ML20134G237

Forwards Questions,Comments & Discussion Items Re W AP600 Adverse Sys Interaction Rept

ML20134G237
Person / Time
Site:	05200003
Issue date:	10/03/1996
From:	Huffman W NRC (Affiliation Not Assigned)
To:	Liparulo N WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
References
NUDOCS 9611130099
Download: ML20134G237 (14)

Text

,. _ _ _ _ _ _ _. _. _. _..

l.*

= yr k

UNITED STATES p

g j

NUCi. EAR REGULATORY COMMISSION ~

j-WASHINGTON, D.C. 30006 4001 October 3, 1996 l

l Mr. Nicholas J. Liparulo, Manager l

Nuclear Safety and. Regulatory Analysis Nuclear and Advanced Technology Division Westinghouse Electric Corporation i

P.O. Box 355 L

Pite'sburgh, Pennsylvania 15230 i

l SulkECT: DISCUSSION ITEMS FOR AP600 WEET:NG ON ADVERSE SYSTEM INTERACTIONS i

l

Dear Mr. Liparulo:

Wesniaghouse letter NSD-NRC-96-4658 dated March 5, 1996 provided the staff with i

9 CAP-14477, "The AP600 Adverse System Interactions Evaluation Report." In the pror.ess of reviewing this report, the staff has developed a number of questions and comments which are enclosed with this letter.

Ne ;*opose that a meeting be scheduled with Westinghouse on the AP600 adverse L

sysces interactions evaluation report in which these question serve as the l

principle agenda item.

The staff requests that Westinghouse prepare a brief summary response to each item and transmit these responses to the NRC suffi-l ciently in advance of the meeting to permit staff to determine questions to focus j

on during the meeting.

i l

You have requested that portions of the information submitted in the June 1992, i

application for design certification be exempt from mandatory public disclosure.

While the staff has not completed its review of your request in accordance with l

the requirements of 10 CFR 2.790, that portion of the submitted information is being withheld from~public disclosure pending the staff's final determination.

The staff concludes that these follow-on questions do not contain those portions cf the information for which exemption is sought.

However, the staff will withhold this letter from public disclosure for 30 calendar days from the date of this letter to allow Westinghouse the opportunity to verify the staff's crnclusions. If, after that time, you do not request that all or portions of the information in the enclosures be withheld from public disclosure in accordance with 10 CFR 2.790, this letter will be placed in the NRC Public Document Room.

I i

l l

l 080060 m M MB M 9611130099 961003 PDR ADOCK 05200003 A

PDR

' ~p i

Mr. Nicholas J. Liparulo October 3,1996 i

'If you - have any questions - regarding this matter, you may contact me at (301) 415-1141.

Sincerely, i

t original signed by:

l l

William C. Huffman, Project Manager l

Standardization Project Directorate Division of Reactor Program Management Office of Nuclear Reactor Regulation Docket No.52-003 I

Enclosure:

As stated I

cc w/ enclosure-See next page D.STLIBUTION:

• 30 DAYS HOLD Mktot File PDST R/F TMartin L

• PUBLIC BGrimes TQuay i '

TKenyon : i DJackson BHuffman i

JSebrosky JMoore, 0-15 B18 EJordan, T-4 018 WDean, 0-17..G21 JLyons, 0-8 D11

^

ACRS (11)

TCollins, 0-8 E23 HLi, 0-8 H3 Alevin, 0-8 E23 RJones, 0-8'E23 JKudrick, 0-8 H7 MSnodderly, 0-8 H7 EButcher, 0-10~E4'r

.NSaltos, 0-10 E4 CThomas, 0-9 H15

. JBongarta; 0-9 H15 ' '

.,EThrom, 0-8 H7 Gholahan, 0-8 E2 jJFlackr 010' E4 '

' l7 ',

i, a

%'i -

.]..~s

[

()7

?L

.;.i.

l e

i.

- 3 l

5 e

l p.

iO- ; '(

s

', DOCUMENT NAMEi _A:ADVR-SYS.CMT_ (9I'AP600 DISK) 73 seestue o espy of thle d=======a indsete in the bes: *C* = Copy without ettechment/encleeure

• E* = Copy with atter,hment/ enclosure

• N* = No copy L

OFFICE PM:PDST:DRPM l

SC:SRXJh$$A l BC:JiHFB:JRCH. l A7 SC:S$

1 NAME WHuffman: h Alevi/if// )

GThadap JLyorYs' DATE 09/f7/96 09/f4/96 /

69pf,/96 09/30/96 1s sneefue as espy of Bie -

_ Inceses In see ben: T = Copy wethout -^

-: T = Copy with ettschenent/encensure

• N* = No copy i

OFFICE,96:SPSB:DSSA cl BC:SCSB:DSSA D:PDST:DRPM l l

NAME /

tihrtchet)ch R.A,

1.s i iriw itA y TQuay ' P M i

DATE/

09/Ja/96 W#)/c,/ Joh g/96%\\\\\\iOS/ 3 /96

'/

0F A4 RECORD COPY eps

A Mr. Nicholas J. Liparulo Docket No. 5?-003 Westinghouse Electric Corporation AP600 cc: Mr. B. A. McIntyre Mr. John C. Butler Advanced Plant Safety & Licensing Advanced Plant Safety & Licensing Westinghouse Electric Corporation Westinghouse Electric Corporation Energy Systems Business Unit Energy Systems Business Unit P.O. Box 355 Box 355 Pittsburgh, PA 15230 Pittsburgh, PA 15230 Mr. M. D. Beaumont Mr. S. M. Modro Nuclear and Advanced Technology Division Nuclear Systems Analysis Technologies i

l' Westinghouse Electric Corporation Lockheed Idaho Technologies Company One Montrose Metro Post Office Box 1625 11921 Rockville Pike Idaho Falls, ID 83415 Suite 350 i

Rockville, MD 20852 Enclosure to be distributed to the following addressees after the result of the proprietary evaluation is received from Westinghouse:

Mr. Ronald Simard, Director Ms. Lynn Connor Advanced Reactor Programs DOC-Search Associates Nuclear Energy Institute Post Office Box 34 1776 Eye Street, N.W.

Cabin John, MD 20818 Suite 300 Washington, DC 20006-3706 Mr. Robert H. Buchholz GE Nuclear Energy Mr. James E. Quinn, Projects Manager 175 Curtner Avenue, MC-781 LMR and SBWR Programs San Jose, CA 95125 GE Nuclear Energy

)

175 Curtner Avenue, M/C 165 Mr. Sterling Franks l

San Jose, CA 95125 U.S. Department of Energy NE-50 Barton Z. Cowan, Esq.

19901 Germantown Road Eckert Seamans Cherin & Mellott Germantown, MD 20874 600 Grant Street 42nd Floor Pittsburgh, PA 15219 Mr. Charles Thompson, Nuclear Engineer AP600 Certification Mr. Frank A. Ross NE-50 U.S. Department of Energy, NE-42 19901 Germantown Road Office of LWR Safety and Technology Germantown, MD 20874 19901 Germantown Road Germantown, MD 20874 Mr. Ed Rodwell, Manager PWR Design Certification Electric Power Research Institute 3412 Hillview Avenue l

Palo Alto, CA 94303 e

i

QUESTIONS, CONNENTS, AND DISCUSSION ITENS CONCERNING THE WESTINGH0USE AP600 ADVERSE SYSTEMS INTERACTION REPORT The Adverse Systems Interactions report does a reasonably good job in describ-ing interactions between single components and/or systems in the AP600.

However, there appears to be relatively little consideration of " integral" effects: for instance, the cumulative impact of operating several non-safety systems for a period after which the passive systems might be required to operate. The staff recognizes that the actual plant response to a transient or accident may depend upon operator (or automatic) actuation of the " defense-in-depth" (DID) systems. The staff is concerned, however, that the integral-l systems impact of operating several DID systems, either in parallel or serially, may affect the plant's thermal-hydraulic state sufficiently to compromise the ability of the passive systems to "take over" should they be required at a later time, in the event that an accident or transient worsens, or if some or all of the DID systems were to fail or be shut off. Has Westinghouse evaluated these types of integral and time-dependent effects?

Overview Comments 1.

Section 2.2.10 discusses interactions between the normal residual heat i

removal system (RNS) and two passive systems - the core makeup tank (CMT) and the in-containment refueling water storage tank (IRWST). The possi-bility of RNS flow delaying CMT drainage is discussed and stated to be beneficial because it could prevent unnecessary actuation of the stage-4 ADS valves. However, there appears to be some " scenario-specific" interactions which are not obviously beneficial.

If, for instance, during a small break LOCA, the RCS pressure were to holdup in the range of the RNS pump shutoff head (after actuation of ADS-1,2, and 3), the possibility of the RNS holding the CMT check valves closed (or at least inhibiting draining) while minimal injection flow is occurring could result in greater than expected RCS inventory depletion before ADS-4 actuates.

In a direct vessel injection (DVI) DEG line break, one injec-tion path is open to containment, and it would appear that RNS injection into the intact DVI line would be shut off by the RCS pressure on that side, but on the broken side, the RNS pumps would provide flow, which would be dumped into the sump through the break. This has the dual effect of shutting off the CMT discharge check valves and depleting IRWST inventory. The intact-side CMT would have to drain to actuate the fourth stage ADS, which would require significant inventory loss through the break. Furthermore, to postulate a possible " worst case" sequence, suppose the pumps were secured or failed just as the RCS reached a l

Enclosure i

l 1

)

1

- l

pressure at which the pumps would normally start to inject.

In this scenario, a tubstantial amount of IRWST water has been dumped into the sump, reducing the injection head, and the system must still depressurize from around 200 psi down to less that 10 psi (relative to the contain-ment) to allow IRWST injection. The transition to sump injection (lower head) would be relatively early, with greater decay heat than assumed on the SSAR analysis.

In addition, not only would the RNS rapidly deplete the IRWST inventory during a DVI DEG break, but it also appears that it could continue to operate drawing suction flow from the recirculation sump as the net positive suction head shifted from the IRWST to the recirculation sump. Could this conceivably result in a flow by-pasc of the core via the following path. Specifically, RNS suction would take suction on the containment recirculation sump and pump it to the two DVI lines; the broken DVI line would spill water back to the sump; the intact DVI line would return some water to the reactor vessel downcomer but a

. percentage of this injection flow would be short-circuited out the vessel side of the broken DVI line. No passive sump recirculation would be expected because of the RNS discharge pressure would be holding the sump recirculation check valves closed.

l Westinghouse should determine if the above scenarios need to be consid-l ered and/or analyzed. The analyses should ascertain:

(a) if enough inventory could be lost to uncover the core; (b) the possibility of flow by-pass of the core if RNS continued to operate with a DVI DEG break; (c) j the worst case effect of the reduction in IRWST injection head and early i

transition to sump injection with higher decay heat levels if RNS flow I

were stopped by an operator after a large quantity of water from the IRWST has been pumped by the RNS into the recirculation sump.

It might benefit the staff if more details were provided on the specific initiation of RNS as a low head injection, active, defense-in-depth I

system for LOCAs. The procedures provided in the ERGS do not seem to clarify these questions.

a. When exactly would operators be instructed to align RNS to inject?

When would the operators be expected to start the pumps (i.e., after an "S" signal or other specific time in the event)? When, would the operators be expected to secure the pumps?

b. What happens if the operators make an error in aligning, stopping, or starting the RNS?

The staff would also like more details on what analysis has been done related to the above described scenarios.

For example, are there poten-tial intermediate break sizes for which the RNS pumps cannot inject sufficient flow to the RCS, but can block enough CMT flow to create a problem? Were these scenarios considered in the PRA?

2.

The report contains no analyses, just descriptive material. There are several mentions of " sensitivity analyses," but no references to where 2

i

i the results might be found (except where they've been incorporated into the SSAR). There is no indication of what the sensitivity analyses have (or have not) considered as relevant " sensitivities."

3.

Injection of saturated water due to energy input to IRWST is mentioned several times, as is the beneficial (" quenching") effect of injecting su.vooled water. There are a number of interactions that can cause the li W T water to become saturated prior to injection to the RCS. Westing-house should confirm that in the Chapter 6/15 analyses, that saturated conditions are assumed in the IRWST to minimize the beneficial effect of subcooled injection or explain why the assumption is not necessary.

Snecific Comments and Questions from Detailed Review 4.

The discussion on fan coolers (pp. 2 2-18) appears to be focused on an extreme situation without regard for other potential adverse condi-tions.

For example; recent concerns were raised regarding operating PWRs via Westinghouse's Nuclear Safety Adv4 Jory Letter on containment fan coolers. Are there any high heat lon, conditions (such as during DBA or Severe Accidents) for the AP600 in wh, h the cooling water system supply-ing non-safety-related fan coolers (Chilhd Water) might be subject to water hammer or other potentials for containment bypass? Could operation of the fan coolers with chilled water isolated by a containment isola-tion signal result in overpressurization of the chilled water line or flashing / water hammers if the heated chilled water lines from the fan coolers were suddenly unisolated?

The Chapter 9 SSAR description of the fan coolers state that they have two speed motors. The high speed is used for normal conditions and the low speed is used during high containm % air density conditions - such as those that might be present during DBA or severe accidents. How is fan speed controlled during accident conditions. Since this is a non-safety related function, how is operation of the fans in fast speed prevented in a high steam environment. Does the fan control circuitry automatically shift to low speed in accident conditions? Are there interlocks to prevent operators from manually shifting to high speed when conditions may be inappropriate in containment.

Is there any potential for the fans to catastrophically fail if operated at high speed in a dense steam environment thereby creating a possible adverse system interaction which could damage the chill water cooling coils (Containment bypass scenario)? The emergency response guidelines (ERGS) for reactor trip or safety injection. AE-0, step 22, does not specify at what speed the fans should be operating under safety injection conditions.

5.

The discussion in ites 2.2.1 (p. 2-7) refers to events after actuation of an "S" signal. However, there are safety system actuations that occur without immediate generation of an "S" signal--such as CMT actuation due to low pressurizer level. Does this discussion apply to that possibility j

as well?

l 3

i l

l l

1 1

i

~ 6.

At the bottom of p. 2-8, Westinghouse states that operation of two RCPs j

in the loop opposite the PRHR heat exchanger could result in reverse flow through the PRHR heat exchanger and possible degrade its effectiver.ess.

j Is this concern also possible with just one RCP operating in the opposite l

loop from the PRHR HX? Are.there any control interlocks that prevent this condition? The necessity of avoiding this situation does not appear i

to be called out in the AP600 ERGS (See step 10 of AES-0.1 for instance).

i i

Are there any common-cause failures (other than loss of an electrical bus, which has been precluded) that could cause the two PRHR-side RCPs to l

trip and the other two pumps to stay on?

l 7.

On p. 2-9, the pressurizer heaters are stated to be assumed to trip on "S" signal actuation.

Is this a safety-related function?

Similarlyr i

what about the isolation valve actuations in the letdown system? Are all i

actuations initiated by the PLS non-safety-related? What is the impact j

of a loss of instrument ac power that would preclude the PLS from actuat-

I ing these isolation functions?

I j

Another function not specifically indicated as being safety-related or j

non-safety-related is the SFW isolation on low RCS CL temperature 1

j (p. 2-15). Please confirm which applies.

I 8.

On p. 2-10, is there any way that operation of the CVS purification loop could cause a thermally stratified single phase flow, which could result f

in cyclical *hermally-induced fatigue stresses?

9.

On p. 2-13, interactions due to hydrogen evolution are not considered important due to the concentration and solubility of the gas at RCS operating pressure. What happens when the system is cooled and depressurized, especially when proceeding to either hot or cold shutdown?

Is there any way for sufficient hydrogen to get into the PRHR HX to

}

degrade the natural circulation driving force?

)

10. Have any events been identified in which the operation of the startup 3

feedwater system could delay the initiation of the PRHR system in such a way as to be detrimental to safety (e.g., if the SFW system ran for a while and then failed)?

I II. For the Plant Control System (Section 2.2.13), what impact does the loss s

of offsite power followed by starting and sequential loading of these j

systems on the non-safety diesels have on system interactions?

I

12. Isolation of the RCDT to prevent overpressurization (p. 2-26) is j

indicated to be non-safety-related. What are the implications of failure i

to accomplish this isolation? Is a tank rupture credible? If so, what j

potential systems interactions might occur?

a

13. Component cooling water (CCS) is discussed in Section 2.2.17.

This j

system has direct interfaces with the RCS. Westinghouse should consider a discussion of the system's capability of withstanding pressurization to RCS pressure as a result of a leak from the RCS into~ the CCS and how the potential for an intersystem LOCA is mitigated.

4

14. Is there any potential for interactions between the spent fuel pool cooling system (Section 2.2.19) and the RNS that could impact IRWST inventory?

15. CMT/ accumulator interactions are discussed in Section 2.3.1.1 Nitrogen from the accumulators is claimed to have no impact on CMT cp e !on.

This may not be completely accurate if there is some means e: which the CMTs could refill late in an event (as observed in the OSU tasts -

although this has been regarded as resulting from a scaling distortion in i

the facility). Also, some ERG instructions permit the operator to isolate the accumulator.

Is there any way that the operator could interfere with accumulator injection by incorrectly shutting the isola-tion MOV while the accumulator still has substantial water in it?

Westinghouse should consider addressing CMT refill in Section 2.3.1.9 on CMT/RCS interactions as well.

16. The discussion of CMT/IRWST interactions in Section 2.3.1.2 appears to be l

focused on SBLOCAs, in claiming that minimal interactions occur between these two ECC systems. What about LBLOCAs, where the ADS is not required to depressurize the plant, and IRWST injection may begin (based on differential pressure) while the CMTs have considerable inventory?

17. The discussion on CMT/PRHR interactions does not take into account the possible role of the PRHR in system-wide interactions, such as those observed in OSU testing.

18. Accumulator /IRWST interactions are discussed in Section 2.3.2.1.

The implication that these two systems have little potential for interaction does not take into account " cascading" effects, i.e., depending on break l

size and location, accumulator injection could interfere with CMT injec-tion, delaying ADS-4 actuation and opening of the IRWST isolation valves.

This " indirect" effect is also not discussed in Section 2.3.2.7, on accumulator /RCS interactions.

19. Accumulators are stated not to have significant interactions with the steam generators (Section 2.3.2.5).

Are there any scenarios in which flow esci11ations could occur, due to maintenance of natural circulation flow through the steam generator, at pressures low enough to have accumu-lator injection?

If so, what is the potential for interaction between l

the two systems?

20. Section 2.3.3.1, on IRWST/ containment interactions, does not address the late-phase oscillations observed in OSU testing, and the possible impact of those oscillations on sump injection.

In addition, the OSU tests indicated the possibility of flow from the sump back into the IRWST.

It would seem appropriate for Westinghouse to address these interactions, 1

and show that adverse effects are not expected.

21. Section 2.3.3.2, on IRWST/PRHR interactions, appears to be inconsistent i

with the interaction that is discussed in the immediately previous i

section.of the report, i.e., spurious opening of the recirculation isolation valves.

In this case, such an event would deprive the PRHR of 4

i 5

its cooling water, creating a potential adverse interaction.

In addi-tion, at the end of the section, Westinghouse states that the difference in IRWST temperature has "no significant effect" on gravity injection.

However, experimental data indicate that a hot IRWST drains more rapidly.

I

22. Section 2.3.3.4 (IRWST/PCCS) does not discuss the effect that containment i

pressure has on IRWST actuation. Since IRWST injection is a function of the difference between RCS and containment pressure, elevated containment pressure will affect the timing of inception of flow from the IRWST to the RCS. A similar comment applies to Section 2.3.4.3 (containment recirc/PCCS), since containment backpressure will have an impact on timing of IRWST injection and, subsequently, sump injection.

23. Section 2.3.5.1, PRHR/ ADS, primarily focuses on the impact of IRWST heating on ADS behavior. Consideration should be given to discussing an indirect interaction, via the RCS, in which PRHR cooling reduces RCS temperature, affecting pressurizer inventory and thereby impacting operation of ADS 1/2/3. Another indirect interaction involves ADS-4; again, PRHR operation affects fluid conditions at ADS-4 actuation, which may be more or less important, depending on the scenario.

I

24. In Section 2.3.5.2, Westinghouse states there are no direct interactions l

between the PRHR and the PCCS.

In the case of long term cooling using PRHR, is there a possibility that PCCS operation is needed to keep l

sufficient water in the IRWST (via condensation return) to allow the PRHR HX to continue to operate? That is, if the PCCS was not providing containment cooling, could enough water inventory, due to boil off of the IRWST, be entrained or held up in the containment to impact continued operation of the PRHR7

25. Section 2.3.5.3 addresses the PRHR and SGS interactions. However, there is no discussion on the eariv-ohase, system-wide oscillations observed in the SPES-2 integral systems tests (during the period in which flow I

through a SG was maintained). These oscillations (or oscillations of a l

similar character) were also observed in the SGTR test in the SPES-2

(

facility. Westinghouse should consider addressing the impact of these l

oscillations. A similar comment is relevant to Section 2.3.6.2 l

(ADS /SGS).

26. Section 2.3.5.5 (PRHR/RCS) does not consider the effect of the PRHR on RCS inventory and thermal-hydraulics. Further, the issue of stratifica-i l

tion in the primary system and its possible impacts are not addressed.

27. The last paragraph of Section 2.3.6.1 (ADS /PCCS) states that PCCS perfor-mance affects the ADS via containment backpressure.

It is not clear that I

this is true all of the time.

If the ADS is in critical flow, it would appear that containment pressure should have little effect on ADS flow.

In the latt ADS-1 phase, containment pressure will affect the transition to subcritical flow, depressurization rate, and--ultimately--IRWST injection. These same comments are relevant, as well, to Section 2.3.7.3 (PCCS/RCS), since the ADS flow impacts both RCS inventory and timing of IRWST and sump injection fcr maintenance of long-term core cooling.

6 l

28. Section 2.3.7 addresses PCCS/ containment interactions, and discusses only j

spurious operation of the PCCS.

It does not address at all the failure of the PCCS, e.g., effects on containment if no water cooling were t

available to augment external containment heat transfer.

Human Factors

29. In addition to human factor related concerns raised in question 1, 4, 6, and 15 above, several other human reliability issues could be elaborated on in this report.

a. The operator has the capability, in a station biackout, to override the automatic ADS actuation just prior to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The rationale for including this actuation, as understood by the staff, is to ensure that sufficient battery power is available to open the ADS valves.

Suppose that an operator overrides the actuation at 24 hr (minus), but i

then finds at some time thereafter (say, 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />) that it is neces-sary to actuate the ADS. What are the effects of such a scenario? Is sufficient power available? When does power cease to be available?

l What alternatives would the operator have if power were not available?

Are there other situations in which delaying an action (either actuat-ing a system or overriding its actuation) could have a significant impact on plant response?

b. At the end of Section 2.3.6.2, Westinghouse states that the AP600 ERGS provide guidance on manual actuation of ADS-1 to terminate an SGTR event. How is this addressed in terms of human reliability? What if the operator makes an error and causes actuation of the entire ADS system?

30. Errors of commission are discussed on pp. 3-15 and 3-16, and are specifi-cally connected to actions in the ERGS.

Please address the following l

questions and comments:

l

a. What is the impact if the operator fails to start the CVS pump, since l

starting a pump is "a part of the expected response to the event"?

1

b. With regard to SFW pump interactions in an SGTR, are there any conse-l quences if the operator fails to follow the procedure discussed?

c. Concerning spent fuel pool cooling system interactions (bottom of

p. 3-16), Westinghouse states that the effects of SFP accidents

" develop slowly" and are thus of insignificant risk. How fast could such events be diagnosed? What is the impact of these events on shutdown risk?

Miscellaneous General Comments

31. Westinghouse should discuss what consideration was given to " indirect" interactions due to instrumentation and controls systems and/or transitory effects (although some credit is taken for the ability of I&C t

7

design to " minimize spurious signals" that might cause adverse interac-tions). For instance, closure of turbine stop valves could create a level transient (or an indication of a level transient) that could actuate the PRHR system.

INEL predicts this could happen.

It is not clear what the ultimate effect would be for: LOCAs (initiates PRHR operation before "S" signal would normally operate); non-LOCA transients and A00s (could start PRHR operation earlier than might otherwise be the case, resulting in additional inventory shrinkage -- the ultimate effect is likely to be scenario dependent); or spurious. actuation (spurious actuation of PRHR system).

If nothing else, the adverse interaction could simply be more actuations over plant lifetime than the PRHR system is designed for.

32. The emphasis in the report is on passive-passive and passive-active interactions that can directly affect the passive safety systems. Are

,there any " active-active" interactions of interest, i.e., an interaction between two active systems that could act to impede (or cause spurious actuation of) a passive system? This could include secondary or tertiary effects, such a feedback from the turbine / generator system through the steam generator to the primary loop.

For example; Table 2-1 does not show any systems beyond the secondary side of the RCS. How about effects deriving from: turbine / generator (e.g., closing of stop valves causing level transient in SG that actuates PRHR); other indirect interactions--

such as transients caused by malfunctions of the EHC system; interactions caused by spurious actuation of the reactor protection system or failure of turbine-over-speed protection.

33. There are interactions noted that involve the spent fuel cooling system.

One rationale given for a low level of concern is that " spent fuel pool accidents are not deemed to be of risk significance."

It is not clear i

that this is consistent with our expressed concern with shutdown risks, or with the recent technical issue on the SFP cooling system, which are still under discussion with Westinghouse.

34. Many actions described in the report involving valve position changes are noted as " safety-related." Examples include: CVS isolation valves (p.2-l!); main feedwater isolation functions (discussed on p. 2 '

these are not explicitly stated to be safety-related, but are assumed by the reviewer to be so);

SG blowdown line isolation functions (discussed on p. 2-17); containment sump pump isolation (p. 2-26);

primary sampling system (not stated to be safety-related but assumed by the reviewer to be

p. 2 2-28);

spent fuel pool cooling system isolation (also assumed to be safety related by the reviewer, p. 2-29). Are they all single-failure proof?

35. Minor comment:

Even if the condensate return lines (non-safety-related) function properly (see p. 2-37, third paragraph in Section 2.3.1.5), some condensate may end up in the sump rather than the IRWST.

36. Section 2.3.3.3, on IRWST/ ADS interactions, does not consider any of the oscillatory behavior noted in the AP600 integral systems tests, including

- both oscillations at 'the start of IRWST injection, and the late phase 8

l l

oscillations.

In both of these cases, the ADS-4 configuration appears to l

play an important role in the development and characteristics of-the oscillations. Westinghouse should consider including a discussion of this behavior and evaluate the possibility of adverse effects. Since i

these oscillations also affect the RCS, the same comments apply to Sec-t tion 2.3.3.7.

These oscillations are also relevant to the following.

I additional sections:

2.3.4.2 (containment recirc/ ADS); 2.3.4.6 (contain-l ment recirc/RCS); 2.3.6.4 (ADS /RCS).

37. Loss of' instrument air in its entirety or partially can have significant impact on both active and passive systems (CMT, PRHR, Containment Isola-tion of active systems). Although it is recognized that the air operated valves will fail to their safe position, there could be substantial impact on the overall behavior of the plant due to the shear number of systems affected. Since loss of instrumentation as an initiating event and on a system bases has been examined in the PRA, it would seem appro-priate that Westinghouse address the PRA insights on potential adverse system interactions from the loss of instrument air in this report.

38. Will spurious opening of the CMT discharge valves (not due to a CMT actuation signal), cause the RCPs to trip? For example, loss of air to the CMT discharge valve will result in them failing open - will this cause the RCPs to trip? If not, what adverse effects would this cause?

l

39. The adverse effects of cold weather on the operation of the PCCS appears to merit some consideration.

For instance, under extremely cold tempera-ture conditions, it is conceivable that the annulus floor drains at the bottom of the containment annulus could ice up. Actuation of the PCCS would result in cooling water not evaporated from the containment vessel water accumulating in the lower annulus.

Enough water accumulation could eventually affect aanulus air flow and degrade PCCS operation.

In i

addition, icing of the distribution bucket and weirs could affect distri-bution of PCCS flow on containment.

40. The stage 1, 2, and 3 ADS discharge lines have vacuum breakers to prevent water hammer following ADS actuation. What are the consequences of ADS actuation with the breakers unseated such that ADS discharge is diverted directly into containment rather than quenched in the IRWST? How is the position of the vacuum breakers determined and monitored?

41. The pressurizer safety relief valve discharge lines appear to have a drain line connection to the ADS valve discharge lines.

It would seem that actuation of the ADS valves could pressurize the safety relief valves discharge line and blow the rupture disk. What adverse effects would this have on system operations? In addition, if ADS-1 is used manually to depressurize, will the operator have to manually close the drain line isolation valve to the RCDT?

l

42. In order for the IRWST to function properly, it must directly communicate l

with the containment atmosphere. Steam and pressure venting capabilities I

of the IRWST are discussed in the SSAR but there does not appear to be any description of the vacuum relief assurance for the IRWST. The staff

(

9 i

j e

4 i

assumes that-the IRWS1 design will have a vacuum relief design suffi-ciently sized to permit required drain down. However, has the l-possibility of clogging or obstruction of the vacuum relief paths been considered along with any adverse effect this would have on IRWST drain-ing? Westinghouse should consider including a discussion on this in the adverse systems interaction report and a description of the venting

' design in the SSAR. This concern would also be applicable to vacuum venting design and potential for clogging / obstructions for the PCCS tank.

43. Are there any adverse interactions or effects possible from ADS blowdown on the IRWST level instrumentation?

1

44. The passive autocatalytic recombiners (PARS) are designed to prevent hydrogen buildup from DBA events from exceeding 4 percent.

In a severe i

accident context, the hydrogen concentrations in containment could l

approach 10 percent. Are there any adverse consequences from the PAR operating in this higher hydrogen concentration environment (such as overheating or flaming of the gas discharged from the PARS)?

t 4

45. The main control room habitability system maintains control room air 2

pressure with pressure relief dampers. What are the consequences of a failure of one of these dampers?

l

46. What controls are provided to ensure the quality of the air in the main control room habitability system air storage tanks? Has the possibility 1

of degradation of the air quality in the storage tanks with time been considered (due to material coatings, grease, other unidentified contami-i nants within the tanks that could gradually sublime and mix with the air)?

47. Is it possible for a secondary side break or rupture (within containment) to cause and actuation of the ADS system? Under such circumstances, significant additional water inventory will be added to containment; are j

there any adverse conditions possible from such a scenario (such as boron l

dilution)?

48. Section 2.3.6.4 of the adverse systems interaction report states that a

" spurious ADS LOCA is a terminable LOCA event, [although] operators are l

not instructed to terminate ADS."

Please explain this statement.

Information in Table 3-1 differs in that it states that " procedures exist i

to terminate the event" [ spurious ADS). How would a spurious ADS be i

terminated?

1 i

49. Extensive effort is being placed on the human factors design of control room operator controls for the AP600.

For example, manual actuation of the ADS requires two separate operator actions. Experience indicates that many human factors related events are a result of. errors during i

testing or maintenance of I&C components.

In the case of a spurious ADS signal, Westinghouse states in Table 3-1 that the most likely human error may be related to testing or maintenance of instrumentation.

Related specifically to the ADS-4 squib valves, what protection is provided by j

the design of the ADS-4 actuation circuitry to prevent an inadvertent 10 1

i i

~

1

c l

l discharge of a squib valve during surveillance testing, trouble shooting, or repairs being conducted inside the applicable I&C cabinets in the PMS system. For example, what measures would prevent a technician from accidently performing a continuity check on the electrical leads to a squib valve explosive charge (assuming that such a check could result in the firing of the charge)? Are there any other systems in which an l

inadvertent actuation due to maintenance or I&C could have significant l

adverse effects.

l

50. Related to the human factors aspects of question 29 above concerning actions following an extended station blackout, there may be a need for operators to take some additional actions if temperature limits are being approached in the I&C cabinets due to lack of normal control room cool-ing. What actions could the operator be expected to take and is there a potential for errors of commission or omission? What would be the l

consequences of a such errors?

51. There appears to be the possibility of adverse effects following the termination of an abnormal event.

For example, the CMTs could be actuated during an event which is then successfully terminated after a period of CMT recirculation. This would leave the CMTs full of hot water at elevated pressure. What potential interactions could occur as the CMTs are cooled? How are these interactions prevented or mitigated? In general, have interactions of this typa (i.e., recovery from terminable sequences) been considered?

l l

l l

11

.. -