ML20136F255
| ML20136F255 | |
| Person / Time | |
|---|---|
| Site: | 05000000, Vogtle |
| Issue date: | 09/27/1984 |
| From: | Houston R Office of Nuclear Reactor Regulation |
| To: | Novak T Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML082840446 | List:
|
| References | |
| FOIA-84-663 NUDOCS 8410100742 | |
| Download: ML20136F255 (100) | |
Text
,m_.n....s.......-m.-w-w-.----..----~--.~~.~.-
y
); Q -(_ ). Q t
E i G34
'< 1 e
MEMORANDUM FOR:
Thomas M. Novak, Assistant Director htek' g
for Licensing Division of Licensing I(
l FROM:
R. Wayne Houston, Assistant Director l
for Reactor Safety Division of Systems Integration
SUBJECT:
V0GTLE UNITS 1 AND 2 - SAFETY EVALUATION REPORT Plant Name:
Vogtle Electric Generating Plant, Units 1 and 2 Docket No.:
50-424/425 Licensing Status:
OL Responsible Branch: Licensing Branch #4 Project Manager:
M. Miller Review Branch:
Reactor Systems Branch Review Status:
13 Open issues The Reactor Systems Branch has c'ospleted the review of Sections 5.2.2, l
5.4.7, 5.4.15, 6.3 and 15 of the Vogtle Units 1 and 2 FSAR. This review included those FSAR amendments through and including the ninth amendment.
Enclosed with this letter is a final draft of Sections 5.2.2, 5.4.7, 5.4.12 and 6.3 of the SER. Also enclosed is a draft of Chapter 15. The final draft of Chapter 15 is to follow soon. This was discussed with the Vogtle Project Manager and found acceptable.
The RSB review has resulted in a number of open issues.
Resolution of these issues, summarized below, will be provided in supplements to this SER.
Ooen Issues SER Section Issue Summary Overpressure Protection 5.2.2.2 The applicant will During Low Temperature provide PORV Operation values to confirm that the Appendix G requirements are met.
I Discrepancy Between 5.2.2.2 FSAR to be updated p(
WCAP 10529 and FSAR to conform to the WCAP 10529 LTOP worst case heat and mass
~
input transients.
y CONTACL ". 5;tr, Y97'iQ(
\\
W o/ 00ML D L-
=
r.
m.
- =
2 l... + > '.
1 i
Natual Circulation 5.4.7.5 The applicant will Boration and conduct tests or i
Cooldown Tests reference 1
appropriate tests that demonstrate adequate boration and cooldown
~
under natural circulation 1
conditions to show compliance with BTP RSB 5-1.
)
RHRS Operation 5.4.7.5 The applicant has Above 450 PSIG been requested to i
explain how the 1
RHRS can be kept i
in. service above 450psig, the setpoint of the RHRS suction relief valves.
Target Rock Valves 5.4.12 The applicant is in RVHVS to evaluate the susceptability of a comamon mode failure in RVHVS valves than can result in a l
I l
II.K.1.5 6.3.1 Applicant is to demonstrate compliance to TMI Action Item II.K.1.5.
II.K.3.10 6.3.1 Applicant is to provide clarification on the Vogtle compliance to Action Item II.K.3.10.
Operator Errors 6.3.2 Applicant is to During Switchover to evaluate whether Recirculaticn single operator i
errors during switchover from infection to recirculation will result in damage to the ECCS pumps.
'I v..-
a
F 'T h 6. e..T. Tri
. CO "TM M rPZ'72.- 2..; "Z F
l J. J,':
3
~
Analysis of Large 6.3.5.1 The applicant must Break LOCA with analyze the large C =1.0 break LOCA with D
CD=1.0 as required by Appendix K to 10CFR50 or to o
i demonstrate that it i
l 1s a bounded by other results.
t Technical Specifications 15.4.6 The applicant is i
To Require Four Valves To required to provide Be Locked Closed Technical During Refueling Specifications that would require valves l
175, 176, 177 and 183 to be locked closed during refueling in order to prevent a boron dilution event.
Inadvertent Boron 15.4.6 The time available Dilution During for operator action Modes 3, 4 and 5 to terminate boron dilution is inadequate.
II.K.3.1/II.K.3.2 15.6.1/15.6.3 The applicant is to demonstrate that the installation of an automatic PORY isolation system will i
increaseplantsafetp.
The impact on the Steam Generator Tube Rupture event should be evaluated.~ ~
Steam Generator 15.6.3 The applicant has not s
i-Tube Rupture provided sufficient documentation to
\\-
support the analyses that the primary to secondary leak j
wi-11-be -
/
terminated in 30
-T minutes.
/
j d
m 1
.=_ m-:--._..--
o 4
i A number of confirmatory issues are also covered in the SER they are:
l Confirmatory SER Section Issue Summary l
Technical Specifications 5.2.2.2 Plant Technical 4
for Accumulator Isolation Specifications are l
Valves and Maximum required to ensure l
Permissable Temperature the FSAR analysis Mismatch Between the assumptions for Primary and Secondary.
LTOP event l
SBLOCA Below P-11 6.3.5.2 The applicant is Interlock to confirm that timely manual action will occur to mitigate the consequences of a i
very small break LOCA during startup and shutdown.
Also included with this memorandum, is a SALP evaluation of the applicant.
Original signed by:
1
]
R. Wayne Houston, Assistant Director j
for Reactor Safety l
Division of Systems Integration
]
1 Distribution 1
Docket File
?
RSB R/F j-RSB P/F: Vogtle
]
MWigdor R/F WHodges BSheron A0/RS Rdg.
l l
"0FFICIAL RECORD COPY"
- PREVIOUS CONCURRENCE SHEET ON FILE W/RSB
{
. *DSI:RSB
- DSI:RSB
- 0SI:RSB
/
I.
s on 1 MWidgor:jf WHodges BSheron
{89/g}/84 09/26/84 09/26/84 09/27/84
}
J
Systematic Assessment of Licensee Performance Vogtle Electric Generating Plant, Units 1 and 2 i
1 The following criteria from Manual Chapter 0516 were reviewed to perform an assessment of licensee performance during the R'SB safety evaluation review of the Vogtle FSAR.
1.
Management Involvement and Control In Assuring Quality Corporate management was consistently involved in discussions between NRC and the applicant. There was consistent evidence of management involvement to ensure concise and to the point responses to staff questions. Manage:aent. was always informed as to the issues involved and expedited closure of open issues.
Rating: Category 1 2.
Approach to Resolution of Technical Issues from A Safety Standpoint
[
The applicant possessed a clear understanding of all of the issues, and produced technically sound and thorough responses in most cases.
l l
Rating: Category 1 3.
Responsiveness to NRC Initiatives Applicant consistently demonstrated outstanding responsiveness in
.t l
e I
i U t"
. :r_ :.-:. -.......
~ -
. -. u.:.
}.. -,.*.
resolving issues through numerous conference calls and meetings.
Rating: Category 1 4.
Enforcement History Evaluat' ion was performed for an operating license, hence there was insufficient information to perform an evaluation.
5.
Reporting and Analysis of Reportable Events
- Insufficient information 6.
Staffing The applicant, in most cases, had the proper personnel involved in meetings and conference calls.
Staffing would have appeared to be ample.
Rating: Category 1 4
7.
Training and Qualification Effectiveness l
Insufficient information 8.
Overall Rating i
Rating: Category 1 4
-e-
.,**9
- - g";
- ._, 7 'g7, *g t. gg??, N e r=r.,
--n,
n..
.gw,,e n-- w ~ e g,.-
=.. _, _. ~. _ _
4,; :
5 REACTOR COOLANT SYSTEM 5.1 Summary Description 5.2 Intecrity of Reactor Coolant Pressure Boundary 5.2.1 Compliance with ASME Code and Code _ Cases 5.2.2 Overpressure Protection 4
Overpressure protection for Vogtle Electric Generating Plant, Units 1 and 2 has been reviewed in accordance with SRP 5.2.2 (NUREG-0800). Conformance with the acceptance criteria, except as"noted, formed the basis for the staff's ccnclusion that the design of the facility for overpressure protection is
' acceptable.
The reactor coolant pressure boundary (RCPB) is protected from overpressuri-zation by three pressurizer safety relief valves and two pressurizer power-operated relief valves in combination with the reactor protection system and operating procedures. For low temperature operation, additional protection is afforded by the safety relief valve on each of the residual heat removal
~
system (RHRS) suction lines. This combination of features provides over-pressurization protection in accordance with the criteria of GDC 15; the ASME l
Code,Section III; and 10 CFR 50, Appendix G.
These criteria ensure RCPB j
overpressure protection for both power operation and low temperature operation (startup and shutdown). Following is a discussion of overpressure protection
}
for each mode of operation.
j 5.2.2.1 Overpressure Protection During Power Operation il.
Overpressure protection during power operation is provided by the pressurizer l
spray system, two power-operated relief valves (PORVs), and three spring-loaded safety relief valves (SRVs), all of which are connected to the pressurizer.
)
09/21/84 5-1 V0GTLE SER INPUT SEC 5 s
~'
f n.-
- ::..-- - z.. ~ ' ~
-^
~. ~.
- 3. s...
i
' The pressurizer spray system is designed to maintain the reactor coolant l
l system (RCS) pressure below the PORV reitef setpoint of 2335 psig during I
normal. design transients. The spray system flow is automatically modulated l
and can also be operated manually from the control room.
l The two PORVs are solenoid-operated valves, each with a capacity of 210,000 pounds of saturated steam per hour at 2385 psig. They are designed to limit the pressurizer pressure to a value below the high pressurizer pressure reactor trip setpoint. The PORVs also have the purpose of limiting challenges to the SRVs. However, the SRVs provide the final overpressure protection during j
power operation.
Both the SRVs and PORVs perform safety-related functions and thus have been designed to safety grade standards, i
j Credit is taken only fo.r safety va1ves in analyzing operational transients and faulted conditions. Each pressurizer safety valve is spring-loaded and has a relieving capacity of 420,000 pounds mass per hour of saturated steam at 2485 psig. The. combined capacity of two of these three safety valves is adequate to prevent the pressurizer pressure from exceeding the SRP criterion i
of 110% of design pressure and therefore the ASME Boiler and Pressure Vessel Code,Section III, limit for the pressure following the worst reactor coolant j
system pressure transient, identified to be a 100% load rejection resulting i
from a turbine trip with concurrent loss of main feedwater. This event was l
analyzed with no credit taken fo'r operation of reactor coolant system PORVs, j
main steamline atmospheric Steam dump valves, automatic rod control, auxiliary feedwater, condenser steam dump system, pressurizer level control system, and pressurizer spray system. Steam relief through the secondary safety valves is d
considered.
In response to a staff concern, the applicant has stated that a time delay due to discharge of the water in the safety valve 1 cop seals was i
assumed in the analysis.
9 S'RP Section 5.2.2 requires the applicant to demonstrate that adequate relief protection is provided, assuming the reactor trip is initiated by the second safety grade signal from the reactor protection system.
In the analysis the applicant has taken credit for a high pressurizer pressure trip (the first 09/2G/84 5-2 V0GTLE SER INPtJT SEC 5 L
.,.. w -
m-erm-e.
n.
- x. -....: =
=
~-
2.:-.
~..L L :..
- ._ : : L :
/ '.'
safety grade trip signal from the reactor protection system). The evaluation is supported by a generic sensitivity study of required safety valve flow rate versus trip parameter presented in WCAP-7769. The applicant has also confirmed that the primary safety valves are sufficiently sized to maintain reactor coolant system pressure to within the ASME pressure limit without any reactor trip for the limiting overpressurization transient. Therefore, the SRP criterion has been met.
4 The above analyses were performed using the LOFTRAN Code, a digital simulation that includes point neutron kinetics, reactor coolant system including the reactor vessel, hot leg, primary side of the steam generator, cold leg, secondary side of the steam generator, pressurizer, and pressurizer surge line. The program computes pertinent plant variables, including temperatures, pressures and power level. This code has been reviewed by the staff and found acceptable.
i In addition, the applicant, in msponse to a staff concern, has stated that uncertainties in the design and operation of the plant were accounted for.
The applicant has provided assurance that the secondary safety valves can provide the required minimum relieving capacity assuming a single failure of one safety valve per loop. The staff has reviewed the' assumed values of temperature and pressure, together with their assumed instrumentation channel errors that were used for the overpressure protection system design bases, and found them acceptable.
The safety valves are designed in accordance with ASME Code,Section III.
Periodic testing and inspection of the PORVs and SRVs is required (10 CFR 50.55a(g)(4)(1)) to be performed in accordance with the edition of Section XI of this code that is in effect twelve (12) months prior to the issuance of a license. Conformance to this requirement will be covered in a supplement to the SER in Section 3.9.6.
In FSAR Chapter 14, the applicant has described the pre' operational test program, which includes testing of the pressure-relieving devices discussed in this SER section, and has indicated that'these tests would be conducted in full compliance with the intent of RG 1.68 Revision 2.
Additional testing of the SRVs and PORVs is required by NUREG-0737 Item II.D.1.
The applicant has stated that 09/21/84 5-3 V0GTLE SER INPUT SEC 5
=
~
__.4
L L
I safety and relief valves similar to these at VEGP have been tested within the 1
Electric Power Research Institute safety and relief test program and have been 4
found adequate for steamflow and waterflow. The evaluation of the applicant's j
compliance with II.D.1 is included in SER Section 3.9.3.
l i
In response to NUREG-0737 Item II.D.3, the applicant has stated that positive position indication will be provided for the PORVs (magnetic reed switches) l and the SRVs (stem mounted limit switches). The evaluation of the applicant's compliance with II.D.3 is included in SER Section 7.5.
The applicant states in FSAR Section 5.4.13.2 that it will be responsible for ensuring that any failure of PORVs or safety valves to close will be reported promptly to the NRC and that all challenges to PORVs and safety valves will be documented in the annual report. The staff concludes that the Vogtle Units 1 and 2 procedures meet the criteria of TMI Action Iteni II.K.3.3. (Report l
Safety Valve and Power-Operated Relief Valve Challenges and Failures).
{
Check valves in the discharge side of the high pressure safety injection, low pressure safety injection, residual heat removal, and charging systems perform i
an isolation function in that they protect low pressure systems from full l
reactor pressure. The staff requires that these check valves be classified l
ASME IW-2000 Category AC, with the leak testing for this. class of valve being performed to code specifications. The applicant has stated that ter' lines and valves have been provided to adequately check that those check valu-that serve to prevent backflow from the RCS into the safety injection system (including the RHR) will perform their isolation function.
L l/
5.2.2.2 Overpressure Protection During Low-Temperature Operation i
The criteria for overpressure protection during low-temperature operation of the plant are in BTP RSB 5-2.
f Low-temperature overpressure protection is primarily provided by the two These valve' have their opening setpoints automatically pressurizer PORVs.
i s
adjusted as a function of reactor coolant temperature.
In order to achieve this, the reactor coolant system wide range temperature measurements will be
?
l 09/26/84
.5-4 V0GTLE SER INPUT SEC 5 i
- . := - -- u= -
_-. :a =-. - :::: z;., _===_ _L ::.
- ~ r:: :- ~u.
7
.?K:..: = z T ~:2==== r = - -^ ~.=.:c^r"
'* ~
[. <. a i
l
'auctioneered to obtain the lowest valve. This temperature will then be sent to a function generator that will have a PORV setpoint curva programmed into i t.
'This PORV setpoint curve is to adequately account for the lag in the l
temperature change of the reactor vessel and for possible ' single failures in the auctioneering system. This function generator will produce a calculated maximum allowable pressure for the prevailing temperature. The calculated
)
pressure is then compared to the indicated RCS pressure from a wide-range pressure channel.
If the measured reactor coolant pressure approaches the maximum allowable pressure within a certain limit, an alarm is counded on the main control board indicating a pressurization transient.
If the reactor coolant pressure continues to increase, the PORVs are automatically opened to mitigate the pressure transient. Thus, the system pressure will always be below the maximum allowable pressure. This PORV setpoint curve shall be periodically updated, as shall be specified in the Bases for the Technical Specifications, to ensure that the stress intensity factors for the reactor vessel at any time in life are lower than the reference stress intensity
' factors as specified in 10 CFR 50, Appendix G.
An alarm is provided to remind the operator to manually arm this system during cooldown.
The cold overpressur-ization mitigation system (COMS) has been designed as two separate trains in j
order to meet the single failure criteria.
I i
i The applicant has performed low-temperature overpressure transient analyses to i
j determine the maximum pressure for the postulated worst case mass input and l
heat input events that would challenge the cold overpressurization mitigation
{
system, which includes the PORVs. The mass input transient analysis was
{
performed assuming complete loss of letdown concurrent with full flow from 1 l
charging pump and spurious closure of the RHR inlet isolation valves.
An event with the potential of even greater mass addition is the inadvertent actuation of a safety injection pump. The applicant has stated that this event will be mitigated by discharge through the RHR suction line relief valves.
The heat input analysis was performed for an inadvertent reactor coolant pump start assuming that the RCS was water solid at the initiation of the event and i
that a 50*F mismatch existed between the RCS (250*F) and the secondary side of the steam generators (300*F). These temperatures were assumed because at t
00/21/84 5-5 vuusi.e sen inrui set, o 4*
iW "r r r r ~ v "
m
- 2. =..2_' : r ~~~~~~ T " ~ ~ _ ~'
'T:_.::
- . T. '
i 0,
p i
j
' temperatures lower than these, the mass input case is limiting. The 50*F t
mismatch is based upon a Technical Specification requirement. The results of i
these analyses show that the allowable limits will not be exceeded. The s
applicant will' provide PORV setpoint values later, and the staff will report j
its evaluation of these in a supplement to this SER.
1 i
f These analyses for the worst case heat and mass input transients were presented in WCAP 10529 and as such, they differ from those presented in the FSAR. The i
applicant should revise the FSAR to confirm the assumptions and conclusions of the WCAP. We will' consider this an open item until the FSAR is revised.
Inadvertent injection of an accumulator has been precluded as an overpressurization event because the isolation valve is closed with power locked out. Deliberate opening of the valve is not likely because the valves are not required to be tested at shutdown.
Inadvertent injection due to a SI j
pump, which is periodically tested, has been considered and is relieved by j
other means as discussed later on in this section.
1i j
The staff was concerned that the COMS may not adequately prctect the reactor vessel for those events that resulted from temperature changes to the primary coolant in such a way that the auctioneered temperature differed from the vessel temperature.
In Amendment 6 to the FSAft, the applicant has stated that nearly complete thermal mixing occurs in the RCS and that even failure of j
a temperature detector would not affect the COMS* ability to protect the reactor 0
vessel sinca the detector is upstream of the SI injection location.
3 a
]
An acceptance criterion for Item II.G.1 of NUREG-0737 is that the PORVs and j'
associated block valves have safety grade emergency power supplies. Section 8.3
}
of the SER provides a discussion of Vogtle's compliance with this criterion.
]
As a backup to the low-temperature overpressure protection system, each of the 1
two inlet suction lines to the residual heat removal system (RHRS) is equipped 3
with a pressure relief valve with a capacity of 900 gpm at a setpoint pressure
}
of 450 psig. The relieving capacity of each valve is adequate to relieve the l
combined flow of the two centrifugal charging pumps. The RHR suction relief valves provide overpressure protection after the RHR is put into operation and 09/26/84 5-6 V0GTi.E btM INPul btG 3 i,
I d
.m.
..........,_....,..__,_.,_........_,~e
,*.__.._____,._.,.._,--,,.-_m.
3_
f the RHR suction isolation valves are opened at RCS pressures less than 400 psig.
As such, credit is taken for the RHR relief valves relieving pressure in the event of an inadvertent safety injection pump injecting into the primary system.
In performing the low temperature overpressurization analysis, tihe applicant has assumed that the power to the safety injection pumps has been locked out, except for periodic testing and that below 1000 psig and 42'5'F the isolation i
valves on the accumulators will be closed with power locked out. The staff' requires technical specifications on these two items in addition to technical specifications on the maximum permissible temperature mismatch between the secondary and the primary before a reactor coolant pump may be started.
1 5.2.2.3 Conclusions Subject to (1) the generation of a. conservative PORV setpoint curve, (2) a i
commitment to periodically update the PORV setpoints for LTOPs to account for radiation-induced embrittlement, (3) appropriate Technical Specifications, as discussed above to prevent LTOPs, and (4) a revision of the FSAR to reference tte correct analysis for mass and heat input, the staff concludes that the over-pressure protection system for both normal and low temperature operation meets the relevant criteria of GDC 15 and 31 and is, therefore, acceptable.
Confor-mance to Appendix G to 10 CFR 50 criteria will be confirmed when the PORV setpoint curve is found acceptable. This. conclusion is based on the following:
i The overpressure protection system prevents overpressurization of the RCPB
)
under the most severe transients and limits reactor pressure,during normal operational transients. Overpressurization protection is provided by three safety valves. These valves discharge to the pressurizer relief tank through a common header from the pressurizar. The pressurizer safety and power-operated relief valves' and the RHR relief valves in the primary system, in conjunction 4
with the steam generator safety and atmospheric steam dump valves in the secondary system, and the reactor protection system, will protect the primary system against overpressure.
09/21/84 5-7 V0GTLE SER INPUT SEC 5
j
- o The peak primary system pressure following the worst transient is limited to the ASME Code allowable value with no credit taken for nonsafety grade relief systems. The Vogtle plant was assumed to be operating at design conditions
{
(102% of rated power) and the reactor is shut down by a high pressurizer pres-j sure trip signal. The calculated pressure is less than 110% of design pressure.
l l
Overpressure protection during low-temperature operation of the plant is provided j
by two PORVs and RHR suction relief valves in conjuntion with administrative controls.
A it The applicant has met GDC 15 and 31. Appendix G criteria are expected to be met when the PORV setpoint curve is generated.
In addition, the applicant has responded to Task Action Plan Items II.D.1 and II.D.3 of NUREG-0737.
Section 5.2.2 of the FSAR needs to.be amended to bring it into conformance f
with the responses to staff questions as identified in Amendment 6 to the FSAR. We will consider this item open until the FSAR revisions are made.
5.4.7 Residual Heat Removal System The design of the residual heat removal system (RHRS) for the Vogtle Units 1 and 2 has been reviewed in accordance with SRP 5.4.7 and Branch Technical Position RSB 5-1 of NUREG-0800.
Conformance with the acceptance criteria formed the basis for the staff's conclusion that the design of the RHRS is acceptable.
The RHRS has two independent cooling trains, which are designed for a pressure of 600 psig and a temperature of 400*F.
Each train has a 3000 gpm pump and l
a heat exchanger that is designed to transfer 32.8 million Stu/hr to the,
component cooling water. The pumps, heat exchangers, and isolation and cont'rol. valves are all located inside of containment.
Each train of the RHRS is powered by a separate vital bus.
l 09/21/84 5-8 V0GTLE SER INPUT SEC 5 i
.m.. _. _ _
. -..-...._ _ __.___......_ - u
--. - - -.m -,
j.
The RHRS operates in the following modes:
(1) Emergency Corp Cooling System (ECCS) Infection Mode I
Functions in conjunction with the high head portion of the ECCS to provide injection of borated water from the refueling water storage tank (RWST) into the RCS cold legs during the infection phase following a loss-of-coolant accident (LOCA).
(2) Emergency Core Cooling System, Recirculation Mode Provides long-term cooling during the rec,irculation phase following a LOCA.
l This function is accomplished by aligning the RHRS to take fluid from the containment pump, cool it by circulation through the RHR heat exchangers, and supply it to the cold legs of,the RCS. During this mode of operation, the RHRS discharge flow may be aligned to the suction of the charging pumps and safety injection pumps to provide water supplies for high head recirculation.
Flow paths are also available for hot-leg infection during the long-term recirculation mode to prevent boron precipitation in the reactor core.
(3) Refueling j
Used to transfer refueling water between the refueling cavity and the j
refueling water storage tank at the beginning and end of the refueling n
operations. During refueling, the RHRS is maintained in service to provide j
a heat removal function to accommodate the heat load.
1 1
)
(4) Cold Shutdown ii
)
Removes fission product decay heat to maintain cold shutdown conditions.
h j
(5) Startup li Connected to the chemical and volume control system (CVCS) via the low j
pressure letdown line to control reactor coolant pressure.
l 09/21/84 5-9 V0GTLE SER INPUT SEC 5
'II -
.w a
.e.
-~
?
f.
~
4 The RHRS is designed to remove heat from the RCS after the system pressure 2-and temperature have been reduced to approximately 400 psig and 350*F, l
f respectively, by the steam and power conversion system.
Under normal conditions, with two trains operating, it will take about 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> to get the reactor coolant temperature down to 140*F.
If there is only one train operating it will take abcut 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> to get the reactor coolant temperature down to 212*F and another 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> to further reduce the temperature to 200*F.
Due to thermal stre'ss considerations, the RCS cooldown is to be limited to 50*F/hr by Technical Specifications. The operator will be aided by both plant procedures and alarms on the safety parameter display systems so as not to exceed this limit.
5.4.7.1 Functional Requirements RS8 5-1 stipulates that the design of a plant shall be such that it can be taken to cold shutdown by using only safety grade systems and that these i
systems shall satisfy GDC-1 through 5.
In this regard Section 5.4.7.2.5 of
{
the FSAR states that the entire RHRS for Vogtle is designed as Safety Class 2 with the exception of the suction isolation valves which form a part of the RCS pressure boundary and are designed as Safety Class 1.
Compliance with GDC 1-5 criteria is as follows:
t GDC-1, quality assurance aspects of safety grade systems, is evaluated in 3
SER Section 17.1.
1 GDC-2, design bases for safety grade system, is evaluated in SER Section 3.2.
I fj GDC-3, fire protection of safety grade systems, is evaluated in SER
"]
Section 9.5.1.
.J GDC-4, environmental and missile protection design for safety grade systems, is evaluated in SER Sections 3.11 and 3.5.
~
l I
l GDC-5 is complied with because these RHRS's are not shared between units.
q i
l 09/21/84 5-10 V0GTLE SER INPUT SEC 5 l[.
y;
.a c
- - : =.==. -
g' To comply with the redundancy criteria of GOC 34 the RHRS has two independent i
- trains, Leak detection for the RHRS is discussed in Section 5.2.5 of this l
SER. Isolation valve and power supply redundancy are discussed under separate topics in this sectica. The staff has reviewed the description of the RHRS l
and the piping and instrumentation diagrams to verify that the system can be operated with or without offsite power and assuming a single failure. The two l
RHR pumps are connected to separate buses that can be powered by separata l
diesel generators in the event of loss of offsite power. Thus a single failure, such as that of a pump, valve, or heat exchanger, will still allow the operation of one train.
h GDC 19 states that a control room shall be provided from which actions can be taken to maintain the plant in a safe condition under accident conditions, i
j including loss-of-coolant accidents. SRP 5.4.7 stipulates that the control of I
the RHRS be such that the cooldown function can be performed from the control 1
room assuming a single failure of any active component, with only either onsite or offsite electric power available. Any operation required outside of the control room is to be justified by th4 appitcant.
k The applicant: states in FSAR Section 5.4.7.2.7 that the RHRS is designed to be
]
fully operable from the control room for normal operation and in Section j
5.4.7.2.3.5 that the RCS can be taken from no-load temperature and pressure to cold conditions using only safety-related systems with only onsite or offsite power available assuming the most limiting single failure.
It is also stated in Section 5.4.7.2.3 that as a backup to tha isolation valves on the ECCS accumulators there are redundant, Class 1E, solenoid operated valves to ensure that any accumulator may be vented, should it fail to be isolated from the RCS.
The auxiliary feedwater system, along with the steam generator safety and y
power-operated relief valves, provides a completely separate, independent, and diverse means of performing the safety function of removing residual heat.
l l
Decay heat. removal is normally performed by the RHRS when RCS temperature is l
1ess than 350*F. The auxiliary-feedwater system is capable of performing this function for an extended period of time following plant shutdown using the condensate storage tanks as a source of water. The applicant, in response to 09/21/84 5-11 V0GTLE SER INPUT SEC 5 1
^
- , 4. --
\\
^^
=..
.. a -
n l
l l
4 a staff concern, 'stited that the steargenerator power-operated relief valves, their operators and power supp1fss are designed tio safety grade standards.
In FSAR Section 5.4.7.1 the ap'plicant states that the RHRS is desigend to I
reduce the temperature of the reactor coolant from 350*F to 140*F in approxi-mately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. With only one @ain in service it will take approximately 15 t
hours to go from 350*F to 222*F. The cooldown time of 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> with one RHRS train is accepta' ele. With tho' stat'ad 4-hour time for cooldown from standby to RHRSconditionstheVogtleUnithiand2plantcanbebroughttocoldshutdown
~
within a reasonable period of time with or without offsite power.
With the exception of the syftability,of the leak detection, which is evaluated in Section 5.2.5, the RHRS has been reviewed and found to meet the functionil requirements of RS8 5-1}
71%
x 5.,,4.7.2 iakS Isolation Requirements A
THe RHRS valving arrangement is%esigned to provide adequate protection to the RHRS frcm overpressurhation when the reactor coolant system is at high pressure.
w2s Thhre are two separate an'd redundant motor-operated isolation vilves (MOVs)
Neheln each of thi,$Jo RHRS pump suction lines and the RCS hot legs.These valves are separately, diversely, and independently ' interlocked to prevent valve opening untfi the RCS pressure falls below 425 psig.
If the valves are open, they are separat'aly, diversely, and independently interlocked to close when the RCS pressure rises above 750 psig. Each one of the four RHRS suction MOVs is aligned to a separate motor control center. The four MOVs are powered from separate power trains.
Thus a single failure will not prevent the isola-tion of the RHRS nor will it cause isolation of both trains of RHR.
In addition, there is direct position indication of these valves in the control room.
Water, trapped between the two suction-side isolation valves at a low temperature, that is heated and thus expands will be relieved through a 3/4" line that extends from a point between the valves to the RCS.
l
- \\.. r
- s.
~
I' 09/21/84 5-12 V0GTLE SER INPUT SEC 5 k
i t
_.y..
y t
(
l.
4 l
There are two check valves and a normally open MOV on.each RHR discharge line.
The two check valves protect the system from the RCS pressure during normal plant operation. The applicant has provided design features to permit leak testing of the check valves with the RCS pressurized to fulfill the staff requirements for high/ low pressure isolation with two check valves. The check
. valves and the MOV are considered part of the ECCS.
i The staff finds that the design of the RHRS isolation system satisfies the criteria of Branch Technical Position RSB 5-1 and is acceptable.
[
5.4.7.3 RHR Pressure Relief Requirements l
Overpressure protection of the RHRS is provided by four relief valves, one on each of the suction and discharge lines.
Each suction line relief valve has a capacity of 900 gpa at 450 psig, which is sufficient to discharge the flow from a safety injection pump at the relief valve setpoint. The fluid discharged by these relief valves is collected in the pressurizer relief tank. Compliance of these valves with NUREG-0737 Item II.D.1 is evaluated in SER Section 3.9.3.
Each discharge line from the RHRS to the RCS is protected from overpressuriza-tion by a pressure relief valve in the ECCS. These valves, which have a relief flow capacity of 20 gpm at a set pressure of 600 psig, are to relieve the maximum possible back-leakege through the valvas separating the RHRS from the RCS. The fluid discharged by these valves is collected in the recycle holdup tank of the boron recycle system.
In response to a staff request to discuss procedures available to the operator
)
for responding to the lifting of an RHR relief valve, the applicant stated in FSAR Amendment 6 that specific procedures will be developed to diagnose a lifted relief valve and isolate the affected train.
If the valve involved were to be the suction side relief valve, the operator would be alerted by level, temperature and pressure indication on the pressurizer relief tank as well as pressurizer level.
If the valve involved were to be the discharge side relief valve, the operator would be alerted by steadily increasing level in the recycle holdup tank and/or high pressure in the discharge line to the tank. This response is acceptable.
09/21/84 5-13 V0GTLE SER INPUT SEC 5
g
~.
...::: 2.
~ ~ -.. ~
L 3
,4 I
k f
g, i
s
]-
5.4.7.4 RH.'t Pump Prot'e'etion
>i q
Each of the tm RHR pumps has a miniflow bypass line to prevent overheating in o
the event of, inadequate pump flow. A valve located in each miniflow line is regulated by(a signal from the flow transmitters located in each pump discharge header. Tne control valve opens when the RHR pump discharge flow is less than approximately 500 gpm and closes when the flow exceeds approximately 1000 gpa.
A pressura densor in each pump discharge header provides a signal for an indicator in the control room. A high pressure alarm is also actuated by the
~
pressure sensior.
q In response to a staff concern regarding the'aispositioning of the miniflow line valves,theapplicanthasstatedinFSiRAmendment6thatthevalveposition cont k1-switch has a spring return to automatic from both the open and close postidns. This is to prevent inadvertent operator action. Valve misalignment can be detected through use of the control room indications of valve position, RHR pump outlet temperature and pump discharge flow.
Correctfunctioningfor the valve is to be verified during RHR in-service testing and flow measurements j
in the miniflow lines are part of the preoperational testing program. The l
staff finds that these precautions and indications are acceptable.
- i The miniflow line valves are fast operating gate valves that will open or close in 10 seconds or less. This precludes RHR pump damage due to operator j
error that'could result in closure of both the residual heat exchanger outlet and bypasr flow control valves, which was another staff concern.
Cooling water is supplied to the RHR pump mechanical seal by the compo.nent
]
cooling water (CCW) systan. With r$ gard to a staff question concerning loss 1
1 of cooling to the seal, the applicant has stated that there are control room k
alarms to indicate low CCW pump discharge iprassure, low flow from the RHR pump seal coolers and high temperature in th'e RHRipump seal coolers.
Furthermore, the j
applicant has ' stated that qualification testO g has shown that the seals can
~
j operate for 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> at 300*F and for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 350*F and 400 psig without i
any signs of detrimental effects to the seals.
Considering (1) the capacity of 1
(
each train to remove heat, (2) as noted earlier, the capability of the seals to l'
a 09/21/84 5-14 V0GTLE SER INFUT SEC 5 s
e
- ~ -~~
~
m
M:.J.2 2. --....
...I-----.--._.
sustain a loss of cooling over an extended period of. time at high temperatures, (3) that degradation is temperature dependent, and (4) that there exists indi-cation to alert the operator, loss of CCW to the seals is not a concern.
The staff requested additional information concerning the possibility of air binding of the RHR pumps during and following periods of (1) maintenance when the RCS has ber s partially drained, (2) improper RCS level control, (3) partial loss of primary inventory or (4) operating the RHRS at an inadequate net pump suction head.
In response, the applicant has stated that if the steam gener-ator tubes need to be drained, the RCS inventory can be reduced without uncovering the inlets to the RHRS and thei RCS level would be continuously monitored.
Inventory makeup could, if need be, be performed by a charging pump.
If the inlets were to be uncovered, the effect of air entrainment would
+
l be minimized by the location of the RHR pumps which provide positive head on j
the pump inlet and procedures call.ing for the minimum RHR flow necessary for
{
In the event thkthe pumps do become air bound, the suction line and the pump can be filled and vented by using control room capabilities to open the vent valves and the refueling water storage tank
{
supply valves.
i l
In response to a staff question, the applicant has stated that plant design precludes water hammer due to air entrapped in the RHR during startup.
The design factors include suction piping that slope downward toward the pump to allow se.lf-venting and vents at piping high points. This is to prevent l
vortexing and air entrainment. Procedures will ensure that the RHRS is completely vented following maintenance operations.
5.4.7.5 Tests, Operational Procedures, and Support Systems The plant preoperational and startup test program provides for demonstrating the operation of the residual heat removal system in conformance with RG 1.68, as specified in SRP 5.4.7, Paragraph III.12.
The applicant was requested to demonstrated the adequacy of the mixing of L
borated water added to the RCS under natural circulation and the ability to cooldown the Vogtle units with natural circulation. The app'licant responded 1
09/26/84 5-15 V0GTLE SER INPUT SEC 5 I,
m;;rzz--
y-
.m
- -wrg - = ~ ;;
by referencing a program, described in a July 7,1981, letter from Westinghouse to H. R. Denton.
Although this program was approved by the staff, it was not approved as a means to satisfy BTP RSB 5-1 position E.
This program described a post TMI startup test procedure for Sequoyah 1.
Westinghouse has confirmed l
in subsequent discussion that the program was not implemented with the intent cf conforming to RSB 5-1 and in fact does not meet this BTP. This item will remain open until the applicant commits to conduct boration and cooldown tests under natural circulation conditions that meet the criteria of RSB 5-1 or j
to reference tests at a similar facility that have been accepted as meeting RS8 5-1.
This commitment should state that BTP RSB 5-1 position E will be met, by either alternative, prior to restart after the first refueling outage. Test procedures and results obtained by the applicant, in order to show compliance, sh~uld be submitted to the NRC for review and approval.
o The staff has reviewed the component cooling water system to ensure that sufficient cooling capability is available to the RHRS heat exchangers. The
[
acceptability of this cooling capacity and its conformance to GDC 44, 45, and
~
e46 are discussed in Section 9.2.2 of this SER.
i The applicant states that the RHRS is housed in a structure that is des,igned to withstand tornadoes, floods, and seismic phenomena, and there are no motor-operated valves in the RHRS which are subject to flooding after a LOCA or a steam line break. This area is addressed further in Section 3 of this SER.
i Leakages resulting from a passive failure of the RHRS piping will be collected by the floor drain system. THe operator will be alerted to such leaks by the control room alarms for the floor drain system, area radiation monitors, room l
high temperature alarms and flood retaining room system alarms. The faulted l
loop' can be completely isolated.with no ic: pact on plant safety because the redundant loop would remain to be available. Single failures, active or passive, in the redundant loop have not been postulated. This is in accord-ance with BTP ASB 3-1.
I i.
The, staff questioned the applicant about the consequences of failing an RHR i
suction line valve closed during shutdown cooling.
Consideration was to be given to either having the vessel head bolted or removed.
In response, the 09/26/84 5-16 V0GTLE SER INPUT SEC 5
T-1 t.O..
_ ___. Z_~ Z ZZ._~..iC__... T. _i~. '.~ Z.__Z.: !..._ ~
i. _...___.._ d i.
d applicant has stated that the valve closure may be reversible (closure caused by operator error), or not reversible.
In any event, the operator would be instructed to start the non-operating RHR pump in the other train.
Failing that (under some conditions only one RHR loop is required to be operable), the operator needs to find an alternate heat removal path. With the_ head bolted on, the steam generators are available to remove decay heat. With the head off and the refueling canal full, boiling will begin in approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
A' degraded water level due to boil-off can be restored by any of the water sources a
available to the operator such as an accumulator. Considering the amount of a
j decay heat and the water sources available, the operator has sufficient time to get at least one RHR loop into operation.
I r
The RHRS capability to withstand pipe whip inside containment as required by GDC 4 and RG 1.46 is discussed in Section 3.6 of this SER.
Protection against 1
piping failures outside of contain, ment in accordance with GDC 4 is discussed 1
in Section 3.6 of this SER.
1
~
All RHR lines, including instrument lines, have containment isolation features; l
their satisfaction of the requirements of GDC 56, 57, and the criteria of RG 1.11 is discussed in Section 6.2.4 of this SER.
1 The applicant, following SRP 5.4.7, Paragraph II.D.1, has demonstrated that u
- 1 suitable plant systems and procedures are available to place the plant in a Ij cold shutdown condition with only offsite or onsite power available within a i
reasonable period of time following shutdown, assuming the most limiting single failure.
i L
L Paragraph 5.4.7.2.4 of the FSAR states that residual heat removal system (RHRS) suction side reliefs have a set pressure of 450 psig.
It also states that the l
RHRS is not isolated from the reactor coolant system until a pressurizer bubble is formed and prior to increasing reactor coolant system pressure to 600 psig and that the isolation valves receive an automatic close signal at 750 psig.
h The applicant was requested to explain how the RHRS could be kept in service l
above 450 psig. This item will remain open until an acceptable response is recieved.
L l
09/26/84 5-l7 V0GTLE SER INPUT SEC 5 l<
II
l -~ ^ n:2 :.. ~~::..
- Y T ----.-T W
' ;_TO l
a 1
5.4.7.6 Conclusions The RHR function is accomplished in two phases: the initial cooldown phase and the RHRS operation phase.
In the event of loss of offsite power, the initial j
phase of cooldown is accomplished by use of the auxiliary feedwater system and l
the atmospheric dump valves. This equipment is used to reduce the reactor l
coolant system temperature and pressure to values that permit operation of the RHRS. The review of the initial cooldown phase is discussed in Section 10.3 f
of this SER. The review of the RHRS operational phase is discussed below.
The RHRS removes core decay heat and provides long-term cooling following the initial phase of reactor cooldown. The scope of review of the RHRS included piping and instrumentation diagrams, failure medes and effects analysis, and design performance specifications for essential components. The review has j
included the applicant's propos,ed design criteria and design bases for the j
RHRS and its analysis of the adequacy of conformance to these criteria and bases.
l.
The staff concludes that the design of the RHRS is acceptable and meets the l
relevant criteria of GDC 2, 5,19, and 34. This conclusion is based on the i
following:
1 j
(1) As stated in SER Section 3.2, the applicant has met GDC 2 with respect j
to Position C.2 of RG 1.29 concerning the seismic design of systems, structures, and components whose failure could cause an unacceptable i
reduction in the capability of the RHRS.
F 1
f (2) The appifcant has met the criteria of GDC 5 with respect.to sharing of i
structures, systems, and components by stating that the RHRS is not l
shared with another unit, i.e'., each unit of the Vogtle plant has a j
separate RHRS.
(3) The applicant has met GDC 19 with respect to the main control room requirements for normal operations and shutdown and GDC 34 which specifies requirements for the residual heat removal system by meeting the regulatory a
i F
09/26/84 5-18 V0GTLE SER INPUT SEC 5 e
~
- n ::c..x.. - n = r.~ r
~ ~ ~
~
~ T T- :-.-M"
~
~
Le i
l position in BTP RS8 5-1 except that the applicant is to demonstrate com-pliance with position E of this Branch Technical" Position.
i The staff resolution of NUREG-0660 Items II.E.3.2, as it relates to systems capability and reliability of shutdown heat removal systems under various transients, and II.E.3.3, as it relates to a coordinated study of shutdown heat removal requirements, will be contained in the resolution of USI-45.
Task Action Plan Ites III.D.1.1 of NUREG-0737 as it relate to primary coolant sources outside of containment is addressed in Section a of this SER.
5.4.12 Reactor Coolant System High Point Vents 10 CFR 50.44(c) (3) (iii) requires all light water reactors to have high point vents on the reactor coolant system and on the reactor vessel head. This requirement is supplemented by guidance in SRP 5.4.12 and NUREG-0737 Item II.8.1.
The applicant has provided information on the RCS high point vent esystem in FSAR Section 5.4.15 and in response to a staff request for further information which is included in Amendment 6 to the FSAR.
The Vogtle reactor vessel head vent system (RVHVS) consists of a single flow path with redundant isolation valves. The system is designed to mitigate a possible condition of inadequate core cooling or impaired natural circulation resulting from the accumulation of noncondensible gases in the RCS.
In FSAR Section 5.4.15 the applicant states the following about the RVHVS:
1 i
l 1.
The active portion of the system consists of four one-inch open/close i
solenoid-operated isolation valves connected to a 1" vent pipe located L
near the center of the reactor vessel head.
l t
2.
All piping and equipment from the vessel vent up to and including the second isolation valve in each flow path are designed and fabricated in 1
j accordance with ASME Section III, Class 1 requirements.
1 i
l
- To be filled in by Project Manager.
l; 09/26/84 5-19 V0GTLE SER INPUT SEC 5 l
. - - - - -. ~. -
2: T - ~
'^
~~
~ 3.
The piping and equipment in the flow paths from the second isolation valves to the modulating valves and from the isolation valves to the excess letdown heat exchanger are designed and fabricated in accordance with ASME Section III, Class 2 requirements. The remainder of the piping is Seismic Category 1, nonnuclear safety.
)
[
4.
The isolation valves in one flow path are powered by one vital power l
supply and'the valves in the second flow path are powered by a second l
, vital power supply. The isolation valves are fail closed, normally closed valves.
5.
The system is operated from the control room or the shutdown panels.
The isolation valves have stem position switches. The position indication from each valve is monitored in the control room by status lights.
The applicant states that a break
- of the.RVHVS would result in a small LOCA of j
not greater than one-inch diameter and would behave similarly to a hot leg l
break. This event is bounded by the spectrum of pipe breaks considered in i
Section 15 of this SER.
lY The applicant has evaluated the possibility of inadvertent actuation of the reactor vessel head vent system and states that no single active failure will
(
preclude reactor vessel head venting or venting isolation. The staff has reviewed this design and concurs with this conclusion. However, the facility is to employ a Target Rock valve system which may be susceptible to common mode failure. The applicant is required to evaluate this susceptibility and implement any necessary corrective action. This item will remain open l
until the applicant confirms the results of this evaluation.
i i
(
The pressurizer may be vented by opening one or both of the power operated relief valves. The steam generator U-tubes are vented by fill and vent proce-1 l
dures during normal operations and by emergency procedures during off normal conditions.
All remotely operated valves in the RVHVS can be tested during plant operation
(
by means of the valve status lights located in the control room. A system 09/26/84 5-20 V0GTLE SER INPUT SEC 5 tT:
- -- w....=.. =.
- =..
L.
.. -. ~ - ~
'l j
.i flow test can be performed at low RCS pressures by observing the system flow indicators or by observing an increase in the level of the pressuriier relief tank.
i The applicant has met the requirements of 10 CFR 50.44(c)(3)(iii) by (1) providing vent paths for the vessel head and pressurizer (2) providing remote operation from the control room (3) providing environmentally and seismically qualified components and power sources for the vent systems (4) taking measures to provide a degree of redundancy to assure venting operation and minimize inadvertent or irreversible operation 1
The applicant has committed to including the RVHVS in the Vogtle inservice testing and inspection program.
q The reactor systems aspects of the reactor coolant system vents have been reviewed, and the staff concludes that they meet the requirements in NUREG-0737 and are, therefore, acceptable.
1 1
Before the vent system is considered fully operational the applicant must j
j (1) complete operating procedures based on staff approvea operating guidelines
]
(2) adopt operability requirements for the vent system in the plant Technical Specifications i
(3) evaluate the susceptibility of the system to common mode failures and to take any necessary corrective action. This evaluation should show that "the vents must not lead to an unacceptable increase in the probability of a loss-of-coolant accident," which is the position of Action Item II.B.1.
The staff recommends that the RVHVS be equipped with a flow restrictor so l
l as to limit the flow, due to a pipe break or inadvertent actuation of the l
Ii 09/26/84 5-21 V0GTLE SER INPUT SEC 5 L
...e
,m
-"~
^-
g A
~
system, to the point where 1.t can be fully compensated for by the normal makeup system. Regarding this ites, the staff will report the results of the applicant's evaluation in a future supplement to this SER.
e e
e l
I 09/26/84 5-22 V0GTLE SER INPUT SEC 5 i
w
,3-.
3
-3 N
5 6.3 Emergency Core Coolina System The staff has reviewed the Vogtle Units 1 and 2 emergency core cooling system (ECCS) in accordance with SRP 6.3 (NUREG-0800).
Each of the four areas listed in the Areas of Review section of the SRP was reviewed according to the SRP Review Procedures. Conformance with the acceptance criteria, except as noted below, formed the basis for concluding that the design of the facility for emergency core cooling is acceptable.
As specified in the SRP, the design of the ECCS was reviewed to determine that it is capable of performing all of the functions stipulated in the design criteria. The ECCS is designed to provide core cooling as well as additional shutdown capability for accidents that result in significant depressurization of the reactor coolant system (RCS). These accidents include mechanical fail-ure of the RCS piping up to and including the double-ended break of the largest pipe, rupture of a control rod drive mechanism, spurious relief valve operation in the primary and secondary fluid systems, and breaks in the steam piping.
The principal bases for the staff's acceptance of this system are conformance to 10 CFR 50.46 and Appendix X to 10 C'FR 50, and GDC 2, 5, 17, 27, 35, 36, and 37.
The app 1tcant states that the criteria will be met even with minimum engineered safeguards available, such as the loss of one emergency power bus, with offsite power unavailable.
6.3.1 System Design As specified in SRP 6.3.1.2, the design of the ECCS was reviewed to determine that it is capable of performing all of the functions required by the design bases. The ECCS de ign is based on the availability of a minimum of three accumulators, one charging pump, one safety injection pump, one RHR pump, and one RHR heat exchanger together with their associated valves and piping.
09/21/84 6-1 V0GTLE SER INPUT SEC 6 n
_g-
q 1
t.'
Following a postulated LOCA, passive (accumulators) and active (injection
~
pumps and associated valves) systems will operate. After the water inventory i
i in the RWST has been depleted, long-term recirculation will be provided by taking suction from the containment sump and discharging to the RCS cold and/or hot legs. The low pressure passive accumulator system consists of four pressure vessels partially filled with borated water and pressurized with s
nitrogen gas.
Fluid level, baron concentration, and nitrogen pressure can bc 3
i remotely monitored and adjusted in each tank. When RCS pressure is lower than li
(
the accumulator tank pressure, borated water is infected through the RCS cold j
legs. The accumulators are equipped with relief valves that the. applicant has l
i stated have sufficient capacity to relieve all RCS backleakage.
i 1
1:
The high-head injection system consists of two centrifugal cf.arging pumps and two centrifugal safety injection pumps that provide high pressure injection of boric acid solution into the RCS. The high head pumps are aligned to take suction from the RWST for the injection phase of their operation.
Low-head injection is accomplished by two'RHR pump subsystems taking suction from the RWST during the short-tern ECCS injection phase and from the containment sump f
during long-term ECCS recirculation. The ECCS pumps are provided with over-current protection and monitoring of the bearing temperature and pump vibration.
i The RWST is a Seismic Category I structure with a nominal water inventory of i
715,000 gal of 2000 ppe borated water. To maintain the RWST water above the
)
temperature of boron precipitation and freezing, the applicant has provided the RWST with a heating system. The applicant has stated that this system 3
will maintain a minimum water temperature of 50*F.
In response to a staff request for additional information, the applicant has further stated that there is RWST temperature indication and a low temperature alarm in the control In addition, the piping leading from the RWST to the auxiliary buf1 ding room.
is heat traced by two redundant systems powered from two independent power A control room alarm is provided in the event of a problem with the sources.
heat tracing system.
In response to another staff concern, Georgia Power has stated that the RWST is equipped with 5 radial vents that are symmetrically placed. This design is to prevent blockage of the vent on the leeward side in f
the event of a freezing rain. These responses, which are part of Amendment 8 09/21/84 6-2 V0GTLE SER INPUT SEC 6 j
l
'T.
.yEX7""'? '~rr.:2.2. T D:f"T.-. :~.: ~ X.~X _
. ~
~~
[.
t*
I to the FSAR, are acceptable, in that they meet the intent of SRP 6.3, Paragraph III.8.
The RWST has been sized to provide allowances for safety infection and manual switchover of ECCS and containment spray pumps to the containment sumps.
Instrument errors in measuring the RWST level were given consideration in sizing the RWST as was consideration given to the worst case single active failure during switchover and level changes in the RWST due to thermal variations. The rate of flow from the RWST was based upon having two RHR pumps, two SI pumps, two centri-fugal charging pumps and two containment spray pumps all taking suction from the RWST. The containment and RCS pressures were assumed to be O psig so as to obtain maximum pump flow.
From the assumed allowances and flowrates, the appli-I cant calculated thati the minimum time to inject the design amount of water from the RWST prior to initiating the switchover process was approximately 19 minutes and the time to complete ECCS switchover was approximately 12 minutes once the I
low-low level alarm in the RWST is actuated.
The switchover time was computed considering the worst case single active failure (not isolating one RHR pump from the RWST). Operator actions were estimated to require less time than was available for switchover.
As specified in FSAR 6.3.3, the ECCS is initiated either manually or automati-cally on (1) low pressurizar pressure, (2) high containment pressure, or (3) low pressure in any steamline. This meets the requirements of GDC 20 and the position stated in SRP 6.3, Paragraph II. The ECCS may also tie manually actuated and unitored from the control room as required by GDC 19. The ECCS is supplemented by instrumentation that will enable the operator to monitor and control the ECCS equipment following a LOCA so that adequate core cooling may be maintained. The evaluation of this aspect of the post accident monitor-ing system is in Section 7.5 of this SER.
As recommended by SRP 6.3, Paragraph III.3, the available net positive suction head (NPSH) for all the pumps in the ECCS (centrifugal charging, safety injec-tion, and RHR pumps) has been shown to provide adequate margin. The calcula-tions were performed to meet the safety intent of RG 1.1, " Net Positive Suction 09/21/84 6-3 V0GTLE SER INPUT SEC 6
m:.m
. :. E. K. I ::' 1. -' ' ::::
- .: ~~ ~ * : X.*~= T = T
._ L C 2 ' T Head for Emergency Core Cooling and Containment Heat Removal System Pumps" as stated in FSAR Section 1.9.1.2.
As recommended in SRP 6.3, Paragraph III.11, the valve arrangement on the ECCS discharge lines has been reviewed with respect to determining adequate isola-tion between the RCS and the low pressure ECCS.
In some lines, this isolation j
is provided by two check valves in series with a normally closed isolation l
valve (high head injection discharge and low head injection discharge to the hot legs). Other discharge lines have only two check valves in series. The applicant has stated in Amendment 6 to the FSAR that test lines are provided for periodic leakage checks of reactor coolant past the check valves forming the reactor coolant system pressure boundaries and that these valves will be categorized as ASME IW-2000 Category AC. The applicant has stated that these valves will be leak tested on a refueling outage basis. This isolation capa-bility is acceptable. The frequency of the leak testing is reviewed in Section 3.9.6 of this SER.
Containment isolation features for all ECCS lines, including instrument lines (GDC 56 and the criteria in RG 1.11, " Instrument Lines Penetrating Primary Reactor Containment") are discussed in Section 6.2.4 of this SER.
The applicant has provided additional information.to address the potential of having debris inside containmer.t (including thermal insulation and construction materials) that may inhibit ECCS performance during the recirculation mode.
The applicant has stated that a procedure has been identified to inspect the containment for debris. GeorgiaPowerhasalsocommittedtoperiodically inspecting containment sump components such as screens and intake structures for visual evidence of structural distress or corrosion.
Stainless steel re-flective insulation is used for the reactor vessel and glass fiber insulation with stainless steel jacketing is used for the remainder of the containment equipment including the primary piping. This fibrous insulation was approved for use in a letter to Owens-Corning dated December 8, 1978.
l The applicant has stated, in response to staff concerns, that the containment sungis are provided with an inner 1/8 inch grating screen installed over the 09/26/84 6-4 V0GTLE SER INPUT SEC 6.3
t'
' intake pipe. The yarpose of the screen is to filter out those. particles that have the potential to eMher damage ECCS equipment or' to prevent flow through the most restrictive flow paths and to precli.de vortex formation that could lead to air entrapment and pump cavitation. Full scale test results were cited as evidence that vortex formation will be prevented by the screen. The tests were conducted by searching for vortices in the sump. With the grating screen removed, a spectrum of configurations of trash rack blockage were examined.
Internal vortices began to appear when 61% of the trash rack was blocked.
The most deleterious configuration, i.e., the configuration that had the most potential to degrade pump performance, was one in which 81% of the total trash rack flow area was blocked. This configuration was then tested with the grat-ing screen in place. Under this test condition, the applicant states that no vortices, with a vapor core, formed inside the sump. The applicant has also stated that the required net positive suction head of the RHR pumps is still available even considering the intake losses due to the trash rack, grating screen and pipe intake.
The effects of primary coolant sources outside containment (NUREG-0737, Item III.D.1) are discussed in Section 13.5.2 of this SER.
Proper ESF functioning can be verified by portions of the Post Acciden't Monitoring Instrumentation (Table 7.5.2-1) of the FSAR.
The. applicant should commit to complying with Action Item II.K.1.5.
This Action Item requires a review of all safety-related valve positicns, positioning requirements ~and positive controls to ensure the proper operation of the ESF.
Procedures are also to be reviewed so that these valves are returned to their correct positions following necessary manipulations and are maintained in their proper positions during all operational modes. This item is open.
In response to a staff concern, the applicant is to provide, at a later date, a clarification on the compliance to Action Item II.K.3.10.
This compliance will be evaluated at that time. This item is open. The applicant has also responded that it has approved administrative procedures for indicating and recording the status of operable and inoperable plant safety systems in accordance with II.K.1.10.
09/26/84 6-5 V0GTLE SER INPUT SEC 6.3 I
.--s
+=.-v,-.--+%-.-.o
--w--
--,.--.m.--m--ca, m
-..-,v,..
,---e
.-.---e,
,_m--.
.u w-.= :
< ~ ::: m
- ' ~ :: = ::: 2 -.2*-
-2=
~ - - - -
F 1..
t I
In FSAR Section 13.5.1.2.6, it is stated that procedures have been developed to report ECCS outage data to the NRC. The applicant st'ates that these procedures
)
l are in accordance with Action Item II.K.3.17.
The compliance of the combined control system capability associated with the ECCS, with respect to RG 1.47 is evaluated in SER Section 7.5.
During normal operation, the ECCS lines will be maintained in a filled condition by the head of the RWST. High point vents are provided and administrative pro-cedures will require that ECCS lines be returned to a filled condition following events such as maintenance that require draining of any of the lines. Maintain-ing these lines in a filled condition will minimize the likelihood of water ham-mer occurring during system startup.
The safety injection lines are protected from intersystem leakage by relief valves in both suction header and
- discharge lines except for the hot leg injec-tion lines. ThIhotleginjectionlinesarequalifiedtoRCSpressures.
Inter-system leakage detection is described in Section 5.2.5 of this SER.
As specified in SRP 6.3,Section II.B. no ECCS components are shared between units. This meets GDC 5.
ECCS performance during the injection and recirculation modes can be monitored j
in the control room by observing the indications for the high head and low head safety injection flows, ECCS valve status, RHR valve status, accumulator pressure, SI pump status, RWST level, containment sump level and RHR pump i
status. These indications are environmentally and seismically qualified.
l I
Following a loss-of-coolant accident (LOCA), the ECCS pumps may be called upon h
to provide long-term core cooling. The applicant has stated in FSAR Amend-ment 8, that the pumps have undergone hydraulic and mechanical testing and
(
that the pump seals have undergone endurance and leak testing under excessive conditions. Furthermore, the procurement specification for the pumps is that
.they be capable of performing their long-term cooling function for 1 year.
The' applicant has been requested to verify that test data existed to confirm that this specification was satisfied.
Section 3.10.2 of this SER reviews the ability of the ECCS pumps to provide long-term cooling for 1 year.
09/26/84 6-6 V0GTLE SER INPUT SEC 6.3 Ln
~~
L. :.:.L*L.. J M.7 ~. : r ~. *:L :-. :*=* r ~= R--- L W ~L J'L : = '~~
~ 'M *=T ' -
- (
. s a.
~
==
=..: : -
. r : 2
-~~~
J e
9-I Various ECCS components are dependent upon plant auxiliaries in order to maintain the performance of their function. These auxiliary systems may provide the required ac power or cooling (primary auxiliaries) or provide proper control of the environments of the rooms in which the ECCS and support equip-ment is located (secondary auxiliaries). The appiteant provided s. list of l
these auxiliary systems in Amendment 8 and noted that with the exception of the electric recirculation heater for the RWST and the auxiliary gas system, these systems are safety grade and designed to applicable industry codes. The auxiliary gas system is normally isolated from the accumulators and the recircu-1 j
lation heater is isolated during ECCS operation. These support systems are i
4 either normally operating or receive automatic start signals when the compo-i nents they support are actuated.
Staff finds this acceptable. The review of these support systems (component cooling water, nuclear service water, contain-ment heat removal, onsite ac power, auxiliary gas, diesel generator building ventilation, auxiliary building emergency ventilation, and essential chilled water) can be found in Chapters 6, 8 and 9 cf this SER.
4 6.3.2 Evaluation of Single Failures h
As recommended by SRP 6.3,Section II, the staff has reviewed the system description and piping and instrumentation diagrams to verify that sufficient core cooling will be provided during the initial injection phase with and without the availability of offsite power, assuming a single active failure.
The accumulators, one in each cold leg, have normally open motor-operated a
- isolation valves in the discharge lines. The applicant has stated in FSAR Section 6.3.2.2.16 that those valves whose spurious movement could result in degraded ECCS performance, including these accumulator isolation valves, have 1
]
power lock-out cap 2bility.
In addition, the applicant further states that the j
accumulator isolation valves were the only valves identified to have their motor operators submerged in the event of a LOCA. Prior to startup, these j
valves are placed i'n the position necessary to mitigate the consequences of a j
LOCA (open) and then have power removed. The possible submergence of the I
accumulator isolation valve motor operators is therefore of no consequence.
1 a
The ECCS is a two train system that is fully redundant except for the water i
.tj source for the injection phase.
There are no single active failures that can o
[j 09/21/84 6-7 V0GTLE SER INPUT SEC 6 o
Oy, o
~yg,y,
-w~~.-
y 3 m~n~ ~
m33.-gg_-y e
prevent the ECCS from taking suction from this source.. The applicant states in FSAR Section 6.3.2.5 that each train of the ECCS is powered by an indepen-dont emergency bus. Each emergency bus can be powered from a separate diesel generator in the event of loss of offsite power, as required by GDC 17.
At least one train will be operable in the event of loss of offsite power and failure of one diesel generator. The high-head injection systems contain parallel valves in the suction and discharge lines, thus ensuring operability of one train even if one valve fails to open. The low-head injection systems are normally aligned so that valve actuation is not required during the injec-tion phase.
The engineered safety features actustion system (ESFAS) is designed to auto-matica11y perform the short-term injection phase; no operator actions are re-quired. Two separate and redundant actuation trains are provided.
Each
. actuation train is assigned to a corresponding electrical power train to ensure that, in the event of a si6gle failure in the actuation logic, at least ore emergency diesel generator, one RHR, one SI and one charging pump would receive an actuation signal. There are also provisions for manual actuation and monitoring of the ECCS on the main control board. This complies with SRP 6.3 and is acceptable.
The applicant has proposed a partially automatic system to effect switchover of the low head system from the injection to the recirculation mode. Operator action will be required to complete this switchover.
Logic is provided to auto-matica11y open the containment sump isolation valves on low-low level in the Refueling Water Storage Tank (RWST) so as to provide a source of water to the RHR pumps. Manual actions are then required in order to isolate the RWST, iso-late the SI miniflow lines, isolate the charging pump alternate miniflow lines and to align the suction of the SI and charging pumps to the discharge of the i
RHR pumps. Switchover normally starts 19 minutes after ECCS initiation. The applicant has stated in Amendment 8 to the FSAR that once switchover begins, the operator has 22 minutes worth of water in the RWST, considering the most limit-I ing single failure, to complete the switchover, yet the manual actions only require about 12 minutes.
09/21/84 6-8 V0GTLE SER INPUT SEC 6 f
,.,-..n.-
,,M-n,%,
--~--.-------J.,--.
,---%n,-. -, -*
L.-
72
- '"~T"-
' * ' ~ * ~ * * '
. L.. : -- -. -. --
X
=-
t:-
i I
'The applicant was requested to describe the consequences of failing to perform the manual actions properly, i.e., omitting a procedural step or performing the s.eps out of order.
In Amendment 8 to the FSAR, the applicant stated that the etarging ptsps and the SI pumps can be damaged as a result of failing to change the position of particular valves. The appifcant was then requested to clarify this response and to indicate whether the consequences were a result i
of a single failure. This item is open.
i The staff has reviewed the plant's capability for hot-leg injection during the
]
recirculation phase to preclude excessive buildup of baron concentration in the pressure vessel. The staff has concluded that there is sufficient redun-dancy in injection lines and pumps to ensure adequate hot leg injection after 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> of cold leg' injection. This meets the requirements of SRP Section 6.3, Paragraph III.6.
During the long-term recirculation cooling phase of ECCS operation, leak detection is required to identify passive ECCS failures outside of containment, such as pump seal failures.
The applicant has provided a system of water-lev,el monitors and radiation detectors located in each compartment that contains ECCS corconents. The applicant states that with this system, the limiting leak (assumed to be 50 gpm) would be detected and isolated within 30 minutes.
The applicant has calculated that the total leakage in 30 minutes would not compromise long-term cooling.
Leak rates of less than 50 gpm would result in scenarios in which the detection (alarm) time would be longer, but the time available for operator response would also be longer.
The staff finds the system acceptable because it provides a means of. identifying and isolating a passive failure in the ECCS outside of containmer.t. The limiting leak was assumed to be a pump shaft seal failure.
Pipe breaks, causing leaks in excess of 50 gpe, are excluded by ME8 3-1 of the SRP.
A concern was raised with the applicant over a single motor-operated isolation valve in the common min'iflow path from the SI pumps to the RWST.
CJosure of this valve with the pumps running and with the RCS pressure high enough to I
preclude the use of the normal injection path could result in damage to both SI pumps.
In response, the appifcant has stated that the valve is normally in
\\
09/21/84 6-9 V0GTLE SER INPUT SEC 6 W
)
the open position with power locked out from the main, control room. In i
addition, the valve has redundant safety related position indication. The j
staff finds this acceptable.
Based on its review of the design features and contingent upon resolution of f
'the item discussed above, the staff concludes that the ECCS complies with the single-failure criterion of GDC 35.
6.3.3 Qualification of Emergency Core Cooling System The ECCS design to seismic Category I criteria, in compliance with RG 1.29 is discussed in Section 3.2 of this SER. The location of ECCS components in struc-tures designed to withstand a safe-shutdown earthquake and other~ natural pheno-mena, per the criteria of GDC 2, is also discussed in Section 3.2, as is the l
compliance of the equipment to the guidance of ANSI N18.2a-1975 in lieu of l
The ECCS prctection against missiles inside and outside containment by the design of suitable reinforced concrete barriers which include reinforced concrete walls and slabs (conformance to GDC 4), is discussed in Section 3.5 of this SER. The protection of the ECCS from pipe whip inside and outside of i
containment is discussed in Section 3.6 of this SER.
1 i
l The active components of the ECCS designed to function under the most severe duty loads, including safe-shutdown earthquake, are discussed in Sections 3.9 and 3.10 of this SER. The ECCS design to permit periodic inspection in accord-1 ance with ASME Code,Section XI, which constitutes compliance with GDC 36, is discussed in Section 6.6 of this SER. This meets the criteria set forth in SRP 6.3, Paragraph III.23.c.
The ECCS incorporates two subsystems that serve other functions. The RHRS provides for decay heat removal during reactor shutdown; at other times the j
RHRS is aligned for ECCS operation. The centrifugal charging pumps are used to maintain the reqei-M eolume *and water chemistry of primary fluid in the RCS. On an ECCS ar*,1 #. signal, the system is aligned to ECCS operation, and the CVCS funct k is isolated.
In neither case (RHR or centrifugal charging) 09/21/84 6-10 V0GTLE SER INPUT SEC 6
?
Tt
.. -.: w
- L
~ ~ ' ~ ' ' ~ ~ ~ ~ ^ ' ~ ~ "~~~: L
~
- 1., --- -
. _ ~
7.~
. - :. w..: ~ " =.
=.L-
-. =...:: =.:...=
I
~
does the normal system use impair its capability to function as an integral portion of the ECCS.
In addition, the RWST serves as a source of water during i
refueling operations.
6.3.4 Testing The applicant has committed to demonstrate the operability of the ECCS by
{
subjecting all components to preoperational and periodic testing. The app 11-cant has committed to meeting the intent of RG 1.68, " Initial Test Programs for Water-Cooled Nuclear Power Plants," and RG 1.79, "Preoperational Testing of Emergency Core Cooling System for Pressurized Water Reactors" for the ECCS.
l A program has been established for periodic testing that demonstrates compliance l
with GDC 37.
4 6.3.4.1 Preoperational Tests Tests will be conducted to verify system actuation: namely, the operability of all ECCS valves initiated by the iafety injection signal, the operability of all safeguard pump circuitry down through the pump breaker control circuits,
~
l and the proper operation of all vtjve interlocks.
Operability of ECCS check i.
valves will be verified.
Another test is to check the cold leg accumulator system and injection line to verify that the lines are free of obstructions and that the accumulator check valves and isolation valves operate correctly. The appifcant will perform a j
low pressure blowdown of each accumulator to confirm that the line is clear and check the operation of the check valves.
l l
The applicant will use the results of the preoperational tests to evaluate the i
hydraulic and mechanical perfomance of ECCS for delivering the flow for emergency core cooling.
The pumps will be operated under both miniflow (through test lines) and full-flow (through the actual piping) conditions. This two point test is to demonstrate compliance with the design specifications for the pump head-flow characteristic curve. The centrifugal charging and SI pumps will also be tested to demonstrate the time required to reach their rated flows.
09/21/84 6-11 V0GTLE SER INPUT SEC 6 i
n
ag 33 33n~.~.aam
-n-
=-
9.'
I By measuring the flow in each pipe, the applicant will,make the adjustments i
necessary to ensure tht no one branch has an unacceptably low or high resist-ance. As part of the ECCS verification, the applicant will analyze the results to ensure there are sufficient total line resistances to prevent excessive run-out of the pumps and adequate NPSH under the most ifmiting system alignment and RCS pressure. The appifcant will verify that the maximum flow rate from the test results confirms the maximum flow rate used in the NPSH calculations under the most limiting conditions and will also confirm that the minimum acceptable flow used in the LOCA analysis is met by the measured total pump flow and the relative flow between the branch lines.
The RHRS response to' simulated safety signals will be demonstrated to verify system alignment for the recirculation mode.
RHR pump performance will be checked to verify head-flow characteristics and runout ficw rates for hot and cold leg recirculation. -
In Section 1.9 of the FSAR, the. applicant has committed to compliance with RGs 1.68 and 1.79 with minor exceptions. The exception to RG 1.68 is not related to the ECCS. The exception taken to RG,1.79 is with respect to the accumulator isolation valve. The guide recommends that the valve be tested, with both normal and emergency power, to confirm that it will open under the maximum differential pressure conditions of zero RCS pressure and maximum expected accumulator procharge pressure. The applicant has stated that condi-tions at the valve motor are independent of power source so that testing with only normal power will meet the intent of the guide. The staff concludes that the preoperational test program for the ECCS conforms to the recommendations of RGs 1.68 and 1.79 and is acceptable pending successful completion of the program. Additional discussion of the preoperational test program is in Section 14 of this SER.
6.3.4.2 Periodic Component Tests Routine periodic testing of the ECCS components and all necessary support systems at power will be performed. All ECCS components can be tested online l
or have power locked out. Valves that actuate after a LOCA are operated through l
09/21/84 6-12 V0GTLE SER INPUT SEC 6 rr.
m m- ;
--v-m::
23_ __ _
'a complete cycle. Pumps are operated individually in this test on their mini flow lines including the charging pumps which can also be tested by their normal charging function. RHR pump operability is also verified durinr, those times the RHR system is put into operation. Series check valves that form a pressure boundary are supplied with test lines to verify that the valves can independently sustain the differential pressure. A visual inspection of pump seals, valve packings, flange connections and relief valves will be made in I
order to detect Teakage. Accumulator performance will be monitored by level and pressure instrumentation during plant operation. The Vogtle plant.will have the capability to conduct an integrated test when the plant is cooled down and RHR is operating. This integrated test will demonstrate operability of the valves, pump circuit breakers and automatic circuitry, including the starting and loading"of the diesel generators. The applicant has stated that the ECCS components and systems are designed to meet the intent of ASME Code,Section XI.
6.3.5. Performance Evaluation The ECCS has been designed to deliver fluid to the RCS to limit the maximum fuel cladding temperature following transients and accidents that require ECCS actuation. The ECCS is also designed to remove the decay and sensible heat during the recirculation mode.
10 CFR 50.46 lists the acceptance criteria for an ECCS. These criteria include the following:
(1) The calculated maximum fuel cladding temperature does not exceed 2200*F.
(2) The calculated total oxidation of the cladding does not exceed 0.17 times the total cladding thickness before oxidation.
(3) The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the l
cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.
09/21/84 6-13 V0GTLE SER INPUT SEC 6
~'T :
. )
p - --.
__.s
. _..- _ =
.___m._m.__=_7-
~-
- c_
22.-
q.
(4) Calculated changes in core geometry are such that the core remains amenable to cooling.
(5) After any calculated successful initial operation of the ECCS, the
[
calculated core temperature is maintained at an acceptable low value and T
decay heat is removed for the extended peMod of time required by the
.long-lived radioactivity remaining in the core.
i' In addition, 10 CFR 50.46 states 4
ECCS cooling performance shall be calculated in accordance with an acceptable model, and shall be calculated for a number of postulated loss-of-coolant accidents. Appendix K to 10 CFR 50, ECCS Evaluation Models, sets forth certain criteria and acceptable features of evaluation models.
6.3.5.1 Large-Break LOCA The appifcant has examined a spectrum of large breaks in RCS piping, and these analyses indicate that the most limiting event is a cold-leg double-ended guillotine break with a Moody discharge coefficient of 0.6.
The applicant took credit for one train of the active ECCS components and three of the four accumulators in the analysis.
In the large-break analysis, the worst case break resulted in decreasing RCS pressure. ECCS was assumed to be initiated by the low pressurizer pressure trip. The analysis results demonstrated that adequate core cooling is provided assuming the worst single failure, with no credit taken for nonsafety grade equipment.
I During startup and shutdown, portions of the ECCS, such as the accumulators and the safety injection pumps, are intentionally isolated from the RCS. A double-ended guillotine break during these times was analyzed and found to be bounded by the full power large-break LOCA. The applicant is to provide con-I firmation of this in a future amendment of the FSAR.
In addition to this ECCS equipment being isolated, the signals providing ECCS actuation due to low ' pressurizer pressure or low compensated steam line pressure are blocked 09/21/84 6-14 V0GTLE SER INPUT SEC 6 r,-
.L. _,._ L. : 2,";
- L LL2 ~ -
T Yl' A e
" - - ~ - ~ ^
^
~
~^
--s= -
below the P-11 interlock (approximately'2000 psi RCS pressure)., The applicant was requested to demonstrate there still existed adequate signals and alarms to detect a LOCA and to initiate mitigation actions. By FSAR Amendments 6 and 8, the applicant has stated that for a large-break LOCA at pressures below the P-11 interlock, safety injection would be actuated on high containment pressure.
In addition, the operator would be informed by safety related indication of the pressurizer level (a low level alarm is provided) and rapid changes in the con-tainment and RCS' pressures.
The applicant has stated that during startup and j'
shutdown, the flow from one charging pump and one RHR pump would be sufficient to maintain the plant within the 10 CFR 50.46 criteria.
The large-break LOCA evaluation model used in this analysis is described in WCAP-9220 (1981 vers' ion). This model was approved by NRC (letter from J. R. Miller, NRC, to E. P. Rahe, Westinghouse, dated April 29, 1978) and is used in large-break LOCA analyses for Westinghouse plants. Concerns expressed in NUREG-0630 about the conservatism of fuel-cladding swelling and rupture models used in LOCA analyses have been addressed in this version of the WCAP.
Containment parameters are chosen to minimize containment pressure so that
, core reflood calculations are conservative.
Fuel rod initial conditions are chosen to maximize clad temperature and oxidation. Calculations of core geometry are carried out past the point where temperatures are decreasing.
The most limiting break with respect to peak clad temperature is the double-ended guillotine break in the pump discharge leg with maximum safety injection and with a discharge coefficient (C ) = 0.'6 The peak clad temperature is D
2171.9'F, which is below the 2200*F limit of 10 CFR 50.46.
The limiting local and core-wide clad oxidation values calculated by the applicant were 8.65% and less than 0.3%, respectively.
These values are within the 17% and 1% limits of 10 CFR 50.46 respectively. Discharge coefficients of 0.4, 0.6 and 0.8 were considered. Appendix K of 10 CFR 50 requires that three valves of discharge coefficients be considered that span the range of 0.6 to 1.0.
The applicant should therefore analyze the case for CD = 1.0 or provide an evaluation that shows that this case is bounded by the previously analyzed cases.
If the appli-cant chooses to analyze the CD = 1.0 case, then it must be shown that the criteria of 10 CFR 50.46 are still met.
09/21/84 6-15 V0GTLE SER INPUT SEC 6 l
W L
. _ 2 _
=_ _
r= 37.2;;7.:2 v
= L. - -
- /
In the LOCA analysis, an upper head temperature equal to the cold leg temperature was assumed. The applicant has predicted that there is sufficient bypass flow to the head region to validate this assumption. The analytical models used to predict the upper head temperature were verified by testing at a Westinghouse facility.
Further confirmation of the analytical models was obtained by head /
fluid temperature measurements at a similar four loop plant.
Excessive boric acid concentration can occur due to bofloff resulting in baron precipitation. This will be prevented by switching over from cold leg recircu-lation to hot leg reciruciation. Backflushing ECCS water through the core prevents baron precipitation. The applicant has stated that if hot leg recir-culation is initiated 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> after the accident, the maximum allowable boric acid concentration w'ill not be exceeded. At this time the boiloff rate (20 lbs/s) is exceeded by the worst case hot leg injection rate (82 lbs/s for the double-ended cold leg guillotine break and loss of one ECCS train).
6.3.5.2 Small-Break LOCA The LOCA sensitivity studies determined the limiting small break to be less than a 10-inch-diameter rupture of the RCS. cold leg. A range of small-break -
analyses was presented that established the limiting break size. The analysis of this break has shown that the high-head portion of the ECCS, together with accumulators, provides sufficient core flooding to keep the calculated peak clad temperature less than that calculated for a large break and below the limits of 10 CFR 50.46.
The applicant has submitted analyses for a spectrum of small-break LOCA analyses (3-in. 4-in, 6-in). These identify that the 4-in. break is the limiting small break in terms of calculated peak cladding temperature (1537'F). The maximum local zirconium-water reaction was calculated to be.78% for a 3-inch break and the core-wide zirconium-water reaction was calculated to be less than.3%
for all break sizes.
The applicant was requested to demonstrate the adequacy of ECCS equipment and actu'ation signals during shutdown and startup in the event of a small-break LOCA.
In Amendments 6 and 8 to the FSAR, the applicant has stated that, for 09/21/84 6-16 V0GTLE SER INPtJT SEC 6 7
L
=-
. ~..
_-,=;=_=,.
=, _,
=:-=-~
f i
very small LOCAs, the containment high pressure setpoint may not be reached.
3 For these transients, less than a 2-inch diameter break, the operator would l
have to observe the available indication, diagnose the situation and manually
' initiate safety injection.
The indication available to the operator is the loss of pressurizer level, decrease in RCS pressure and increase in containment pressure.
In addition, radiation alarms and sump water level may also be avail-able. The operator has 10 minutes prior to the initiation of core uncovery.
This response is" satisfactory provided that the applicant can demonstrate that there is data to verify that operator action will take place prior to the core exceeding Appendix K criteria for a very small LOCA inside and outside contain-ment. This item will be confinatory.
The applicant has analyzed the performance of the ECCS in accordance with the criteria set forth in 10 CFR 50.46 and Appendix K to 10 CFR 50. The staff has reviewed the applicant's evaluation, and concludes that it is acceptable with I
the exception that timely operator action for a very small LOCA during startup and shutdown shall be verified.
6.3.6 Conclusions The ECCS includes the piping, valves, pumps, heat exchangers, instrumentation, and controls used to transfer heat from the core after a LOCA. The scope of review of the ECCS for the Vogtle plant included piping and instrumentation j
diagrams, equipment layout, failure modes and effects analyses, and design f
specifications for essential components. The review. included the applicant's proposed design criteria and design bases for the ECCS and the manner in which t'he design conforms to these criteria and bases.
The staff concludes that th'e design of the ECCS is acceptable and meets the requirements of GDC 2, 5, 17, 27, 35, 36, and 37, except.as noted. This conclusion is based on the following:
1' (1) As stated in Section 3.2 of this SER, the applicant has att the criteria
. of GOC 2 with regard to the seismic desiga of nonsafety systems or portions thereof that could have an adverse effect on ECCS by meeting Position C.2 of RG 1.29.
09/21/84 6-17 V0GTLE SER INPUT SEC 6 U'
_ ~
_._.._..___.._-._.___m_
s y
A it ll
=
s s
s (2) The appifcant has met tt's criteria.of GDC 5 with respect to sharing of structures, systems, and components by demonstrating that such sharing does not significantly impair the ability of the ECCS to perform its safsty tviction, g.., s n:
(3) The applicant has; met the criteria of GDC 17 with respect to providing sufficient capacity and capability to ensure that (a) specified accept-able fuel. design limits and design conditions of the RCPB are not exceeded as a result of anticipated operational occurrences and (b) the core is cooled and vital functions are maintained in the event of postu-lated accidents.
(4) The applicant has met the criteria of GOC 27 with regard to providing combined reactivity control system capability to ensure that under postu-lated accioent conditions and with appropriate margin for stuck rods, the capability to cool the core l's maintained, and the applicant's design meets the guidelines of RG 1,47 except as noted in SER Section 7.5.
(5) The applicant has met the criteria of GDC 35 in regard to abundant cooling capability for ECCS by providing redundant safety grade systems that meet the recommendations of RG 1.1.
'However, the applicant must provide additional information to demonstrate adequate ECCS capability in Ifght of single failures in operator actions during switchover.
(6) The epplicantTas met the criteria of GDC 36 with respect to the design of EdCS to permit aparopriate periodic inspection of important components of-the system.
(7) The applicant hn cet the criteria of GDC 37 with respect to designing the ECCS to permit testing of the operability of the system throughout the life of tha-plant, including the full operational sequence that
~
brings the system into operation.
The plant Technical Specifications
-will need to be reviewed to confirm compliance.to the criteria.
~
(8) The applicant has provided an analysis of the ECCS performance using an approved analysis model that meets the criteria of Appendix'K to 10 CFR 50 09/21/84 6-18 V0GTLE SER INPUT SEC 6 7
w-,e e=--
w--*
~e,-.-,e.-4,-
-,---_-,p--
T ~ ~ T T " T r _ Z TJ_.i.~.*. T ~ ~~~ T ~~ ~.J.1 _iT?. 2 ~
3-F W
e,,
- k.
and has shown the system performance meets the acceptance criteria of
~
l 10 CFR 50.46 with the exception that a large break LOCA must be evaluated r
with a discharge coefficient of 1.0.
This includes a demonstration that the~ peak cladding temperature, maximum hydrogen generation, and long I
cooling, as calculated with an acceptable evaluation model, are in accor-dance with these criteria.
I The applicant must provide confirmation that the operator can take appropriate action within the stated time in the o
f, event of a very small LOCA during startup and shutdown.
I :
Un h
l
- [ 9 i
l
(
1 I
l l
1
)
j 09/21/84 6-19 V0GTLE SER INPilT SEC 6 i
!e r
m.._
--_--__m.,._.
.)
15 ACCIDENT ANALYSES f
The accident analyses for Vogtle Units 1 and 2 have been reviewed in accordance with Sectioii 15 of the SRP (NUREG-0800). Conformance with the acceptance criteria, except as noted for each of the sections, formed the basis for concluding that the design of the facility for each of the areas reviewed is acceptable.
k In accordance with SRP 15.1.1, Paragraph I, the applicant evaluated the ability of Vogtle Units 1 and 2 to withstand anticipated operational occurrences and a broad spectrum o' postulated accidents without undue hazard to the health and safety of the public. The results of these analyses are used to show conform-ance with GDC M; 15, 27, and 31..
For each event analyzed, the worst operating conditions and the most limiting single failure were assumed, and credit was taken for minimum engineered safe-guards response, such as maximum delay times and minimum pump performance. The staff has asked the applicant to show the effect of a loss of offsite power on all anticipated operational occurrences and postulated accidents. The applicant has stated that all the the design basis accidents and anticipated operational 1
/
occurrences hava' beer, analyzed with and without offsite power available.
Parameters specific to individual events were conservatively selected. Two types of events were analyzed:
(1) those incidents that might be expected to occur during the lifetime of the reactor (2) those incidents not expected to occur that have the potential to result in significant radioactive material release (accidents) 09/26/84 15-1 V0GTLE SER INPUT SEC 15
... ~. __
- The nuclear feedback coefficients were conservatively chosen to produce the most adverse core response. The reactivity insertion curve, used to represent
~
the control rod insertion, accounts for a stuck rod; it complies with GDC 26.
j For transients and accidents, the applicant used a method that conservatively l
bounds the consequences of the event by accounting for fabrication and operating 5
uncertainties directly in the calculations. DN8Rs were calculated using the W-3 correlation'with a modified spacer factor R, with a minimum DNBR of 1.3 used as the threshold for fuel failure.
I The applicant accounts for variations in the initial conditions by making the following assumptions as appropriate for the event being considered:
(
l 1
core power, 3425 MWt, +2%
3 iverage reactor vessel temperature (T,yg), 588.5
- 4.0*F 4
pressure (at pressurizer), 2250 2 30 psi The staff requested that the applicant discuss the degree of conservatism in
[,
the initial pressurizer volume and to justify why this parameter is to be excluded from the plant Technical Specifications. In response, the applicant stated that the pressurizer volume assumed in the accident analyses was a nominal value that included allowances for uncertainties such as measurement er c and control dead band and that the level is maintained by a control syuem.
In addition, the applicant stated that the values for the process variables in the technical specifications, other than those specifically noted, may be treated as indicated values without consideration for instrument uncertainties. The rationale presented is that the typical measurement un-certainties are negligible in comparison to the conservatisms in the plant i
design and safety analyses. While the staff concurs that safety margin may I
exist in FSAR safety analyses to cover these instrument uncertainties, such safety margin has not been explicitly quantified.
)
i n
The existance and magnitude of the safety margins will be confirmed as part of l
efforts to address the recommendations of NUREG-1024. Specifically, the issue of indicated vs. actual values will be incorporated into the NUREG-1024 efforts.
?>
09/26/84 15-2 V0GTLE SER INPUT SEC 15
'~~
- . : *: " : ~ "^".. ~ ~ ~: " :. = ? 7.T : : T. 2.. X T " '.?
^.: ^ T u
(
o,*.
j i
~ Moreover the applicant has indicated it will pursue this along wig ?N identified in NUREG-1024 with the staff on a generic ' basis. Given the j
commitment to achieve confirmation of this issue, we find the applicant's f
response acceptable.
The staff concludes that the assumptions for initial conditions are acceptable because they are conservatively applied to produce the most adverse effects.
These assumed values will form the basis for the technical specification Itmits. For transients and accidents used to verify the ESF design, the app 11-cant used the safeguards power design value of 3579 MWt.
In analyzing the transients and accidents, it was assumed that the pressurizer heaters were not energized. The applicant was requested to demonstrate the i
conservatism of this assumption or to quantify the effects to show that they are negligible.
In response, the applicant has demonstrated that for cooldown transients or departure from nucidate boiling (DNB) limited transients, the transients occur so quickly that the pressurization due to the heaters is neg-11gible. For steam generator tube ruptures and small break LOCAs, the lini. ting l
assumption of loss of offsite power precludes the energization of the heaters.
f For the large LOCAs, the energy release and heat stored in the piping signifi-l cantly dominate the heat input from the pressurizer heaters. The break flow controls the system pressure with the heaters again having a negligible effect.
I l
For long term heat up transients, the applicant cited WCAP-9230. Report on the Consequences of a Postulated Main Feedline Rupture, as evidence to show that the heaters had a negligible effect. This is acceptable pending NRC approval i
i
{
of this report.
The applicant has also analyzed several events expected to occur one or more times in the life'of the plant. A number of transients can be expected to occur with moderate frequency as a result of equipment malfunctions or operator errors in the course of the various operating modes during the plant lifetime.
l l
Specific events were reviewed to ensure conformance with the acceptance crite-ria provided in the SRP.
t' 09/26/84 15-3 V0GTLE SER INPUT SEC 15
[W<
.?-
m_,.
_ -- =_
.e
.___.______._..-.]
- _ _... _. _... ~.. _ _ _ _ _ _ _ _. _ _ _ _ _. _.
y The acceptance criteria for transients of moderate frequency in the SRP include the following:
(1) Pressure in the reactor coolant and main steam systems should be main-tained below 110% of the design values (derived from Section III of the i
American Society of Mechanical Engineers Boiler and Pressure Vessel Code).
(2) Fuel clad integrity shall be maintained by ensuring that the minimus DN8R (departure from nucleate boiling) will remain above the 95/95 DNBR limit for PWRs.
(The 95/95 criterion discussed in Section 4.4 of this SER provides a 95% probability, at a 95% confidence level, that no fuel rod in the core experiences a DNB.)
l (3) An incident of moderate frequency should not generate a more serious plant l
condition without other faults occurring independently.
(4) For transients of moderate frequency in combination with a single failure, no loss of function of any fission product barrier, other than fuel ele-ment cladding, shall occur. Core geometry is maintained in such a way that there is no loss of core cooling capability and control rod inser-tability is maintained.
t j
Staff noted that the loss of nonemergency ac power to the station auxiliaries,
~
a Condition II event, is the initiator for the complete loss of forced reactor l
coolant flow, which is classified as a Condition III event. The applicant, in response to a stafi request to clarify this issue, stated that although the complete loss of forced reactor coolant flow is classified as a condition III event in the FSAR, it was analyzed and found to meet the Condition II acceptance 4
criteria. This is acceptable.
j Conformance with the SRP acceptance criteria for anticipated operational occur-rences constitutes compliance with GDC 10,15, and 26 of Appendix A to 10 CFR 50.
See Section 10.4.9 of this SER for a discussion of auxiliary feedwater system con-formance to TMI Action Plan Item II.E.1.1 and Section 7.3.3.1 for a discussion
~
of compliance with TMI Action Plan Item II.E.1.2.
These items address the adequacy of the AFWS design to remove decay heat.
09/26/84 15-4 V0GTLE SER INPUT SEC 15 T
~
pmr.
T.-J
--- tr T1..
-m I
9
- In response to TMI Action Item II.K.2.17 (Potential for Voiding in the Reactor Coolant System During Transients), the applicant has stated that Westinghouse has performed a study that addresses the potential for void i
formation in Westinghouse-designed NSSS during natural circulation cooldown/
j depressurization transients. This study has been submitted to the NRC by j
the Westinghouse Owners Group. As stated in R. Wayne Houston's December 6, 1983 memorandum to Gus C. Lainas entitled, "Multiplant Action Item F-33, I
(
Voiding in the Reactor Coolant System During Anticipated Trant fonts," the t
results of this study have been accepted.
Sequentiai auxiliary feedwater flow criteria are only of concern to once-l through steam generator designs. Since Westinghouse has inverted Utubo i
steam generator designs, the analysis requested by TMI Action Item II.K.2.19 (Sequential Auxiliary Flow Analysis) is not needed for Vogtle.
The transients analyzed are protected by the following reactor trips:
(1) power range high neutron flux (high and low settings)
(2) high pressurizer pressure (3) low pressurizer pressure j
(4) overpower AT (5) overtemperature AT (6) low reactor coolant flow l
(7) reactor coolant pump undervoltage
]
(8) low-low steam generator water level (9) high steam generator water level 1
j The reactor may also trip on other variables for which credit has not been j
taken in the accident analyses. This includes source and intermediate range neutron flux, pressurizer water level, turbine trip, safety injection, and L
reactor coolant pump underfrequency. The operators will also have the l
capability to manually trip the reactor.
il I
]
1 1
e i
p 09/26/84 15-5 V0GTLE SER INPUT SEC 15
=
7 Time delays to trip, calculated for each trip signal; ECCS actuation times, including the times for the ECCS pumps to reach rated flow; and diesel generator startup times'are included in the analyses. See Section 4.6 of this SER for a discussion of the staff review of reactivity control system func-tional design.
All of the events that are expected to occur with moderate frequency can be grouped according to the following plant process disturbances: changes in heat removal by the secondary system, changes in reactor coolant flow rate, changes i
in reactivity and power distribution, and changes in reactor coolant inventory.
l Design-basis accidents have been evaluated separately and are discussed at the i
and of this section and in Section 6.3 of the SER.
The fuel design is such that the fuel rod internal pressure may exceed primary system pressure. The applicant was requested to demonstrate that this was considered because this higher internal pressure may cause additional fuel rod ballooning and failures. 'The applicant cited WCAP-8963-P-A, " Safety Analysis for the Revised Fuel Rod Internal Pressure Design Basis." By letter of May'19, 1978, to T. M. Anderson from J. F. Stolz, this report was found acceptable.
o The applicant was requested to discuss the loss of instrument air as a plant transient.
In response, it was demonstrated that the cause for a complete loss of instrument air would be the loss of all nonemergency ac power to the 4
plant auxiliaries which is an analyzed event (FSAR Section 15.2.6).
L Limited operator action may be required following some transients. Some of these actions occur after the plant conditions have been stabilized and an h
orderly shutdown is undertaken.. Operato: actions here would be similar to ii those of normal shutdown. Other operator actions are required for switchover 1
from injection to recirculation. These operator actions are discussed in l
Section 6.3 of this SER. Other operation actions would be to identify and j
isolate a faulted steam generator from auxiliary feedwater flow in the event
'l of a steamline or feedwater line break. For these two events, the operator l
wili also need to manually control the repressurization of the RCS. This is 1'
performed by modulating the flow from the charging and SI pumps.
Relying on l
i I
i 09/26/84 15-6 V0GTLE SER INPUT SEC 15 l
t 7
2.u.
.. :J - ~ ~
T~-
' T :- -- -
1. 1 - --- ^
1 --
--i-
~
l o:
safety related indications and controls, the operator has sufficient time to accomplish these actions.
~
15.1 Increase in Heat Removal by the Secondary System The applicant's analysis of events that produced increased heat removal by the secondary system is addressed in the following paragraphs.
I 15.1.1 Decrease in Feedwater Temperature l
l The cause of this transient was assumed to be the isolation of c e string of low pressure feedwater heaters. Reactor trip on either neutron overpower,
- overpower AT or overtemperature AT prevents any power excursion which could lead to a DNB of less than 1.30, according to the applicant. The consequences of a decrease in feedwater temperature transient are bounded by those in Sections 15.1.2 and 15.1.3.
This is considered a condition II event.
15.1.2 Increase in Feedwater Flow Increases in feedwater flow can be the result of the full opening of a feed-
~
water control valve due to system malfunction or operator error. This will decrease the temperature of the reactor coolant water.
Due to'the negative moderator temperature coefficient this will insert positive reactivity and increase core power.
In Section 15.1.2.1 of the FSAR the applicant states that for these events the l
high neutron flux trip, overtemperature AT trip, and overpower AT trip prevent I
any power increase which could lead to a DN8R less than the limit value of 1.30.
The analytical results presented for these events are those where a steam generator (SG) hi-hi level trip closes all feedwater control and isolation j
valves, trips the main feedwater pumps, and trips the turbine. The applicant states that continuous addition of feedwater is prevented by the steam generator hi-hi level trip.,
I t
l i
09/26/84 15-7 V0GTLE SER INPUT SEC 15 r
.... ~ - -
- c-
- - --- --
-._-...._u.---
.-.------._--;---------z-c-- -----. ;- - ]
i
' This transient was analyzed by LOFTRAN which is a digital code that simulates i
a multiloop system, neutron kinetics, the pressurizer, pressurizer relief I
and safety valves, pressurizer spray, steam generator and SG safety valves.
Two sets of initial conditions were analyzed. One set assumed the transient initiating with the reactor just critical at zero-load conditions and that the malfunction resulted in a step increase in feedwater flow from 0 to 225%
of the nominal full-load value for one steam generator. The other set of initial conditions assumed full-load conditions and a step increase to 157%
of the nominal feedwater flow to one SG.
The analysis shows that at no-load conditions, the maximum reactivity inser-tion rate due to an increase in feedwater flow is less than the maximum value calculated for an inadvertent control rod withdrawal, which is evaluated in Section 15.4 of this SER. The full power case results in the largest power increase. However, for this case, reactor trip is initiated by SG 1evel high-high and the applicant states that*the DNBR remains above 1.30.
15.1.3 Increase in Steam Flow Increases in steam flow in excess of the capability of the reactor control sys-tem can be caused by an administrative violation such as excessive loading or an equipment malfunction in the steam dump control or turbine speed control.
Four sets of initial conditions were analyzed. These were:
reactor control in manual or automatic with either minimum or maximum moderator reactivity feedback.
LOFTRAN was used to analyze this transient. Full power operation j
with a 10% step increase in steam demand is assumed.
Protection against the transient could be afforded by either the power range high neutron flux, overpower AT or overtemperature AT reactor trip.
- However, for the cases involving' automatic reactor control, no credit was taken for the AT trips.
In fact, the analyses performed by the applicant show that the reactor would not trip but would reach a stabilized condition at the higher power level. This is qualified for the automatic control cases since the uncertainties in the setpoints may result in reactor trip.
In any case, all analyses show the reactor achieving a stabilized condition with the DNBR remaining above 1.30 at all times.
09/26/84 15-8 V0GTLE SER INPUT SEC 15 r.
-o
-.. _ _. ~. _.
,1
' 15.1.4 Inadvertent Opening of a Steam Generator Relief Valve or Safety Valve In FSAR Section 15.1.4.1 the applicant states that the most severe core con-ditions resulting from an accidental depressurization of the main steam sys-tem are associated with an inadvertent opening of a single steam dump, relief, or safety valve. The suddenly increased steam demand causes a reactor power in-crease which results in a reactor trip due to high neutron flux, overtemperature, or overpower signals or due to the trip occurring in conjunction with safety injection. The continued steam flow through the open valve will cause addi-tional cooldown which will, because of the negative moderator temperature coefficient, result in positive reactivity.
The safety 'njection system (SIS) i will inject borated water from the boron injection tank into the primary cool-ant system on either two out of four pressurizer low pressure signals, or two out of three low steamline pressure signals in any one loop. This ensures the t
reactor will be shut down during any subsequent cooldown. The narmal steam generator feedwater would be isolated automatically upon SIS initiation, and then the plant would be gradually cooled down with only safety grade equipment.
DN8 does not occur during this transient.
This tra'nsient was analyzed using LOFTRAN. The initial conditions included 4
having the reactor at just critical (no load) with an end-of-life shutdown margin. The most reactive rod cluster control assembly was assumed to be stuck in the fully withdrawn position and the single failure assumed was one -
SI train so as to minimize the boric acid injection. The transient was assumed initiated by the valve with the highest rated steam flow capacity that relieves to outside of the secondary system.
The no-load condition, in conjunction with offsite power available, all a
reactor coolant pumps running and maximum cold auxiliary feedwater flow has been assumed in order to maximize the cooldown transient that follows the valve opening.
The applicant has stated, in response to a staff concern, that although the pressur'izer empties during this. transient, void formation in the RCS will not occur because the coolant enthalpy will remain well below the saturation enthalpy corresponding to the prevailing RCS pressure.
i a
09/26/84 15-9 V0GTLE SER INPUT SEC 15 i
1
7
(
~,,'
l The applicant's analyses shaw that for transient events leading to an increase in heat removal by the secondary system (with or with'out single failure), the minimum DN8R remains above the design basis limit of 1.3.
Thus no fuel failure is predicted to occur, core geometry and control rod insertability are maintained with no loss of core cooling capability, and the maximum s
reactor coolant system pressure remains below 110% of design pressure. The staff finds the results of these analyses in conformance with the acceptance criteria of SRP 15.1.1 through 15.1.4, and, therefore, acceptable.
h 15.1.5 Steamline Rupture Accident The applicant has submitted analyses of postulated steamline breaks that show no fuel fsilures attributed to the accident. These results are similar to those obtained for previously reviewed Westinghouse four-loop plants.
A postulated double-ended rupture at hot shutdown power was analyzed as the worst case. The applicant reference'd MCAP-9226 as justification for this I
selection. WCAP-9226 is currently under review by the staff. The applicant l
has stated that the steam generators have integral flow restrictors with a I
1.4fts throat area, any rupture with a break area greater than 1.4fts, regard-less of location, will have the same effect on the system as a 1 4ft2 break; so this was assumed in the analysis. The doubled-ended rupture would cause the reactor to increase in power due to the decrease in reactor coolant temperature.
The reactor would be tripped by either reactor overpower AT, by high neutron
(
flux or by the actuation of the SIS. The SIS will be actuated by any of the following: two out of four low pressurizer pressure signals; two out of three Hf containment pressure signals; or two out of three low steamline i
pressure signals in ary one loop. The transient is terminated using only t
[
safety grade equipment. The injection of highly borated water ensures the
[
reactor is maintained in a shutdown condition.
j The applicant analyzed this transient with and without offsite power avail-
[
able. As a result, both full reactor coolant system flow and loss of flow
{.
09/26/84 15-10 V0GTLE SER INPUT SEC 15 i
i PT-it
.w,. -
-.. - =
- -- ^ ^
- ' - -^
-. ~. -.. -.. -
l
- were considered with the full flow case determined to be more limiting. The initial conditions included end-of-life shutdown marg'in, no load and the most f
reactive rod cluster control assembly stuck out. A single failure was chosen l
so as to minimize baron injection.
In addition to assuming offsite power available, and thus full reactor system coolant flow, other assumptions were made so as to maximize the cooldown transient that ens'ues the postulated steamline break. These assumptions included a maximum euxiliary feedwater (AFW) flow, minimum enthalpy and ime-diate delivery of auxiliary feedwater to the steam generators. Operator action at 30 minutes was assumed to isolate the AFW from the faulted SG.
In analyzing this event, the applicant utilized the W-3 correlation beyond the range for which it has been accepted. ~This is an open item as discussed in Section 4.4 of this SER.
Compliance with Task Action Plan Item II.K.3.5 for a non-LOCA event is addressed in a Westinghouse Owners Group report (letter OG-110, December 1983).
This report is in response to generic letter 83-10C which delineates the staff resolution of II.K.3.5.
The Owners Group response is under staff review.
Compliance to Task Action Plan II.K.3.25 is addressed in FSAR Section 9.2.8.
The intent of the item is to prevent excessive loss of RCS inventory as a result of RCP seal failure due to a loss of cooling water. The applicant has stated that in the event of a loss of offsite power, the RCP motor is de-energized and the' auxiliary component cooling water (ACCW) pump, which pro-vides the cooling water to the seals, is loaded onto the diesel generator's unless there is a coincident ESF signal. Thus, unless there is an ESF signal, seal cooling water would be restored within seconds. The applicant states that the pumps will incur no damage with ACCW flow interrupted for 10 l
minutes.
In the event of an ESF signal, the operator will thus have 10
[
minutes in which to manually load the ACCW onto the diesel generators. The RCPs can also be manually tripped if so desired. The operator has safety-related indication of ACCW flow, pressure, surge tank level and valve posi-tion that can be relied upon to reach a decision.
Staff finds the applicant to be in compliance with II.M,3.25.
09/26/84 11 V0GTLE SER INPUT SEC 15
- % s
...- - ~. - =
. =. - -
J L. _..
__u._...
..__ _ c.. _
- 1.....
__ _ z.. _;;
~ --
-'-~~-1
- The staff concludes that the consequences of postulated steamline breaks meet the relevant criteria in GDC 27, 28, 31, and 35 regarding control rod inser-tability and core coolability and Ti4I Action Plan Items. This conclusion is based upon the following:
(1) The applicant has met the criteria of GDC 27 and 28 by demonstrating that fuel damage, if any, is such that control rod insertability will be main-tained, and there'will be no loss of core cooling capability. The minimum DN8R experienced by any fuel rod was >1.30, resulting in none of the fuel elements being predicted to experience cladding perfo:ation.
(2) The applicant has met the criteria of GDC 31 with respect to demonstrating l
the integrity of the primary system boundary to withstand the postulated accident.
4 (3) - The applicant has met the criteria of GDC 35 with respect to demonstrating the adequacy of the emergency, cooling systems to provide abundant core cooling and reactivity control (via boron injection).
(4) A mathematical model, which accounts for incomplete coolant mixing in the reactor vessel, has been reviewed and.found acceptable by the staff. This model was used to analyze the effects of steamline breaks inside and out-sida of containment, during various modes of operation, with and without offsite power.
l (5) The parameters used as input to this model were reviewed and found to be suitably conservative.
15.2 Decrease in Heat Removal by the Secondary System l
l l
The applicant's analyses of events that result in a decrease in heat removal by l
the secondary system are presented below.
1 i
l l
I 09/26/84 15-12 V0GTLE SER INPUT SEC 15 7
i
,=-
..e-II
,._ m gn. _....
.. _...._ -. _..~.
.i
'15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow In Section 15.2.1 of the FSAR the applicant states that there are no stears pressureregulatorswhosefailureormalfunctioncouldcauseasteamilcw transient.
1 15.2.2 Loss of External Load In a loss of external load event, an electrical disturbance can cause a loss of a significant portion of the generator load. This loss of load situation 1
differs from the loss of ac power condition considered in Section 15.2.6 in that offsite power remains available to operate the station auxiliaries such as the reactor coolant pumps. The onsite diesel generators are therefore not required for this transient. The applicant states that in the event that a n
i safety limit is approached, the reactor will be tripped on high pressurizer pressure, high pressurizer level or overtemperature AT.
~
In addition, in Section 15.2.2.1 of the FSAR the applicant states that the results of_the turbine trip event analysis are more severe than those expected for the loss of external load. The reason given is that a turbine trip actuates the turbine stop valves whereas a loss of external load actuates only the turbine control valves. Since the stop valve can more 53ddenly cut off
}
the steam flow to the turbine this is a more severe " decreased heat removal" l
15.2.3 Turbine Trip 3
The applicant analyzed the turbine trip event for a complete loss of steam load from full power without a direct reactor trip (on turbine trip) and with only the pressurizer and steam generator safety valves assumed for pressure relief. The applicant states that RCS temperatures and pressures do not increase significantly if the turbine bypass system and pressurizer pressure control systems function properly. However, loss of the condenser would result in loss of main feedwater and could result in lifting the SG safety valves.
09/26/84 15-13 V0GTLE SER INPUT SEC 15 j.
yMT -~:2.. -. -. ::..' ~.: -
.- T.* 2. W
--~ ~.%.
i Reactor protection would be provided by the high pressurizer pressure, high pressurizer level, low-low SG water level and overtemperature AT trips. The applicant took credit for auxiliary feedwater only for long-term recovery so as to maximize the primary site pressure transient. The applicant did not take ::rsdit for the turbine bypass sytem of thG SG power-operated relief valves. The transient was analyzed with both minimum and maximum reactivity feedback. These two cases were analyzed with and without credit taken for pressurizer spray and pressurizer PORVs. The FSAR results show that the RCS peak pressure for all of the cases was below 2550 psia, which is well below the SRP limit of 110% of design pressure. For these assumptions, the minimum DN8R is 1.50 which is above the minimum limiting value of 1.30.
1 The consequences of a turbine trip without offsite power available are dis-cussed in Section 15.2.6.
15.2.4 Inadvertent Closure of Main Steam Isolation Valves Inadvertent closure of the main steam isolation valves would result in a tur-i bine trip without the turbine bypass system. This event is identical to the turbine trip which is described in Section 15.2.3 of this SER.
15.2.5 Loss of Condenser Vacuum and Other Events Resulting in a Turbine Trip Loss of tne condenser vacuum is an event that can cause a turbine trip.
In addition, loss of the condenser will preclude the use of the steam dump. The turbine trip analysis does not take credit for the steam dump, hence, this event is identical to the turbine trip transient which is described in Sec-tion 15.2.3 of this SER. The applicant has stated that other causes of a l
turbine trip are also covered in FSAR 15.2.3 and are therefore evaluated as turbine trip events.
15.2.6 Loss of Nonemergency AC Power to the Plant Auxiliaries The loss of the nonemergency ac. power can be caused by a complete loss of the'offsite grid followed by a turbine trip or a loss of the onsite ac dis-tribution grid.
09/26/34 15-14 V0GTLE SER INPUT SEC 15
-7 L
= " " ' - C:
...L...-....,_.
r
~ A loss of nonemergency ac power event is more limiting than the turbine-trip-l initiated decrease in secondary heat removal without ' loss of ac power because tha reactor coolant pumps are lost and the subsequent flow coastdown further reduces the rate of heat removed from the core.
In this transient, the loss j'
of offsite power is closely followed by turbine trip and reactor trip. The reactor trip is assumed to come from either the turbine trip, loss of power to the control rod drive mechanisms or from one of the trip setpoints in the pri-mary or secondary systems that would be reached as a result of the flow coast-1 down and decrease in secondary heat removal. The auxiliary feedwater system is automatically started on low-low level in any SG. Only one electric-motor-driven pump is assumed to be feeding all three steam generators.
\\
l The overall SG heat transfer coefficient assumed in the analysis following coastdown was that associated with natural circulation. The applicant has stated that this coefficient will be checked during the initial test program.
The applicant's LOFTRAN analysis shows that the natural circulation flow avail-able adequately transfers the decay heat from the' core to steam generators, which are being fed with emergency feedwater flow. The steam which is gener-ated is assumed to be relieved through the steam generator safety valves.
The primary system relief valves are assumed not to function.
The variations over time for this transient show that DNBR remains above 1.30 and that the primary and secondary pressures remain below 110% of their design pressure.
15.2.7 Loss of Normal Feedwater Flow A loss of normal feedwater flow can be caused by failures in the main feedwater
[
system such as pump or valve malfunctions or by the loss of ac power.
If the event is initiated by a loss of ac power, then the consequences are identical to those of the loss of nonemergency ac power event that is discussed in g
Section 15.2.6.
The applicant has analyzed this event for the case where it
}
is initiated by a pump or valve. failure. The result is that there will be a I
1 s
l 09/26/84 15-15 V0GTLE SER INPUT SEC 15 m
~
l i
.:,L T~
.. :. ~ '
-. ~ : :~. -..: : : ': ~
'^
^
-.L*X. X.X ~ : :
./
=/
i reduction in the capability of the secondary side to remove heat from the primary side.
In order to maximize the consequences'of the event, the applicant's assumptions were made so as to minimize the heat removal '
capability and to maximize the initial energy in the core. The assumptions included an auxiliary feedwater flow from one mator-driven pump, a heat trans-for coefficient associated with natural circulation of the RCS, the plant I
operating at 102% of design, the initial T,yg being 4*F over the nominal value, and auxiliary feedwater initiated by SG low-low level.
The analysis shows'that that a low-low' level in a SG will initiate reactor trip. Since the condenser has been assumed to be unavailable, the secondary side pressure rise will be limited by lifting the secondary relief and safety valvc.s. However, the applicant only took credit for the safeties.
In FSAR Section 15.2.7.1, the applicant notes that a small secondary system break could effect normal feedwater control causing low SG 1evels prior to protective actions for this break. The applicant has committed to reanaly:ing this event and has stated that this reanalysis will be part of the response to IE Notice 79-22. The evaluation of the applicant's response to IE Notice 79-22 is included in Section 7.7 of this SER.
The applicant's results show that primary pressure remains at or below 2500 psia, that secondary pressure remains at or below 1250 psia and DNBR drops to about 1.40 after 60 seconds following event initiation and then increases.
These results are within the SRP criteria.
15.2.8 Feedwater System Pipe Breaks In FSAR Section 15.2.8.1, the applicant states that pipe breaks upstream of the feedwater line check valve would preclude AFW flow to the faulted SG and would effect the plant only as a loss of feedwater and is covered by the evaluations in Sections 15.2.6 and 15.2.7.
The applicant also states that depending upon the size of the break and the operating conditions, the break could cause a RCS cooldown or heatup. The potential cooldown transient resulting from a feedwater line break is evaluated in Section 15.1.5 of the 09/26/84 15-16 V0GTLE SER INPUT SEC 15 ri -
o
~
m.-
c I.
I
~SER.
As a result, the applicant analyzed the heatup case for this event and thus used assumptions that minimized secondary system' heat removal capability and maximized heat addition to the primary system coolant.
Sensitivity studies, as presented in WCAP-9230, " Report on the Consequences of a Postulated Main Feedline Rupture," have shown that the most limiting i
i
.feedwater line break is a double-ended rupture of the largest feedwater ifne.
WCAP-9230 is under review by the staff.
The applicant has analyzed this event at full power with and without loss of offsite power and did not take credit for the pressurizer PORVs, pressurizer spray or for reactor trip on high pressurize,r pressure, high pressurizer level, containment pressure'or overtemperature AT.
i The analysis assumed reactor trip on SG low-low level. The auxiliary feed-I water system was assumed to be initiated also on this signal and AFW is assumed to be provided by one motor-driven pump to the three intact SG,s.
The l
turbine-driven AFW pump was assumed to fail and the other motor-driv' n pump e
was assumed to deliver all of its flow out the break.
I j
There is sufficient feedwater flow to adequately remove the residual h' eat after reactor shutdown. The use of safety grade equipment will mitigate this accident The applicant has provided the results of the analysis that shows that peak RCS pressure and peak secondary pressure remain below 110% of their design values and that DNBR remains above 1.30.
f l
15.3 Decreases in Reactor Coolant Flow Rate t
i 15.3.1/15.3.2 Loss of Forced Reactor Coolant Flow, Including Trip of Pump and Flow Controller Malfunctions A partial loss of coolant flow may be caused by a mechanical or electrical failure in a RCP motor, a fault in the power supply to the RCP or a pump l
trip,. A complete loss of flow may result from the simultaneous loss of
]
electrical power to all pump motors. The loss of coolant flow, if the reactor is at power, will result in a rapid increase in coolant temperature.
Ii 09/26/84 15-17 V0GTLE SER INPUT SEC 15 l
4 m
g
- ~. -
2 g
I
' Core protection against the partial and complete ?oss of coolant flow events is provided by reactor trip on low primary coolant f1'ow.
Above permissive P8, low flow in any one loop will initiate a reactor trip while a reactor trip will be actuated on low flow in any two loops if the power level is below P8 but above P7. Also above P7, the undervoltage reactor trip is available.
Frequency disturbances in the power grid can result in a reactor trip on RCP underfrequencf.
The partial loss of reactor coolant flow was analyzed for a loss of two pumps with four loops in operation. The complete loss of coolant flow event was analyzed with loss of all four pumps with all four loops in operation. These events were reviewed with the proceduces and acceptance criteria set forth in SRP 15.3.1-15.3.2.
Results provided by the applicant show that primary pressure remains well below the 110% of design pressure ' criteria. For both cases, the results j
show a decrease in the margin to DNS with the complete loss of coolant flow a
being more limiting. However, even for the limiting case, the minimum DN8, which is reached about 3 seconds into the transient, remains above 1.30 (approximately 1.33).
i i
15.3.3/15.3.4 Reactor Coolant Pump Rotor Seizure and Shaft Break Accident The applicant has analyzed the reactor coolant pump (RCP) rotor seizure and shaft break events with the LOFTRAN and FACTRAN corputer codes. Since the ini-tial rate of reduction of coolant flow is greater after an RCP rotor seizure, this is the limiting event. The locked rotor (RCP rotor. seizure) was analyzed both with a loss of offsite power and with offsite power available with four 1
loops in operation. A rapid buildup in the coolant temperature results in expansion of the coolant into the pressurizer causing a pressure increase in the RCS.
In the analysis, the applicant states that credit was not taken for the pressurizer PORVs or for the pressurizer spray. The pressurizer safety valves are taken credit for in order to maintain pressure below the 110% of desi,gn limitation. The results.show that the cladding goes into DNS and that the peak RCS pressure, maximum clad temperature and zirconium-steam reaction
)
09/26/84 15-18 V0GTLE SER INPUT SEC 15
}w
m m.- ~ ~
n-
- mm r
p
' are independent of whether or not offsite power is available. The maximum pressure was calculated to be 2548 psia.
The applicant's results show that fuel cooling enters into the nucleate boiling regime (i.e., DNB) within one second. Those fuel rods that were computed to have entered DNB were assumed to have failed for computing the radiological consequences.
15.4 Reactivity and Power Distribution Anomalies In the following sections, the staff addresses the appitcant's evaluation of events that result in reactivity and power distribution anomalies.
15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature In FSAR Section 15.4.4, the. applicant provides the results of an analysis for startup of an inactive reactor coolant pump event. This event was reviewed with the procedures and acceptance criteria set forth in SRP 15.4.4.
The applicant assumed that the transient began at a power level of 721 During the first part of the transient, the increase in core flow with cold water results in an increase in nuclear power and a decrease in core average temperature.
Reactivity addition for the inactive loop startup event is the result of the decrease in core inlet water temperature. This transient was evaluated by the applicant using a mathematical model that has been reviewed and found acceptable to the staff. The maximum calculated RCS pressure is below 2300 psia and the minimum DNBR is above 1.3 throughout the transient.
15.4.6 Inadvertent Baron Dilution Unborated water can be added to the reactor coolant system, via the chemical and volume control system (CVCS), to increase core reactivity. This may
~
happen inadvertently, because of operator error or CVCS malfunction, and cause
. 09/26/84 15-19 V0GTLE SER INPUT SEC 15
~
n--
..:. - -... ~,.
.. _ -... -... ~.
. _. ~ -.._.
i 1
- an unwanted increase in reactivity and a decrease in shutdown margin. The applicant has analyzed this event during all modes of operation. Operator action is required to mitigate this event and time limitations for this action are set forth in SRP 15.4.6.
The boron dilution that was analyzed by the applicant was caused by the flow from the reactor water makeup system (part of the CVCS) into the RCS. The l
ap'plicant has stated that the maximum flow from this system is 242 gal / min of f
unborated water.
]
For the baron dilution event during power operations, the reactor is tripped j
by overtemperature AT. According to the applicant, if the reactor is in manual 1
reactor control mode, then the alarms associated with this trip alert the operator to take action.
If the reactor is in automatic, then the operator is alerted to the event by the rod insertion limit alarms. During startup, the 4
applicant states that the event will cause a trip on power range neutron flux and the alarms associated with this trip alert the operator to take action.
j For these modes of operation, the applicant has demonstrated that sufficient j
time exists for the operator to take action.
Furthermore, the applicant i
states in response to a staff concern,"that the transient prior to reactor j
trip f,or these two modes is bounded by the rod withdrawal at power event.
3 The applicant' discounts the boron dilution event during refueling since by 3
administrative procedure, the RCS is isolated from unborated water sources by J
locking closed key valves. This item will remain open until Technical Speci-
)
fications are provided that would require these valves (175, 176, 177, and 183)
)
to be locked closed during refueling.
?
j Preliminary results of the applicants analysis show that the time available to the operator to take sitigative st.eps for this event during hot standby, hot f
shutdown and cold shut'own, is insufficient. The applicant has committed to d
}
provide supplemental information in the FSAR on this topic. Previous staff concerns, stated in the May 31, 1984, letter to the applicant, regarding DNBR, RCS pressure and redundant alarms should also be addressed. This item is open.
L 09/26/84 15-20 V0GTLE SER INPUT SEC 15 j
~
P
___.T.T_T. '
_7 T Z " _T ' ~'i.l_.___ '~_.
_ l_i_J
~
~
., 2
- /
1l
' The applicant was requested to describe the potential for boron dilution due to the chemical addition portion of the CVCS and due'to dilution sources other than the CVCS.
In response, the applicant.has stated that either these other 1j sources are precluded because they would require more than one failure to 4
bring about RCS dilution or that they are bounded by the dilution source assumed in the FSAR.
15.5 Increases in Reactor Coolant System Inventory 1
4 15.'5.1 Inadvertent Operation of the Emergency Core Cooling System During Power Operation ECCS operation could be initiated by a spurious signal or an operator error. A SI signal would ordinarily result in a trip of the reactor followed by a turbine l
trip. However, operator action can take place to block the SIS signal. The applicant has examined the case in which the reactor' trips.later in the tran-sient because of low RCS pressure. The DNBR never drops below its initial value.
If the operator fails to turn off the charging pumps the safety valves will open. Continued operation of these pumps would overfill the Pressure Relief l
Tank. However,.as stated in Table 6.3-1 of the FSAR, the cutoff head of the charging pumps is 6200 ft (2687 psig); so they cannot create 110% of the reac-j-
tor vessel design pressure (2733 psig) and thus cannot fail the vessel.
15.5.2 CVCS Malfunction That Increases Reactor Coolant Inventory 1
The evaluation of the consequences of injecting unborated water is included in Section 15.4.6.
The evaluation of the consequences of injecting borated water is included in Section 15.5.1.
l 15.6 Decrease in Reactor Coolant Inventory 15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve In FSAR Section 15.6.1, the applicant provides the results of an analysis for inadvertent opening of a pressurizer safety valve. This event bounds the l
09/26/84 15-21 V0GTLE SER INPUT SEC 15 1
f w
=-
+
3
~
' inadvertent opening of a relief valve. During this event, nuclear power is maintained at the initial value until reactor trip occurs on low pressurizer pressure. The DNBR decreases initially, but increases rapidly following the trip. The minimum DNBR of approximately 1.34 cccurred at 33 seconds into the transient. The RCS pressure decreases throughout the transient.
In response to TMI Action Ites II.K.3.1 (Installation and Testing of. Automatic Power Operated Relief Valve Isolation System), the applicant has stated that each of the PORVs has an associated block valve that will automatically close on low pressurizer pressure. The applicant should confirm that a test of the automatic block valve closure system will be conducted following installation.
The applicant also stated that the requirements of Action Item II.K.3.2 (Report on Overall Safety Effect of PORY Isolation System) is not applicable to the plant. This results from compliance to II.K.3.1.
The applicant must demon-strate that installation of tnis system will not impact the overall safety of the plant including the ability to depressurize the primary to mitigate the consequences of a steam generator tube rupture.
15.6.3 Steam Generator Tube Rupture The applicant has provided an analysis of the systems response and'r to-logical consequences of a steam generator tube rupture (SGTR) accident. This analysis is based upon the ability to isolate the effected SG within 30 minutes. Staff has requested justification that the operator can take appro-priate action within 30 minutes. Staff has also expressed concerns to the applicant regarding those systems for which the analysis takes credit in mitigating the consequences of a SGTR.
In response, the applicant states that the Westinghouse Owners Group is investigating several SGTR licensing concerns and will address the staff's concerns through a generic resolution at a future date. Upon receipt of this additional information, the staff will complete the review of the SGTR event and the radiological consequences thereof.
15.6.5 LOCA In FSAR Section 15.6.5, the applicant has analyzed the double-ended cold leg guillotine (DECLG) as the most limiting large-break LOCA. The analysis was 09/26/84 15-22 V0GTLE SER INPUT SEC 15
...j
^ :::..
_....'L.'-..-...----....----
.---- L I2
~
l
~l accomplished using three different flow coefficients. The results of this cal-culation show that the DECLG with a Moody break discharge coefficient of 0.6 with maximum safety injection is the worst case.
In this analysis, peak clad temperature reached is 2172*F. For the small-break LOCA, the applicant has determined that a cold leg rupture of less than 10 in. diameter is the most limiting. The analysis was performed for 3-in., 4-in. and 6-in.-diameter breaks. The results show that the 4-in.-diameter break results in the highest peak clad temperature (1537*F). The 3-in break results in the greatest amount of zirconium / steam reaction (.78%). Both of these accidents are terminated by SIS and ECCS operations. Only safety grade equipment is used to mitigate the accident.
The applicant has performed analyses of the performance of the ECCS in accor-dance with th'e Commission's regulations (10 CFR 50.46 and Appendix K to 10 CFR 50) except as noted in SER section 6.3.5.1.
The analyses considered a spectrum of postulated break sizes and locations. As shown in NUREG-0390, theseanalysesSe'reperformedwithanevaluationm'delthathadbeenpreviously o
reviewed and approved by the staff. The results show that the ECCS satisfies the following critirfa:
(1) The calculated maximum fuel rod cladding temperature does not exceed 2200*F.
(2) The calculated maximum local oxidation of the cladding does not exceed 17% of the total cladding thickness before oxidation.
(3) The calculated total amount of hydrogen generated from the chemical reac-tion of the cladding with water or steam does not exceed 1% of the hypo-thetical amount that would be generated if all of the metal in the clad-ding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.
(4) Calculated changes in core geometry are such that the core remains amena-ble to cooling.
09/26/84 15-23 V0GTLE SER INPUT SEC 15
'T,
v-
=
~ _, _
~
. g
,.o ;
(5) After any calculated successful initial operation of the ECCS, the calcu-lated core temperature is maintained at an acceptably low value and decay heat is removed for the extended period of time required by the long-lived radioactivity.
The applicant is a member of the Westinghouse Owners Group that is evaluating TMI Action Item II.K.2.13 (Thermal Mechanical Report: Effect of High Pressure Injection on Vessel Integrity for Small-Break LOCA with No Auxiliary Feed-water). Staff review of this item will be covered in NRC unresolved safety issue A-49, " Press'urized Thermal Shock."
In response to Action Item II.K.3.30 (Revised Small-Break LOCA Methods To Show Compliance With 10 CFR 50, Appendix K), the applicant stated that Westinghouse has submitted a new small-break evaluation model to NRC. The staff is currently reviewing this submittal. The applicant further stated that after j
the staff review of this evaluation model is completed, a plant specific sub-mittal on this issue will be supplied. This will address Action Item II.K.3.31 (Plant Specific. calculations To Show Compliance with 3 CFR 50.46).
The staff concludes that the calculated performance of the ECCS following pos-l tulated LOCA accidents conform to the Commission's regulations and to applica-ble regulatory guides and staff technical positions except as noted, and the i
ECCS performance is considered acceptable for the postulated accidents.
r r
i l
09/26/84 15-24 V0GTLE SER INPUT SEC 15 if,
,