified in SRP 5.4.7, Paragraph 111.12.
The adequancy of the mixing of borated water added to the RCS under natural circulation and the ability to cooldown Beaver Valley Unit 2 with natural circulation will be verified by referencing the results of a natural circula-tion test at a similar plant.
For this type of verification a detailed comparison of the two plants is required.
This must include a comparison 'f
~
the elevations of the major components As stated in FSAR Section SA.3.2, the boron that is needed to offset the decay l
of xenon and the increase of reactivity during cooldown is provided by redundant, seismic Category I systems.
The staff has reviewed the component cooling water system to ensure that suf-ficient cooling capability is available to the RHRS heat exchangers.
The acceptability of this cooling capacity and its conformance to GDC 44, 45, and 46 are discussed in Section 9.2.2 of this SER.
l The applicant states that the RHR5 is housed in a structure that is designed to withstand tornadoes, floods, and seismic phenomena, and that there are no motor-operated valves in the RHR5 which are subject to flooding after a loss of coolant or steam line break accident.
This area is addressed further in l
Section 3 of this SER.
Conformance with GDC 4 and the criteria in RG 1.46 for withstanding pipe whip inside containment is discussed in Section 3.6 of this SER.
The entire RHRS is located inside the reactor containment.
The applicant, following SRP 5.4.7, Paragrapr II.D.1, has demonstrated that suitable plant systems and procedures are available to place the plant in a cold shutdown condition with only of f site or ensite power available within a
11/E4 5-12 EEAVER VALLEY SER INPUT SEC 5
reasenable period of time following shutdown, assuming the most limiting single failure.
5.4.7.6 Conclusions The RHR ' function is accomplished in two phases:
the initial cooldown phase and the RHRS operation ph'ase.
In the event of loss of offsite power, the initial phase of cooldown is accomplished by use of the auxiliary feedwater system and the atmospheric dump valves. This equipment is used to reduce the reactor coolant system temperature and pressure to values that permit operation of the RHRS.
The review of the initial cooldown phase is discussed in Section 10.3 of this SER.
The review of the RHRS operational phase is discussed below.
The RHRS removes core decay heat and provides long-term cooling following the initial phase of reactor cooldown.
The scope of review of the RHRS included piping and instrumentation diagrams, failure modes and effects analysis, and design performance specifications for essential components.
The review has included the applicant's proposed design criteria and design bases for the RHRS and its analysis of the adequacy of and conformance to these criteria and bases.
Except for the above noted unresolved issue, the staff concludes that the design of the RHRS is' acceptable and meets the relevant criteria of GDC 2, 5, 19, and 34.
This conclusion is; based on the following:
(1)
As stated in SER Section 3.2, the applicant has met GDC 2 with respect to Position C.2 of RG 1.29 concerning the seismic design of systems, struc-tures, and components whose failure could cause an unacceptable reduction in the capability of the RHRS.
(2)
The applicant has"skt the criteria of GDC 5 with respect to sharing of structures, systems, and components by stating that the RHRS is not shared with another unit, i.e., Beaver Valley Unit 1.
06/08/84 5-13 BEAVER VALLEY SER INPUT SEC 5
f (3)
Except as noted above,tb8 applicant has met GDC 19 with respect to the l
main control room criteria for normal operations and shutdown and GDC 34 i
which specifies criteria for the residual heat removal. system by meeting I
the regulatory position in BPT RSB 5-1.
I i
i i
t I
i l
C4 /* 1/24 5-14 BEAVER VALLEY SER INPUT SEC 5
5.4.12 Reactor Coolant System High Point Vents 10 CFR 50.44(c) (3) (iii) requires all light water reactors to have high point vents on the reactor coolant system and on the reactor vessel head.
This requirement is supplemented by guidance in SRP 5.4.12 and NUREG-0737 Item II.B.1.
The applicant has provided information on the RCS high point vent system in FSAR Sections 5.4.13 and 5.4.15.
The Beaver Valley' Unit 2 vent system consists of three pressurizer vent paths with PORV's and block valves and a reactor vessel head vent with two parallel f'.ow paths with redundant isolation valves in each flow path.
The pressurizer vent paths with PORV's and block valves are evaluated in Section 5.2 of this SER.
In FSAR Section 5.4.15 the applicant states the following about the reactor vessel head vent system (RVHVS):
1.
The active portion of the system consists of four one-inch open/
close solenoid operated isolation valves connected to a 1" vent pipe located near the center of the reactor vessel head.
2.
All piping and equipment from the vessel head vent up to and including the second isolation valve in each flow path are designed and fabri-cated in accordance with ASME Section III, Class I requirements.
3.
The piping and equipment in the flow paths from the second isolation valves to the modulating valves are designed and fabricated in accordance with ASME Section III, Class 2 requirements.
4.
The isolaton valves in one flow path are powered by one vital power supply and the valves in the second flow path are powered by a second vital power supply.
The isola *. ice alves are fail closed normally closed valves.
05/15/84 5-15 BEAVER VALLEY SER INPUT SEC 5
d I'*
5.
The system is operated from the control room.
The isolation valves have stem position switches.
The position indication from each valve is monitored in the. control room by status lights.
l The app.]icant states that 'a break of the RVHV5 wnuld result in a small LOCA of not greater than one-inch diameter.
This event is bounded by the spectrum of pipe breaks considered in Section 15 of this SER.
The applicant has evaluated the possibility of inadvertent actuation of the reactor vessel head vent system and states that no single component failure, operator error, or test and maintenance action could cause inadvertent opening or a failure to close af ter opening.
The staff has reviewed the head vent system design and concurs with the applicant's conclusion.
The applicant has met the requirements of 10 CFR 50.44(c)(3)(iii) by; (1) providing vent paths for the vessel head and pressurizer (2) providing remote operation from the control room (3) providing environmentally and seismically qualified components and power sources for the vent systems (4) taking measures to provide a degree of redundancy to assure venting operation and minimize inadvertent or irreversible operation Before the vent system is considered fully operational the applicant must (1) complete operating procedures based on staff approved operating guidelines (2) adopt operability requirements for the vent system in the plant Technical Specifications 06/08/84 5-16 BEAVER VALLEY SER INPUT SEC 5
(3) include tha vent system in approved inservice testing and inspection
' programs 06/08/84 5-17 BEAVER VALLEY SER INPUT SEC 5
6.3 Emergency Core Cooling System l
l The staff has reviewed the Beaver Valley Unit 2 emergency core cooling system (ECCS) in accordance with SRP 6.3 (NUREG-0800).
Each of the four areas listed i
in the Areas of Review section of the SRP was reviewed according to the SRP Review Procedures.
Conformance with the acceptance criteria, except as noted, l
below, formed the basis for concluding that the design of the facility for emergency core cooling is acceptable.
As specified in the SRP, the design of the ECCS was reviewed to determine that it is capable of performing all of the functions stipulated in the design criteria.
The ECCS is designed to provide core cooling as well as additional shutdown capability for accidents that result in significant depressurization of the reactor coolant system (RCS).
These accidents include mechanical fail-ure of the RCS piping up to and including the double-ended break of the largest pipe, rupture of a control rod drive mechanism, spurious relief valve operation in the primary and secondary fluid systems, and breaks in the steam piping.
The principal bases for the staff's acceptance of this system are conformance to 10 CFR 50.46 and Appendix K to 10 CFR 50, and GDC 2, 5, 17, 27, 35, 36, and 37.
The applicant states that the criteria will be met even with minimum engineered safeguards available, such as the loss of one emergency power bus, with offsite power unavailable.
6.3.1
System Design
As specified in SRP 6.3.1.2, the design of the ECCS was reviewed to determine that it is capable of performing all of the functions stipulated in the design criteria.
The ECCS design is based on the availability of a minimum of two accumulators, one high head safety injection (HHSI)/ charging pump and one low head safety injection pump (LHSI) for the injection phase, and one HHSI/ charging 11/06/84 6-1 BEAVER VALLEY SER INPUT SEC 6
I l
pump and one recirculation spray pump with their associated valves and piping for the recirculation phase.
Following a postulated LOCA, passive (accumulators) and active (injection pumps and associated valves) systems will operate.
After the water inventory in the refueling water storage tank (RWST) has been depleted, long-term recirculation will be provided by taking suction from the containment sump and discharging to the RCS cold and/or hot legs.
The passive accumulator system consists of three pressure vessels partially filled with borated water and pressurized with nitrogen gas to approximately 660 psia.
Fluid level, boron concentration, and nitrogen pressure can be remotely monitored and adjusted in each tank.
When RCS pressure is lower than the accumulator tank pressure, borated water is injected through the RCS cold legs.
The high-head injection system consists of three centrifugal charging pumps that provide high pressure injection of boric acid solution into the RCS.
The high-head pumps are aligned to take suction from the RWST for the injection phase of their operation.
Low-head injection is accomplished by two centri-l fugal LHSI pumps taking suction from the RWST during the short-term ECCS l
injection and from the containment sump during the long-term ECCS recircula-tion phase.
The capacity of the RWST is approximately 850,000 gallons.
The minimum concen-
)
tration of boron in the RWST water is 2000 ppm.
The applicant states in FSAR Section 6.2.2.2.1 that the temperature of the water in the RWST will be main-tained between 45 and 50 F during all seasons by a heat exchanger.
In response to the staff's request for additional information on the vent for the RWST, the applicant stated in FSAR Amendment 3 that this vent is a 12-inch-diameter stainless steel pipe attached to the highest point of the tank.
There is a 180 bend in the pipe, but there are no low points that could become clogged.
In addition, this vent line is heat traced to prevent freezing.
This response is acceptable to the staff.
As specified in SRP 6.3,Section II, the ECCS is initiated either manually or automatically on (1) low pressurizer pressure, (2) high containment pressure, I
or (3) low pressure in any steamline.
This meets GDC 20.
The ECCS may also be manually actuated, monitored, and controlled from the control room as 11/06/84 6-2 BEAVER VALLEY SER INPUT SEC 6
stipulated in GDC 19.
The applicant states in FSAR Section 1.8 that the instrumentation in Beaver Valley Unit 2 is sufficient to allow the operating staff to ascertain plant conditions during and following a LOCA.
The evaluation of this aspect of the post accident monitoring system (PAMS) is in Section 7.5 of this SER.
The evaluations of other aspects of the PAMS are in Sections 6.2.5, 9.3.2, and 11.5.
As specified in SRP 6.3,Section III.3, the available net positive suction head (NPSH) for all the pumps in the ECCS (HHSI/ charging, LHSI, and recircula-tion spray) has been shown to provide adequate margin by calculations performed to meet the safety intent of RG 1.1, " Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal System Pumps."
l l
As stipulated in SRP 6.3,Section III.11, the valve arrangement on the ECCS discharge lines has been reviewed with respect to adequate isolation between the RCS and the low pressure ECCS.
All lines to the RCS have at least two check valves in series with a normally closed isolation valve.
This arrange-ment is acceptable.
Containment isolation features for all ECCS lines, including instrument lines (GDC 56 and the criteria in RG 1.11, " Instrument Lines Penetrating Primary Reactor Containment") are discussed in Section 6.2.4 of this SER.
The applicant has responded as follows to the staff's questions on an inspection i
program, operator training, and emergency procedures for dealing with debris, vortices and air entrainment in the containment sump:
i
)
The containment sump at Beaver Valley Unit 2 is designed to allow pumping regardless of any single failure.
Thus it is divided at the centerline by screening; so that failure of either half of the containment sump assembly will not impair the operation of the other half.
For an inspection program the applicant has provided draft Technical Specifica-tion 4.5.2.C, which states that an inspection will be performed at least once every 18 months to verify that the subsystem suction inlets are not restricted 11/06/84 6-3 BEAVER VALLEY SER INPUT SEC 6
f by debris and that the sump components (trash racks, screens, etc) show no evidence of structral distress or corrosion.
In regard to debris blocking flow through the containment sump the applicant states that:
1.
The sump screen assembly rises approximately 5 feet above the containment floor; so it is highly improbable that all of the screen area could become clogged.
2.
The sump is covered by a plate deck roof to protect it from impingement from above. Thus the top of the sump is not part of the intake area.
3.
The insulation inside of containment is mostly reflective consisting of multiple layers of stainless steel.
However, some of the piping is insulated with calcium silicate, and some bats, blankets, and anti-sweat types of insulation are also used. If any of the insulation breaks away from piping it will fall to the floor
'l hulk of it will probably remain due to the low velocity and tortuous paths of the flow to the containment sump.
4.
The mesh size in the fine screen (3/32 inch) is smaller than the smallest coolant passage in the reactor core (1/8 inch) and smaller than the orifices of the spray nozzles (3/8 inch).
The recirculation system pumps are designed to accomodate any small, neutrally-buoyant particles that get through the screen.
Lighter particles will float on the water surface which will be above the screen assembly.
Heavier particles will sink to the containment floor and will not be drawn into the screens due to the low inlet velocities.
i In regard to vortices around the pump inlets, with the associated air entrainment, impeding or stopping the flow from the containment sump the applicant states that:
1.
Horizontal gratings above the pipe inlets serve as vortex breakers.
11/06/84 6-4 BEAVER VALLEY SER INPUT SEC 6
2.
A wide range of approach flow distributions, for r/ck and screen blockages, water levels and pump operating combinations were tested in a 1/3 scale model of the containment sump.
For all tests one half of the screen area in the worst possible orientation was blocked.
The tests showed that at the minimum water levels at which the Recirculation Spray System pumps operate, there is no unacceptable vortexing.
In addition to the containment sump testing the Recirculation Spray System pumps were tested to verify that they can produce the required flow rates at the pressure heads which will be available.
The effects of primary coolant sources outside containment (NUREG-0737, Item III.D.1) are discussed in Section 13.5.2 of this SER.
During normal operation, the ECCS lines will be maintained in a filled condi-tion.
Suitable vents are provided and administrative procedures will require that ECCS lines be returned to a filled condition following events such as maintenance that require draining of any of the lines.
Maintaining these lines in a filled condition will minimize the likelihood of water hammer occurring system startup.
The safety injection lines are protected from intersystem leakage by relief valves in both suction header and discharge lines.
Intersystem leakage detec-tion is described in Section 5.2.5 of this SER.
As specified in SRP 6.3,Section II.B no ECCS components are shared between units.
This meets GDC 5.
6.3.2 Evaluation of Single Failures As specified in SRP 6.3,Section II, the staff has reviewed the system descrip-tion and piping and instrumentation diagrams to verify that sufficient core cooling will be provided during the initial injection phase with and without the availability of offsite power, assuming a single failure.
The cold leg accumulators have normally open motor-operated isolation valves in the dis-11/06/84 6-5 BEAVER VALLEY SER INPUT SEC 6
charge lines.
One accumulator is attached to each of the RCS cold legs. These isolation valves will have control power removed to preclude inadvertent valve movement that could result in degraded accumulator performance.
Two active injection systems are to be available, each with two pumps operable.
The pumps in each system are connected to separate power buses and are powered from separate diesel generators in the event of loss of offsite power, in accordance with GDC 17.
Thus, at least one pump in each injection train would be actuated in the event of a loss of offsite power and failure of one diesel to start.
The high-head injection systems contain parallel valves in the suc-tion and discharge lines, thus ensuring operability of one train even if one valve fails to open.
The low-head injection systems are normally aligned so that valve actuation is not required during the injection phase.
The engineered safety features actuation system (ESFAS) is designed to auto-matically perform the short-term injection phase; no operator actions are required.
Two separate and redundant actuation trains are provided.
Eacn actuation train is assigned to a corresponding electrical power train to ensure that, in the event of a single failure in the actuation logic, at least one emergency diesel generator, one LHSI, and one HHSI/ charging pump would receive an actuation signal.
There are also provisions for manual actuation, monitoring, and control of the ECCS on the main control board.
This complies with SRP 6.3 and is acceptable.
After a LOCA the ESFAS will automatically initiate the transfer from the injection phase to the cold leg recirculation phase.
However, the following operator actions are required to complete the transfer:
i 1.
Open the cold leg isolation valve in the redundant high-head safety-injection flow path.
2.
Close the isolation valves in both the common suction and discharge headers of the HHSI pumps to separate the redundant flow paths.
These operator actions are acceptable.
11/06/84 6-6 BEAVER VALLEY SER INPUT SEC 6
In this phase two of the four recirculation spray pumps, which are located in I
separate cubicles outside of containment, are automatically aligned to pump the water that will collect in the containment sump to the cold legs as well as to the inlets of the HHSI/ charging pumps.
The two operable charging pumps have separate flow paths to hot leg connections.
This provides the capability l
for backflushing through the core to prevent boron precipitation.
Since recirculation spray coolers are used to transfer the decay heat to the service water, it also provides subcooled water to terminate boiloff.
This meets the l
criteria of SRP 6.3 Section III.6.
1 To ensure a long term cooling capability, leak detection and a method for isolating the leak is required.
The applicant states that means are provided to detect and isolate leaks in the emergency core cooling flow path within 30 minutes. In a study of the system, the applicant found that the largest, sudden, potential leak is the failure of a recirculation spray pump shaft seal and that this would result in a leak rate of less than 50 gpm.
This maximum leak would be detected by alarms which indicate the loss of accumulator pressure on the seal water. The applicant states that if this leaking pump is isolated within 30 minutes the ECCS will still meet the minimum core cooling requirements.
The staff finds this system acceptable.
The evaluation of the complete Equipment and Floor Drainage System is in Section 9.3.3 of this SER.
Flooding of ECCS components inside containment following a LOCA has been evaluated.
The applicant states that all motor-operated valves which have to change positions after the injection phase are located to prevent their vulner-ability to flooding and that those valves whose spurious repositioning could result in the loss of the ECCS function have their power removed.
Based on its review of the design features the staff concludes that the ECCS complies with the single-failure criterion of GDC 35.
6.3.3 Qualification of Emergency Core Cooling System The ECCS design to seismic Category I criteria, in compliance with RG 1.29, and its location in structures designed to withstand a safe-shutdown earthquake and other natural phenomena, per the criteria of GDC 2, and the equipment 11/06/84 6-7 BEAVER VALLEY SER INPUT SEC 6
)
)
design to Quality Group B, in compliance with RG 1.26, are discussed in Section 3.2 of this SER.
The ECCS protection against missiles inside and outside containment by the design of suitable reinforced concrete barriers, which include reinforced concrete walls and slabs (conformance to GDC 4), is discussed in Section 3.5 of this SER.
The protection of the ECCS from pipe whip inside and outside of containment is discussed in Section 3.6 of this SER.
The active components of the ECCS designed to function under the most severe duty loads, including safe-shutdown earthquake, are discussed in Sections 3.9 and 3.10 of this SER.
The ECCS design to permit periodic inspection in accordance with ASME Code,Section XI, which constitutes compliance with GDC 36, is discussed in Section 6.6 of this SER.
This meets the criteria set forth in SRP 6.3, Paragraph III.23.c.
The ECCS is connected to one subsystem that serves another function.
The cen-trifugal HHSI/ charging pumps are normally aligned to the chemical and volume and control system (CVCS) for maintaining the required amount and chemistry of water in the RCS and for supplying water to the seals of the reactor coolant pump 3.
On an ECCS actuation signal, the system is aligned for ECCS operation and the CVCS function is isolated.
This normal system use does not impair its capability to function in the ECCS mode.
6.3.4 Testing The applicant has committed to demonstrate the operability of the ECCS by sub-jecting all components to preoperational and periodic testing, per the criteria l
of RG 1.68, "Preoperational and Initial Startup Test Programs for Water-Cooled Power Reactors," RG 1.79, "Preoperational Testing of Emergency Core Cooling System for Pressurized Water Reactors," and to GDC 37.
6.3.4.1 Preoperational Tests One of these tests is to verify system actuation: namely, the operability of all ECCS valves initiated by the safety injection signal, the operability of 11/06/84 6-8 BEAVER VALLEY SER INPUT SEC 6 1
i all safeguard pump circuitry down through the pump breaker control circuits, and the proper operation of all valve interlocks.
Another test is to check the cold leg accumulator system and injection line to verify that the lines are free of obstructions and that the accumulator check valves and isolation valves operate correctly.
The applicant will perform a low pressure blowdown of each accumulator to confirm that the line is clear and check the operation of the check valves.
The applicant will use the results of the preoperational tests to evaluate the hydraulic and mechanical performance of ECCS for delivering the flow for emergency core cooling.
The pumps will be operated under both miniflow (through test lines) and full-flow (through the actual piping) conditions.
By measuring the flow in each pipe, the applicant will make the adjustments necessary to ensure that no one branch has an unacceptably low or high resist-ance.
As part of the ECCS verification, the applicant will analyze the results to ensure there are sufficient total line resistance to prevent excessive runout of the pumps and adequate NPSH under the most limiting system alignment and RCS pressure.
The applicant will verity that the maximum flow rate from the test results confirms the maximum flow rate used in the NPSH calculations under the most limiting conditions and will also confirm that the minimum acceptable flow used in the LOCA analysis is met by the measured total pump flow and the relative flow between the branch lines.
The staff concludes that the preoperational test program conforms to the recom-mendations of RGs 1.68 and 1.79 and is acceptable pending successful completion of the program.
Additional discussion of the preoperational test program is in Section 14 of this SER.
6.3.4.2 Periodic Component Tests Routine periodic testing of the ECCS components and all necessary support systems at power will be performed.
Valves that actuate after a LOCA are operated through a complete cycle.
Pumps are operated individually in this test on their miniflow lines except the charging pumps which are tested by 11/06/84 6-9 BEAVER VALLEY SER INPUT SEC 6
their normal charging function.
The applicant has stated that these tests will be performed in accordance with ASME Code,Section XI.
i 6.3.5 Performance Evaluation i
The ECCS has been designed to deliver fluid to the RCS to limit the maximum fuel cladding temperature following transients and accidents that require ECCS actua-l tion.
The ECCS is also designed to remove the decay and sensible heat during the recirculation mode.
10 CFR 50.46 lists the acceptance criteria for an ECCS.
These criteria include the following:
I (1) The calculated maximum fuel cladding temperature does not exceed 2200*F.
(2) The calculated total oxidation of the cladding does not exceed 0.17 times the total cladding thickness before oxidation.
i f
(3) The calculated total amount of hydrogen generated from the chemical I
reaction of the cladding with water or steam does not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the cladding cylinders surrounding the fuel, excluding the l
cladding surrounding the plenum volume, were to react.
j (4) Calculated changes in core geometry are such that the core remains i
amenable to cooling.
(5) After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptable low value and decay heat is removed for the extended period of time required by i
the long-lived radioactivity remaining in the core.
l In addition, 10 CFR 50.46 states i
ECCS cooling performance shall be calculated in accordance with an i
acceptable model, and shall be calculated for a number of postulated loss-of-coolant accidents.
Appendix K to 10 CFR 50, ECCS Evaluation i
11/06/84 6-10 BEAVER VALLEY SER INPUT SEC 6 l
)
f O
- Models, sets forth certain criteria and acceptable features of evaluation models.
6.3.5.1 Large-Break LOCA The applicant has examined a spectrum of large breaks in RCS piping, and these analyses indicate that the most limiting event is a cold-leg double-ended guil-lotine break with a Moody discharge coefficient of 0.4.
The applicant took credit in the analysis for one train of active ECCS components and two of the three accumulators.
ECCS was assumed to be initiated by low pressurizer pres-sure trip.
The analysis results demonstrate that adequate core cooling is pro-vided assuming the worst single failure, with no credit taken for nonsafety-l grade equipment.
The large-break LOCA evaluation model used in this analysis is described in WCAP-9220.
This model was approved by NRC (letter from J. F. Stolz, NRC, to i
T. M. Anderson, Westinghouse, dated April 29, 1978) and is used in large-break LOCA analyses for Westinghouse plants.
Concerns expressed in NUREG-0630 about the conservatism of fuel-cladding swelling and rupture models used in LOCA analyses have been addressed by the applicant.
l Containment parameters are chosen to minimize containment pressure so that core l
reflood calculations are conservative.
Fuel rod initial conditions are chosen to maximize clad temperature and oxidation.
Calculations of core geometry are carried out past the point where temperatures start to decrease.
The most limit-ing break with respect to peak clad temperature is the double-ended guillotine break in the pump discharge leg with a CD = 0.4.
The peak clad temperature is l
2179'F, which is below the 2200'F limit of 10 CFR 50.46.
The limiting local and core-wide clad oxidation values calculated by the applicant were 7.95% and less than 0.3%, respectively.
6.3.5.2 Small-Break LOCA The LOCA sensitivity studies determined the limiting small break to be less than a 10-inch-diameter rupture of the RCS cold leg.
A range of small-break l
analyses was presented that established the limiting break size.
The analysis 11/06/84 6-11 BEAVER VALLEY SER INPUT SEC 6
y-of this break has shown that the high-head portion of the ECCS, together with accumulators, provides sufficient core flooding to keep the calculated peak cladding temperature below the limits of 10 CFR 50.46.
The applicant analyzed a spectrum of small-break LOCAs.
These showed that a 3-inch-diameter break is the limiting small break, the calculated peak clad temperature is 1985*F, the maximum local zirconium-water reaction is 2.88%, and l
the core-wide zirconium-water reaction is less than 0.3%.
TheapplicanthasanalyzedtheperformanceoftheECC)inaccordancewiththe criteria set forth in 10 CFR 50.46 and Appendix K to 10 CFR 50.
The staff has reviewed the applicant's evaluation, and concludes that it is acceptable.
6.3.6 Conclusions The ECCS includes the piping, valves, pumps, heat exchangers, instrumentation, and controls used to transfer heat from the core after a LOCA.
The scope of review of the ECCS for Beaver Valley Unit 2 included piping and instrumentation diagrams, equipment layout, failure modes and effects analyses, and design specifications for essential components.
The review included the applicant's proposed design criteria and design bases for the ECCS and the manner in which the design conforms to these criteria and bases.
The staff concludes that the design of the ECCS is acceptable and meets the requirements of GDC 2, 5, 17, 27, 35, 36, and 37.
This conclusion is based on the following:
(1) As stated in Section 3.2 of this SER the applicant has met the criteria of GDC 2 with regard to the seismic design of nonsafety systems or portions l
thereof that could have an adverse effect on ECCS by meeting Position C.2 l
of RG 1.29.
l l
(2) The applicant has met the criteria of GDC 5 with respect to sharing of structures, systems, and components by demonstrating that such sharing i
does not significantly impair the ability of the ECCS to perform its safety function.
l 11/06/84 6-12 BEAVER VALLEY SER INPUT SEC 6 l
?
l l
(3) The applicant has met the criteria of GDC 17 with respect to providing sufficient capacity and capability to ensure that (a) specified acceptable l
fuel design limits and design conditions of the RCPB are not exceeded as a i
result of anticipated operational occurrences and (b) the core is cooled and vital functions are maintained in the event of postulated accidents.
f I
(4) The applicant has met the criteria of GDC 27 with regard to providing combined reactivity control system capability to ensure that under postu-lated accident conditions and with appropriate margin for stuck rods, the l
capability to cool the core is maintained, and the applicant's design meets the guidelines of RG 1.47.
l (5) The applicant has met the criteria of GDC 35 in regard to abundant cooling capability for ECCS by providing redundant safety grade systems that meet l
the recommendations of RG 1.1.
i I
(6) The applicant has met the criteria of GDC 36 with respect to the design of l
ECCS to permit appropriate periodic inspection of important components of i
the system.
(7) The applicant has met the criteria of GDC 37 with respect to designing the
[
ECCS to permit testing of the operability of the system throughout the life of the plant, including the full operational sequence that brings the system into operation.
(8) The applicant has provided an analysis of the ECCS performance using an approved analysis model that meets the criteria of Appendix K to 10 CFR 50 and has shown the system performance meets the acceptance criteria of f
This includes a demonstration that the peak cladding tem-perature, maximum hydrogen generation, and long-term cooling, as calcu-l lated with an acceptable evaluation model, are in accordance with these criteria.
l 1
I I
r 11/06/84 6-13 BEAVER VALLEY SER INPUT SEC 6 l
i I
l
I 6
l 15 ACCIDENT ANALYSES The accident analyses for Beaver Valley Unit 2 have been reviewed in accordance with Section 15 of the SRP (NUREG-0800).
Conformance with the acceptance criteria, except as noted for each of the sections, formed the basis for concluding that the design of the facility for each of the areas reviewed is acceptable.
l In accordance with SRP 15.1.1, Paragraph I, the applicant evaluated the ability l
of Beaver Valley Unit 2 to withstand anticipated operational occurrences and a broad spectrum of postulated accidents without undue hazard to the health and safety of the public.
The results of these analyses are used to show conform-ance with GDC 10, 15, 27, and 31.
l For each event analyzed, the worst operating conditions and the most limiting single failure were assumed.
Credit was taken for only minimum engineered safeguards response.
Parameters specific to individual events were conserva-tively selected.
Two types of events were analyzed i
t (1) those incidents that might be expected to occur during the lifetime of the reactor (2) those incidents not expected to occur that ha/e the potential to result in significant radioactive material release (accidents)
The nuclear feedback coefficients were conservatively chosen to produce the most adverse core response.
The reactivity insertion curve, used to represent the control rod insertion, accounts for a stuck rod; it is in accordance with GDC 26.
For transients and accidents, the applicant used a method that conservatively bounds the consequences of the event by accounting for fabrication and operating uncertainties directly in the calculations.
DNBRs were calculated using the l
11/06/84 15-1 BEAVER VALLEY SER INPUT SEC 15 i
l O
h*
's s
W-3 correlation with a modified spa:er factor R, with a minimum DNBR of 1.3 used as the threshold for fuel failure.
The applicant accounts for variations in initial conditions by making the following assumptions as appropriate for the event being considered:
3-Loop Operation 2-Loop Operation Core Power (MWt) 2652 + 2%
1724 + 2%
Average Reactor Vessel Temperature (*F) 576.2 1 4%
566.0 1 4%
Pressure (psi) i l
(at pressurizer) 2250 1 30 2250 1 30 The staff concludes the assumptions for initial conditions are acceptable because they are conservatively applied to produce the most adverse effects.
These assumed values will form the basis for the technical specification limits.
l For transients and accidents used to verify the ESF design, the applicant used the safeguards power design value of 2780 MWt.
The applicant has also analyzed several events expected to occur one or more times in the life of the plant.
A number of transients can be expected to occur with moderate frequency as a result of equipment malfunctions or operator errors in the course of refueling and power operation during the plant lifetime.
Specific events were reviewed to ensure conformance with the acceptance crite-ria provided in the SRP.
The acceptance criteria for transients of moderate frequency in the SRP include i
the following:
(1) Pressure in the reactor coolant and main steam systems should be main-tained below 110% of the design values (Section III of the American Socie-l ty of Mechanical Engineers Boiler and Pressure Vessel Code).
11/06/84 15-2 BEAVER VALLEY SER INPUT SEC 15
O (2) Fuel clad integrity shall be maintained by ensuring that the minimum DNBR will remain above the 95/95 DNBR limit for PWRs.
(The 95/95 criterion discussed in Section 4.4 of this SER provides a 95% probability, at a 95%
confidence level, that no fuel rod in the core experiences a DNB.)
(3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.
(4) For transients of moderate frequency in combination with a single failure, l
no loss of function of any fission product barrier, other than fuel ele-ment cladding, shall occur.
Core geometry is maintained in such a way that there is no loss of core cooling capability and control rod inser-tability is maintained.
Conformance with the SRP acceptance criteria for anticipated operational occurrences constitutes compliance with GDC 10, 15, and 26 of Appendix A to 10 CFR 50. See Section 6.8 of this SER for a discussion of auxiliary feedwater system conformance to TMI Action Plan Item II.E.1.1 and Sections 6.8 and 7.3.1.7 for a discussion of compliance with TMI Action Plan Item II.E.1.2.
The transients analyzed are protected by the following reactor trips:
1
[
(1) power range high neutron flux (2) high pressure (3) low pressure (4) overpower AT (5) overtemperature AT (6) low coolant flow (7) pump undervoltage/underfrequency l
l l
(8) low steam generator water level (9) high steam generator water level Time delays to trip, calculated for each trip signal, are included in the ana-
)
lyses.
See Section 4.6 of this SER for a discussion of the staff review of reactivity control system functional design.
i 11/CS/84 15-3 BEAVER VALLEY SER INPUT SEC 15
l All of the events that are expected to occur with moderate frequency can be grouped according to the following plant process disturbances:
changes in heat removal by the secondary system, changes in reactor coolant flow rate, j
changes in reactivity and power distribution, and changes in reactor coolant inventory. Design-basis accidents have been evaluated separately and are discussed at the end of this section of the SER.
l 15.1 Increase in Heat Removal by the Secondary System The applicant's analysis of events that produced increased heat removal by the secondary system is addressed in the following paragraphs, i
15.1.1 Decrease in Feedwater Temperature i
The consequences of a decrease in feedwater temperature transient are bounded by those in Sections 15.1.2 and 15.1.4.
The peak pressure is less than that in Section 15.1.2.
The minimum DNBR is greater than that in Section 1.5.1.4.
15.1.2 Increase in Feedwater Flow l
Increases in feedwater flow decrease the temperature of the reactor coolant water.
Due to the negative moderator temperature coefficient this will insert positive reactivity and increase core power.
In Section 15.1.2.1 of the FSAR the applicant states that for these events the high neutron flux trip, overtemperature _T trip, and overpower _T trip prevent l
any power increase which could lead to a DNBR less than the limit value of 1.30. However, the only analytical results presented for these events are l
those where a steam generator hi-hi level trip closes all feedwater control l
and isolation valves, trips the main feedwater pumps, trips the turbine, and initiates a reactor trip.
The applicant states that continuous addition of feedwater is prevented by the steam generator hi-hi level trip.
l This analysis shows that the maximum reactivity insertion rate due to an in-crease in feedwater flow occurs at no-load conditions and is less than the maximum value calculated for an inadvertent control rod withdrawal, which is 11/06/84 15-4 BEAVER VALLEY SER INPUT SEC 15 l
I j.
evaluated in Section 15.4 of this SER.
However, this analysis also shows that an increased feedwater flow event can cause a peak RCS pressure of 2270 psia.
l This is below the design pressure of 2485 psig, but it is the highest RCS pressure the applicant calculated for any of this group of events.
15.1.3 Increase in Steam Flow 1
The consequences of an increase in steam flow transient are bounded by those in Sections 15.1.2 and 15.1.4.
The peak pressure is less than that in Section 15.1.2.
The minimum DNBR is greater than that in Section 15.1.4.
15.1.4 Inadvertent Opening of a Steam Generator Relief Valve or Safety Valve The transient that is most limiting of this group of transients with respect to fuel performance is the inadvertent opening of the steam generator relief or safety valve.
The suddenly increased steam demand causes a reactor power increase which results in a reactor trip due to high neutron flux, overtempera-ture, or overpower signals.
The continued steam flow through the open valve will cause additional cooldown which will, because of the negative moderator temperature coefficient, result in positive reactivity.
The safety injection system (SIS) will inject highly concentrated boric acid from the boron injection tank into the primary coolant system on either two out of three pressurizer low pressure signals, or two out of three low steamline pressure signals in any one loop.
This ensures the reactor will be shut down during any subsequent cooldown.
The normal steam generator feedwater would be isolated automatically upon SIS initiation, and then the plant would be gradually cooled down with only safety grade equipment.
DNB does not occur during this transient.
The applicant has provided results of its study for a transient of this group in combination with its limiting single failure.
No credible single failure j
has been identified that could result in a more limiting peak reactor coolant j
system pressure or DNBR than that from the events themselves.
The applicant's analyses show that for transient events leading to an increase in heat removal by the secondary system (with or without single failure), the minimum DNBR is 1.3.
Thus no fuel failure is predicted to occur, core geometry 11/06/84 15-5 BEAVER VAltEY SER INPUT SEC 15 4
i and control rod insertability are maintained with no loss of core cooling capability, and the maximum reactor coolant system pressure remains below 110%
of design pressure.
The staff finds the results of these analyses in confor-mance with the acceptance criteria of SRP 15.1.1 through 15.1.4, and, therefore, acceptable.
15.1.5 Steamline Rupture Accident r
The applicant has submitted analyses of postulated steamline breaks that show l
no fuel failures attributed to the accident.
These results are similar to i
those obtained for previously reviewed Westinghouse three-loop plants.
I A postulated double-ended rupture at hot standby power with no decay heat was analyzed as the wurst case.
Since the steam generators have integral flow restrictors with a 1.4 ft2 throat area, any rupture with a break area greater than 1.4 fts, regardless of location, will have the same effect on the system as a 1.4 fta break; so this was assumed in the analysis.
The doubled-ended rupture would cause the reactor to increase in power due to the decrease in reactor coolant temperature.
The reactor would be tripped by either reactor overpower AT or by the actuation of the SIS.
The SIS will be actuated by any of the following: two out of three low pressurizer pressure signals; two out of threeHi-1containmentpressuresignals;ortwooutofthreelowsteamlinepres-i sure signals in any one loop.
The transient is terminated using only safety-grade equipment.
The injection of highly borated water ensures the reactor is returned to and then maintained in a shutdown condition.
The staff concludes that the consequences of postulated steamline breaks meet the relevant criteria in GDC 27, 18, 31, and 35 regarding control rod inser-tability and core coolability and TMI Action Plan Items.
This conclusion is based upon the following:
(1) The applicant has met the criteria of GDC 27 and 28 by demonstrating that fuel damage, if any, is such that control rod insertability will be main-tained, and there will be no loss of core cooling capability.
The minimum DNBR experienced by any fuel rod was >1.30, resulting in none of the fuel elemente being predicted to experience cladding perforation.
11/06/84 15-6 BEAVER VALLEY SER INPUT SEC 15
(2) The applicant has met the criteria of GDC 31 with respect to demonstrating the integrity of the primary system boundary to withstand the postulated accident.
(3) The applicant has met the criteria of GDC 35 with respect to demonstrating the adequacy of the emergency cooling systems to provide abundant core cooling and reactivity control (via boron injection).
I (4) A mathematical model, which accounts for incomplete coolant mixing in the reactor vessel, has been revieweo and found acceptable by the staff.
This model was used to analyze the effects of steamline breaks inside and out-side of containment, during various modes of operation, with and without offsite power.
(5) The parameters used as input to this model were reviewed and found to be suitably conservative.
15.2 Decrease in Heat Removal by the Secondary System r
l The applicant's analyses of events that result in a decrease in heat removal by the secondary system are presented below.
15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow In Section 15.2.1 of the FSAR the applicant states that any steam flow decrease caused by a malfunction or failure of any steam pressure regulator is conserva-tively bounded by the turbine trip event and analyzed in Section 15.2.3.
15.2.2 Loss of External Load In Section 15.2.2 of the FSAR the applicant states that the results of the tur-I bine trip event analysis are more severe than those expected for the loss of external load.
The reason given is that a turbine trip actuates the turbine stop valve whereas a loss of external load actuates only the turbine control l
i 11/06/84 15-7 BEAVER VALLEY SER INPUT SEC 15
- - - - - -t
O t
valves.
Since the stop valve can more suddenly cut off the steam flow to the i
turbine this is a more severe " decreased heat removal" transient.
15.2.3 Turbine Trip Assuming offsite power is available to run the reactor coolant pumps, the ap-plicant analyzed the turbine trip event for a complete loss of steam load from full power without a direct reactor trip and with only the pressurizer and steam generator safety valves assumed for pressure relief.
These assumptions-result in the highest peak RCS pressure for any " decreased heat removal" event. The calculated peak value is 2560 psia, which is well below the ASME limit of 110% of the design pressure.
For these assumptions the minimum DNBR is 1.75, which is well above the minimum limiting value of 1.30.
The applicant's analyses show that if instead of relying on just the safety l
valves, the pressurizer spray and PORV's are used to limit the pressure during this turbine trip event, the minimum DN8R can go down to 1.60.
On pagejk (gl440.1-3oftheFSARtheapplicantstatesthatifthePORVusedinthissituation was to stick open there would be no impact on the minimum DNBR because in the (l
analysis the PORV's are not required to close until after the reactor trip, at l
which point the DN8R is rising and is very high. Likewise, the steam relief valves in the secondary system are not required to close until after the reactor trip.
Thus a failure to close will have no impact on the DNBR.
1 The consequences of a turbine trip without offsite power available are dis-cussed in Section 15.2.6.
15.2.4 Inadvertent Closure of Main Steam Isolation Valves i
Consequences are the same as those discussed in Sections 15.2.3 and 15.2.6.
15.2.5 Loss of Condenser Vacuum Consequences are the same as those discussed in Sections 15.2.3 and 15.2.6.
11/06/84 15-8 BEAVER VALLEY SER INPUT SEC 15
5 15.2.6 L;uss of Nonemergency AC Power to the Pl ant Auxiliaries A loss of initiatec secrease in secondary heat rmonemergency ac pow n the turbine-trip-th2 react:- coolant pumps are lost and the subsequent flow coas reduces tne this transment, the loss of off site power iamount of heat th own further m the core.
In trip and rea: tor trip.
s closely followed by a turbine g2nerator !++'el which is the second safety grade triThe w steam system is automatically started and one electric mot The emergency feedwater p.
to b2 feedt eq all three steam generators or-driven pump is assumed The applicart 's LOFTRAN analysis shows that the available aceauately transfers the decay heat from thnatural circulation flo which are be'ng fed with emergency feedwater flow e core to steam generators, is assumed tc be relieved through the steamThe steam which is generated primary systen relief valves are assumed not to fun tigenerator safety va The c on.
The cmergency feedwater comes from the primary pl ag2 tank (PPDVST) which, the applicant states in FSAR Sant demineralizer w centains sufficient water to reduce the hot leg temperatection 10.4.9.1, transient.
At 350'F the RHRS can be started to take away thures to 350*F for e decay heat.
Th2 DNBR remains above 1.30 throughout this transi sure tcmains below 110% of the design pressure ent, and the peak RCS pres-15.2.7 Loss of Normal Feedwater Flow The. consequences of this anticipated operational oc D cencurrent loss of offsite power is assumedcurrence are more severe if towe However, if a loss of offsite (c p:r is assumed the consequences will be the same as wer event discussed in Section 15.2.6.
}/06/84 15-9 15 BEAVER VALLEY SER INPUT SEC 15
l l
15.3.3/15.3.4 Reactor Coolant Pump Rotor Seizure and Shaft Break Accident l
The applicant has analyzed the reactor coolant pump (RCP) rotor seizure and shaft break events with the LOFTRAN and FACTRAN computer codes.
Since the initial rate of reduction of coolant flow is greater after an RCP rotor seizure, this is the limiting event.
For the analyses the applicant assumed that the fuel cooling goes into the nucleate boiling regime (i.e., DNB) immediately at the beginning of the transient.
The maximum RCS pressure will occur in the event of an RCP rotor seizure while only two of the three Icops are operating.
This maximum pressure is calculated to be 2647 psia with only the opening of the pressurizer and steam generator safety valves.
The applicant states that 2647 psia is below the faulted condition stress limit of the RCS.
In response to the staff's request the applicant reanalyzed the RCP rotor seizure event with an assumed loss of offsite power.
For this case the appli-l cant's analysis shows:
(1) the maximum RCS pressure goes up to 2679 psia (2) the maximum clad temperature goes up to 1956 F (3) the maximum zirconium l
reaction fraction increases to 0.57% (4) the minimum DNBR is unchanged.
Since a pressure of 2679 psia is still below the faulted condition stress limit and the minimum DNBR is unchanged, the radiological releases tabulated in FSAR Table 15.3-4 are unchanged by assuming a concurrent loss of offsite power with the RCP rotor seizure event.
l The staff's evaluation and finding on fuel damage and consequent control rod l
insertability and core cooling considerations during this event are included in SER Section 4.2.
The LOFTRAN computer code has been approved by the NRC.
The remaining staff findings are (1) The parameters used as input to the mathematical model are suitably conservative.
(2) The use of Service Limit C" of the ASME Code is acceptable for conforming to GDC 31 and demonstrating the integrity of the RCS during this accident; the maximum pressure is below this limit.
{
i t
11/06/84 15-11 BEAVER VALLEY SER INPUT SEC 15 l
t 15.4 Changes in Reactivity and Power Distribution 15.4.4/15.4.5 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature In FSAR Section 15.4.4, the applicant provides the results of an analysis for startup of an inactive reactor coolant pump event.
This event was reviewed with the procedures and acceptance criteria set forth in SRP 15.4.4.
During the first part of the transient, the increase in core f' low with cold l
water results in an increase in nuclear power and a decrease in core average te.nperature.
Reactivity addition for the inactive loop startup event is the result of the decrease in core inlet water temperature.' This transient was evaluated by the applicant using a mathematical model that has been reviewed and found acceptable to the staff.
The maximum calculated RCS pressure is 2310 psia and the minimum DNBR is above 1.3 throughout the transient.
- O 15.4.6 Inadvertent Boron Dilution Various chemical and volume control system (CVCS) malfunctions which could l
lead to an unplanned boron dilution incident have been reviewed.
The malfunc-tions that allow the operator the shortest time for corrective action have been analyzed starting from plant conditions of startup, power operation (automatic and manual), hot standby, and cold shutdown.
The applicant used acceptably conservative assumptions in these analyses.
The results show that the operator has at least 15 minutes between the time when an alarm announces an unplanned moderator dilution ano the time of loss of shutdown margin, i.e.,
criticality.
The maximum reactivity insertion rate by boron dilution was found to be 1.5X10 5 ok/k (1.5 pcm) per second.
In the event the operator does not stop the dilu-tion, the DNBR will still remain above 1.49, and the RCS and main steam pres-sures will remain below 110% of design.
In response to a question on protection from inadvertent boron dilution during refueling, the applicant stated that during refueling the RCS is isolated from 11/06/84-15-12 BEAVER VALLEY SER INPUT SEC 15 1
1.
the potential source..of unborated water.
This isolation is accomplished by having the operators place danger tags on the primary grade water header isolation valves, or by locking these valves closed whenever the RCS water is below the normal level.
The operator performing these tasks is required to sign off on each step of a procedural checklist.
This is an acceptable procedure when the plant's Technical Specifications require the lockout of all possible sources of dilution water when the plant is in Mode 6.
This item will remain open until the applicant provides an acceptable Technical Specification.
With the exception of the refueling mode the staff concludes t' hat the analysis for the decrease in reactor coolant boron concentration event is acceptable and conforms to General Design Criteria 10, 15, and 26.
This conclusion is based on the following:
1.
The applicant has met the criteria of GDC 10 with respect to demonstrating that the specified acceptable fuel design limits are not exceeded for this event.
This criterion has been met since the results of the analysis showed that the thermal margin limits are satisfied as indicated by SER Section 4.4.
b 2.
The applicant has met the criteria of GDC 15 with respect to demonstrating that the reactor coolant pressure boundary limits have not been exceeded for this event.
This criterion has been met since the analysis showed that the maximum pressure in the reactor coolant and main steam systems did not exceed 110% of the design pressure.
l 3.
The applicant has met the criteria of GDC 26 with respect to demonstrating that the control rod system has the capability of overcoming the effects of boron dilution events during reactor operation.
The applicant has demonstrated conformance with these criteria by showing that under the postulated accident conditions, and with appropriate margins for stuck rods, the specified acceptable fuel design limits are not exceeded.
l 15.5 Increases in Reactor Coolant System Inventory i
l l
11/06/84 15-13 BEAVER VALLEY SER INPUT SEC 15
r.
15.5.1 Inadvertent Operation of the Emergency Core Cooling System During Power Operation ECCS operation could be initiated by a spurious signal or an operator error.
Two cases were examined, one in which reactor trip occurs simultaneously as a result of the safety injection signal, and the other in which the reactor trips later in the transient because of low reactor coolant system (RCS) pressure. The reactor pressure decreases during the initial phase of the transient and then increases to a peak pressure of 2350 psia at 200 seconds intothetransient.TheDNBRneverdropsbelowitsinitialvaIueforeither All of these transients are terminated by use of only safety grade case.
systems.
If the operator fails to turn off the HHSI/ charging pumps the safety valves will open. Continued operation of these pumps would overfill the Pressure Relief Tank. However, as stated in Table 6.3-1 of the FSAR, the cutoff head of the HHSI/ charging pumps is 6000 ft (2600 psig); so they cannot create 110% of the reactor vessel design pressure (2733 psig) and thus cannot fail the vessel.
15.5.2 CVCS Malfunction That Increases Reactor Coolant Inventory Evaluation of consequences is included in Section 15.4.6.
15.6 Decrease in Reactor Coolant Inventory 15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve In FSAP Section 15.6.1, the applicant provides the results of an analysis for inadvertent opening of a pressurizer safety valve.
During this event, nuclear power is maintained at the initial value until reactor trip occurs on low pressurizer pressure.
The DNBR decreases initially, but increases rapidly following the trip.
The minimum DNBR of 1.50 occurred at 31 seconds into the transient. 'The RCS pressure decreases throughout the transient.
15.6.3 Steam Generator Tube Rupture l
The staff has again requested justification that the operator can take appropriate action within 30 minutes.
There are also concerns as to what systems the 11/06/84-15-14 BEAVER VALLEY SER INPUT SEC 15
)
f r
D E
analysis takes credit for in mitigating the consequences of a SGTR.
In response, the applicant states that the Westinghouse Owners Group is investigating several SGTR licensing concerns and will address the staff's concerns throu a generic resolution at a future date.
Upon receipt of this additional informa-tion, the staff will complete the review of the SGTR event and the radiolog consequences thereof.
15.6.5 LOCAs In FSAR Section 15.6.5, the applicant has analyzed the double ended col guillotine (DECLG) as the most limiting large-break LOCA.
The analysis was dane for three different flow coefficients.
The results of these show that the DECLG with a Moody break discharge coefficient of 0.4 is the worst case In this analysis, the peak clad temperature reached is 2179*F.
For the small-break LOCA the applicant has determined that a cold leg rupture of less than 10 in. in diameter is the most limiting.
The analysis was performed for 3-in., 4-in, and 6-in.-diameter breaks.
The results show that the 3-in.-diameter break is the worst case, and it results in a peak clad temperature of 1985*F Both of these accidents are terminated by SIS and ECCS operations.
Only safety grade equipment is used to mitigate the accident.
The applicant has performed analyses of the performance of the ECCS in accor-dance with the Commission's regulations (10 CFR 50.46 and Appendix K to 1 The analyses considered a spectrum of postulated break sizes and locations.
l As shown in NUREG-0390, these analyses were performed with an evaluation mode that had been previously reviewed and approved by the staff. The results show l
that the ECCS satisfies the following criteria:
l l
l (1)
The calculated maximum fuel rod claoding temperature does not exceed 2200*F.
(2)
The calculated maximum local oxidation of the cladding does not exceed 17%
of the total cladding thickness before oxidation.
11/06/84 15-15 BEAVER VALLEY SER INPUT SEC 15
o
15.9.3 II.K.2.13 Thermal Mechanical Report:
Effect of High-Pressure Injection on Vessel Integrity for Small-Break LOCA With No Auxiliary Feedwater f
Staff review of this item will be covered in NRC unresolved safety issue A-49,
" Pressurized Thermal Shock."
15.9.4 II.K.2.17 Potential for Voiding in the Reactor Coolant System During Transients t
Westinghouse has performed a study that addresses the potential for void forma-tion in Westinghouse-designed NSSS during natural circulation cooldown/
depressurization transients.
This study has been submitted to the NRC by the Westinghouse Owners Group.
As stated in R. Wayne Houston's December 6,1983 memorandum to Gus C. Lainas entitled "Multiplant Action Item F-33, Voiding in the Reactor Coolant System During Anticipated Transients," the results of this study have been accepted.
15.9.5 II.K.2.19 Sequential Auxiliary Flow Analysis Sequential auxiliary feedwater flow criteria are only of concern to once-through steam generator designs.
Since Westinghouse has inverted U-tube steam genera-tot designs, the analysis requested by Item II.K.2.19 is not needed for Beaver Valley Unit 2.
15.9.6 II.K.3.2 Report on Overall Safety Effect of Power-Operated Relief Valve Isolation System As a response to Item II.K.3.2, the applicant referenced a generic Westinghouse Owners Group submittal.
Should staff generic review of this material conclude otherwise, NRC will request further consideration of modification of Beaver Valley Unit 2.
i 11/06/84 15-17 BEAVER VALLEY SER INPUT SEC 15
^
o 1
15.9.7 II.K.3.3 Reporting SV and PORV Challenges and Failures 1
The applicant states in FSAR Table 1.10-1 that it will be responsible for en-suring that any failure of PORVs or safety valves to close will be reported promptly to the NRC and that all challenges to PORVs and safety valves will be documented in the annual report.
The staff concludes that the Beaver Valley Unit 2 procedures meet the criteria of this item and are acceptable.
3 15.9.8 II.K.3.5 Automatic Trip of RCPs During LOCA In response to this criterion, the applicant stated that Westinghouse performed an analysis of delayed RCP trip during LOCA.
This analysis is documented and is the basis for the Westinghouse position on RCP trip (i.e., automatic RCP trip is not necessary because sufficient time is available for manual tripping of the RCPs).
Westinghouse has submitted a generic report which is under review.
The appli-cant should state whether or not it intends to endorse this report and comply 1
with the criteria proposed in it, assuming the NRC finds it acceptable.
15.9.9 II.K.3.10 Proposed Anticipatory Trip Modification The applicant has not proposed any modification to its standard anticipatory trip.
Therefore, no TMI action plan requirements are imposed.
I 15.9.10 II.K.3.17 Report on Outages of ECCS The applicant states in Table 1.10-1 and in Section 13.5.2.1 of the FSAR that it will meet the intent of this item when the Operating and Maintenance Proce-dures are written.
They are scheduled to be completed in June 1985.
The ac-
)
l ceptability~of the measures taken to satisfy this item will be evaluated when O
these procedures are submitted.
11/06/84-15-18 BEAVER VALLEY SER INPUT SEC 15.
f 1
l G A 15.9.11 II.K.3.25 Effect of Loss of AC Power on RCP Seals i
)
In response to'this criterion, the applicant stated that in the event of loss of offsite power, the RCP motor is de energized, the diesel generators are automatically started, and both seal injection flow and component cocling water flow are automatically restorod within seconds.
I f
The staff concludes that the applicant's design meets the criteria of this 1
item'and is acceptable.
15.9.12 II.K.3.30 Revised Small-Break LOCA Methods To Show Compliance With 10 CFR 50, Appendix K In response to this criterion, the applicant stated that Westinghouse has sub-j mitted a new small-break evaluation model to NRC.
The staff is currently re-l viewing this submittal.
15.9.13 II.K.3.31 Plant-Specific Calculations To Show Compliance with 10 CFR 50.46 L
The applicant states that the present (i.e., July, 1983) Westinghouse small-break, loss-of-coolant evaluation model was used for the analyses which are discussed in FSAR Section 15.6.5.
However, this does not constitute a review that shows Beaver Valley Unit 2 is in full compliance with 10 CFR 50.46.
After the staff's review of this evaluation model is completed a specific submittal on
.this issue will be required.
\\
\\
v J
M 11/06/84 15-19 BEAVER VALLEY SER INPUT SEC 15
,