ML20141B307
| ML20141B307 | |
| Person / Time | |
|---|---|
| Site: | 05200003 |
| Issue date: | 04/30/1997 |
| From: | Brockhoff C, Corletti M, Lindgren D WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP. |
| To: | |
| Shared Package | |
| ML20141B305 | List: |
| References | |
| WCAP-14477, WCAP-14477-R01, WCAP-14477-R1, NUDOCS 9705150228 | |
| Download: ML20141B307 (97) | |
Text
.
g-
- c. . .
. I: -il .\.l .)l'.f.; ;.{ l;..f.;.
.. w : ;m' * ~.. .:.,3. ; ; . :; :,: : ., a : p).;..g
{j.: f 'l ,h .h' h ;%.'.l .M.,$. h*l.'l, ,
- . ? f $ ..'ll .& '.?'l. .f. '...? 'h f*
- i,$ . .
) f h*:['!.f.D,;
-' c. ,g;y.: .y*. .gy .;
' t.l ' - . '.
. [ . %. G.a .:
. . . .. .;;. c f y '. v, '
.l l"..ry..w.v
- -: .. . : , .l.;;;. _ . ,. . c:;. . 7.~';; g _ . . a:;. , ~ . w ; x:4.;
9;3:.7,;. .., .y:l* l ~ . ~.v ,
,y ' ' . .::;p: ., *.s *; ,7: y. :g::_ : .a . - .- . .' ..
.; '.,o:;;,'.,;.'<,..t. . g-_ .).i' - : . , f.;
.. . : i.;.. : ::' ., t:l.. ,, . .: .. '.. 3.:
- -iv : ,
e )' .' 9.:'. 3 - ..r;e a.
, b ..y.. ::.._,; Yr.ys;s:g R.a..nr'*. . ,
. :'.. , . .x - L.
, .,. -, . . . . . 4., ,,s. .;' j, '.c ..'e '* .; ,. s.
- .;.;..):. ,.;,. .
...,.e.;,,.'.:...'_.,; a 5.;.
. ze - * % ;. . . . ,, ;,. .;y,y.y: :,
,.:*.a.:.*. . ' . - . . .'p. ..:'_.
,..'s..,,
,.. * , by :pf -+m. .;-f,. -s A,'.p,. s ,.
..s *
. . . '?: . . -
.,.6s
.'. **l- '. . ': l : s . ,: . * . . .:
.s-
.-: W; . . :..'.
- l,v q- - ,)f.\ >iV.q.; 7,. ,T.y:.o.'. .
. .'. ;t. ...:-'
, t .l1.:.\..:
.'.. ., n? ;, ; e q * . .'l-. .; *- g M ds :l . ,. %> ?_* u .im, ,,* 9. . l s. n{.'%f ,. -.-," : y : 7. ; ;. .',., , . - . . .- ., :g
';; ; ; - l * :: . c, ,r, l :f, ? '.*,' . ;' ** . . ..: :.j,. e; . ?: %,::}j'.':: . ..G*.,%, W:e'.*'. . . .&
~
. . i.
.W.,
, :: i.> . :
U.* :i ?J
.q. ; ;. U' .l :? $. .':? .
. ~ ^ * 'n y,p a .
. f. ,,\,lr ..Y- . *.i,f.,
- . - . ,u
. .. .-:9. .,'9 ;fc g?l .'* :
.i;.*:h.} . Ll. l. '; ','; ':
. . Y:.. . . - :.,,.
.~e,. . . ... . ..s .. ,...;_
. ;. ., .%. .. ,,e , : ?. .. -'. -' c. z . O. .~ . -
t ; .. . - ' . . .
....,.u r. . . .,. r :m q. . '. - .
.. ..'v.v,. .. .,. :..,. ,, .., ). J. h..a. y.
., .:.. '. . y:gw ^a. &......-.. . .:. ,.;,~,a..*..,.
g,.%,,; n. > d. L.y . , ?. .,. u. ;.. * ? -~
. i. *
.. : ; ; .. f. . .. ?. ,%. ,. . . s . . . . . ., ,. -*p : y , '. .),..?... a: :
..4.,. .".e *: p. c, :
- q.. ;::" p.
. . a.m. ...vp^.:.p.. .g . . _
0 %
v'. .. ..s.. 3 : r. .
- w. n . e
~.'..l, ; . . .4 .
r,. z%_._, .&.,.,A. -. :..%.~.. N .M:4.-l.,. . .,. , .p" :,. ,.. ,. i.,s. ,.. ".;.._.: , '::;C ; . .. . !-:;
, : .p
-.c m,
\ ,.. ;... m .,",.;y:4,g .,* ;. ...'c .
.l z; 9..*..i.. ., ..,. ..;...g,%
...2 .
1 : , . * ; r .:: %,...,.c..'.: "c. ,. :.,a., 9 , .:... _t. .. . . . . . -
. g a, n.. e . -
' . ." ,; f.. . . (..1 ,.*): . p . & . . .:: ;;fa ; . . '..:.s. rGn ,1 l ' ;,. ; - s
;,. ;:i h. ,. ,* . :.3 3. . . .A . 's . ., .,. ,.',.t',--; .
. . . . : = .:4; '. q. * ^. :: \;:..: ,1 V*;m .".s. .. ._ ,;,? o
- : "+ , ,
- .a%' . 'W ...s Y:%,.::-7 .q *. j :,, .e.y . ;; .l :: * .' . *.:.: , _.,,
~ 3.^;.
. . ,1 : ;. _3:l,_ r.* :..; ::;:: :.: ;: ~ .. .. . . _ _ , ,
f.. . > l ..,5 ?):; G,;;*:,V ', ..y. .; ;.:c'.glWl', y,, . ?n;% :,:4[.g..
. .,v, . . . . ,. .;-: e ; ..s.-..- - :
y- -'. t,;;. ,.. .,s, ,. ,y.a. : i ^
..;.gq.* y;..; ; /.;-
..,4..
.s . .;.ef, m,
..*v,...
....p,..'..i. .,. ; .*
.f.r,-. y.....s_m,-:,'-
y...w . f. , .. ',..;;;:.,q,o.t.: .' .
,.- n., . . . . . , - e. -
' l;' ., _,.v.'..:.,
.I I !. ,
, .; ? f $.
? g,
- f_ '. * . . ..
..- .e j :- ,
.; ~ . . ; ..,,:s
......s f'f: - -'
3 .:
.> . ....'-.,;g . ;ys.,i^7s;, ._e- ... . . . -
- .,'y,s . , "*d: .; . . . n. s : .. . ;- n . ,
..~.- ,& - -.. u.r s.., ! 7... p)],. :...:.;.,;.l,,
- , \. k ..(;_. .."..e;.,. .~ _;
., . . , .~,~. R. . . - . . . .M .g'..'.::a,
- .. . .p, ,2 .
. $_ . . ~;; r.. .. ::y(:-.j,-f.._. ; . ; .; . : .
- .,.s.,..... .. ,?.
,...:;.;... ;.. ;, ..~ . .c, .,;,$.-. .Q. . . .:c... . ,1:.:~.. 't k,:..._ , ... -.
,a.:
v
_..z.....,'.'..%,-.
- y"...,: .'. . , .?.
- f. ;g:v. ,. ?. ;
,-w.,.. .. - ,4, . ..,.s......,..: . .: . , ,,. . t 3 :, , ,e,,.
6 q . ...o
. . . , .*_ ; ; , .,~: . ,"., ,3, , .
,,,.L., ,,
s ,,. . - .
- ,.c.,
~
..-' .o.. . , , ' ,. '. ,- ,-.s... ,... ..# . , . .,Y, ,, ,[' . "..*'..:......'..,.,',..'.15.'..'[*',.*'.f( .4 ; - '. ' . , '
J 2.- *** ' -
5,.- '. ' , ,i
. * [+'k-*
.,.s.4
.a a- * ;*,-- u
- . 4+ e 't*% , f . ' , ~4%. ;
s
-: t *e..
,?.4l'.- .-
? :;. .- ' 3. Q,n ".r ~ :, **.3: ' * ..; < . ,. 3,: -. ;,V :',w,
.<, . ;.. . , , , 5 ;
-q :).' ;; . ht, ! * "?. . , ;j . , .'. . . '.-' .:' +'e
- . ,
- 4'. ,;. . *..' -l .
- ., .
.,.'.s. ,.%....;
- - ., ,.;. :*g
.t . ..* i . .
- ., . .. *.....s.'.,'. ,2..
7, . ,
,v. -
..'s...,.';;...
,n. ;- a
- , . s '..- ' . ;.y .,, . . t:. .. . - d.* .: . .- .-s . ,.. .
t m.,..,';- K, :- ...;<?
' , ' . ' . .. 2-: p:. u: : ..
' , L "~. .k..<.
,-l g :-:..'..~.. .., . - ,
,.,g* , ,. ,,,'s..,.,,- , ;.;.,,'.
l, l d i *' . . .
- c 'l ~ }, ,
f : ' '* ,l . ' ,, n.. .7, %, . j'..'h',..~
, , 's ,3 : ..
{,, . .:.-g ,
[* '. - *
, f. 4 c.,.,,,,.,. .- ...n
,J,,..q;...',.'"*,e,.'
. ' ,; ,'l
- .g
. M t...:..
- . ,e
- ,....>,'.s;,,*.: . : . . . t, ; , s*', ...e
'p.,-
...;#;..s....
. . /, ~;<: . ' 3- ~,;
3 . ..
...',6 .,f
. .'....,.p
- ..- ". . ', f
- , ',.-
- >--c ?5,!
.s t
'.?:, , J , . r;M.
- . ..*' },n '3.'. . .*a.
- . ; h . .., .. . . =, *; ,.* - >-
- :: <+.: '. z
.m; ;;
- . .2:.n .k q.hY ,'. ; u,(.*. . :. .< -
te a :. a.'.s.. -.
,: .. %. -} , ; .,. ;..,......,;...!.,.....m.2:...
.. -- -y .-
,,t .e.,.4,,.'..>g.
u
. ; .,...:. ..,....J....., ..,. ...s.s
. . ...Y ,J~ :. .,
.s..., :- , .e.; , ,.
J....;,g._..
. . . ;. .. , , _.. .._..e;.,,4 ,y; .. , . .. . . . . , .. - p._
_. '. ;... _,$:,._.........,,T.. * :
.t t. -
. y : , ..
- ,
- .,.; .. ,...,* .,_,.. 9.-
.p
. f-. .,. ,*,e;. ,. -> .- .
. . - : p. ~,J e.-' ....y.;....).,'...',.;., ;. .,v . . , , , . *.,e . ...,....;.v,. : ' , . .l,'..: :... , . - -
. . e..., - .,..l s ..s,.;. - ..- . .f * -
,y
,f. '* * , '=-, . , f; - .. #. ; . -1g. y - t .* y .,: - ,
.' ,; b. ,, , f .",T*y V; ';*..,,[=-
.,*# M. - tj, f . . .y#" *i?- *
. . k )/ :e. , .f.. ' P'. . , -
j
'.*,*;..'s'g,'.*-[*'i .. .- . -l e ..- t
.q ' , . .
, ;.' -l , . 3. ..,'.l..K' ; *o.g, . ..?, * "; %,.
- . ,., ;g.' . . e O ll.9.* . ?, .T..:3*'.. .\,n;;', . : .' ... .: h,, ;,si... : $..* .. l! c' ?..:.;...f,c. sQ .;.(... % C.'.l, @,- ., , g. . . . :
i
-%.*^'. .
. [@, ; i . *fq . .. .: G8. g A..*,
.;.n
- y::: ? .;. ,.%_.',*p,* ..
.. '.z , , ::l . .. . , " , . y; : b.S. ' ~..s.:: . , . . T >* v. S.d .-
. .t .
. . :S %' . '. * . , . *..m.'.
. - ' . . . yy:'
' ..f.. . ; .. :.~n. . . iJ. : ... '.i."...:, ; . , .[.' ,L)'A,* v-.I." 3. h. :**.c;d' .
. c;. ,., *. .,.&. .. ** * :;> .s ,r.y. h.la g 4, . h.
- - . ,, yQ. t. .f' 2:w :.. }Q.,.w. :: . .y <.* .: :i:: s : :. . c.,. ..~; e..
,, ;, G ;
- m. Ay . " -:.y
- .* n.
rv s.
,1.
- f.. .. .....:y '
. t, sp:.. ..,- .;;; . . .
.: $.h&n. . . . ;~.. .IL:b;h:': ? '- ' ~ ~ -l&, .h$?
k't. i .lY
.l.5.h.& ' K . 0S?[W.W'O ?? ??. ..Vi.e.l.:.J L- ~' U',. ',' . :J'm.Yl, .;.? ;^ . ' . , ' - ~ ' .},.';@w?<
,:.....c...
.;p:
TI*M.6..~t v.:w.. .f: '.Y ;9 . " ( : i .' . 3 .-
n.n. a ..: Y.N.Q6I,
- . ,- .a.q:.y: ... . . . . .. . .,ph, w:... ...y....,. .I,. ".. ,:: . *, .~". E
~
. . s.
v..".:-,;;;, -i m
. n. !. ., ,
- ..7: . ,.. .;; ....
y 1- . 9. .j. t.y m+ ,n:,.
v..:.G..e u 'y,, .m . ..
.n... ;:.- m ; . ..~. .
. n. . ..f..:... .v.-y...y.?y b< . o: (..: -. - .q e
- q..t..
- .: . ~
.<, > : ., ; :.. c
..g..4, .. : -;;. . ..;,;,; ,. . . . .y;,., n *,<.. -:n:-. 6q.(n *,;..;: ., ;' j. , :;4 * * [;;.> 9 ~.4._. , ,. ;. :. :u: 4,.,.Q3,...
,y:.3,. ;> :s .-
,.. - gTe .s y p. ,;g' . .ger.3.:. y. . . .
. 37, ! . . . ) r ,,. : .
. -' '* ,,. . ,::t;y j ;.
- ** . , Q_1 .,t.
_5 g_. e,.,p.__c.'.,,
, _;, , a ;- -
y ,e
- + _
. .. * ; ., , * . . i . .
. . , . t,.
3..
,,_,g..,: .* . ,q' , %..s. :.. . ., .p .. . .
.3.
+
. -Q .
- s'<' .' -.
.e_.,.A ..s.,.,., ..s; ;
.,4.>.y,7,
- v .,;y..;. sA. .. ,
~,' .. . - ; i. ( '_;..., . . . , .
.I. @l5'.o.c
.' .7. ,. . .[,-c.;. sp* !':E.
S ,I .:;2. '.'[b, . .k'.;f...N.
y..:. . . . ~ .;
.. ,.~ ... ~,,.g
,)?
~.' ' ,h ;.O .*[(
O.;;. g.,'; a. s. ; .,. ' : ::, ;, ' v: .
r
. j. : .b '. i . M. ,3'. . ,..q 't ., .
v :. P. . 3 ;.-:. :. y.,. . ..
.rt h.;',..'\.:'Q,. . , I
%-. fNh'.h,:h.*:N.S, ..
.s.- 4.n, .;' r. ., .: .- ..
?
.=f',"'..*^:,
'.(.,y f.f '.W k . . '.* ' { * ; >;* . ". ....? .;M: '.g
- ^
.d. '.'^ ^;f' .?:ll? Q:,il:.* 'lQ _ *' ~ _ ' . - - .q,:f,,Q, ,Q:s f,_ .
c'. ;? ..e
.' . .. s. :L .~
.
- y. 4. ':-
,~ .Q . '. , y.. . , . - , ~. , y; . ? ~."; .i' .: . ..%/ .*'. :9G ' .:
- Q a;q. a .. .n.4.,, . . '. .
rR,'h.;. *(,w g .
,, "3
.{. ;
- a. . ',. -
. ' ; .: : x ,. . . .; r. l l..g'.s W f--: .r; ~ ._ - ,
- s 4a--'s : . , .n , s. t . . , r . .%. .+: .,'.e.. .;;2.. :...,......*....'1 y.,. ' e. .?
. :: b :,,
p ~< 3. ..x.,., .e. ..;si >.R.
.5 . .!;.. - . .: .... ..f. vA ,'. . .* . :
- s. . . ..
. 2, . . . .
.- 4 . ;,..f' 's t',y. a.. . ;- .,';. . ..~p; .a.s . *. - ..o. r:. s
.,.Q, -
m:,: 9.,:.. Q . .y ;.;.; y^;y.p.. ., ....' - . . .. .,e . .
=4...., .. , .
. v -.;s n
.t.,
s y- .
y .v. :h. .,-.. . ., ; .3 -
.c;._,.
- , .4 ' y,f, y , y. M 'Y1;$j '; d .. ,yh..M . .. .. _,s.
>~.- .. , f::;. . g:g;_, -
.'., 2'.If *T:/,'.;-/c;,[-((Y *)'.r".[/).;7.j pM.. : *"[- P (.'F[7 .'.#.M '. : ;.' ' I ' , ' i 'a'N.(l ;[ J :i N / ~ " y
' ~
h .'55
, [ .: .[. . . .$ - b: .
['e .- - ; h. ;. . .\ . .;1<. . .
. I..*i';.. i. ..:.-.hlon.
.:l'lk
.'lh.
- :n 4:
.y .ar,.gl,~,M.
y..y; $? . . .. ',3. $,n. ~ f. hr . w.. k r u.,.~.m~...,.n.,% .h. Y ?.$m'.*: .>-
W . .sh,'Y,.,
,s,. k, .*:h, ? ', . .l ~ .r b.
, . . ?y.- . . . . . . . . , . . . . . . . . . '.,,.,..t.,.p. . _
- . . . . l. ._ ,,sf. *.*?.?
.y~,.ry'.. ,; .. m,.,. . .. . u. : .:n . .
.s
- nu.g.y .s
.ge {;; . . . - . . ..- ; 3 . . :,e~ar+%,- .+ -.--.. ~ . .
l
- ' ' : *. . .* fN -
- ', {s.. . . .
, pr ,,, .. A p ,,k: , u., . 1;.g . g . ,
f*. * ?h . . t.F, w! *
-' i, , ; .
y ;
es,. .*:.: - .
- ,: c,,..,...*4..
s
..,s.. ; ,g\ j* ,y ..p. .;,; , ..e., ' .:n': z2.,. ..e. r .3, r..',,t_.,.,[...:.:...v....,.;
.._.v...,:.. . .g:. .'q *.;;.9..y.. m* .- ' . -
y .<.,e
- qs .s. ; . 5 4..;;*. , , . * .,' %, .-
y.,. ., ., ,.
..rv.,.:,' .:G :;v;o .e :. .. .
..q : ?.,.. .. *,,:.. . ..--;.: .:W v;.e --..v'as<..:. + ~..?, .sr .. .--. L.%n. , .. . ...s..m.....,.-:.. , ,. - ......u. ..s . . ;':' f*. , .: . : a .:q - . . . .. ;: .%.',;: .,: . ..-
. l: ' .- .
.,m.
.. <: 7.: . ..<
- p. ; .::. 'g . m. 'g%
. > y .e,. .'.. y.;.:. 'E ,g.;;*- Uii.c.
.- t- -
. a.n u.. . . - .e . ..
c d,'
- u. .s..>- ; ;
- -t.s.*' .s '
- a. - ..- .:, .. s.. .;.-
g.'..r,.
." ' q ,.;.;
.e,,=,..sl i r .',,,fu.
..l -., M* .
.,...j.. '..,.,,f'.,1,: .V
- ,, . / ,s e,f. 7 ,.,. ..J;38., , . ;.;; . , .,, *, *. .
g .
'e. .-
- ' ,;-n I'. -
- * .*. *.
- . . . ..~ -; . ; .:. . ". :; . ,; :. . . .
- A * ......,,;a. .',g'.. - ,.
. i .' % "/ ~ .. L .
.:.? la .. .;..; . . .; ;,. ::.'. .t.
- #- ,: .. : , J{g
.:= . . z ; g %;',hy. p
- e g. * ,*
l-s ' ,
v.n n'. . - a . .J: ,. . . @*.A ;4 s,
. :%. . *i, r . . .. , g . c.:?
. ...r.s.,..,,n...-
, . . y ny 6- e <.. 44, ... . -!.2. . . ; .s . .. .. e. .;. ,c 'y" . , . v.'.
.: .af,,.
- v. - u -. . e . ::
-f . *^.. .:'
r..:p .-
y;.,..........4 . . .. ' ...;,~.';1-'..,..
^ - . .. S.
..?,' .{ ; . .,'.. . L QQ g. ' /,i ,. . . ..; , ,. . ,O _ ? L ft '. y .
- l% _; n. [y: . , o " V f ^ .n , 'p .. .. . -
..[ N'* y;*:. ~l
- ~
^
'.'.3
,.q',
+ '* *' '; ., @ ? L
- 1 r : ."'s?::. **
}. b_ "", .{?. . .,"? I.1. ' ;y v .e .l. '?, f . fi"3 l * ',~) *:' '".,_' &'{ ..: s ' ,..; ~ ,l*3': * .-l.~* . ' .r. . . .
i ),W, ';. _~ l ; .; Qi; -
f.,. ; Yl.l; .
N
'^
.j,f.l s .'..;,..:*,'.~,. . ,( h.) ll ({W't f., 6, -l . fo; 'l. .: $ k' .E .." ,, .h . . . 3s::f * ,. '.
ih' , ?t?,., . .{ * !., , ._ . t*'
n.,..'..
c
. y . n .. -.. ..y s ,
pe *..;n..,.. . ..
- . '. '. - : e . . s ;. ,
p.n.,. .y. ;... ..;.:. * . . . . .e.,.,
1
- . ._ , , s; . . ~ . ,
. ,. ..n. . . 4 -v, ..
y a-
.n,..,: ,. e% <
- .y; ,g.. ., l.l, .jQ.. ~. . . . . v . , . .f*i 3;y
[.sf g _ ,' g .,n. . s. .s. ;...';.4?.. .
. ;i n 9.;,.i.*.._,.,.m..*.. ,.
_ ,, '*;. y f . : ..a . Dj- . . ,;
. . ', ' ,. . ',*::;
- l ,;;
.-^ .
Se., . . - ..,e h ' . (.;_T ..:.*gr .9.-[.- h. ., ', M,T.S
. ! ',] f ~p . . . * )#. . '* '
'a' .I , .. .( .h,
.u.[ eh, y,~. ')Irl .k .'. . . ho -; :' :.*_$ 'i.[ N 'fN.9- -t'.,dS' '
n, _.}b p sht"1*h. + :.; .- .--* ::
..e - ., - .
.. ... :. 3.
! e G. .e. ' s .H,...,.......s * . '
- ' ' ;. ;, f f f:: *,;, _.., q, p. . '? p.Jr .; N, y;. - ,, ..@% i: . ,=. .y: ; y._ 'l;ell ...g .; Q. .s ,-..' ; s&.-:,r.); ;.," . .", ' ,;[ ., ' -
- . 1* ,, , :
- y*,Y,
+ ; ;. - k..,'* q:.w ?l.*
- $e1..<;.)".
. .. ^ .! .l..
- g. .[
2 !n g.s;, '. >%.3.',3 . .%,
..y',....t;. ,; ..,, ;.--i; ;. - - - :; e. W' ' ,%..?;.v. ,';. '. m* .-~.
, :.. - .q 's-**.
- * *..r.
.* g a : . e *s . . * * . .
-; 1. > ;3
- v. . . :;. .' .} .o.; ._;;
tr .e .??. y .: ,n . '.
,. o sv .- .,p.'.J,'."..,::.,- .' ' ' U.t ;:*.
. n,. ,; ,< ;;;,..y;. ' Q ,. .,_ .i.e .9 :. '., t. ..
n~*c.*.*,..,..'e.: .. .,..:+ .. 3 ' .: ,n. .e ys. s,
> . .. _ . .:a ,.5. y. L .* - .
,..t,.,;..s.,.., s ;'.n . .,fn. :. 3.,.
- 1
..e. *. :.. . z,. .e : .( .. ..~%.<,..
. :.. :.. , , ,.. s .r: ... .
. . . .yy ....;...s
- .....,..,..,s...:.; .
. . . .; , .c.3, n .,G: .t.e%...#,r.,*:v v%.- -
, . c t. ..e ;.
., .. .. :r. . .m.c '. ,.m . <;,. ~. .
.: .,m;s, 3:..
.s.,.,.,..,...
u.
. . u< v.,.g.,-*,.s...
v.
c ~.}.. .. . . .. . I.:.. . 4.y pn &: .-:*~.v... ,+.
'q......A,
. . , l V, .s. ..* .3 . .. . , y . ~. , .e. . ~ . . . . . ,.. m,: . .a . ;g;..yem..n.c.s.. :.y ..v:. m..g ..,. .:.. . i..... : w; ;< .
> ....u y, g .
...w. u n .
, . . - ; 1:'.?. ,'sh.%~}.
lj. . f.:; , y. - s , . . n. G . *7,g :)n.;....'x jQ;;y.,.1 .W >f.r3 +:;
.::. .. . . . . . *., n.:.M.
. . .g. ..Q k...X,.J..,. .v.. i)-;'i}l%.pc. ~.,., ; ..v,.y :s ,.i...c::,7,s.%.
... i.,Q. d,q';
.;:y..y. p .:g; . >
. . .. Q:.'..":.....Q,,.,.
..h*",.,..
- . . . ; ,
- . t. . .,.. . ...,.,..t..',u, . .a....-e. . :. . .. a. ., A. :
. r r:. :. .... . -,
.s s , ; , . , - -
(>. sh. 4. .- W.. u. ;c:. .
. . . - .s.- ;,. - -
.,r a - -
$; .. .{.}-. .*'::*.$ll::f .. .Y.0 . . .$.?ll... . ._l.., 'e*. _. b.. 7l-f.N ':f*@.~h,.h! -i.?.. , 4., M. .i W lG
.l ,; l,. ;:. .h.e ,:$:i:. h.,. . . t.:...
- . ?;c l.~$, *#
- . .d *~
- * ' H. .: *N - .' : - ;u : . . .. .j. '
Csu .. . ,. S. .,._ v*
gi'n; ;r y .Q:.i.% ,::f - ~ '
. ' . . .M ::. ', . . :s ..
- _ p. . 2.-Q. *'.'.U.\l< p: :-. .e. C; .T .g.+p*@.'
,; 5 %.E c ::" ',- ;:V ,i. ;.,., :._ .i-. h.., ..:.. *$., _r .?: . . .l,z:. . . .'
. g - ! .
%m/ o.;,, -l .\ :y?k. ..FG:*:$M.' \ k.;.;u;Y'.".9,.,._.. y
- . b;% q
- 9,,y ;W:;; .. pyQ.;~. .Mf:y f.:,p.o};.u;.Q.&y
,.1. ,
~.; . . . s. : <. . .
. %9. T. ? MEdfiM. :@.E ,, . .4: Ms. f@,. .;! ' ,
~
. .TM. .
e g
....is..
'W j '
i E :- $5 W;.M..+,. ., pd.g ;Ri 9705130228 970509 PDR ADOCK 05200003 WM,4,- ' .?
- ,
- .:;.6. :C't.3 2'.Mi 7..Nk.$ jh
. .e'4J' : ' .
b- d. . M$p. .-
,.. ;in i Mh ~
[J.A M.u @... %. .%.3.,M A PDR :c W .L .. . , . . . P. ..- . . .
.P.}A9%@,59.: s NE((,i . . . ..~NG... Wib,I6.W.. .D<,. .%.m .g..M. . j..h' :. <.. ~
- . C%j:y4 W.!' @1,.3' :%MnpM < - ' ;.:5 4: 5. f : :..~r : :; L ~ "
@Q Q l*n y:a W .
y*:::.
kV}& -
- pg1. -:Wry;d{7 f*,f_%.}
,3c; Q %.lfg:Q
- %.,
- M U3. ; .&
.Q.'}.ycf; . %. .f':.M.n.
y %Q. : ':
- 4. .t.q}11
.y .::;;
. W:. . %.Q;'.y
. ; ??&:?fM].., .g;W%q' b.Q;' ;Q
.m:. 9 Q.J :
- . ., . $'K 3%..
.Q . .O.:: _ . ;. '- ^
,;yWlfjhy;.w.y W .g ..
' .,s.'. .. r,l :
3 ". .: .!:= T l. S : a. < : : .?::%;
..:. q? :l,.f;:~': .} g. . ..u +Q f.l:p .: .,+:(f.}g..;.;. ;.:::.3 f:fR.Q.QQ.f1,s.f y p:
,6..bk.f...;..i.:;ym.:...;::
. n m. -
.f $$ . .y~; wy. %. .<.w..;;.g.f.:;[,,;x.%
,O:N
- .<
- c.:.?,,: . p w: n:lc _ _ .
!cx.n .un _
. . .,4, g:fQyylg Q. . . .
- . g,..
. . . . .; ...;... . . . . . . . . . z. ., .. r , . y, : w. . .e.,. m p,..e.y..s....,:u: . <. . ..;...; . . ... :..:: y. . yt.m. .e.. .m;y ,. :,: . . .. &,..,,
.e?. . .. . 7..g .g r.. i^Q*?
~w .r .~ n. . .s. . . . .
.n. .*.,.n'e.,. .
er
. l.ls'~f.m.:,v:. kA* l ia Nm= . ..r*$;' . :a','? ~,:h ,. a $ E ' .z. .y*g ,'. . .,?',.5:'"* i . 'ig: .t;} ..h , m% m<:g., ' ,. . ,::** &far .y&I s" q.. *)&i fI.h, **5'.*-
y fj(%a CI a.
- 4* 3. :\'. ..' 'l % }:,;l . .,,4 Y*f .*.
.n.* I ').l*z $ % a,
% ,'f* hh)n v?st ...,; ,$:l
- 1..;Y f . . i _.'. i *i ' l.' ,0. ' ^? 'h y } l,?h '
s N:? ' h h h l h*
,....'.;.',' -, . :; .Q. '^,s l y *-M. .*}*,.;f.. f. *' j..; ?, j', $f :.** .;:. * :4.'h' .';/:.' ! * . * , ,
k , yQ.,g l v,Q.:
.; .- .. . ,. . , :\.h 'ig;'3
- bl,
- -a_'.a..* .. ..:. .
. ' L .,:
.,..e;... ,.:f?. ,
- p. . %
v*. ,.f*!** _ ,:. .aw,;.*V y ;, *%: sl., .f.6'
. :n - .s.)/.
'. ^
- 3.)[
. Q, f.-%
. i.'h
' ;> V i *
- ~ : .}ld;,q'.
.f ::k ', ?" +
. f: -k.h,@n Q 9:w ..i,,.p...-
e 0
QMGMl,L:&ps'.f'hgr
. ' .: '[. ., >$t 4,: **. r' ; ' . N. *4?:,sl,. - .,r[j s.d hl.s!..l i. *: 7 .b.Qf,g.
Q ;,,, Q,@ 9.T'Q;),.,%,- .-:.H,h.Q
? : Q I']
y.y.'G:D.].c'. &Q;Q g _ }f.&g,jf,fQ.
l[;j'.;f q&.;./y.Q.65.y ' J.'. Q. $^ y. [*.{&' *4 %
Rlff},Q .
. g .
Westinghouse' Non-Proprietary Class 3 WC AP-14477
$. $ $ ;$ $ $$$ Revision 1 The AP600 Adverse System Interactions Evaluation Report '
I*
g ..*
s s
s l~
i"18S 3My(:; ,
Westinghouse Energy Systems !W ame
_ ___.m
AP600 DOCUMENT COVER SHEET TDC: IDS: 1 S Form 58202G(594) [o:\3677w wptix]
AP600 CENTRAL FILE USE ONLY:
0058.FRM RFS#: RFS ITEM #:
AP600 DOCUMENT NO. REVISION NO. ASSIGNED TO GW-JIR-003 1 Page 1 of hn (, M\/
ALTERNATE DOCUMENT NUMBER:
,g g g WORK BREAKDOWN #: gl,q j DESIGN AGENT ORGANIZATION: WESTINGHOUSE l
l PROJECT: AP600 j TITLE: THE AP600 ADVERSE SYSTEM INTERACTIONS EVALUATION REPORT l
j l
l l ATTACHMENTS: N/A DCP #!REV. INCORPORATED IN THIS DOCUMENT
! REVISION: N/A CALCULATION / ANALYSIS
REFERENCE:
522 0:\3577w.non:1b ELECTRONIC FILENAME ELECTRONIC FILE FORMAT ELECTRONIC FILE DESCRIPTION 3577w.non WordPedect 5.2 DOCUMENT TEXT AND FIGURES
- COVER SHEET ,
(C) WESTINGHOUSE ELECTRIC CORPORATION 19 0 0 WESTINGHOUSE PROPRIETARY CLASS 2 TNs document contans information propn'etary 10 Wesbnghouse Electric Corporabon: it is submitted in conndence and is to be used solely for the purpose for which R is fumished and retumed upon request. Ihm &cument and sum hformaban is not to be reproduced, transmitted, disclosed or used odierwise in whole or in part without prior wntlen authorizaban of Wesbnghouse Electric Corporabon, Energy Systems Busness Unit, subject to the legends contamed hereof.
O WESTINGHOUSE PROPRIETARY CLASS 2C This document is the pr@erty of and contans Proprietary Information owned by Woshnghouse Electnc Corporabon and/or its suocontractors ano suppliers, it is tranentted to you in confidence ano trust, and you agree to treet this document in strict accordance with the terms and conditons of the agreement under which it was provided to you.
@ WESTINGHOUSE CLASS 3 (NON PROPRIETARY)
COMPLETE 1 IF WORK PERFORMED UNDER DESIGN CERTIFICATION QS COMPLETE 2 IF WORK PERFORMED UNDER FOAK DOE DESIGN CERTIFICATION PROGRAM - GOVERNMENT UMITED RIGHTS STATEMENT [See page 21 M:;M^ Copyright statement A licerwe is reserved to the U.S. Government under contract DE AC0390SF18495.
hPI' DOE CONTRACT DELIVERABLES (DEUVERED DATA)
N Subsect to specthed exceptons, disclosure of hs data is restncted intil September 30,1995 or Design Certification under DOE contract DE-AC0190SF18495, whichever is .
later.
EPRi CONFIDENTIAL: NOTICE: 1 2O 3@ 4 5 CATEGORY: A G BD C D E F0 2 O ARC FOAKE PROGRAM ARC UMITED RIGHTS STATEMENT [See page 2)
Copynght statement A license is reserved to the U.S. Government under contract DE FC02-NE34267 and subcontract ARC 911SC@1.
O ARC CONTRACT DEUVERABLES (CONTRACT DATA)
Subject to speerfied exceptons, disclosure of hs data is restncted under ARC Subcontract ARC-911SC-001.
ORIGINATOR Si TpA 4 R. K. NydeS (,y ./ W C(b , $ Q - T]
AP600 RESPONSIBLE MANAGER S -
APPROV L DATE B. MCintyre ATURE' [J
, , , p d-7 the responsib6e manager agithes that document's complete, all required revievEuts complete, electronic his e attac%d a6d document is l
AP600 DOCUMENT COVER SHEET Page2 Form 5S?03G(5/94) LIMITEDRIGHTSSTATEMENTS DOE GOVERNMENT LIMITED RIGHTS STATEMENT (A) These data are submitted eth irnited rights under government contract No. DE-AC03-90SF18495. These data may be reproduced and used by the govemment with the express Irrutaban that they mil not, ethout wreen permsson of the contractor, be used for purposes of manufacturer nor declosed outside the govemment; except that j the government may d sclose these data outside the govemment for the folloung purposes, if any, provded that the govemment makes such disclosure subt ect to i
sb: tion against further uso and disclosure. -
- 1) The Proptrtary Data' may be declosed for evaluation p;rposes under the restnctons above.
II) The 'Propnetary Data' may be dsclosed to the Electnc Power Research insbtute (EPRI). electnc utiity representat:yes and their direct consultants, excluding direct commercial compebtors, and the DOE Nabonal Laboratones under the prohibitons and restacbons above.
(B) The nobce shall be marked on any reproduchon of these data, in whole or in part.
ARC LIMITED RIGHTS STATEMENT:
This propnetary data, fumshed under Subcontract Numter ARC-93-3-SC401 with ARC may be dupheated and used by the govemment and ARC, sub t ect to the limitatens of Article H-17.F. of that subcontract, mth the express Irnitations that the propnetary data may not be disclosed outside the govemment or ARC, or ARC's Class 1 & 3 members or EPRI or be used for purposes of manufacture ethout pnor permsson of the Subcontractor, except that further disclosure or use may be made solely for the follomng purposes.
The propnetary data may be disclosed to other than commercial competitors of Subcontractor for evaluation purposes of this subcontract under the restriction that the propnetary data De retained in confdence and not be further disclosed, and subject to the terms of a norkdsclosure agreement between the Subcontractor and that organizabon, excluding DOE and its contractors. -
DEFINITIONS CONTRACT /DEUVERED DATA - Consists of documents (e.g speofications, drawings, reports) Which are generated under the DOE or ARC ,
contracts which contain no background proprietary data.
EPRI CONFIDENTIALITY / OBLIGATIONNOTICES NOTICE 1: The data in this document is subject to no confidentiality obligatons.
NOTICE 2: The data in the document is propneta and confidential to Westi house Electric Corporaton and/or its Contractors. It is forwarded to recipient under an obligabon of Conrdence and Trust for hmrted purposes only. use, dsclosure to unau ed persons, or copying of this document or parts thereof is prohibited except as agreed to in advance by the Electnc Power Research insbtute (EP I) and Wesbnghouse Electnc Corporaten. Recipent of the data has a duty to r1 quire of EPRI and/or Westinghouse as to the uses of the informaton contained herein that are permitted.
NOTICE 3: The data in this document is propnetary and conrdential to Westinghouse Electnc Corporaton and/or its Contractors. It is forwarded to recipient under an obligaton of Confidence and Trust for use only in evaluaton tasks specifically authonzed by the Electric Power Research institute (EPRI). Any use, dsclosure to unauthonzed persons, or i this document or parts thereof is prohibited except as agreed to in advance by EPRI and Wesbnghouse Electre Corporabon. Recipient of this data has a duty to inquire of and/or Westinghouse as to the uses of the riformahon contained herein that are permitted. The document and any copies or excerpts thereof that may have been generated are to be retumed to Wesunghouse, directly or through EPRI, when requested to do so.
NOTICE 4: The data m the document is propnetary and confidential to Westinghouse Electnc Corporaton and/or its Contractors. It is being revealed in confidence and trust only to Employees of EPRI and to certain contractors of EPRI for limited evaluabon tasks authonzed by EPRI. Any use, declosure to unauthonzeo persons, or copying of thss document or parts thereof a prohibited. The Doctrient and any copes or excerpts thereof that may have been generated are to be retumed to Westinghouse, directly or through EPRI, when requested to do so.
NOTICE 5: The data in the document is propnetary and confidential to Westinghouse Electnc Corporaton and/or its Contractors. Access to this data is given in Confidence and Trust only at Wesunghouse facilities for limited evaluauon tasks assigned by EPRI. Any use, delosure to unauthortzed persons, or copying of this document or parts thereof is prohibited. Neither ins cocument nor any excerpts therefrom are to be removed from Westinghouse facilibes.
EPRI CONFIDENTIALITY / OBLIGA TION CA TEGORIES CATEGORY 'A'- (See Debvered Data) Consists of CONTRACTOR Foreground Data that is contained in an issued reported.
CATEGG. ,1 *B'-(See Dehvered Data) Consists of CONTRACTOR Foreground Data that is not contained in an issued report, excast for computer programs.
CATEGORY 'C'- Corsists of CONTRACTOR Background Data except for computer programs.
CATEGORY 'D*- Conssts of computer programs developed in the course of performing the Wort.
CATEGORY 'E'- Consists of computer programs developed prior to the Effective Date or after the Effective Date but outside the scope of the Work.
CATEGORY *F'- Consists of administrative plans and adminstrative reports.
O l
l 1
l m- 1 l
1
i WESTINGHOUSE NON-PROPRIETARY CLASS 3 l
WCAP-14477 j Revision 1 THE AP600 ADVERSE l SYSTEM INTERACTIONS EVALUATION REPORT
~
1 AP600 Document Number: GW-GLR-003, Revision 1 C. Brockhoff M. Corletti D. Lindgren T. Rowell S. Sancakar l April 1997 r
i l
l l
Westinghouse Electric Corporation Energy System Business Unit l P.O. Box 355 Pittsburgh, PA 15230-0355 i
O 1997 Westinghouse Electric Corporation
, All Rights Reserved I
mA3577w.non:lb-050497 REVISION: 1
iii l
TABLE OF CONTENTS
1.0 INTRODUCTION
1-1 1.1 Background 1-1 1
1.2 Scope 1-1 2.0 FUNCTIONAL INTERACTIONS 2-1 2.1 Methodology 2-1 ,
2.2 Evaluations of Active-Passive Interactions 2-4 l
2.3 Passive-Passive Interactions 2-33 i =
3.0 EVALUATION OF POTENTIAL HUMAN COMMISSION ERRORS 3-1 3.1 Objectives and Method 3-1 3.2 Results of Analysis 3-15 3.3 Commission Error Related to Economic Consequences 3-18 3.4 Commission Error Related to Instrumentation Errors 3-20 3.5 Conclusions 3-20 4.0 SPATIAL INTERACTIONS 41
5.0 CONCLUSION
S 5-1
6.0 REFERENCES
6-1 l
i l
i l
m:U577w.non:lb-050797 REVIslON 1
iv LIST OF TABLES Table 2-1 Potential Adverse System Interactions Matrix-Active-Passive Interactions 2-5 Table 2-2. Ma*.rix Summary of Relevant Nonsafety-Related Systems' Assumptions 2-23 Table 3-1 Table of Assessment of Potential Adverse Human Commission Errors 3-4 t
nt\3577w.non:lb-050497 REVISION 1
1-1 l
1.0 INTRODUCTION
The purpose of this report is to summarize Westinghouse Electric Corporation's evaluation of the AP600 for potential adverse system interactions. This report documents the systematic approach used l to evaluate systems' interactions and their impact on plant safety. This report also describes how these I
! . interactions have bee'n considered in the analyses and evaluations presented in the AP600 Standard Safety Analysis Report (SSAR) and Probabilistic Risk Assessment (PRA) (References I and 2).
1.1 BACKGROUND
I
- . The design, analysis, and testing of the AP600 systems have been conducted with consideration for potential adverse system's interactions. The AP600 incorporates a number of design features that prevent or limit adverse system interactions. This report describes the systematic and thorough approach used to evaluate system interactions and demonstrates that potential adverse system interactions have been addressed.
The requirement for an evaluation of potential adverse system interactions was identified during discussions between Westinghouse and the United States Nuclear Regulatory Commission (U.S. NRC) on the regulatory treatment of nonsafety systems (RTNSS) for the AP600 design. The emphasis was on the effect that operating active nonsafety-related systems had on the function of passive, safety-related systems. The process used to address adverse systems' interactions was also discussed with the NRC staff. The NRC staff agreed that Westinghouse's approach to address potential adverse systems' l interactions for the AP600 safety systems would be acceptable (Reference 3). ,
1.2. SCOPE Three categories of adverse system interactions have been identified and are discussed in this report.
The three types of interactions include functional interactions, spatial interactions, and human- ;
intervention interactions.
l Functionalinteractions are those system performance interactions attributed to the sharing of common ,
systems or components, or physical connections between systems including electrical, hydraulic,
~
l pneumatic, or mechanical connections. Spatial interactions include fire, flood, missile hazard, pipe break, and effects of seismic events. Human-intervention interactions involve the effects of operator actions.
E i-l s
mA3577w.non:Ib-050497 REVISION 1
2-1 l
l l 2.0 FUNCTIONAL INTERACTIONS Functional interactions are interactions between systems or subsystems that result from a common
- interface. A functional interaction exists if the operation of one system can affect the performance of another system or subsystem. An adverse system interaction exists if the operation, or lack thereof, causes a negative impact on the performance of a safety-related system during plant operation or during the mitigation of an accident.
l Section 2.1 discusses the methodology used to identify potential adverse systems' interactions between nonsafety-related and safety-related systems, and between safety-related and other safety-related systems in performing their safety-related missions. Section 2.2 evaluates each potential adverse L systems' interaction outlined in Section 2.1. Section 2.2 also discusses how these interactions are captured in the various AP600 licensing submittals.
l 2.1 METHODOLOGY l .
l Westinghouse has developed a methodology to systematically identify and evaluate potential adverse systems interactions. An approach has been taken to identify adverse system interactions between active, nonsafety-related systems, and passive safety related systems (active-passive interactions) as well as adverse system interactions between passive safety-related systems (passive-passive interactions).
An adverse system interaction is defined as when the operation and/or performance of an (initiating) l system adversely affects the operation and/or performance of a safety related (affected) system as it performs its safety-related function. The systematic evaluation of functional interactions began by examining and identifying the potential affected systems or structures based on consideration of the AP600 critical safety functions, including:
I l
- Suberiticality l .
- Core cooling l
- Reactor coolant system (RCS) pressure boundary integrity
- RCS inventory
~
- Heat sink
- Containment integrity The systems, structures, or components that perform or maintain these safety functions were identified and categorized as potential affected systems as follows:
- Core
- RCS (pressure boundary)
]
- Steam generator system (pressure boundary) l
- Containment system I
mA3577w.non:Ib.054897 REVISION I
1 2-2 1
- Automatic depressurization system (ADS) l e Core makeup tanks (CMTs)
-
. In-containment refueling water storage tank (IRWST) -
- Containment recirculation a Passive residual heat removal heat exchanger (PRHR HX)
- Passive containment cooling system (PCS) .
g.
In addition, other systems, such as the main control room habitability system, that perform safety-related functions, were identified and categorized as potential affected systems.
s Potential initiating systems were then identified by examination of the affected systems above, and systematically evaluating each system as a potential initiating system. This began with the reactor >
coolant system (RCS) and subsystems. For purposes of this evaluation, the RCS was divided into the following subsystems or components:
= Reactor coolant pumps (RCPs)
- RCS pressure control (pressurizer heaters and spray)
- ADS valves
- Reactor vessel head vent These systems are listed in the left-hand column of Table 2-1 as potential initiating systems that could cause an adverse system interaction. Additional potential initiating systems were identified by examining the systems that interfaced with the RCS and steam generator system (SGS), as shown on ,
the RCS and SGS piping and instrumentation diagram (SSAR Figures 5.1-5 and 10.3.2-1 l [ Reference 1), respectively). These auxiliary systems or subsystems include the following:
- - Chemicat god volume control system (CVS) makeup pumps
- CVS pr. Tion lov ,
. CVS letd'own line
. CVS hydrogen addition line
. CVS makeup control system
. Normal residual heat removal system (RNS) pumps .
- Primary sampling system (PSS)
. Liquid waste processing system (WLS) i Component cooling water system (CCS) l . Main feedwater pumps
. Startup feedwater pump >,
. Steam generator blowdown lines d
- l Additional potential initiating systems were identified by examining the passive safety-related systems !
including the passive core cooling system (PXS) and the passive containment cooling system (PCS),
mM571w.non:lb-054197 REVislON 1
. - -- --- ._ - _. - . . - = . - - - . - ....-- -
2-3 I and the systems that interfaced with these systems as shown on the PXS and PCS piping and instmmentation diagram (SSAR Figures 6.3-2 and 6.2-122, respectively). These systems and/or subsystems include the following potential initiating systems:
- . Core makeup tanks (CMTs)
- In-containment refueling water storage tank (IRWST)
- Passive residual heat removal heat exchanger (PRHR HX)
- Passive containment cooling system (PCS)
- Spent fuel pool cooling system
.
- Containment recirculation e pH adjustment of containment recirculation Additional potential initiating systems were identified by considering safety-related structures such as the containment, the spent fuel pool, and the main control room. These systems include the following potential initiating systems:
- Containment fan coolers
- Spent fuel pool cooling system i
- Nuclear island nonradioactive ventilation system These systems form the basis for the evaluation of potential adverse system interactions considered for the AP600. Table 21 is a matrix of the potential initiating systems and the potential affected systems.
Section 2 includes a discussion on the interactions for each combination of the systems and features listed above. Each section briefly describes the potential interactions between the systems considered in this evaluation. The discussions in each section identify the important interactions and any ' adverse interactions, and confirm that any adverse interactions have been identified, addressed, and evaluated as part tu the plant design process, through the various design, analysis, and testing mechanisms discussed later.
i There are two principal types of system interactions that have been considered in completing this evaluation. They are:
- Process fluid interactions that include the design interactions expected between the various features, such as steam discharged from the ADS sparger and the water in the IRWST that is used to quench this steam f
- Actuation interactions, such as the CMT low-low level actuating the fourth stage ADS valves and the IRWST discharge isolation valves i
m:\3577w.non:Ib-05o497 REVISloN l
2-4 In each discussion, the most important interactions are identified. The important interactions for each of the systems or components are generally related to the safety-related functions that the system is designed to perform.
'Ihe less important interactions are included in the discussions for completeness, but they are not significant in comparison to the important interactions. These other interactions are considered secondary interactions, which are not important to the safety-related passive systems for several different reasons, which could include any of the following:
- There may be some interactions between the systems or components, but the effects of these interactions are insignificant. ,
- The operation of the initiating systems may affect the affected system, but the timing of the interaction is such that interaction is not important for accident mitigation.
Some systems have no interactions because there may be no physical interaction between the initiating system and the affected system and therefore, the components are essentially unrelated.
Operation of the various active nonsafety-related systems and passive safety-related systems, and the potential interactions between these systems have been evaluated through a variety of mechanisia as part of the AP600 design process. These mechanisms include the following:
- Detailed design work including analyses, calculations, and evaluations
- Basic research testing at University of Wisconsin, University of Tennessee, and Westinghouse ,
~
Science and Technology Center
- Separate effects testing at Columbia University, VAPORE Italy test facility, Westinghouse Science and Technology Center, and Waltz Mill sites
- Integral system testing at Oregon State University, SPES-2, and Westinghouse Science and Technology Center
- Design basis safety analyses provided in Chapter 15 of the AP60C AR I e PRA (Reference 2) success criteria analyses l-* Supporting Emergency Response Guidelines (ERGS) (Reference 3) analyses 2.2 EVALUATIONS OF ACTIVE-PASSIVE INTERACTIONS l
This section discusses potential adverse system interactions between the active nonsafety-related systems and passive safety related systems identified in Table 2-1. Each evaluation includes a discussion of the potential adverse interactions and discussions of how such interactions have been I accounted for in the AP600 SSAR and PRA (References 1 and 2). '
\
l l
l i
mA3577w.non:lt45(M97 REVislON l !
-- - . - - - - - . . . ~ . - . . - _ _ - _ - _ _ _ - - - - - - - - _ . - - - _ _ - _ - - - - -
i l s e r s t
B -
d a
i j d TABLE 2-1 i i
? POTFNI'IAL ADVERSE SYSTEM INTERACTIONS MATRIX - ACTIVE - PASSIVE INTERACTIONS E I i R Ros scs Pressere Pressere Cent. ADS ADS Cent. t i
ANected Sydena Initeeting Sysseni Core Beendary Beendary Baundary U.3) (4) CMT Accuse. IRW3T Recire. PRHR PCS VES RCPs 2.2.I 2.2. I 2.2. t RCS Pressure - - 2.2.2 - 2.2.2 - 2.2.2 - - - 2.2.2 - -
I Control i CVS Makeup 2.23 2.23 2.23 - - - 2.23 - - - 2.23 - -
Pumps CVS Punlication - - - - - - - - - - 2.2.4 - -
I i l>wp '
Makeup Control 2.2.5 2.2.5 - - - - 2.2.5 - - - 2.2.5 - -
System CVS Ixtdown line 2.2.6 2.2.6 - 2.2.6 - - - - - - - - -
Hydrogen Addition - - - - - -
2.2.7 .- - - 2.2.7 - -
tane ;
MFW Pumps - - 2.2.8 2.2.8 - - - - - -
2.2.8 - -
SFW Pumps - - 2.2.9 2.2.9 - - - - - -
2.2.9 - -
RNS Pumps - - - - - 2.2.10 2.2.10 - 2.2.10 2.2.10 - - -
l Containnent Fan - - - 2.2.12 2.2.12 2.2.12 - - 2.2.12 2.2.12 -
2.2.12 -
Coolers i
SG Blowann - - 2.2.11 - - - - - - - - - -
i System WLS RCDT - - - -
2.2.14 - - - - - - - - i W1.S Containnrnt - - - 2.2.15 - - - - - 2.2.15 - . -
Sump Pumps Gutter Drain - - - - - - - - - - 2.2.16 - -
CCS -
2.2.17 - - - - - - - - - - -
PSS - 2.2.18 - - - - - - - - - - -
SFS - - - - - - - - 2.2.19 - - - -
VBS - - - - - - - - - - - - 2.2.20 m
< f M
O ?
Z Y vi i
t i
- . . . ~ . . . ..
R Y c.
u a -
-d TABLE 2-1 (cont.) ,
-8 POTENTIAL ADVERSE SYSTEM INTERACTIONS MATRIX - PASSIVE - PASSIVE INTERACTIONS i B
$ Affected Systems GlTs - Access. IRWST Recire. PRHR ADS (1-3) ADS (4) PCS SGS VES RCS T
3 OfTs X 23.1.1 23 1.2 23.3.3 23.l.4 23.1.5 23 13 23.1.6 23.13 23 1.8 23.6.4 [
Accurmdmors - X - - - 23 1.5 23.15 23.2.4 23.2.5 23.26 2.3.19 [
[ IRWST - - X 233.I 2.33 2 2333 2333 2334 233.5 2336 2.3.2.7 ,
Contanmes Recuculmma - - - X 23.4.I 23 4.2 2.3.4.2 23.43 23.4.4 23.4.5 23.4.6 ,
i PRHR - - - - X 2.3.51 23.5.8 23.5.2 233.3 2334 233.7-ADS' - - - - - X X 23.6.1 23.6.2 23 6.4 i RCS - - - - - X X 23.6.I 23.6.2 23 6.3 ~ 23.5.5 I PCS - - - - - - - X 233.1 233.2 23.6.4 .
SGS - - - - - - - - X 23 8.1 23.73 VES - - - - - - - - - X t
v i
i 9
t I
r I
t 1
h N
m .
G b
Z j 5
h
. . s . j
+
w s.,- - .. _ - +,
i
?
j 2-7 2.2.1 Reactor Coolant Pump Interactions ne reactor coolant pumps (RCPs) are part of the reactor coolant system (RCS) and are described in l SSAR subsection 5.1.3.3 (Reference 1). They circulate coolant through the reactor vessel (RV), core l
- and steam generators (SGs). De potential adverse systems' interactions associated with the RCPs
)
have been identified. These include interactions with the reactor core, the core makeup tanks (CMTs),
_ j
!- and the passive residual heat removal heat exchanger (PRHR HX). A summary of these interactions ~
follows. ,
1 Reactor Coolant Pump - Core l- Operation of the RCPs enhances cooling of the core during operation, during a transient, or following l- an accident. However, during loss-of-coolant accidents (LOCAs), operation of the RCPs can mask the severity of an event by misguiding the operators that sufficient coolant inventory is present. In the Three Mile Island event, RCP operation masked a condition of high voiding in the reactor coolant l system (RCS). Subsequently, the RCPs were lost and the void collapse in the RCS resulted in core uncovery and fuel damage. This phenomena prompted the incorporation of RV level and RCS void instrumentation in current plants. His instrumentation aids the operator in determining when to trip the RCPs following a LOCA by monitoring RCS void content and RV level. In current plants, the operator must decide when and if to trip the RCPs following a LOCA when specified criteria are met in order to prevent subsequent core uncovery due to a failure of the RCPs.
l The AP600 precludes this adverse system interaction. Following a CMT actuation signal (on either a i I safeguard actuation signal or low pmssurizer level), the RCPs automatically trip. His allows the l . CMTs to operate properly, and prevents RCP operation from masking an actual LOCA. Restart of the
-l ' RCPs is allowed only after the status of the plant is verified, the reactor is shut down, the safety 1 systems are operating properly, and the appropriate passive safety system termination criteria have
'l been met. Restart of the RCPs occurs only after the operators have diagnosed the event. If an LOCA l has' occurred, CMT termination criteria will not be met, and the Emergency Response Guidelines 1 (ERGS) (Reference 3) would not direct the operators to restart the pumps. If the plant is brought to a I stable safe condition, and CMT termination criteria are met, the operator would be permitted to restart
-l the RCPs. In addition, the PMS interlocks prevent restart of the RCPs until the CMT actuation signal I is no longer present. To clear this signal, the pressurizer water level must be restored, and the l ~ safeguards actuation signal must be rnanually blocked. Blocking of this signal is allowed if the preset I termination criteria are met.
Reactor Coolant Pump - Core Makeup Tank
! Operation of the RCPs can also affect the performance of the CMTs. As shown in SSAR l Figure 6 3 5, the CMTs discharge to the RV via a direct vessel injection (DVI) line and connect to the l RCS cold legs via a cold-leg balance line. This enables the core makeup tanks to recirculate and/or nt\3577w.nortib-05(M97 REVistoN 1
. ~ .-- . - -. .- . - - . . - .- - --.. . - - . -
2-8 inject into the RCS to mitigate an accident. The CMT flow rate is therefore a function of the pressure in the cold leg and the pressure in the downcomer at the outlet of the DVI rt zzle.
When the RCPs are running, the pressure in the downcomer is increased by the change in velocity between the cold leg and the downcomer (approximately 45 ft/sec, and 15 ft/sec. mpectively). This static head tends to reduce the resulting CMT flow rate by causing higher local pressure at the DVI connection to the downcomer.
r
~
When the RCPs are tripped, this static head is substantially reduced and the pressure at the DVI connection to the downcomer is approximately the same as cold leg pressure, increasing available AP to drive CMT injection. ,
ne AP600 has addressed this interaction by providing a safety-related automatic trip of the RCPs on CMT actuation. In addition, as stated earlier, restart of the RCPs is not performed unless the CMT termination criteria can be met.
Reactor Coolant Pump - Passive Residual Heat Removal Heat Exchanger he passive residual heat removal heat exchanger (PRHR HX) is connected to the RCS to promote natural circulation c' ooling. When the RCPs operate, forced flow through the PRHR HX enters the top and exits the bottom where it retums to the RCP suctions. If the RCPs are tripped, natural circulation flow develops in the same direction. Earlier design sensitivity calculations were performed that connected the outlet of the PRHR HX to the cold legs. For this configuration, when the RCPs operated, reverse flow was developed through the PRHR HX. Following this, when the RCPs were tripped PRHR HX natural circulation flow would slow down and eventually stop, but never move ir. a forward direction. This was unacceptable because for a loss-of-heat sink event, if the RCPs weg not immediately tripped, the PRHR HX effectiveness would be degraded rendering it insufficient to mitigate the event.
As shown in SSAR Figure 6.3-6, the PRHR HX return connection is located on the suctions sides of the RCPs. This ensures a forward flow through the PRHR HX when the RCPs operate and when they are tripped. When the RCPs operate, a higher flow rate develops through the PRHR HX, increasing the heat transfer performance of the PRHR HX. Although this is usually not an adverse interaction,it .
can be adverse in accidents where RCS overcooling is a concern, such as in large steam line breaks.-
In the analysis of such events, the RCPs are assumed to operate at least until a CMT actuation signal is generated, causing the RCPs to trip. Due to the importance of tripping the RCPs in response to an accident, the AP600 implements this function with safety-related equipment, and can perform this I function assuming a single limiting failure.
It was also noted in the design of the AP600 that if the two RCPs in the loop opposite the PRHR HX were to operate in conjunction with the PRHR HX, reverse flow could develop through the PRHR HX. To avoid this adverse interaction, the power supply to the RCPs is designed so that the loss of a m \3577w.non:Ib-050497 . REVISION 1 w , ,c~ - , , ,. , ,-
l 2-9 l
single electrical bus will not result in the loss of power to two RCPs, in the same SG. This prevents simultaneous PRHR HX operations with the two RCPs in the opposite loop on the PRHR HX, thus preventing reverse flow through the PRHR HX.
I In addition, the AP600 SSAR, Chapter 16 requires at least one RCP operate in the loop with the l PRHR HX, to ensure that reverse flow would not develop through the PRHR HX upon a loss of ac l power and subsequent PRHR actuation.
2.2.2 Post-Accident Interactions Involving the Pressurizer Heaters o The pressurizer heaters function as part of the RCS pressure control subsystem and are described in
- _ SSAR subsection 5.1.3.5. They operate to maintain pressure in the RCS pressurizer by maintaining a steam bubble-water interface in the pressurizer. Their operation following a loss-of-coolant accident (LOCA) can create an adverse system interaction by adding energy to the primary system.
Such an adverse interaction can occur during a steam generator tube rupture (SGTR) event. For these events, the CMTs and PRHR HX automatically operate to reduce the pressure in the RCS below the pressure of the secondary system, and therefore terminate the leak of reactor coolant to the secondary side. Operation of the pressurizer heaters in such an event would counteract or prevent the CMTs and ,
PRHR HX from equalizing primary to secondary pressures, and would increase the amount of primary coolant that was discharged to the secondary side, thus increasing potential radioactive releases following sucn an addent. Ultimately, continued operation of the pressurizer heaters for hours (assuming no operator actions) would cause the CMTs to drain to the ADS setpoint, resulting in actuation of the ADS. ADS actuation in this scenario would be acceptable and would prevent further release of radioactivity to the environment, but it does result in a significant plant transient.
The AP600 has addressed the potential adverse system interactions caused by the operation of the heaters during some events by tripping the heaters on an S-signal actuation. The safety analysis provided in Chapter 15 of the SSAR is performed assuming the pressurizer heaters are tripped following S-signal actuations.
2,2.3 Chemical and Volume Control System Makeup Pump Interactions As shown in SSAR Figure 9.3.6-1, the chemical and volume control system (CVS) contains two makeup pumps that maintain pressurizer water level within its normal operating band. These are nonsafety-related components controlled by the nonsafety-related plant control system (PLS).
However, operation of the makeup pumps can cause adverse systems' interactions during some j accident scenarios.
l l
i l
m:\3577w.non:lb-05M7 REVISloN 1
2 10 Non LOCA Events During non-LOCA events, the normal pressurizer level control program can cause the makeup pumps to operate. During such events, the CMTs can operate in a recirculation mode, and their operation in conjunction with the makeup pumps can cause an increase in coolant inventory. Therefore, in events such as loss-of-feedwater or feedline break, if the makeup pumps were to operate without level control, the pressurizer water level would increase until the pressurizer became filled with water.
The AP600 has addressed this adverse interaction by incorporating logic in the PLS and safety-related 7 logic in the Protection and Safety Monitoring System (PMS) to prevent pressurizer overfill during I transient events.- The complete list of PMS and PLS isolation functions associated with pressurizer .
7 l level is provided in the table on the following page.
This logic prevents the makeup pumps from overfilling the pressurizer during design-basis events.
A description of this analysis can be found in Chapter 15 of the SSAR.
SGTR Events During SGTR events, continued makeup pump operation would maintain a primary- to secondary-side
' leak and could cause the SG to become filled, thus potentially causing water relief through the SG safety valve. Therefore, to prevent this adverse interaction, the CVS makeup line receives a safety-related signal to isolate on high SG water level (PMS), precluding the possibility of the makeup pumps continuing to operate and overfilling the SGs. A description of the SGTR analysis can be found in Chapter 15 of the SSAR.
2.2.4 CVS Purification Loop As shown in SSAR Figures 9.3.6-1 and 9.3.6-2, the AP600 has a high-pressure purification loop that takes suction from the discharge of an RCP, and discharges to the suction of an RCP. In this manner, purification flow of approximately 100 gpm is maintained when the RCPs are operating. The
^ '
purification return line to the RCS is shared with the PRHR HX return line and is shown in SSAR Figure 5.1-1.
Operation of the purification loop can affect the temperature distribution in the PRHR HX retum line. .
The temperature distribution affects the thermal center of the PRHR HX loop and the initial driving force for the PRHR HX flow rate. To maximize the PRHR HX initial driving force, the outlet piping of the PRHR HX should be kept as cold as possible. ,
1 I
m:\3577w.non:Ib-05Gl97 REVISION 1 l
L- _ _ - . _ ~
2-11 Nominal Setpoints No Load Full-Load i
I&C % of volume % of volume ,
Pressurizer Level Setpoint System span (ft') span (ft')
1 High-3 Reactor Trip PMS 92.0 1,360 92.0 1,360 l i High-2 CVS Makeup Valves Isolation PMS 67.0 1,023 67.0 1,023 l .
Maximum Nominal Level 51.2 811 65.8 1,008 Letdown Open (Standby)'" PLS 50 794 65 996 j 1
Makeup Pump Stop (Standby)'" PLS 45 727 60 929 Letdown Open (Borate / Dilute)'" PLS 40 660 55 862 Letdown Close'" PLS 35 593 50 794 ,
1 High-1 CVS Makeup Valves isolation PMS 30.0 525 30.0 525 l (Post "S")
Makeup Pump Start (Standby)'" PLS 30 525 45 727 Minimum Nominal Level 25.3 463 40.0 657 Low-l CVS Purification Isolation PMS 20.5 397 20.5 397 Pressurizer Heater Trip Makeup Pump Stop (Post "S") PLS 20.0 391 20.0 391 Makeup Pump Start (Post "S") PLS 10.0 256 10.0 256 Low-2 CMT Actuation PMS 7.0 215 7.0 216 DAS l '" Approximate Setpoints The layout of the purification loop and connection to the PRHR HX return line has been selected to minimize the amount of PRHR HX discharge piping that could be heated by the purification loop. In addition, temperature instrumentation has been incorporated to measure both the PRHR HX outlet and inlet piping to verify that these lines are maintained at temperatures that ensure natural circulation through the PRHR HX when required. Finally, the SSAR safety analyses have assumed a temperature l gradient that conservatively bounds the initial driving head available to the PRHR HX by assuming lower than expected inlet temperatures, and higher than expected outlet temperatures.
^
2.2.5 Makeup Control System
) The makeup control system is a subsystem of the nonsafety-related plant control system (PLS) that controls the operation of the makeup pumps, makeup flow rate, and makeup boric acid concentration.
Potential adverse interactions can occur if the makeup control system malfunctions in such a manner
, mM577w.non:lb-05G497 REVISION 1 i
J
i 2-12 l
l l
as to inject makeup at incorrect boron concentrations. This can result in reactivity transients that can cause temperature excursions and affect the interactions of the passive systems with the RCS. l l
Unexpected borations at-power will result in a reduction in RCS temperature, and can thus aggravate condition 11 cooldown events or events that result in an increase in reactor coolant inventory, such as CVS malfunction (see SSAR subsection 15.5.2). Sensitivity studies perforrr.ed to support this analysis demonstrated the sensitivity of overfilling the RCS to makeup concentration mismatches. If the makeup pumps injected makeup at a higher boron concentration than expected, the RCS would shrink i slightly, and additional mass would be added. Eventually, if an S-signal were generated on either low
)
T-cold or low steam line pressure, the CMTs and PRHR HX would be initiated. However, due to the j higher RCS initial mass, and the lower RCS temperatures, which in turn reduces the heat transfer .
l capabilities of the PRHR HX, the recirculation of the CMTs could cause an overfill of the pressurizer. l l
Because of this phenomenon, CVS isolation setpoints have been selected to preclude the possibility of I overfilling the RCS for any condition II event including the CVS malfunction event.
Unexpected boron dilutions can also occur if the makeup control system malfunctions. The analysis of boron dilution accidents caused by the makeup control system is included in SSAR subsection 15.4.6.
This section includes evaluations of boron dilution events in Modes 1 through 5. Boron dilution scenarios are terminated by isolation of the clean water source to the CVS makeup pumps. This safety-related function is accomplished by redundant safety-related isolation valves in the CVS. This function can be performed assumirig single-failure criteria. These isolation valves then receive I automatic signals to close on a reactor trip, safeguards actuation, source range neutron flux signal, and indications of a loss-of-offsite power. This minimizes the potential of an unexpected boron dilution due to a malfunction of the makeup control systems.
2.2.6 Letdown Line Interactions The AP600 does not use continuous makeup and letdown for chemistry control, but instead uses a high pressure purification loop inside containment. The AP600 employs a letdown line for various !
operations such as degassing of the reactor coolant, and for reactor coolant boron concentration ,
adjustments. SSAR Figure 9.3.6-2 shows the CVS purification loop and letdown line. ]
For letdown operations, the letdown line is automatically aligned by the plant control system (PLS) to -
discharge coolant to the liquid waste processing system. The letdown line is also used to reduce the coolant inventory during shutdown for midloop operations. Consequently, the letdown line can potentially adversely interact with the RCS and the passive safety-related systems during mitigation of an accident. The letdown line represents a potential bypass of the reactor coolant pressure boundary and the containment pressure boundary. If an accident would occur during letdown operation, reactor coolant and safety injection flow could be diverted outside containment, and ultimately challenge the passive recirculation phase of core cooling.
mM577w.non:lts050497 REVISION l
t 2-13 The letdown line receives numerous automatic isolation signals to prevent unwanted or excessive letdown. He letdown isolation valves (CVS V045 and V047) receive signals from the PLS to close on low pressurizer level. These valves are also containment isolation valves and close automatically on a containment isolation signal. In addition, the purification stop valves (CVS V001 and V002) provide RCS pressure boundary isolation. hey close automatically on low-low pressurizer level and on an S-signal. Dese safety-related functions are accomplished in accordance with single failure criteria, and protect the reactor coolant pressure boundary, as well as the containment boundary.
Dese features prevent potential adverse system interactions between the letdown line and the passive l- safety-related systems.
The AP600 has also addressed overdraining of the RCS by the letdown line during midloop operations. The letdown line is used to drain the water in the RCS. To achieve this, the isolation signals that isolate letdown on low pressurizer level must be blocked. However, to prevent overdraining, the letdown line is also isolated on indication of low hot leg water level. The hot leg l
! level instruments provide redundant safety-related indication of the RCS water level.
2.2.7 Hydrogen-Addition Line l
He AP600 reduces occupational radiation exposure (ORE) and minimizes the potential for radioactive crud formation with RCS chemistry control by excluding oxygen from the coolant. This is achieved by maintaining a concentration of hydrogen in solution in the coolant. Unlike pressurized water reactors (PWRs) that maintain hydrogen in the coolant via the volume control tank, the AP600 coolant I
hydrogen concentration is maintained by batch addition of hydrogen via a connection in the CVS. He i hydrogen addition line, as shown in SSAR Figure 9.3.6-2, connects to a limited supply of hydrogen.
As required, the operator aligns the hydrogen injection line to add hydrogen to the high-pressure, purification return line.
The design of the hydrogen injection line promotes mixing of the hydrogen in the purification stream so that hydrogen is efficiently dissolved into solution. Due to the high pressure of the reactor coolant and the relatively low concentrations of hydrogen in solution, the hydrogen will be very soluble in the coolant.
A potential adverse interaction could occur if large amounts of undissolved hydrogen would enter the primary loop and collect in the high points of the PRHR HX line and CMT lines. It has been postulated that this phenomenon could potentially degrade and/or prevent natural circulation of the !
! PRHR HX or CMTs. Therefore, injection of a large amount of undissolved hydrogen should be L avoided.
This interaction is not a concern for the AP600 for the following reasons:
I
l concentration in the coolant.
- l. mA3577w.nort itK)50497 REVISION l
2-14 l
t The maximum amount of hydrogen that can be physically injected via the hydrogen line is small.
- Hydrogen should dissolve in the CVS line. -
Undissolved hydrogen that enters the RCS will be dissolved into solution as the gas passes through the RCP and before it gets to the CMT and PRHR connections.
.- The configuration of the RCS loop and connection to the PRHR HX and CMT minimize the potential for undissolved hydrogen to collect in the PRHR HX or CMT lines.
Hydrogen is maintained in solution at concentrations ranging from approximately 20-50 cc/kg. At !
the RCS operating pressure of 2250 psia, the saturation concentration of hydrogen in water is over 10,000 cc/kg. Therefore, provided there is sufficient mixing, hydrogen gas will quickly go into solution in the primary coolant.
The second reason that this interaction is not a concern is that the maximum amount of hydrogen that I can be injected is very small because the hydrogen line connects to a single bottle. Design
-I . calculations show that one hydrogen bottle (6000 psi,550 scf STP) will increase the RCS concentration less than 25 cc/kg. In addition, the rate of addition has been selected to preclude -
undissolved hydrogen from entering the RCS primary loop.
Even in the unlikely event that undissolved hydrogen should enter the RCS via the purification return line, the turbulence of the RCP suction breaks up the hydrogen bubbles and causes them to go into solution.
1 The AP600 layout minimizes the potential for undissolved hydrogen to collect in the PRHR HX or CMT lines. Hydrogen enters the RCS via the purification return line that connects to SG-1, the CMTs connect to the cold legs in the opposite loop. Therefore, undissolved hydrogen that entered SG 1 would have to remain undissolved while travelling through the RCPs, through the RV, through the opposite SG and RCPs, and into the cold-leg balance lines to the CMT. This scenario is not credible.
For undissolved hydrogen to collect in the PRHR HX inlet, it would travel a similar path through the .
RCPs and RV, and into the PRHR HX inlet line. This is not considered to be a credible mechanism.
In addition, the design of the PRHR HX and CMT inlet piping have provisions to detect collections of noncondensible gasses in the high points of these lines. Each CMT inlet line as well as the PRHR HX inlet line contain a collection standpipe that is instrumented with redundant level indication to alen the operator in the event that noncondensible gasses accumulate in the inlet of the line. Although this condition is not expected, technical specifications require the operator to vent these lines should it happen.
m:\3577w.non:Ib-050497 REVistoN l
- ~ . - - . _ - . - - - . -. - . - -. - . - - - - - - .
2-15 A direct path to the PRHR HX inlet line could exist because the purification return line shares a connection with the PRHR HX return line. He orientation of the purification retum piping has been configured so that any undissolved hydrogen entering this line would flow into the SG instead of going into the PRHR HX discharge piping. This line connects between the PRHR HX low point and
.the SG channel head so that undissolved hydrogen gas that entered the PRHR HX line would rise directly into the SG. If the connection had been made upstream of the low point in this line, then hydrogen gas could migrate into the PRHR HX discharge piping. Ultimately, this gas could then migrate through the heat exchanger (HX) and into the PRHR HX inlet piping. Therefore, the selected piping layout prevents this adverse interaction scenario.
.. 2.2.8 Main Feedwater Pumps
! At describ;d in SSAR Sections 10.3 and 10.4.7, the main feedwater pumps supply the SGs with sufficient feedwater to meet the power generation steam flow rates. Feedwater flow to each SG is controlled by feedwater flow control valves that control the flow rate based on the water level in the SG. Although the operation of the main feedwater pumps during a plant transient is typically a benefit l for transients by providing a heat sink for the RCS, duri'ng certain transients or accidents, feedwater operation can result in an adverse system interaction by overcooling the RCS.
! Continued operation of the main feedwater pumps following a reactor trip could lead to the l unnecessary actuation of an S-signal due to low cold leg temperature. He AP600 prevents this potential adverse system interaction as follows:
- To prevent overcooling to the low T-cold setpoint the main feedwater flow control valves are closed on a low-l T,,, signal.
- To prevent overcooling to the low T-cold setpoint the feedwater pumps are tripped and the main feedwater isolation valves are closed on a lower, low-2 T,,, signal.
This logic serves to avoid this potential adverse system interaction caused by the operation of the main feedwater pumps. In addition, main feedwater is isolated on a high steam generator water level. This precludes the possibility of overfilling a SG. Feedwater is also isolated on a safeguards actuation
. . signal to mitigate mass and energy released following a steam line break. If this were not isolated, the c fluid entering the SGs would be boiled and released to centainment, potentially overpressurizing
! containment.
l l -2.2.9. Startup Feedwater Pumps j As described in SSAR subsection 10.4.9, the startup feedwater pumps are part of the main and startup j feedwater system (FWS) and are shown in SSAR Figure 10.4.7-1. The startup feedwater pumps
- typically operate at no-load conditions when the main feedwater pumps are unavailable. The startup feedwater pumps can also operate during transient and accident events if the main feedwater pumps l mM5nw.non
- lb-050 97 REVISION 1
2-16 i
are lost. Startup feedwater (SFW) flow is automatically controlled and the pumps are automatically started on a low SG water level.
As mentioned above, feedwater is isolated on a safeguards signal to terminate mass and energy releases to containment on a steam line break. In addition, SFW is isolated on a low RCS cold leg temperature to prevent the need for operators to throttle S'/W during accident events.
The operation of the startup feedwater pumps can interact ruh the operation of the PRHR HX and can also affect radioactivity released following a postulated SGTR event.
Startup Feedwater - Passive Residual Heat Removal Heat Exchanger .
On a loss-of-feedwater event, the SFW pumps would be actuated on low water level in either SG.
The SFW would automatically operate to maintain water level in the normal SG level span. If the levels in both SGs fall to below the low narrow range SC level setpoint, and the SFW flow is less than a set value, the PRHR HX will be actuated to cool the plant. If, however, the SFW pumps are delivering flow, then the PRHR HX is not actuated unless the level in either SG falls to below the low wide range level setpoint. This actuation logic provides the SFW pumps the opportunity to remove core decay heat and maintain an RCS heat sink by providing feed flow to one or both SGs. If SFW is unable to match decay heat, the SG water level will fall, and the PRHR HX will automatically be actuated to mitigate the event.
In the SSAR Chapter 15 accident analyses, no credit is taken for the SFW to feed the SGs and remove decay heat. Therefore, these events conservatively found loss-of-heat sink events where the SFW system operates and possibly delays PRHR HX actuation.
Therefore, following a loss-of feedwater to the SGs, operation of the SFW pumps prevents the unnecessary operation of the PRHR HX. This interaction is not considered adverse, but rather reflects the AP600 design philosophy of the defense-in-depth systems. If the nonsafety-related system is available, its operation can obviate the need for actuating the safety-related systems. If the nonsafety-related SFW pumps do not operate, the safety-related PRHR HX is automatically activated. In addition, the AP600 ERGS specify that PRHR HX termination criteria can not be met until the SFW l pumps are operational and available, and water level in either SG is recovered, thereby maintaining a ,
heat sink for the RCS.
Startup Feedwater - Steam Generator Tube Rupture During SGTR events, operation of SFW pumps can aggravate the event by filling the SGs, thus potentially causing a the SG PORVs and/or safety valves to lift, and bypassing the SG pressure boundary. Therefore, to preclude this possibility, the SFW flow is automatically isolated on a high SG water level from the protection and safety monitoring system (PMS). This safety-related function can be accomplished in accordance with single-failure criteria.
m \3577w.non:lti-050497 Revision 1
2-17 l
2.2.10 Normal Residual Heat Removal System As described in SSAR subsection 5.4.7, the normal residual heat removal system (RNS) return line to i the RCS connects to each passive core cooling system (PXS) DVI line. This shared connection can result in interactions with the PXS as described below.
I Normal Residual Heat Removal Systeri- Core Makeup Tank During the recovery from a loss-of-coolant accident, the operators are instructed to align the RNS
' pumps to inject from the IRWST to the RCS via the DVI lines if the CMT water level begins to decrease. Operation in this mode provides additional injection flow to the RCS, thereby providing additional core cooling margin.
l
~
Furthermore, for small break LOCAs or in cases of spurious ADS operation, the operation of the RNS pumps in this mode can prevent the ADS-4 valves from actuating. This occurs because the RNS pumps increase the backpressure on the CMTs and prevent the CMTs from draining to the ADS-4 actuation setpoint, thereby preventing the ADS-4 valves that are connected to the hot legs from opening and flooding the loop compartments. Operation ci the RNS pumps will refill the RCS and recover the water level in the pressurizer.
This interaction is beneficial because it minimizes the consequences of a spurious ADS or a small LOCA without jeopardizing the safety of the plant. If the event is not a spurious ADS or a small LOCA, but is a larger break, the capacity of the RNS pumps will not be sufficient to prevent the CMTs from draining, and subsequent ADS-4 actuation. Its operation will then only provide additional 4 safety injection and core cooling. Operation of the RNS pumps is not credited in the SSAR Chapter 15 accident analyses, but is modeled in the PRA.
I Normal Residual Heat Removal System - In-Containment Refueling Water Storage Tanks -
j ,
As described previously, the RNS pumps can be aligned to inject water from the IRWST into the RCS via the DVI lines. This capability provides additional core cooling and adds to the overall reliability of the AP600.
t ..
During loss-of-coolant accident (LOCA) events, continued long-term operation of the RNS pumps could potentially cause the IRWST to drain at a faster rate than if the RNS pumps were not operating.
This is not a concem as long as the RNS pumps continue to operate. However, if the RNS pumps were to fail, the available gravity head for safety injection (either via the IRWST or via the 3 containment recirculation path) could be less than would have been available if the pumps had not j l operated at all. The long-term cooling safety analysis presented in the SSAR, Chapter 15 has
! I considered this phenomenon in the determination of the earliest possible time that containment
- I recirculation is required. Therefore, this adverse system interaction has been addressed.
mT3577w.non:lb-050497 REVISION 1 l
l
._. . . _ _ _ _ _ . ~ . _ .._ _ _ _ _ _ . _ _ _ _ . _ _ _
-'2-18 i
?
I 2.2.11 Steam Generator Blowdown Steam jerator blowdown from the secondary side of each steam generator is provided to help control sc..adary side water chemistry. This continuous blowdown is normally routed to the
- condenser, but can also be discharged from the plat v.a the waste water system. There am two potential adverse system interactions involving steam generator blowdown.
Steam generator blowdown during a loss of heat sink event (such as loss of feedwater or feedwater line breaks) will decrease the available RCS heat sink. The PRHR HX is designed to mitigate these loss of heat sink events.~ The PRHR HX performance rec,uirements are determined assuming a minimum initial steam generator water inventory. Analysis provided in the SSAR takes credit for the .
l secondary side inventory available in the steam generator. A significant reduction in steam generator inventory would reduce the available heat sink for these events.
Another potential adverse interaction associated with blowdown is related to off-site doses during an SGTR event. For these events, SG blowdown could cause an increase in radioactive releases resulting from the tube mpture.
The AP600 has addressed these potential interactions by providing safety related isolation of the steam -
4 generator blowdown lines on safety-related signals including low steam generator water level, PRHR actuation, and containment isolation as well as indication of high blowdown temperature, pressure, or radiation. These signals protect the steam generator water inventory as a heat sink, and prevents the-
, potential release of radioactivity via the blowdown line during tube rupture events.
2.2.12 Containment Fan Coolers The AP600 containment fan coolers provide containment cooling during normal operations. A potential adverse system interaction was postulated regarding the ability of the fan coolers, acting in conjunction with the safety-related passive containment cooling system (PCS) to reduce the containment pressure and challenge the integrity of the containment structure. The results of the ,
external pressure analysis (SSAR subsection 6.2.1.1.4) shows that a loss of all ac power sources during extreme cold ambient conditions has the potential for creating the most limiting extemal pressure load on the containment vessel. Operation of the containment fan coolers is not assumed for the following -
reasons:
- The loss of ac power prevents the fan coolers from operating.
- The low ambient temperatures (-40*F) and high containment temperature (120 F) can only occur if the fan coolers are aligned to the hot water system for the purposes of heating the containment; therefore their operation in this alignment would add heat to the containment, and would result in a less severe containment temperature and pressure reduction.
l m:0577w.non:lb-050497 REVisloN I
2-19 Therefore, adverse system interactions involving the containment fan coolers and the PCS are bounded by the external pressure scenario described above.
I De fan coolers are cooled by 'c hilled water supplied by the central chilled water system (VWS). The l AP600 fan coolers and VWS are not relied on for safety-related containment cooling. The only safety I function of the VWS is to isolate the chilled water supply and retum lines to the containment I ' recirculation cooling system (VCS) fan cooler coil units, following any event resulting in a l containment isolation signal to provide containment integrity. During cold weather when the plant is
~
l shut down, the high capacity subsystem is also designed to permit use of the chilled water piping l inside containment for containment heating. Manual realignment of the system allows hot water to be
. I supplied from the hot water heating system (VYS) to the VCS fan coils units. Therefore, the chilled I water piping inside containment is insulated.
l l The postulated accident scenario for the evaluation is a double-ended guillotine break of one of the I reactor coolant system cold legs. This event results in a rapid increase in containment pressure (and I temperature) to near the containment design pressure, and in the longer term containment pressure and j i temperature can remain elevated. As a result of the increase in containment pressure and/or the loss of I reactor coolant, the chilled water supply and retum piping from the fan coolers are isolated almost 1 immediately. In the AP600 design the operating fan cooler fans continw to operate at low speed, I circulating the heated containment atmosphere across the cooler coils. This would cause the stagnant I chilled water in the coolers to heat up to and be maintained at the containment air / mixture I temperature. If the VWS piping is subsequently unisolated after the water in the coolers has been 1 - heated, the heated water in the coolers may flash. The subsequent supply of cold water from the VWS I to the coolers could collapse the steam, creating a water hammer. Also of concern is that flashing I could occur in the coolers when they are in operation at elevated containment temperature conditions, l causing two-phase flow and loss of cooling flow capability. Unlike other PWR plants, the VCS and 1 VWS in the AP600 are not required to operate post accident and they are not restarted automatically.
I An evaluation has been performed which identifies the conditions when the VWS can be used I post-accident.
I l The evaluation has concluded that sufficient overpressure exists such that the AP600 chilled water l' system can be unisolated and operated with no flashing of chilled water, provided the containment s I temperature is below 228'F. This evaluation provides the following preew. ions and limitations to .
1 prevent flashing and potential water hammer in the chilled water piping:
-l I .- Following an event that results in heatup of the containment air / steam above 228'F, the l isolated cooling water supply and return containment isolation valves should not be opened to I restore chilled water flow to the operating fan coolers, until the containment atmosphere
!- temperature has been reduced to 5 228'F.
I l . Following an event that results in heatup of the containment air / steam above 228'F, cooling I water flow should not be initiated to fan cooler coils unless the fans for these coolers have mA3577w.non:Ib-050797 REVislON I
r 2-20 l been running for a sufficiently long time to ensure the water in the coils is at equilibrium i temperature with the containment atmospnut temperature, and until the containment I atmosphere temperature has been reduced to 5 228 F. w l
1
- The chilled water flow to operating fan coolers should be stopped and isolated using the [
l containment isolation va'.ves, whenever the containment atmosphere temperature exceeds
{
l 228 F. 't I
l = Following en event that results in heatup of the containment air / steam above 228 F, chilled .. 5 I water flow to operating fra coolers should be initiated by first opening the chilled water return I line isolation valves be' ore the supply line isolation valves. .
I s I The evaluation concludes that if tiw.,e precautions and limitations are adhered to, the chilled water l piping inside containment will not be subject to water hammer, which could lead to a containment i bypass scenario. Overpressure protection of the chilled water system is provided by a thermal relief I valve. The relief valve prevents the chilled water piping design pressure from being exceeded . ,
i following containment isolation, and subsequent heatup of the containment, with the chilled water I system piping water solid. Another design feature of the chilled water piping and containment fan f.
I cooler coils is the capability of these systems to withstand a perfect vacuum. Following the I containment heatup and cooldown postulated in the evaluation, the resulting rainimum pressure in the .
I system piping and components can approach a perfect vacuum, and the system piping and components I shall be designed to acccmmodate this condition.
l l The containment fan coolers are equipped with two-speed fans. The high speed is used for normal I conditions, and the low speed is used primarily to perform the containment integrated leak rate testing, -
I which requires the containment to be pressurized to design pressure. Normally, the fans are manually _.
I realigned to perform this test. However, following a transient or accident that results in the ,
I containment pressure and temperature being elevated, the fan motors receive a signal to automatically I switch to low-speed operation, based on a pre-set containment pressure signal. This is accomplished I via the nonsafety-related plant control system. In addition, if the fans were to operate in a high I containment pressure / temperature condition, the fan mo, ors are provided with a thermal overload I switch that would automatically trip the motor to prevent damage. Operation of the fans at high speed I with high containment pressure could damage the fan motors, but would not cause damage to the ,
I chilled water system.
I 2.2.13 Plant Control System -
The AP600 plant control system (PLS) provides for the courol and operation of the nonsafety-refued systems. Therefore, numerous interactions between safety-related and nonsafety-related systems as a result of the normal and abnormal operations of the PLS must be considered in the Chapter 15 SSAR ! i I analyses. j .
mA3577w.non:Ib-050797 REVISION l
l l
l l 2-21 l
l l
l l l A systematic review of the SSAR Chapter 15 design basis analyses (Sections 15.1 through 15.6) has been performed to determine the treatment of the most relevant nonsafety-related systems for each event. Table 2-2 presents the results of this systematic review in a matrix format. In the left hand I column, each SSAR Chapter 15 event is listed; along the top, each nonsafety-related system is listed.
An "a" indicates that the nonsafety-related system was assumed operable in the analysis of that event.
An "n" indicates that the nonsafety-related system was not assumed. Table 2-2.a provides the rationale behind the decisions to assume nonsafety-related systems available. Table 2-2.n provides the rationale behind the decisions not to assume the nonsafety-related systems available.
2.2.14 Liquid Waste Processing System As described in SSAR Section 11.2, the liquid waste processing system (WLS) collects and processes radioactive waste from the RCS. These effluents are generated from RCS borations and dilutions, RCS sampling, RCS loop draining, and components including vessel and RCP flange leakoffs, safety valve leakage, and ADS valve leakage. Leakage from the ADS valves is collected and routed to the WLS reactor coolant drain tank (RCDT). The 1-inch drain line from the ADS valve discharge header to the RCDT contains a remotely-operated valve that closes on a safeguards actuation signal or on high RCDT tank pressure. The purpose of this isolation valve is to prevent ADS operation from overpressurizing the RCDT. This isolation function is not safety-related, but is provided for equipment protection.
An adverse system interaction could occur if ;he isolation valve (RCS-V241) failed to close on demand pnor to ADS operation. Actuation of the ADS valves connected to the pressurizer could cause the drain line to become pressurized and lift the relief valve on the RCDT, and/or damage the tank due to ex:easive pressurization. However, this is not a safety concem because of the following:
The ADS function of depressurizing the RCS is not degraded; the total ADS flow would actually be slightly increased due to the increased flow area.
The drain line is small (1-inch) and the amount of ADS flow that could be diverted from the IRWST to the RCDT is minimal; therefore the impact to the IRWST injection driving head is negligible.
The ADS flow that is diverted from the IRWST is discharged to the RCDT (volume -
900 gallons). If the RCDT relief valve opens, the ADS flow is diverted to the containment mmp that eventually floods up for long term containment recirculation. The maximum amount of inventory that could be lost from the volume that provides containment recirculation is 900 gallons, which is negligible.
Therefore, this potential adverse system interaction involving the RCDT does not affect the overall j safety of the AP600.
m \3577wmn:Ib-050797 REVIslON 1
2-22 2.2.15 Liquid Waste Processing System Containment Sump Pumps
! As discussed in SSAR Section 11.2, the WLS contains two redundant containment sump pumps that
- automatically operate to pump out the contents of the containment sump to the WLS effluent holdup
] tanks for processing. As these pumps operate automatically on sump water level, their operation
] during a loss-of-coolant accident (LOCA) could result in a containment bypass scenario. Their
- i. operation could diminish the coolant inventory available to flood the containment and provide j long-term, post-accident containment recirculation. To avoid this interaction, the containment sump j pumps' discharge line is automatically isolated on a containment isolation signal. A containment isolation signal will result from a safeguards actuation signal that actuates the core makeup tanks (CMTs) and passive residual heat removal heat exchanger (PRHR HX). Therefore, this potential .
adverse system interaction is avoided for the AP600.
- . 2.2.16 In-Containment Refueling Water Storage Tank Gutter I
As discussed in SSAR subsection 6.3.2.1.1, the PXS contains an IRWST gutter that functions to return j.
(
condensate that collects on the containment shell. During normal power operations, this gutter directs the condensate collected to the containment sump for inclusion in the measurement of RCS leakage.
Following actuation of the PRHR HX, the gutter is aligned to direct the condensate to the IRWST, to sustain a heat sink for the PRHR HX for a very long time. Even without recovery of the condensate i from the IRWST gutter, the IRWST inventory is sufficient to provide a heat sink for the PRHR HX :
for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. !
The IRWST gutter is nonsafety-related, therefore no credit for condensate retum via the gutter is taken 4 in the SSAR Chapter 15 design basis accident analyses. i 2.2.17 Componen'. Cooling Water System
- The AP600 compones cooling water system (CCS) is a nonsafety-related system and is described in ;
SSAR subsection 9.2.2. t performs no safety-related functions with the exception of the containment ,
boundary isolation. The CCS provides component cooling water to various components on the nuclear island including the reactor coolant pumps (RCPs). An adverse system interaction associated with the CCS and the RCS results from the failure of the CCS to supply cooling water to the RCPs. -
If component cooling water were lost to any RCP, the RCP bearing water temperature would increaw,
- eventually leading to a failure of the RCP The worst pump failure postulated would be an RCP locked rotor, which is evaluated in the SSAR Chapter 15 accident analyses (see SSAR l subsection 15.3.3). I I
l l
i m \3577w.non:lb-050797 Revision I 5
TABIA MATRIX
SUMMARY
OF RELEVANT NONSAF Main Sk Feedwater Main Fees SSAR Chapter 15 Control Feedwater ca Event System - Pump Trip Sy i
15.1.1 Feedwater System Malfunctions That Result in an Increase in Feedwater Temperature Bounded by increase in feedwi 15.1.2 Feedwater System Malfunctions That Result in an increase in Feedwater Flow n.2 a.5 1 15.1.3 Excessive Increase in Secondary Steam Flow a.2 n.10 1 l
15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve a.2 n.10 l 15.1.5 - Steam System Piping Failure a.2 n.10 15.1.6 Inadvertent Operation of the Passive Residual Heat Reinoval System a.2 n.10 15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow There are no steam pressure te 15.2.2 Loss of External Electrical Load Bounded by turbine trip event 15.2.3 Turbine Trip n.15 n.15 d.
i l
l 15.2.4 Inadvertent Closure of the Main Steam Line isolation Valves Bounded by turbine trip event 1 15.2.5 Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip Bounded by turbine trip event 15.2.6 Loss of AC Power to Plant Auxiliaries n.2 n.15 1
15.2.7 Loss of Normal Feedwater n.2 n.15 d I
15.2.8 Feedwater System Pipe Break n.16 n.16 l 15.3.1 Partial Loss of Forced Reactor Coolant Flow a.2 n.15 15.3.2 Complete Loss of Reactor Coolant Flow a.2 n.15 j 1
15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) a.2 n.15 15.3.4 Reactor Coolant Pump Shaft Break Bounded by locked rotor eve (
l l 15.4.1 Uncontrolled RCCA Bank Withdrawal from a Suberitical or Low-Power Startup Condition Thermal-hydraulic codes not d
- l. calculated. l l
l l l
)
i mA3577.non:IbW50597 ;
n s ,
, ,,.e. - ,~ , -, -
. . . . - . - . - . . . _ _ - , . ~ , _ . .
h bl(2-23 ..l APEp;f;;7 '
l Q R r-I
- -2 TY RELATED SYSTEMS' ASSUMPTIONS O A ~4V
- P - . .a-Chemical d
tup rnd Automatic Turbine Main Steam k:ter Volume Pressurizer Rod Stop and llranch trol Control Pressurizer Pressurizer lleater Steam Control Control isolation SG (em System Sprays IIcaters Illock Dump System Valves Valves PORVs r flow event (Section 15.1.2) and increase in secondary steam flow event (Section 15.1.3).
i p n.5 a.8 n.9 n.11 n.5 a.1 a.5 a.5 n.5 l
5 n.5 a.8 n.9 n. I 1 a.3 a.6 n.5 n.5 n.5 i
[I n. I 2 n.5 n.9 n. I 1 n.5 n.13 a.5 a.5 a.3 i
7 n.12 n.5 n.9 n.11 n.5 n.13 a.5 a.5 n.5
[1 n.12 a.8 n.9 n.11 n.5 n.1 n.5 n.5 n.5 hiators in the AP600 whose failure or malfunction cause a steamflow transient.
iection 15.2.3) l4 n.5 a.6 n.25 n.11 n.4 n.7 a.3 a.4 n.4 hection 15.2.3) hection 15.2.3) l4 n.2 n.2 n.2 n. I 1 n.2 n.2 a.4 a.4 n.2 l4 n.3 a.I n.6 a.5 n.4 n.7 a.4 a.4 n.4 14 n.3 n.18 n.17 n.11 n.4 n.7 a.4 a.4 n.4 5 n.5 n.19 n.19 n.11 n.4 n.7 a.4 a.4 n.4 5 n.5 n.19 n.19 n.11 n.4 n.7 a.4 a.4 n.4 5 n.5 n.19 n.19 n.11 n.4 n.7 a.4 a.4 n.4
- Section 15.3.3) td to analyze plant transient response. Core nuclear power transient and core heat flux transient are calculated, then DNBR is 970510WO REVISION: 1
~~
P TABLE 2-2 MATRIX
SUMMARY
OF RELEVANT NONSAl Main .
Feedwater Main Fct SSAR Chapter 15 Control Feedwater Cd Event System Pump Trip Sl 15.4.1 Uncontrolled RCCA Bank Withdrawal from a Suberitical or Low-Power Startup Condition Thermal-hydraulic codes not(
calculated. I 15.4.2 Uncontrolled RCCA Bank Withdrawal at Power a.2 n.10 15.4.3 One or more dropped RCCAs (same group) a.2 n.10 l
15.4.3 Statically misaligned RCCA Thermal-hydraulic codes not d Withdrawal of a Single RCCA (and/or number of rods in DM 15.4.4 Startup of an Inactive Reactor Coolant Loop at an incorrect Temperature a.2 n.10 i 15.4.5 . A malfunction or Failure of the Flow Controller in a BWR Reacto
- fop Does not apply to AP600.
15.4.6 CVS Malfunction 'That Results in a Decrease in the RCS Boron Coi ntration Inadvertent boron dilution eve ~
Inadvertent boron dilution eve 2 Following reactor trip, automd 15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position l Thermal-hydraulic codes not d rated thermal power using a td 15.4.8 Spectrum of RCCA Ejection Act.idents Thermal-hydraulic codes not rd over which the core response 5 l 15.5.1 Inadvertent Operation of the Coce Makeup Tanks During Power Operation a.2 n.10 15.5.2 CVS Malfunction That Increases Reactor Coolant Inventory a.2 n.10 l 15.5.3 BWR Transients Does not apply to AP600.
i
[ 15.6.1 Inadvertent Opening of a Pressurizer Safety Valve or Inadvertent Operation of the ADS a.2 n.10 15.6.2 Failure of a Small Lines Carrying Primary Coolant Outside Containment Thermal-hydraulic codes not d non-limiting primary system @(
15.6.3 Steam Generator Tube Rupture (for offsite doses) a.2 n.10 d 15.6.3 Steam Generator Tube Rupture (for SG overfill) a.2 n.10 k 15.6.4 Spectrum of BWR Steam System Piping Failures Outside of Containment Does not apply to AP600.
15.6.5 Small Break LOCA a.2 n.10 Large Break LOCA 1
i m13577mn:Ibw50597 l
-~
hh5s e
, CARD l oItini'ed) #
m'-RELATED SYSTEMS' ASSUMPTIONS 4lso 4,,,p
! Aptrtud, j'[
Chemical op and Maln Steam wit:r Volume Pressurizer Automatic Turbine Stop Branch 1 itrol Control Pressurizer Pressurizer lleater Steam Rod Control and Control Isolation SG t:m System Sprays lleaters Block l Dump System Valves Valves PORVs id to analyze plant transient response. Core nuclear power transient and core heat flux transient are calculated. then DNBR is 3 n.5 a.8 n.9 n.1 I n.4 n.7 a.4 a.4 n.4 5 n.5 a.8 n.9 n.4
- n. I 1 n.7 a.4 a.4 n.4 l
td to analyze plant transient response. Steady-state power distributions are used to calculate minimum DNBR l.
5 n.5 n.5 n.9 n. I 1 n.4 n.7 a.4 a.4 n.4 6 are prevented during refueling and automatically termir.ated during cold shutdown, hot shutdown, and hot standby modes.
i during start-up or power operation, if not detected and terminated by the operators, result in an automatic reactor trip.
- termination of the dilution occurs and any post-trip return to criticality is prevented.
d to analyze plant transient response. Steady-state power distributions in the x-y pane of the core are calculated at 30 percent
-dimensional few group diffusion code.
I l d to analyze plant transient response. The operation of non-safety-related systems have little effect on this <3 second transiet analyzed.
4 n.3 n.18 n.6 a.5 n.4 n.8 a.4 a.4 n.4 I a.3 n.1 n.6 a.5 n.4 n.1 a.4 a.4 n.4 5 n.20 n.5 n.9 n.11 n.4 n.7 a.4 a.4 n.4 d to analyze plant transient response. Offsite doses are calculated based on break flow isolation after 30 minutes. This is a l sient.
I a.9 n.5 a.9 a.5 n.22 n.23 a.5 a.5 a.10
]
1 I a.9 n.5 a.9 a.5 n.24 n.23 a.5 a.5 a.10 i n.20 n.5 n.6 n. I I n.4 n.7 a.4 a.4 n4 REVl5 !ON: I
1 1
2-27 l l
l l
l LEGEND FOR TABLE 2 2 l
l a = nonsafety-related <vstem assumed available in safety analys.is a.1 Sensitivity studies were performed and showed that operation of this non safety system iesults in a more limiting transient. I l
l a.2 Nonsafety-related system operation is assumed because a detectable and non-consequential random, independent failure must occur in order to disable the system.
a.3 Spurious operation of this non-safety-related system is the initiating event. ,
l a.4 Steam generators are conservatively assumed to be bottled up to maximize their stored energy and j minimize their heat removal capability. Only safety-related SG safety valves are assumed for j steam relief after reactor trip. I a.5 Nonsafety-related equipment credited as backup protection. Equipment is included in the in- i l
service testing (IST) program.
l a.6 Cases with and without this non-safety-related system are presented in SSAR, Chapter 15.
i l
a.7 Startup feedwater increases secondary side heat removal capability and worsens the severity of a l
cooldown event. '
1 a.8 Nonsafety-related system operation is assumed, because it reduces primary system pressure and thereby minimizes the calculated values of DNBR.
1 a.9 Nonsafety-related equipment which maintains primary pressure is conservatively assumed for the ,
SGTR event in order to maximize break flow. j 1
a.10 Assuming the SG PORVs to be operable results in a higher prirnary-secondary AT, which l maximizes break Dow during the SGTR event.
a.11 Maximum startup feedwater is assumed to add inventory to the SGs and reduce steaming; both of l these effects minimize margin to SG overfill. j d
I i
1 mM577wmn:lb-050497 REVISION 1
l
! 2 28 i
! LEGEND FOR TABLE 2 2 (Continued) i n = nonsafety-related system not assumed available in safety analysis n.1 Sensitivity studies were performed and showed that operation of this non-safety system results in a less limiting transient.
n.2 Not available as a consequence of the initiating event.
n.3 Isolated on an S-signal coincident with high pressurizer level of 30% span. CVS contribution only -
significant during post S signal portion of transient, n.4 Steam generators are conservatively assumed to be bottled up to maximize their stored energy and ,
minimize their heat removal capability. Only safety-related SG safety valves are assumed for steam relici after reactor trip.
n.5 Not actuated during transient.
n.6 The pressurizer heaters are blocked on an S-signal. Heaters contribution only significant during post-
"S"-signal portion of transient.
n.7 Provides additional shutdown prior to reactor trip.
n.8 Reactor is tripped on S-signal at initiation of event, n.9 It is conservative to neglect heat addition from pressurizer heaters; this reduces primary system pressure and thereby minimizes the calculated values of DNBR.
n.10 Redundant safety-related functions are available for MFW isolation without MFW pump trip.
n.11 Pressurizer heater block is met since heater operation is not assumed.
n.12 CVS is not credited. Shutdown is accomplished via the passive, safety-related core makeup tanks.
n.13 Analysis performed at HZP. Reactor is in manual rod control at HZP.
n.14 Startup feedwater is not credited to ininimize secondary side heat removal capability.
%O I
l l l l
i m13577w.non:tb-oso497 REVISION I
l l
l 1
2-29 1
l l
l LEGEND FOR TABLE 2 2 (Continued) l l
l l
p = nons.afety-related system not assumed available in safety analysis l
n.15 Non necessary to assume nonsafety-related MFW pump trip. MFW is assumed to be lost at I the time of event initiation; this minimizes the secondary side heat removal capability. ;
1 n.16 MFW is assumed to spill out the break. l n.17 It is conservative to neglect heat addition from pressurizer heaters; heaters maintain primary system pressure and margin to saturation.
n.18 The pressurizer sprays are disabled when the RCPs trip. RCPs are tripped upon receipt of an S-signal. Sprays contribution only significant during post S-signal portion of transient.
n.19 Pressurizer pressure control systems not assumed for transient analysis. A conservatively low initial pressurizer pressure is transmitted with statepoints used for steady-state DNBR i calculations.
n.20 It is conservative to neglect the make-up capability of the CVS for this decrease in reactor coolant inventory event.
n.21 Startup feedwater is not credited to maximize the amount of steaming and offsite doses released during the SGTR event, n.22 The steam dump system is assumed to be inoperable; this maximizes the amount of steam l I
released through the SG PORVs to the atmosphere.
n.23 As a result of an SGTR, primary pressure decreases until the low pressurizer pressure reactor trip signal is reached. No significant power excursion occurs during the initial part of the transient, so the operability of the automatic rod control system has a negligible effect on the transient.
n.24 The steam dump system is assumed to be inoperable; this reduces the ability of the SGs to cool down the primary and reduces the amount of steam inventory leaving the SGs, both of these effects minimize the margin to SG overfill.
n.25 Pre.ssurizer heaters have a negligible effect on the peak pressure which occurs within i1 seconds of the transient initiation.
l l
- mA3577wmn:ltwo30497 REVISION l
E 2-30
)
i Since the CCS supplies each RCP with cooling water, a complete loss of CCS could lead to multiple RCP failures including multiple locked rotor scenarios. To preclude this possibility, the AP600 protection and safety monitoring system (PMS) (see SSAR Chapter 7) has incorporated automatic l features to trip the reactor on a high bearing water temperature in any RCP. Each RCP has four ;
safety-related temperature sensors that measure bearing water temperature. Hey provide a signal to the PMS (on a two-out-of-four voting logic) to trip the reactor on high temperature. They also provide ;
a signal to trip the affected RCP after the reactor has been tripped. !
. l Another potential adverse system interaction between the CCS and the RCS is the potential for the l RCS to leak into the CCS via the RCPs and cause an overpressure of the CCS that would lead to an
- l intersystem LOCA. The CCS provides cooling water to the canned-motor RCPs to support normal ..
I pump operation. Reactor coolant circulates through cooling coils around the stator, where it is caoled I by component cooling water. In the unlikely event that the cooling coil pressure boundary is I breached, reactor coolant would leak into the cooling water jacket and into the CCS. The CCS is >
- l designed to minimize the consequences of in-leakage from the various components it services.
-I 1 There are several possible scenarios, depending on the size and location of a leak. Minor leakage of a [
l few gallons per minute into the CCS would be discovered via gradually increasing surge tank level or 1 - system radiation.
I 1 For intermediate size leaks from the RCPs, a flow meter in each CCS line servicing the RCPs will I detect the increased flow rate and automatically close the valve in the individual CCS line returning l from the RCP. Closure of this valve will not terminate the leak however, since the associated CCS '
I relief valve will lift and discharge to containment. If the leakage is within the makeup pump capacity, I no safeguards actuation signal is generated, and the plant would be shut down and depressurized with l normal systems.
I I For large leaks from the RCPs that exceed the capacity of the makeup pumps, the event is a small l LOCA inside containment. since the associated relief valve will lift and discharge to containment. {
l Ultimately, the continuing loss of inventory will result in a safeguards actuation signal, RCP trip, and
- l containment isolation. The appropriate emergency response procedures would be used for recovery. 7 2.2.18 Primary Sampling System .
The primary sampling system (PSS) is connected to the primary system and provides normal and post-accident sampling of the RCS, PXS and containment as required (see SSAR subsection 9.3.3). The system is connected to the RCS and penetrates the containment boundary, it represents, therefore, a potential containment bypass path that could lead to a loss of reactor coolant and/or containment recirculation fluid outside containment.
To preclude potential containment bypass scenarios post-accident, the PSS sample lines that penetrate containment are automatically isolated on a containment isolation signal. These lines would be i l
mA3577w.non:ltr050797 REVisloN 1
2-31 l
l manually re-opened eight hours post-accident to permit the post-accident sampling required (see SSAR subsection 9.3.3.1.2.2). The sampling volumes taken at this time are very small and would not impact ;
the volumes of reactor coolant and containment recirculation fluid necessary to maintain long-term I containment recirculation. Therefore, adverse system interactions associated with the primary sampling system are avoided. )
2.2.19 Spent Fuel Pool Cooling System The AP600 spent fuel pool cooling system (SFS) is a nonsafety-related system and is described in SSAR subsection 9.1.3. It performs no active safety-related functions with the exception of the containment boundary isolation. It also provides a safety-related path for long-term (post-72 hours) spent fuel pool makeup in the event of a loss-of-spent fuel pool cooling. The SFS functions to provide cooling of the spent fuel pool during all modes of operation. The safety-related means of cooling the spen; t.sel is provided by the inventory of water in the spent fuel pool. To achieve this, j the spent fuel pool itself is safety-related and is seismic category I. The SFS can also function to i purify the refueling water when it is in the IRWST (during power operation), and when it is in the l refueling cavity (during refueling operations). It also functions to transfer the refueling water between .l l
the IRWST and the refueling cavity to facilitate refueling operations. '
The SFS is shown in SSAR Figure 9.1-8. Due to the various interconnections of the nonsafety-related SFS to the various safety-related pools and tanks (spent fuel pool, IRWST, refueling cavity), special I design considerations have been incorporated to preclude adverse system interactions involving the SFS. These design considerations are discussed in the following paragraphs.
l The spent fuel pool is designed to provide the safety-related means of spent fuel pool cooling. The l SFS connections to the spent fuel pool are located at an elevation sufficient to maintain spent fuel J cooling and prevent uncovery of the spent fuel for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following the loss-of-spent fuel pool cooling. SSAR Table 9.1-4 provides the times before boiling would occur and minimum fuel pool inventory for various postulated loss-of-spent fuel pool cooling scenarios. These scenarios include ones where the initial fuel pool inventory is reduced to the level of the SFS connection immediately prior to the loss-of-fuel pool cooling that could occur if the SFS line to the fuel pool was severed.
The SFS connection to the spent fuel pool is located 4 feet below the normal water level in the pool.
As discussed in SSAR subsection 9.3.6, the CVS makeup pumps can also take suction from the SFS as a backup emergency boration water source. To preclude adverse system interactions involving the ,
CVS and the SFS, the CVS connection to the spent fuel pool is located 2 feet below the normal water level in the pool, and 2 feet above the SFS connection. Therefore, CVS operation cannot drain the l
- spent fuel pool, which could result in a loss of nonnal fuel pool cooling.
I The SFS also contains connections to the IRWST to transfer refueling water to the refueling cavity.
f These lines are safety-related and are administratively controlled to prevent inadvertent draining of the mA3577w.non:Ib-050797 REVislON 1 l
l
2-32 IRWST. IRWST level is monitored and is included in the AP600 technical specifications (SSAR Chapter 16, subsection 3.5.4). In the event of the mispositioning of the manual valves that connect the IRWST to the refueling cavity, the administratively controlled drain of the refueling cavity, aligned to the containment sump during power operations, would cause the IRWST to drain to the containment sump. This prevents the IRWST inventory from being lost (that is, held-up) in the refueling cavity, causing it to be unavailable for post-accident containment recirculation.
The SFS contains a line that connects the IRWST and the refueling cavity to the SFS pumps and therefore penetrates the containment boundary. The containment isolation valves close automatically on a containment isolation signal to preclude the possibility of draining the IRWST during an accident.
These valves also close on a low spent fuel pool level to preclude the possibility of draining the ,
refueling cavity and/or spent fuel pool during refueling operations.
The SFS also contains a connection to the bottom of the fuel transfer canal to permit draining of the canal for maintenance operations. This line is safety-related and seismic category I up to and including the normally closed manual isolation valve (SFS-V040). This valve is administratively locked-closed to ensure that inadvertent draining of the spent fuel pool cannot occur. It is opened only when the gate between the fuel transfer canal and the spent fuel pool is closed, thereby preventing its opening from draining the spent fuel pool.
These design features have been incorporated to avoid potential adverse system interactions involving the SFS and the safety-related pools and tanks that it services.
2.2.20 Habitability Systems SSAR Section 6.4 discusses the design of the AP600 habitability systems, including the nuclear island non-radioactive ventilations system (VBS) and the main control room emergency habitability system (VES). The VBS provides main control room (MCR) HVAC during all normal and abnormal conditions with the exceptions of a loss-of-all ac power, and for conditions of high radioactivity in the MCR. The VES provides safety-related HVAC for the MCR in the event of a loss-of-ac power or high radioactivity in the MCR, Adverse system interactions between these systems is avoided by segregating the operation of the two systems. Furthermore, the nonsafety-related VBS has safety-related isolation upon actuation of the VES, as described in SSAR Section 6.4. ,
m:\3577w.non:ltw050797 REv!SloN 1
)
2-33 2.3 PASSIVE - PASSIVE INTERACTIONS This section discusses the various interactions, including the adverse systems interactions, associated with the operation of passive safety-related systems and components. Also described are the passive safety-related system and component operations and their effect on the operations and performance of other passive safety-related features. l
, Interactions between the following passive safety-related systems and cc,mponents are included in this l
evaluation of adverse system interactions:
Passive core cooling system 1 Core makeup tanks (CMTs)
Accumulators In-containment refueling water storage tank (IRWST)
Containment recirculation Passive residual heat removal heat exchanger (PRHR HX)
Automatic depressurization system (ADS) valves
=
Passive containment cooling system (PCS)/ Containment a
Main control room habitability system Steam generator system (SGS) e Reactor coolant system (RCS)
The reactor coolant and steam generator systems are also included in the list of passive safety-related components that must perform safety-related functions. The functions for these two systems are primarily related to maintaining sufficient system integrity to support the passive injection and core cooling mechanisms.
The RCS includes interactions with both the reactor core and the RCS pressure boundary. The RCS must provide the following imponant flow paths to support safety injection and core decay heat removal after any accident:
= Injection from the various passive injection sources such as CMTs, accumulators, the IRWST,
, and containment recirculation.
. Natural circulation heat transfer of both decay heat from the core and sensible heat from the system components for safety-related heat removal by the PRHR HX or nonsafety-related heat removal by the steam generators.
. Steam venting through the ADS valves in the pressurizer and the hot legs.
The steam generators (SGs) are also discussed as part of this evaluation for two important interactions.
They perform a safety-related function to maintain RCS integrity, which is lost following a steam m13577w.non:lb 050497 Revision 1 l
I
2-34 generator tube rupture event (SGTR). They also impact the reactor coolant system heat removal processes. Following events where heat removal is provided by the passive safety-related systems only, the steam generators and the secondary side water inventory can provide heat input to the reactor coolant system (RCS). However, the heat input becomes less significant to the RCS for those events where there is reduced RCS flow or significant voiding of the RCS and the heat transfer is through vapor on the primary side of the steam generator. The SGS secondary system integrity is also important since a loss of this pressure boundary can release steam to containment, thereby affecting containment pressure and passive decay heat removal. -
l The interactions between the various passive components and the PCS also directly affect the ' l containment since steam generation following an event results in an increase in containment pressure .
that can challenge containment integrity. In addition, actuation of the PCS removes steam from the i
containment atmosphere and results in condensate formation on the inside of the containment vessel I
shell, which drains back to either the IRWST or the containment recirculation areas, depending on the status of the condensate return isolation valves. Therefore, in the following discussions, the ;
interactions between the various components and the PCS also implicitly address the containment and containment integrity. There is one impoitant difference in the interactions between the safety-related passive components and contairment that is different from the interaction with containment and nonsafety-related systems and components. The passive components are generally located within containment and do not have containment penetrations, while the nonsafety-related systems generally penetrate containment and have containment isolation valves in their process lines. Therefore, the passive component interaction discussions focus primarily on how the passive components impact containment pressure, which could challenge containment integrity, and the related actuation of PCS that mitigates the pressure transients and provides long term decay heat removal.
l l
l Approach i
t This section includes a discussion on the interactions for each combination of the passive systems and
- f. components listed above. Each section briefly describes the various interactions between the specif'c l components, including how the first component affects the second one, and vice versa. The l
discussions in each section identify the important interactions and any adverse interactions, and confirm that any adverse interactions have been identified, addressed, and evaluated as part of the l
plant design process, through the various design, analysis, and testing mechanisms discussed later. ,
There are thme principal types of component interactions that have been considered in completing this evaluation:
. Process fluid interactions that include the design interactions expected between the various passive components, such steam discharged from the ADS sparger and the water in the IRWST that is used to quench this steam.
mA3577w.non:Ib-050497 REVislON l
I 2 35 l Actuation interactions, such as the CMT low level actuating the fourth stage ADS valves and the IRWST discharge isolation (explosive) valves.
Other physical interactions that may not normally be expected, such as the IRWST inventory l flooding the CMT compartment and cooling the CMT that may be at high temperatures following recirculation operation. 1
- In each discussion, the most important interactions are identified. The important interactions for each I of the components are generally related to the specific safety-related functions that the component was designed to perform.
l The less important interactions are included in the discussions for completeness, but they are not significant in comparison to the important interactions. These other interactions are considered as secondary interactions, not important to the safety-related passive systems for several different reasons, which could include any of the following:
There may be no physical interaction between the specific passive system components, rendering the components essentially unrelated.
There may be some interactions between the components, but the effects of these interactions are second-order.
_ The operation of the first component may affect the second component, but when the interaction occurs, the operation of the second component is not important for accident mitigation.
The following examples help to clarify the distinction in interactions between the safety-related passive components.
The following is an example of an important system interaction:
The ADS has an important impact on the IRWST, significantly affecting the tank temperature
, once ADS actuates. The water temperature primarily affects the IRWST quenching capability, although it is a consideration for both the water injection temperature and the PRHR HX heat sink temperature. In an opposite sense, the IRWST level and water temperature haw an important impact on ADS, affecting the tank's ability to quench the ADS steam discharge and the ADS (stages one to three) backpressure due to the ADS sparger submergence in the l IRWST.
I 1
l mA3577w.non:Ib-050497 REVISloN I l
- . . . . - - ~ . - - . - - - - _ . _ . . .
'2-36 1
I
) he following is an example of a secondary interaction:
I
{
. to be important. However, this is a secondary interaction since ADS heat removal is much !
more important than PRHR HX heat removal for events where ADS occurs. In this case, there l j
i are interactions between these two components, but they are not considered important.
l Another second-order effect is the impact of the higher temperature water on the IRWST gravity injection. .
i The following is an example of two components that do not interact:
i .
a The effect of ADS operation on the main control room habitability system is insignificant since their operations are not related. The habitability system actuates on high radiation, which requires significant multiple failures of various safety-related passive systems to cause radiation levels that would actuate this system. Therefore, this system is not significantly ,
impacted by any other single passive, safety related system component, and is expected to only be a concern following a severe accident.
l For many interaction cases, the integral systems tests, Oregon State University and SPES-2 tests I (References 5 through 8) provide insight into the various systems interactions, and are cited where l appropriate.
2.3.1 Core Makeup Tanks 2.3.1.1. Core Makeup Tanks - Accumulators The core makeup tanks and accumulators are both designed as safety injection sources to maintain inventory for the reactor coolant system, but they have different safety injection functions, as discussed I in Section 6.3 of the AP600 Standard Safety Analysis Report (SSAR)(Reference 1). Their injection capabilities complement each other and they are designed to interact with each other since each core makeup tank shares a common direct vessel injection line with an accumulator. The general design philosophy for safety injection following an event is that the CMTs can inject at full RCS pressure, followed by the accumulators (at lower pressures), the IRWST (at very low pressures), and finally by ,
containment recirculation as the reactor coolant system depressurization continues and containment floodup progresses.
The CMTs, which are designed to provide safety injection to maintain RCS inventog at the existing RCS pressure, preclude the need for accumulators for most non-LOCA events except main steam line breaks, where the resulting cooldown of the reactor coolant system (RCS) reduces system pressure below the accumulator pressure. The accumulators are designed to provide rapid reflood and refilling of the reactor vessel following larger LOCA events.
fr.%Dw.,% d,-050497 REVistoN I
2-37 One specific interaction is relatively important in the design of these two components. The accumulator injection stalls CMT injection (as described below), which reduces the CMT injection water that is lost out the break early in the event when pressure is higher. This additional CMT water is then available after the accumulator injection ends, extending the duration of CMT injection and delaying the actuation of ADS depressurization. For non-LOCA events, ADS is not expected and, therefore, accumulator actuation is also not expected, except as noted above.
During the injection phase for LOCAs with a break size about 2 inches or greater, the accumulator injection flow stalls the CMT injection now due to the higher driving head available to the accumulators when the reactor coolant system pressure decreases significantly below the static
. I accumulator pressure. This phenomena can be seen in the analysis of an inadvertent ADS actuation provided in the AP600 SSAR. As discussed in SSAR subsection 15.6.5, CMT recirculation begins immediately upon actuation of the CMTs. Maximum CMT injection occurs approximately 500 seconds into the event, and slowly decreases until approximately 1000 seconds. During this time, the RCS pressure is slowly reduced to the operating pressure of the accumulators, and they begin to inject.
At approximately 1000 seconds, the second stage ADS valves are actuated, and the RCS pressure is significantly reduced. At this point, the accumulator flow is significantly increased, thus effectively shutting off CMT flow. This lasts until the accumulators empty, and CMT injection flow begins again
(~1300 seconds).
The potential benefits of this interaction were identified early in the system design process before the I
safety analyses were performed, and this interaction has been evaluated in the SSAR analyses provided in Chapter 15, and in the Oregon State University and SPES-2 tests. )
i l
The potentially adverse interaction between the accumulator nitrogen and the CMT is insignificant.
l Nitrogen cannot be discharged from the accumulators until the RCS is almost fully depressurized to l l less than about 100 psig. Accumulator nitrogen interactions are not important to CMT operation in this plant condition due to either the timing or volume of the nitrogen release. The Oregon State l l University and SPES-2 test results confirm this conclusion.
i l l \
, 1 Operator actions may be taken to isolate the accumulator (by closing the motor-operated discharge l l isolation valve) in Emergency Response Guideline AES-1.2, Post LOCA Cooldown and j j Depressurization (Reference 3), prior to reaching the accumulator discharge pressure during the RCS I l depressurization in Step 13, if the operator confirms that accumulator operation is not required based I on the existing plant conditions. This isolation prevents unnecessarily injecting the accumulators.
I However, there are no concerns with the associated nitrogen discharge if the accumulators do inject i into the RCS.
mA3577w.non:11w050497 REVislON 1
2 38 ,
\
a>
2.3.1.2 Core Makeup Tanks - In Containment Refueling Water Storage Tank i The core makeup tanks (CMTs) and IRWST are both designed as safety injection sources to maintain inventory for the reactor coolant system, but they have different safety injection functions, as discussed ,
in SSAR Section 6.3. Their injection capabilities complement each other and they are designed to interact with each other since each core makeup tank shares a common direct vessel injection line with one of the IRWST gravity.
1 The CMTs, which are designed to provide safety injection to maintain RCS inventory at the existmg RCS pressure, initiate the transition to IRWST gravity injection by actuating ADS as the CMT levels decrease. The IRWST is designed to provide a long. term injection source following reactor coolant . ;
system depressurization.
Although th6 CMTs share a common injection line with the IRWST, IRWST injection does not occur ,
until later in an event during or after the opening of the fourth stage ADS valves. This does not occur i until the CMTs are nearly empty. Depending on the event and the specific component failures that occurred, the timing and rate of the RCS depressurization will vary. For most LOCA events, there is [
not a significant amount of injection overlap between these two injection sources. Flow rates from these sources are relatively low, end interactions between these two components are not considered I significant. In the PRA (Reference 2) success cdteria analyses, the CMT is generally empty when the IRWST begins to inject.
The CMTs actuate ADS stages one to three, which discharge into the IRWST. ADS directly impacts IRWST conditions by adding heat to the IRWST inventory as the ADS discharge is quenched. The interactions between the ADS and the IRWST are discussed in subsection 2.3.3.3 of this report.
One specific interaction is relatively important in the design of these two components, but it is a valve actuation signal and not a process fluid interaction. The CMTs actuate the fourth stage ADS valves, and this same signal opens the IRWST injection isolation (explosive) valves. Valve actuation results in IRWST injection, reducing the IRWST water level, once RCS pressure has decreased sufficiently to imdate IRWST gravity injection.
Since there is little overlap between IRWST and CMT injection, the IRWST does not have any , ,
significant effect on the CMT from the perspective of process fluid interactions. .
2.3.1.3 Core Makeup Tanks - Containment Recirculation 8 The core makeup tanks (CMTs) and containment recirculation are both designed as safety injection sources to maintain inventory for the RCS, but they have different safety injection functions, as -
discussed in Section 6.3 of the SSAR. Their injection capabilities complement each other and they are designed to interact with each other since each CMT shares a common direct vessel injection line with one of the containment recirculation lines.
m \3577w.non:Ib-050497 REvlsloN 1 i
2-39 The CMTs, which are designed to provide safety injection to maintain RCS inventory at the exis i
RCS pressure, initiate the transition to IRWST gravity injection, and eventually containment recirculation, by actuating ADS as the CMT levels decrease. The containment recirculation is designed to provide a long-term injection source, in conjunction with the IRWST, following RCS depressurization.
Although the CMTs share a common injection line with containment recirculation, the latter does not
- ' occur until later in an event after the fourth stage ADS valves open and the IRWST is almost empty.
Typically, this does not occur until long after the CMTs are empty. Therefore, there are no periods of common injection flow expected, so there are no significant interactions between these two
- p. components. In the PRA success criteria analyses, the CMT is empty when containment recirculation l begins.
t The CMTs actuate the stage four ADS valves, which discharge into the containment loop compartments, and the resulting RCS mass loss can contribute to the containment floodup and recirculation inventory. 'Ihe interactions between the ADS and containment recirculation are discussed l
in subsection 2.3.4.2 of this report.
l 2.3.1.4 Core Makeup Tanks - Passive Residual Heat Removal Non LOCA Events During non-LOCA events, operation of the CMTs can degrade the performance of the PP.HR HX.
This occurs because the operation of the CMTs removes heat from the RCS, and cause the temperature in RCS hot leg to be reduced. Since the effectiveness of the PRHR HX heat removal is proportional l to the inlet temperature to the PRHR HX, the heat transfer capability of the PRHR HX is reduced and the RCS temperature is reduced. However, if CMT operation serves to remove heat from the RCS l during non-LOCA events, the required heat transfer from the PRHR HX is therefore reduced. This phenomena is presented in the SSAR Chapter 15 analysis of non-LOCA events. These analyses model the operation of the PRHR HX in conjunction with recirculating CMTs.
PRHR HX operation can result in CMT actuation by reducing RCS temperature during an event,
, which reduces the pressurizer water level. This is a beneficial interaction and for most significant plant events, when CMT actuation occurs, the PRHR HX is also actuated, and their operation complements one another as demonstrated in plant analysis and testing. PRHR HX operation also reduces the potential for RCS overfill following a spurious CMT actuation.
LOCA Events The interaction between these two components is considered as a secondary effect, which is not
The CMT injection flowpath is from the CMT into the direct vessel injection nozzle in the reactor mA3577w.non:lb05N97 REVistoN 1
_ _ . _ _ _ . _ . . _ . . _ . _ . _ . _ _ _ _ . _ _ ~
2-40 vessel, with balance flow back to the CMT through the cold leg pressure balance line. The PRHR HX heat removal flow path is from the reactor vessel, through the hot leg, through the PRHR HX piping l and heat exchanger piping, retuming to the reactor through the steam generator cold leg channel head and the cold leg.
The CMTs can indirectly impact PRHR HX heat removal capabilities in two ways following LOCA event.1 First, they provide cold makeup water to RCS, which maintains the reactor coolant system j j
' inven;ory; for LOCA events, the PRHR HX heat removal process, which is only significant prior to - ,
ADS actuation, may be either liquid phase heat conduction or steam condensation heat transfer, depending on the leak rate. For non-LOCA events with the exception of a main steam line break, the CMTs will provide sufficient water to keep the PRHR HX piping water-filled. Also, the CMTs initiate ADS stages one to three that discharge into the IRWST and increase IRWST water temperature; However, during LOCA events, once ADS actuates, the PRHR HX heat removal is small compared to ADS heat removal. Therefore, this CMT interaction with the PRHR HX is a secondary interaction which is not important.
l 2.3.1.5 Core Makeup Tanks / Accumulators - Automatic Depressurization System 1 >
l One important interaction for the CMTs is the actuation of the automatic depressurization system
! (ADS). Stage one is actuated after CMT level has decreased to a specific level set point and the stage
~
l four ADS valves actuate at a second level set point before the CMTs are empty.
l-The accumulators can indirectly impact ADS actuation, but not the ADS ability to depressurize the RCS, since the accumulators can temporarily delay the need for CMT injection, as described in subsection 2.3.1.1 of this report. This interaction is only important for LOCA events where the [
p accumulators provide injection flow..
L ADS actuation can affect CMTs and accumulators by opening the reactor coolant system (RCS) and
! removing RCS inventory, requiring safety injection from these two sources. Inventory removed '
through ADS stages one to three, except for steam that vents from the IRWST and water that flows out of the IRWST into the containment recirculation inventory, is retained in the IRWST and used to ;
provide IRWST gravity injection. After ADS stage four actuation, the steam that vents from this stage l
, ~is condensed on the containment shell and returns to the IRWST through the condensate return lines .
I for subsequent re-injection into the RCS.
l 1-l . As documented in Appendix A of the PRA, additional CMTs or accumulators do not adversely impact the ability of the ADS to depressurize the RCS and initiate IRWST gravity injection for the success criteria assumed. Sensitivity analyses vmying the number of CMTc =d accumulators credited in the :
accident scenarios show that the minimum tank availability produces the most limiting results. This conclusion is true for all ADS success criteria that are credited in the AP600 PRA.
t' l . mM577w.non:lt45N97 REVISloN 1
l l
l 2-41 I
23.1.6 Core Makeup Tanks - Passive Containment Cooling / Containment There are no direct interactions between the CMTs and the PCS. The PCS actuates on high containment pressure resulting following steam releases to containment from either breaks such as a LOCA or main steam line break and from IRWST steaming due to PRHR HX or ADS actuation. The CMTs indirectly affect PCS operation by actuating ADS discharge to the IRWST and to containment.
The ADS interaction with the PCS is discussed in subsection 23.5.2 of this report.
The PCS affects passive injection indirectly through control of containment pressure, which affects the RCS pressure and therefore, the ability of the passive RCS injection sources. However, containment steaming does not initiate until later in most events after either the IRWST temperature increases or the stage four ADS valves actuate. Therefore, the PCS impact on the CMTs is a relatively insignificant secondary interaction.
2.3.1.7 Core Makeup Tanks - Steam Generator System As discussed in Section 23 of this report, the focus of the CMT and SGS interactions is related to the effects on the integrity of the reactor coolant system pressure boundary. A break in the SGS secondary system pressure boundary can discharge steam to containment, but this interaction is not significant.
The CMTs do not directly interact with the SGS since CMT injection flow and pressure balance line flow does not pass through the steam generators. The CMTs provide safety injection flow to the RCS following a steam generator tube rupture (SGTR).
These design interactions have been confirmed as part of the testing and plant analyses.
23.1.8 Core Makeup Tanks - Main Control Room Habitability There are no significant interactions between the CMTs and the main control room habitability system.
23.1.9 Core Makeup Tanks - Reactor Coolant System 4
The core makeup tanks (CMTs) are designed as safety injection sources to maintain inventory for the RCS at the existing RCS pressure, as discussed in SSAR Section 63.
Spurious operation of the core makeup tanks can result in an adverse system interaction with the RCS. ,
Actuation of the CMTs when the RCS inventory is near normal results in CMT operation in a recirculation mode as described in Section 6.3 of the SSAR. The CMTs will inject cold borated water into the reactor coolant system that will heat and expand once it enters the RCS. The cold water in I the CMT is replaced by high temperature water from the RCS cold legs.
l i
m:\3577w.non:Ib-050497 REVISION 1
2-42 Spurious CMT actuation during full power operation results in a reactor trip and subsequent cooldown of the reactor coolant system. The effects of this transient are discussed in SSAR Chapter 15. In I addition. RCS design transients discussed in SSAR subsection 3.9.1 have been performed for the purposes of component design that bound the thermal transient on the primary components as a result of spurious CMT actuation. Therefore, the AP600 design has addressed this adverse system interaction.
2.3.2 Accumulators .
23.2.1 Accumulators -In. Containment Refueling Water Storage Tank The accumulators and IRWST are both designed as safety injection sources to maintain inventory for the RCS, but they have different safety injection functions, as discussed in SSAR Section 63 (Reference 1). Their injection capabilities complement each other and they are designed to interact with each other since eacle accumulator shares a common direct vessel injection line with one of the IRWST gravity injection lines.
The accumulators are designed to provide stuety injection to maintain RCS inventory when RCS pressure decreases below the static accumulator gas pressure. The accumulators function as an intermediate pressure safety injection source, with one of the more important functions to refill the reactor vessel and reflood the core following larger LOCAs.
Although the accumulators share a common injection line with IRWST, IRWST injection does not occur until hter in an event during or after the opening of the fourth stage ADS valves. The IRWST does not provide gravity injection until the RCS is completely depressurized and the accumulators are I empty. Therefore, there are no intervals of significant injection overlap between these two components so that sharing a common injection line does not result in any significant interactions.
For the same reason, the IRWST does not have any significant effect on the accumulator, from the perspective of process fluid interactions.
23.2.2 Accumulators - Containment Recirculation The accumulators and containment recirculation are both designed as safety injection sources to maintain inventory for the RCS, but they have different safety injection functions, as discussed in SSAR Section 63. Their injection capabilities complement each other and they are designed to interact with each other since each accumulator shares a common direct vessel injection line with one of the containment recirculation lines. The general design philosophy for safety injection following an event is that the CMTs inject first, followed by the accumulators, the IRWST, and finally by containment recirculation as the reactor coolant system depressurization continues and containment floodup progresses.
mA3577w.non:lb-o$o497 REVislON 1
2-43 The accumulators are designed to provide safety injection to maintain RCS inventory when RCS pressure decreases below the static accumulator gas pressure. The accumulators function a intermediate pressure safety injection source, with one of the more important functions to refil reactor vessel and reflood the core following larger LOCAs. The containment recirculation is to provide a long-term injection source, in conjunction with the IRWST, following RCS depressurization.
Although the accumulators share a common injection line with containment recirculation
~
does not occur until later in an event after the fourth stage ADS valves open and the IRWST is a empty. Containment recirculation does not occur until long after the accumulators are empty.
Therefore, there are no periods of common injection flow expected, so there are no significant interactions between these two components.
The accumulators can also directly contribute to water mass lost to containment during a LOCA indirectly after the water passes through the RCS and out the break, or directly into containmen during a DVI line break LOCA. However, this water may or may not be available for containm recirculation depending on the break location, since the accumulators are located in a compar containment that is not normally flooded. Inventory retained within the accumulator compartmen to a pipe break in that compartment will not be available for containment recirculation unle piping penetration seals in the compartment wall leak. The accumulator floodup interactio insignificant since the accumulator inventory contribution is insignificant, when compared t IRWST inventory.
Since there is no injection overlap between containment recirculation and accumulator injection, containment recirculation does not have an effect on the accumulator, from the perspective of pro fluid interactions.
23.23 Accumulators - Passive Residual Heat Removal Heat Exchanger The interaction between these two components is considered as a secondary effect, which is not significant, since accumulator injection flow does not directly interact with PRHR HX heat How. The accumulator injection flowpath is from the accumulator into the direct vessel injection nozzle in the reactor vessel. The PRHR HX heat removal flow path is from the reactor vessel, through the hot leg, through the PRHR HX piping and heat exchanger piping, returning to the through the steam generator cold leg channel head and the cold leg.
The accumulators also indirectly impact the PRHR HX beat removal capabilities through the impac on RCS inventory following LOCA event. The accumulators provide cold makeup water to the which subcools the core and maintains the reactor coolant system inventory. However, when accumulator injection occurs following a LOCA, the RCS has significant voiding and PRHR HX operation is in a steam-condensation mode. Since the accumulator injection does not f HX, the accumulator operation does not impact PRHR HX operation. In addition, once ADS a REvlSloN l m:\3577w non:lb-050497
2-44 occurs, the PRHR HX contribution to heat removal is nat important. Therefore, the accumulator interaction with PRHR HX is a secondary interaction which is not important.
' PRHR HX operation can result in RCS cooling and the resulting coolant contraction reduces RCS pressure and pressurizer level. But PRHR HX operation by itself is not expected to initiate accumulator injection. In general, the PRHR HX impact on accumulator operation is a secondary interaction that is not significant.
- The adverse interaction between the accumulator nitrogen and the PRHR HX is insignificant.
- Nitrogen cannot be discharged from the accumulators until the RCS is almost fully depressurized to less than about 100 psig. This is only expected for events where ADS operation is also expected and .
' PRHR HX operation is not required for heat removal. Therefore, the accumulator nitrogen interactions are not important to PRHR HX operation in this plant condition. The Oregon State University and SPES-2 test results support this conclusion.
2.3.2.4 Accumulators - Passive Containment Cooling / Containment There are no direct interactions between the accumulators and the PCS. The PCS actuates on high containment pressure resulting following steam releases to containment from either breaks such as a -
LOCA or main steam line break and from IRWST steaming due to PRHR HX or ADS actuation. The accumulators provide RCS injection for larger LOCAs and in conjunction with ADS actuation for other LOCAs. For these events, the accumulators indirectly affect PCS operation since they help to
]
maintain the RCS inventory and some of the accumulator volume can contribute to containment l steaming. However, this is a secondary effect that is not significant.
The PCS affects passive injection indirectly through control of containment pressure, which affects the RCS pressure and, therefore, the ability of the passive RCS injection sources. However, containment steaming does not initiate until later in most events after either the IRWST temperature increases or the stage four ADS valves actuate. For events that depressurize the RCS very rapidly, the accumulator injection is complete before the PCS operation has any significant impact on containment conditions.
Therefore, the PCS impact on the accumulators is a relatively insignificant secondary interaction.
- 2.3.2.5 Accumulators - Steam Generator System ,
As discussed in Section 2.3 of this document, the focus of the accumulator and SGS interactions is related to the effects on the integrity of the reactor coolant system pressure boundary. A break in the SGS secondary system pressure boundary can discharge steam to containment, but this interaction in not significant.
The accumulato'rs do not directly interact with the SGS since accumulator injection flow does not pass
- l. through the steam generators. Accumulator injection is not expected following an SGTR, and l
mA3577w.non:ltw05o497 REVistoN 1
l 2-45 1
accumulator injection can not cause steam generator overfill since they do not inject until RCS l pressure is much lower than steam generator pressure. Therefore, this is not a significant interaction.
The SG is not expected to initiate accumulator injection following a steam generator tube rupture since the RCS will not lose sufficient inventory to depressurize to accumulator static pressure and ADS is
! not expected to be actuated. Therefore, this is not an important interaction. However, the initiation of accumulator injection following any decrease in RCS inventory is a beneficial design interaction.
1
~
l Oscillatory behavior noted between these systems during the AP600 testing does not result in any I significant adverse interactions since the oscillations are damped, satisfactory core cooling is
. I maintained, and core uncovery is prevented.
2.3.2.6 Accumulators - Main Control Room Habitability )
l There are no significant interactions between the accumulators and the main control room habitability ;
system.
2.3.2.7 Accumulators - Reactor Coolant System The accumulators are designed to provide safety injection to maintain RCS inventory when RCS j I
pressure decreases below the static accumulator gas pressure, as' discussed in Section 6.3 of the SSAR.
The general design philosophy for safety injection following an event is that the CMTs inject first, l followed by the accumulators, the IRWST, and finally by containment recirculation as the RCS depressurization continues and containment floodup progresses. The accumulators function as an ;
intermediate pressure safety injection source, with one of the more important functions to refill the reactor vessel and reflood the core following larger LOCAs.
The RCS pressure determines accumulator injection. Once the RCS pressure decreases below static accumulator pressure, the discharge check valves open and accumulator injection initiates. The rate of accumulator injection is based on the change in RCS pressure. This important design interaction has been confirmed as part of the testing and plant analyses. j 1
i
. The adverse interaction between the accumulator nitrogen and the RCS is not significant. Nitrogen cannot be discharged from the accumulators until the RCS is almost fully depressurized to less than about 100 psig. This is only expected for events where a larger LOCA has occurred or where ADS l
actuation occurs, resulting in RCS depressurization. The accumulator nitrogen interactions are not important to RCS operation in this plant condition. The Oregon State University and SPES-2 test j i results support this conclusion.
l l l Operator actions may be taken to isolate the accumulator (by closing the motor-operated discharge
! ! isolation valve)in Emergency Response Guideline AES-1.2, Post LOCA Cooldown and l l Depressurization, prior to reaching the accumulator discharge pressure during the RCS depressurization mA3577w.non:lb-05M97 REVISION 1
._ ~. __ . - . . _ __ __
2-46 i
l
. l l in Step 13, if the operator confirms that accumulator operation is not required based on the existing I plant conditions. This isolation prevents unnecessarily injecting the accumulators. However, there are I no concerns with the associated nitrogen discharge if the accumulators do inject into the RCS.
2.3.3 In Containment Refueling Water Storage Tank 2.3.3.1 In-Containment Refueling Water Storage Tank - Containment Recirculation The IRWST and containment recirculation are both designed as long-term safety injection sources to maintain inventory for the RCS, but they have different safety injection functions, as discussed in SSAR Section 6.3. Their injection capabilities complement each other and they are designed to . 4 interact with each other, since each IRWST gravity injection line shares a common direct vessel injection line with one of the containment recirculation lines. The IRWST and containment recirculation also interact because the containment recirculation isolation valves are automatically opened on low IRWST level signals. The general design philosophy for safety injection following an event is that the CMTs inject first, fc!! owed by the accumulators, the IRWST, and finally by containment recirculation as the RCS depressurization continues and containment floodup progresses.
l The design interactions have been confirmed as part of the integral systems testing (References 5 I through 8) and plant analyses (Reference 1).
The IRWST is designed to provide safety injection to maintain RCS inventory later in an event, after the RCS has been depressurized. This normally does not occur until after the fourth stage ADS valves are open. Containment recirculation is also designed to provide long-term RCS injection. As the IRWST becomes nearly empty, the containment has flooded up sufficiently to provide recirculation flow, and the RCS is depressurized. These two injection sources complement each other to provide continuous long-term injection.
The interaction of these two components is important to long. term RCS injection. The IRWST provides the initial gravity injection following RCS depressurization. Once the low IRWST level actuation signal opens the containment recirculation isolation valves, containment recirculation initiates in parallel with injection of the remaining IRWST inventory, the IRWST establishes an equilibrium injection head with the containment recirculation inventory, based on the injection line flow resistance from the two sources. There is the potential for water flow between the two sources to establish and .
maintain this equilibrium, once containment recirculation is actuated.
Both the IRWST and the containment recirculation areas are exposed to the same containment overpressure. As the IRWST water temperature increases due to PRHR HX or ADS actuation, steaming to containment from the IRWST is possible, which could cause a small increase in the pressure due to the steam venting through the air space above the IRWST, but this is not significant.
With significant steaming to containment following a LOCA or a main steam line break, the PCS actuates and the condensate that collects on the containment vessel shell is retumed to the IRWST. If mA3577w.non:Ib oSN97 REvIS10N 1
2-47 the condensate return valves remain open instead of failing closed, the condensate return flows directly to the containment recirculation areas.- However, after containment recirculation actuation, the IRWST is connected to the containment recirculation areas through the shared injection lines and the [
condensate return is shared between these two components.
The IRWST can also directly impact containment recirculation following a DVI line break. In this case, the IRWST provides injection through the intt < ~ ,ection line and drains directly to containment through the broken line, increasing the containment floodup rate and decreasing the time until containment recirculation is actuated. At the same time, the IRWST provides gravity injection through the intact injection line, where LOCA break flow and ADS fourth stage discharge flow increases the
. containment recirculation inventory.
Therefore, the overall interaction between the IRWST and containment recirculation is very important,
- as shown by the testing and plant analyses, and the two injection sources work closely together to l provide continuous long-term RCS injection. j l
i l An adverse interaction can occur due to spurious opening of the containment recirculation isolation valves. This occurs if the line with the motor-operated valve and explosive valve is opened and the j i- IRWST starts to gravity drain to containment, causing floodup of containment. This event does not result in any plant transient, but it does have some adverse effects if the IRWST is allowed to drain significantly. The spurious opening of these valves is prevented by the instrumentation and control design. The response to spurious opening of the containment recirculation isolation valves is to j confirm that the actuation is spurious and then to take operator actions to close the motor-operated j valve. This is not a significant interaction since it does not cause a plant transient and there is sufficient time, alarms, and indications to allow the operators to diagnose the problem and take the corrective actions required.
I Oscillatory behavior noted between these systems during the AP600 testing does not result in any I significant adverse interactions since the oscillations are damped, satisfactory core cooling is I maintained, and core uncovery is prevented.
2.3.3.2 In Containment Refueling Water Storage Tank - Passive ResMual Heat Removal Heat Exchanger i t
1 i The interaction between the IRWST and PRHR HX is important for non-LOCA events where the j PRHR HX provides the primary heat removal mechanism for the RCS, as shown in the testing and
! plant analyses. The IRWST provides the heat sink for the PRHR HX, with IRWST level and water l l temperature significantly impacting the PRHR HX heat transfer capability. The design interactions j l have been confirmed as part of the integral systems testing (References 5 through 8) and plant
{ l analyses (Reference 1).
l.
A N N.Mk
...r., , - . . -, . . - - ._ y.
2-48 Initially following PRHR HX actuation, the IRWST maintains the PRHR HX completely covered with water, and the IRWST water temperature is expected to be relatively cold (close to the containment ambient temperature). Following PRHR HX actuation, the IRWST temperature increases and after the containment saturation temperature is reached, the IRWST begins to steam to containment. The containment pressure determines the limit.ng IRWST water temperature, within a relatively small
. temperature range.
For events such as LOCA or other events where ADS actuates, the interaction between the IRWST and PRHP HX is only significant early in the event prior to ADS actuation when PRHR HX operation is providmc the primary heat removal mechanism. For larger LOCAs where the break provides significant heat removal, PRHR HX heat removal is generally not expected to be important when .
j compared r. > heat removal from the break and from ADS, and the interactions between the IRWST and PRHR HX are not important for these events.
For very small LOCAs (0.5 inch or less), PRHR HX operation will heat the IRWST up to saturation temperature prior to ADS actuation. ADS operation at this time will then add energy to a saturated IRWST, which limits the steam condensation capability. This PRHR HX operation results in significant enting of steam from the IRWST.
The important difference between PRHR HX heating and ADS heating of the IRWST is that the PRHR HX heats the entire tank depth, while the ADS discharges heat to the upper part of the IRWST, at and above the ADS sparger elevation. In addition, the ADS spargers and the PRHR HX are located on opposite ends of the IRWST. ADS tank heating generally results in subcooled IRWST gravity injection, followed by saturated injection flow. For non-LOCA events, PRHR HX heating of the
. IRWST is not expected to be followed by gravity injection i,ince ADS actuation is not expected. But ated gravity injection can occur for events such as a small break LOCA, where PRHR HX heating initiates shortly after the event, followed eventually by ADS actuation and the initial gravity injection . j flow is much hotter. The difference in ir.jection temperature has no significant effect on gravity '
injection capability, but subcooled injection flow has a quenching effect in the core region.
2.333 In Containment Refueling Water Storage Tank - Automatic Depressurization System
- j
)
I The ADS valves are designed to provide a controlled RCS depressurization when safety injection from ,
the accumulators, IRWST, and containment recirculation is needed. The ADS stage one to three valves that connect to the top of pressurizer steam space discharge two-phase flow into the IRWST through the spargers that are located about ten feet below the normal IRWST water surface. The j purpose of this arrangement is for the IRWST to condense the ADS steam diccharge and collect the condensate for return to the RCS, once the RCS is depressurized and gravity injection flow is initiated.
- This arrangement also minimizes the potential for discharging steam to containment following ADS I actuation. The design interactions have been confirmed as part of the integral systems testing l (References 5 through 8) and plant analyses (Reference 1).
4 i
P i
j m \3577w.non:ltroSO497 REVislON 1
2-49
'Ihe IRWST water temperature controls the capability of the IRWST to condense the ADS steam discharge ' Once the IRWST water heats up and reaches saturation temperature for the existin
. containment pressure, the ADS steam discharge passes up through the water without condensi discharges directly to the containment atmosphere.
- The IRWST water level and temperature also control the backpressure on ADS stages I to 3, which affects the discharge flow rate. The backpressure is not significant for the early stages of an ADS discharge. However, it becomes more important late in the depressurization process, when RCS pressure is nearly equal to the containment pressure. At very low RCS pressures, the IRWST wate backpressure can significantly reduce the stage one to three ADS discharge flow. The long-term
- l. l
. backpressure contribution from IRWST level can be reduced by several important processes: ,
occur sooner.
l .
'
l
- Condensate return from the containment shell maintains th; $WST level.
= Gravity injection slowly drains the IRWST. ,
The IRWST water can be heated by both the PRHR HX and the ADS discharge, as discussed in subsection 2.3.3.2 of this report. The important difference between PRHR HX heating and ADS heating of the IRWST is that the PRHR HX heats the entire tank depth, while ADS discharges heat to the upper part of the IRWST, at and above the ADS sparger elevation. In addition, the ADS spargers and the PRHR HX are located on opposite ends of the IRWST.
ADS heating of the IRWST generally results in a transition from subcooled IRWST gravity injection to saturated injection flow, once the subcooled layer below the ADS sparger is injected. For non-LOCA events, PRHR HX heating of the IRWST is not expected to be followed by gravity injection M since ADS actuation is not expected. But heated gravity injection can also occur without ADS heating of the IRWST for events such as a small break LOCA. In this case, PRHR HX heating initiates shortly after the event, followed eventually by ADS actuation and the initial gravity injection flow is much hotter since there is not a subcooled layer that injects first. The difference in injection temperature has no significant effect on gravity injection capability, but subcooled injection flow has a quenching effect in the core region.
l l Oscillatory behavior noted between these systems during the AP600 testing does not result in any ,
I significant adverse interactions since the oscillations are damped, satisfactory core coaling is I maintained, and core uncovery is prevented.
mA3577w.non:lb-050497 REVISloN !
2-50 1
2.3.3.4 IRWST - Passive Containment Cooling /Containmen : 1
'The PCS actuates on high containment pressure resulting for. awing steam releases to cont!
either breaks such as a LOCA or main steam line bre.c and from IRWST steaming due to PRHR HX I l or ADS actuation. The IRWST water level and temperature control the amount of steaming to containment, for both ADS discharges and PRHR HX operation. De rate of steaming to containment determines when PCS is actuated. The impact of IRWST conditions on PCS actuation is most important for non-LOCA events and for smaller LOCAs. The IRWST has insignificant impact on PCS actuation for larger LOCAs and main steam line breaks inside containment, since the break flow ~
rapidly pressurizes containment, regardless of IRWST conditions.
The IRWST configuration also has some effect on the steam venting to containment, since steam must pass through the IRWST vents. The IRWST vents are designed to prevent pressurization of the i
IRWST, so this interaction is not significant to the steam venting process.
PCS operation controls the pressure in containment by the condensation of steam from the containment atmosphere. This interaction affects the resulting containment floodup liquid temperatures, the IRWST j
! saturation temperature reached following PRHR HX or ADS heating. The condensate retum
{
! temperature from the containment shell and the RCS temperatures. However, the range of IRWST and !
containment recirculation water temperature enanges are relatively small. I PCS operation also affects IRWST inventory since the condensation on the containment shell provides !
condensate return to either the IRWST or the containment recirculation areas, depending upon the i status of the condensate return isolation valves.
i I ' The design imeractions have been confirmed as part of the integral systems testing (References 5 l- through 8) and plant analyses (Reference 1).
2.3.3.5 In. Containment Refueling Water Storage Tank - Steam Generator System l
L As discussed in Section 2.3 of this document, the focus of the IRWST and SGS interactions is related "
to the effects on the integrity of the reactor coolant system pressure boundary. A br-ak in the SGS secondary system pressure boundary can discharge steam to containment,' which restdm m an increase ,
in containment pressure and condensate retum to the IRWST similar to the interaction effects discussed in subsection 2.3.3.4 of this report.
The IRWST does not directly interact with the SGS since IRWST gravity injection flow does not pass through the steam generators. De IRWST is designed to provide safety injection to maintain RCS
, inventory later in an event, after the RCS has been depressurized. This normally does not occur until I - after the fourth stage ADS valves are open, except for larger LOCA events. Therefore, IRWST j injection is not expected following a steam generator tube rupture since ADS does not occur.
i mA3577w.non.ltW50497 REVislON 1
_ _ _ . _ _ _ . . _ _ . _ ~ _ _ . _
2-51 i . The design interactions have been confirmed as part of the integral systems testing (References 5 I . through 8) and p' ant analyses (Reference 1).
233.6 In.Containmen Refueling W/.ter Storage Tank - Main Control Room Habitability There are no significant iciteracticas h: tween the IRWST and the main control room habitability ,
system.
P
'233.7 In-Containment Refueling Water Storage Tank - Reactor Coolant System
. The IRWST is designed as a long-term safety injection source to maintain inventory for the RCS, as discussed in Section 63 of the AP600 SSAR. The general design philosophy for safety injection following an event is that the CMTs inject first, followed by the accumulators, the IRWST and finally by containment recirculation as the RCS depressurization continues and containment floodup '
progresses. The important design interactions have been confirmed as part of the testing and plant analyses.
The IRWST is designed to provide sufficient gravity injection flow to keep the core covered and to remove core decay heat,in conjunction with ADS venting. The IRWST maintains the RCS inventory ,
at lower levels within the RCS than exist during power operation, since the fourth stage valve elevations and the gravity injectica head elevations limit the amount that the RCS can be filled.
The IRWST does not provide gravity injection until after the fourth stage ADS valves are open. Two- l phase flow is primarily discharged out through the fourth stage ADS valves late in an event when IRWST gravity injection initiates. When gravity injection first initiates, the highest expected IRWST +
5 water level is at about the 128-foot elevation. 'Ihe hot leg centerline elevation is at about the 101-foot elevation, and the fourth stage ADS valves discharge at about the 112-foot elevation.
The RCS affects IRWST level since the gravity injection flow depends on the existing RCS pressure.
In addition, the RCS affects the IRWST temperature conditions through heat additions from both PRHR HX and ADS operation. The specific interactions are discussed in subsections 233.2 and 233.3 of this report, respectively.
I Oscillatory behavior noted between these systems during the AP600 testing does not result in any l significant adverse interactions since the oscillations are damped, satisfactory core cooling is I maintained, and core uncovery is prevented.
m\3577w.non:Ib-02897 Revision 1
2-52' 2.3.4 Containtnent Recirculation 2.3.4.1 Containment Recirculation - Passive Residual Heat Removal Heat Exchanger The interaction between these two components is not significant since containment recirculation flow does not interact with PRHR HX heat removal flow.
PRHR HX heat removal occurs either for non-LOCA events or early in smaller LOCA events before the initiation of ADS. After the RCS is depressurized, PRHR HX heat removal is not imponant.
- Containment recirculation does not occur until the RCS is fully depressurized, RCS temperatures are ,
relatively close to the IRWST temperatures, the PRHR HX is voided, the IRWST is essentially ,
drained, and the PRHR HX is mostly uncovered. .
Therefore, when PRHR HX operation occurs, containment recirculation cannot occur because the RCS pressure is too high and when containment recirculation initiates, the PRHR HX is unable to provide decay heat removal.
I An adves Weraction can occur due to spurious opening of the containment recirculation isolation I valves. This occurs if the line with the motor-operated valve and explosive valve is opened and the i IRWST starts to gravity drain to containment, causing floodup of containment. His event does not I result in any plant transient, but it does have some adverse effects if the IRWST is allowed to drain l significantly. The spurious opening of these valves is prevented by the instrumentation and control L l design. He response to spurious opening of the containment recirculation isolation valves is to I confirm that the actuation is spurious and then to take operator actions to close the motor-operated l l valve. This is not a significant interaction since it does not cause a plant tratisient and there is
-l sufficient time, alarms, and indications to allow the operators to diagnose the problem and take the I corrective actions required. In addition, it the motor-operated isolation valve spuriously opened to I initiate draining, it is expected that it would again function properly to close and terminate the IRWST l flow.
PRHR HX operation does not significantly impact containment recirculation. PRHR HX operation can reduce RCS pressure and temperature and, therefore, somewhat affect the time that it takes to reach containment recirculation. However, RCS d: pressurization following a larger LOCA or ADS ,
operation is required to initiate containment recirculation and the resulting recirculation temperatures are a result of the containment saturation conditions and not significantly impacted by PRHR HX operation.
2.3.4.2 Containment Recirculation - Automatic Depressurization System The ADS valves are designed to previde a controlled RCS depressurization when safety injection from r the accumulators, IRWST, and containment recirculation is needed. Therefore, ADS operation is very important to containment recirculation.
mA3577w.non:Ib-050497 REVISION I l
2-53 l:
l De ADS stage four valves connected to the top of the RCS hot legs discharge two-phase flow directly to containment inside the RCS loop compartments, at an elevation above the normally flooded areas l used for containment recirculation. The purpose of this arrangement is to have the minimal ADS backpressure at the completion of the RCS depressurization. He steam from the fourth stage ADS l discharge condenses on the containment shell and returns to either the IRWST or the containment -
recirculation areas, depending upon the status of the IRWST condensate return isolation valves.
i.
l The containment recirculation inventory has no impact on the ADS discharge flow, from the I
perspective of affecting outlet conditions. The fourth stage ADS valves discharge above the maximum j containment floodup elevation. De containment recirculation area floodup elevation and the IRWST
! . . water surface elevations are interrelated following recirculation actuation since these volumes are cross-connected through the common ravity injection lines. However, the IRWST elevations at this time are well below the ADS Stage one to three sparger elevation and the sparger is uncovered.
l Therefore, the containment recirculation has no effect on the ADS discharge backpressure.
l The containment recirculation inventory does have an indirect impact on the generation of the ADS
( flow within the RCS. Recirculation provides the long-term injection that maintains the RCS inventory and that subsequently is needed to generate the ADS discharge flow. However, without recirculation, l ADS flow would still continue until the available RCS inventory was depleted and core uncovery l occurred. !
l; a l l Oscillatory behavior noted between these systems during the AP600 testing does not result in any I
I significant adverse interactions since the oscillations are damped, satisfactory core cooling is
- I maintained, and core uncovery is prevented.
l The design interactions have been confirmed as part of the integral systems testing (References 5 l l through 8) and plant analyses (Reference 1).
2.3.4.3 Containment Recirculation - Passive Containment Cooling / Containment l
Containment recirculation has no significant impact on the actuation of the PCS. The PCS actuates on l
high containment pressure resulting from steam releases to containment from breaks such as a LOCA s or main steam line break, and from IRWST steaming due to PRHR HX or ADS actuation. The containment recirculation floodup elevation does not get high enough to affect the discharge of any of i the ADS stages by providing a backpressure on the ADS discharge, and the containment recirculation temperatures are at saturation for containment pressure, so that the recirculation inventory could not condense the ADS steam discharge.
Containment recirculation does indirectly impact continuing PCS operation in that it indirectly impacts the generation of the ADS flow within the RCS. Recirculation provides the lo .g-term injection that
(
maintains the RCS inventory and that subsequently is needed to generate the ADS discharge flow.
I nt\3577wmn:lb.050497 REVISION 1
. -a - .. . . . - - , . , , ..- .. -- .-
i 2-54 However, without recirculation, ADS flow would still continue until the available RCS iinventory were depleted and core uncovery occurred.
PCS operation controls the pressure in containment by the condensation of steam from the containment atmosphere. .This interaction affects the resulting containment floodup liquid temperatures, the IRWST ,
saturation temperature reached following PRHR HX or ADS heating. The condensate return !
temperature from the containment shell, and, indirectly, the RCS temperatures. However, the range of 'l IRWST and containment recirculation water temperature changes are relatively small.
PCS operation also results in condensation on the containment shell, which provides the condensate ,
return that either passes directly to the containment recirculation inventory or indirectly to both the ,
IRWST and containment recirculation inventories, depending upon the status of the condensate return isolation valves.
l The design interactions have been confirmed as part of the integnj systems testing (References 5 l through 8) and plant analyses (Reference 1).
2.3.4.4 ' Containment Recirculation - Steam Generator System As discussed in Section 2.3 of this document, the focus of the containment recirculation and SGS interactions is related to the effects on the integrity of the reactor coolant system pressure boundary.
' A break in the SGS secondary system pressure boundary can discharge steam to containment, which results in an increase in contaiament pressure and condensate retum to the containment recirculation area, similar to the interaction effects discussed in subsection 2.3.4.3 of this report.
Containment recirculation does not directly interact with the SGS since recirculation flow does not i pass through the steam generators. Containment recirculation is designed to provide safety injection to maintain RCS inventory later in an event, after the RCS has been depressurized. This normally does not occur until after the fourth stage ADS valves are open, except for larger LOCA events. '
Containment recirculation is not expected following a steam generator tube rupture since ADS does ,
not occur. If the RCS is subsequently depressurized following a steam generator tube rupture to facilitate repairs, the containment recirculation can not cause steam generator overfill. Therefore, this is not a significant interaction. ,
1 The design interactions have been confirmed as part of the integral systems testing (References 5 l through 8) and plant analyses (Reference 1).-
2.3.4.5 Containment Recirculation - Main Control Room Habitability There are no significant interactions between containment recirculation and the main control room habitability system.
mA3577w.non:lb-oSN97 REVIS10N 1
l 2-55 2.3.4.6 Containment Recirculation - Reactor Coolant System Containment recirculation is designed as a long-term safety injection source to maintain inventory fo the RCS, as discussed in Section 6.3 of the SSAR. The general design philosoph, for safety injection following an event is that the CMTs inject first, followed by the accumulators, the IRWST, and fi by containment recirculation as the RCS depressurization continues and containment floodup i
progresses.
- Centainment recirculation is designed to provide sufficient gravity injection flow to keep the core covered and to remove core decay heat,in conjunction with ADS venting. Containment recirculation maintains the RCS inventory at lower levels within the RCS than those that exist during power operation, since the fourth stage valve elevations and the gravity injection head elevations limit amount that the RCS can be filled. Containment recirculation does not provide gravity injection until after the fourth stage ADS valves are open. Two-phase flow is primarily discharged out through the fourth stage ADS valves late in an event when containment recirculation initiates.
The maximum containment floodup elevation is to about the 107-foot elevvion. When containment recirculation initiates, the highest expected IRWST water level is at about the,107-foot elevation and the IRWST will establish equilibnum levels with the containment floodup inventory, which varies slightly based on the specific event. The hot leg centerline elevation is at about the 101-foot e and the fourth stage ADS valves discharge at about the 112-foot elevation.
The RCS affects containment recirculation floodup level since the gravity injection flow depends on the existirig RCS pressure.
I Oscillatory behavior noted between these systems during the AP600 testing does not result in any I significant adverse interactions since the oscillaticns are damped, satisfactory core cooling is I maintained, and core uncovery is prevented.
l The design interactions have been confirmed as part of the integral systems testing (References 5 l through 8) and plant analyses (Reference 1).
2.3.5 Passive Residual Heat Removal Heat Exchanger 2.3.5.1 Passive Residual lleat Removal Heat Exchanger - Automatic Depressurization System There are several important design interactions between the PRHR HX and ADS. First, both components use the IRWST as a heat sink, as described in subsections 2.3.3.2 and 2.3.3.3 of thi report.
In addition, both components are connected to the RCS, and the PRHR HX inlet piping shares a common section of piping with the fourth stage ADS valves connected to that RCS hot leg. PRHR l HX cooling prior to ADS operation can also impact the initial RCS pressure when ADS actuates. l The l
l REVislON 1 mA3577w.non:1b.05N97
2 56 I
l I
design interactions have been confirmed as part of the integral systems testing (R
- 8) and plant analyses (Reference 1;.
When PRHR HX actuates, the IRWST temperature will increase and depending upon the d the PRHR HX operation, some IRWST inventory may be lost due to steaming. These two eff to reduce the backpressure for ADS stages one to three, which is not significant in the early the depressurization, but affects flow through these stages more toward the end of the depr process when RCS pressures are low. However, this is not a significant effect since the fourth ADS valves provide the most significant venting contribution at the end of the RCS depressuriz * '
i PRHR HX operation also tends to heat the IRWST closer to saturation temperatures, which allows, the; ADS discharge to vent from the IRWST without being condensed. This effect does not signific impact ADS performance, but as discussed in subsection 2.3.3.4 herein, it does contribute to earlier PCS actuation.
The heating of the IRWST from ADS operation is not significant to the PRHR HX because for those i
events that initiate ADS depressurization, the primary heat removal occurs due to ADS venting, along I with any break flow that may exist for LOCA events, and PRHR HX heat removal is not important.
Although the PRHR HX and one of the fourth stage ADS valve groups share a common section of piping, this is not significant since the ADS and PRHR HX are not simultaneously required to operate.
PRHR HX heat removal is on!y important prior to ADS actuation; when fourth stage ADS actuates, the RCS is significantly voided and at temperature and pressure conditions where the PRHR HX is not important to heat removal. !
2.3.5.2 Passive Residual Heat Removal Heat Exchanger - Passive Containment Cooling / Containment l
There are no direct interactions between these two components. PRHR HX operation indirectly affects the PCS through the PRHR HX heating of the IRWST. The PCS impacts PRHR HX operation by l controlling the saturation temperature that the IRWST can reach during an event. The interactions
l 2.3.5.3 Pa.ssive Residual Heat Removal Heat Exchanger - Steam Generator System As discussed in Section 2.3 cf this document, the focus of the PRHR HX and SGS interactions is related to the effects on the integrity of the RCS pressure boundary. A break in the SGS secondary system pressure boundary can discharge steam to containment, which results in an increase in containment pressure and condensate return that indirectly affect the PRH.R HX through IRWST interactions discussed in subsection 2.3.3.4 cf this report.
4
[
mA3577w.non:lb-oSO497 REVISION l
I
\
l 2 57 The PRHR HX does not directly interact with the SGS since PRHR HX flow does not pass through the steam generators. However, PRHR HX affects the SGS through changes in the RCS due to PRHR HX cooldown and depressurization of the RCS. The PRHR HX provides decay heat removal for non-LOCA events, including a steam generator tube rupture, by transferring the core decay heat to the IRWST. PPHR HX actuation is very important following a steam generew tube rupture (SGTR) j since it; op :; ion reduces RCS temperature and pressure, which helps prevent steam generator overfill l and precludes the need for ADS actuation to mitigate this event.
~
l
-l Oscillatory behavior noted between these systems during the AP600 testing does not result in any I significant adverse interactions since the oscillations are damped, satisfactory core cooling is
- , I maintained, and core uncovery is prevented.
I I The design interactions have been confirmed as part of the integral systems testing (References 5 l through 8) and plant analyses (Reference 1).
2.3.5.4 Passive Residual Heat Removal Heat Exchanger - Main Control Room Habitability There are no significant interactions between the PRHR HX and the main control room habitability system.
2.3.5.5 Passive Residual Heat Removal Heat Exchanger - Reactor Coolant System The PRHR HX is designed as the primary heat removal mechanism for non-LOCA events.
The PRHR HX is actuated when the normal heat removal systems are unavailable. RCS integrity and Guid conditions affect the PRHR HX operation. PRHR HX actuation with the reactor coolant pumps operating provides the most effective single-phase heat removal. However, PRHR HX operation with natural circulation now can effectively remove core decay heat. As the RCS cools down and contracts, RCS voiding may occur, which can eventually change the PRHR HX heat transfer process to steam condensation heat transfer that increases the PRHR HX heat removal effectiveness. As the RCS temperatures continue to decrease and the IRWST water temperatures increase, the PRHR HX heat transfer capability decreases. )
For events that result in extensive RCS voiding and subsequent ADS actuation, such as a LOCA, the PRHR HX heat removal is not important following ADS actuation. I Spurious actuation of the PRHR HX results in an adverse system interaction with the RCS. Spurious actuation of the PRHR HX during power operation will result in a reactor power increase due to cooling of the reactor coolant that passes through the PRHR HX. The effects of this transient are discussed in SSAR Chapter 15. In addition, design analyses have been performed for the purposes of component design that bound the thermal transient on the primary components as a result of spurious mA357)w.non:Ib-050497 REVISION 1 l 1
2 58 PRHR actuation. Therefore, the AP600 design has addressed this potential adverse systems interaction.
l l
l There are no significant adverse interactions from stratification effects on the RCS when PRHR HX is I operating. As discussed in Section 3.9 of the AP600 SSAR (Reference 1), the stress analyses for the l RCS loop piping and components include consideration for the thermal stratification resulting from i PRHR HX operation.
l The design interactions have been confirmed as part of the integral systems testing (References 5 l l through 8) and plant analyses (Reference 1).
l 2.3.6 Automatic Depressurization System 2.3.6.1 Automatic Depressurization System - Passive Containment Cooling / Containment The ADS valves are designed to provide a controlled RCS depressurization when safety injection from the accumulators, IRWST, and containment recirculation is needed.
The ADS stage one to three valves, which connect to the top of pressurizer steam space, discharge two-phase flow into the IRWST through the spargers that are located about 10 feet below the normal IRWST water surface. The purpose of this arrangement is for the IRWST to condense the ADS steam discharge and collect the condensate for retum to the RCS, once the RCS is depressurized and gravity injection flow is initiated.
The ADS stage four valves, which connect to the top of the RCS hot legs, discharge two-phase flow directly to containment inside the RCS loop compartments, at an elevation above the normally flooded J areas used for containment recirculation. The purpose of this arrangement is to have the minimal ADS backpressure at the completion of the RCS depressurization. The steam from the fourth stage ADS discharge condenses on the containment shell and returns to either the IRWST or the containment recirculation areas, depending upon the status of the IRWST condensate return isolation valves.
This ADS arrangement minimizes the potential for discharging steam to containment during tae early pr.rt of the RCS depressurization using ADS, and then enhances ADS performance when the RCS is ,
nearly depressurized.
l Therefore, ADS contributes to containment pressurization and PCS actuation through two flow paths.
During the ADS stage one to three depressurization, the ADS discharges to the IRWST and contributes to PCS actuation. once the IRWST heaa up to saturation, as desenbed in subsection 2.3.3.4 of this report.
During the ADS stage four actuation, ADS directly discharges steam to containment. By the time the fourth stage ADS valves are opened following ADS actuation during LOCA events, it is expected that PCS will already be operating.
! I mA3577w.non:lb-0$o497 REVISION 1
l 2-59 This ADS and PCS interaction is designed to provide the long-term passive heat removal mechanism for those events where ADS actuation is expected, such as LOCA.
l The PCS afMs ADS performance by cooling the containment, which condenses the steam in the
-l atmosphere and reduces the containment pressure following an event. At RCS pressures that are much l higher than the expected range of containment pressures (early in an event), critical flow exists from 1 the ADS stages. Containment pressure variations and, therefore, PCS operation have no significant 1 impact on ADS performance until the transition to suberitical flow is approached as the RCS continues l to depressurize.
l
, I Later in the ADS depressurization sequence when the RCS pressure is much lower and decreasing, I approaching about twice the existing containment pressures, the operation of the ADS moves out of a I critical flow regime. At this late time in the depressurization, and later, the existing containment I pressure, which is significantly affected by PCS operation, affects both RCS injection and ADS vent I flow. Containment pressure also affects the ADS vent flow since the discharge pressure in -
1 containment controls the ADS vent flow steam density, increasing discharge steam density with I increasing containment pressure. This interaction is included in the Chapter 15 LOCA analysis.
1 23.6.2 Automatic Depressurization System - Steam Generator System 1
As discussed in Section 23 previously in this document, the focus of the ADS and SGS interactions is related to the effects on the integrity of the reactor coolant system pressure (RCS) boundary. A break
' in the SGS secondary system pressure boundary can discharge steam to containment, which results in .
. an increase in containment pressure and condensate return that indirectly affect the ADS through IRWST interactions discussed in subsection 233.4 of this WCAP and by increasing fourth stage ADS backpressure, as described in subsection 2.3.6.1, herein.
The ADS does not directly interact with the SGS since ADS flow does not pass through the steam f.
generators, although ADS does impact the RCS pressure that exists on the primary side of the steam generators. During a steam generator tube rupture, ADS is not expected to actuate to mitigate the event, If the ADS were to actuate following a steam generator tube rupture, the ADS operation would reduce the RCS temperature and pressure, reducing break flow into the steam generator, helping to prevent steam generator overfill. Following such an ADS actuation, some steam generator secondary ,
water from the faulted steam generator could drain back into the RCS as the depressurization continues, potentially causing a reduction in RCS boron concentrations. This flow is limited by the pressure equalization which occurs, thus maintaining the RCS reactivity within shutdown limits.
The ADS is not required following a steam generator tube rupture since PRHR HX operation helps to reduce break flow into the steam generator, preventing the CMTs from actuating ADS. Therefcce, the SGS does not impact ADS operation following a steam generator tube rupture in design basis events.
m:\3577w.non:lb-050797 Revision 1
)
2-60 I
For beyond design basis SGTR events where multiple failures in the safety-related systems occur, ADS operation will successfully reduce the RCS pressure, thereby terminating the primary to secondary leak. The use of the ADS in mitigating an SGTR event is modeled in the PRA. '
The AP600 Emergency Response Guidelines (ERGS) also address the use of the first stage ADS valve to manually terminste an SGTR event. Section AE-3 of the AP600 ERG Background Information demonstrate the successful use of a first stage ADS valve by the operator to mitigate the consequences )
of an SGTR event.
I Oscillatory behavior noted between these systems during the AP600 testing does not result in any I significant adverse interactions since the oscillations are damped, satisfactory core cooling is .
I maintained, and core uncovery is prevented.
I The design interactions have been confirmed as part of the integral systems testing (References 5 I through 8) and plant analyses (Reference 1). !
23.63 Automatic Depressurization System - Main Control Room Habitability There are no significant interactions between the ADS and the main control room habitability system.
23.6.4 Automatic Depressurization System - Reactor Coolant System The ADS valves are designed to provide a controlled RCS depressurization when safety injection from the accumulators, IRWST, and containment recirculation is needed.
The ADS stage one to three valves, which connect to the top of pressurizer steam space, discharge two-phase flow into the IRWST through the spargers that are located about ten feet below the normal IRWST water surface. The purpose of this arrangement is for the IRWST to condense the ADS steam discharge and collect the condensate for return to the RCS, once the RCS is depressurized and gravity injection flow is initiated. This arrangement also minimizes the potential for discharging steam to containment following ADS actuation.
'Ihe ADS stage four valves, which connect to tne top of the RCS hot legs, discharge two-phase flow ,
[
directly to containment inside the RCS loop compartments, at an elevation above the normally flooded areas used for containment recirculation. The purpose of this arrangement is to have the minimal ADS backpressure at the completion of the RCS depressurization. The steam from the fourth stage ADS discharge condenses on the containment shell and returns to either the IRWST or the containment recirculation areas, depending upon the status of the IRWST condensate return isolation valves.
l The RCS affects ADS operation since RCS pressure controls the ADS flow rate and the RCS I i conditions affect the ADS discharge (such single-phase versus two-phase flow and fluid enthalpy).
I mA3577w.non:lb 050797 REvlSION 1 1
2-61 1 The ADS and RCS interactions are designed to provide the long-term passive heat removal mechanism for LOCA events.
Spurious operation of the ADS results in an adverse system interaction with the RCS. Spurious actuation of the ADS valves during power operation will result in a reactor trip on low pressure, followed by depressurization of the RCS. The effects of this transient are discussed in SSAR Chapter 15. Therefore, the AP600 design has addressed this potential adverse systems interaction.
l Oscillatory behavior noted between these systems during the AP600 testing does not result in any I significant adverse interactions since the oscillations are damped, satisfactory core cooling is
, I maintained, and core uncovery is prevented.
l The design interactions have been confirmed as part of the integral systems testing (References 5 I through 8) and plant analyses (Reference 1).
2.3.7 Passive Containment Cooling / Containment Spurious operation of the PCS results in an adverse system interaction with the containment. This occurs if either PCS isolation valve is opened and causes the PCS storage tank to drain water onto the outside of the containment vessel. This event does not result in any plant transient. The spurious opening of these valves is prevented by the instrumentation and control design. This is not a significant interaction since it does not cause a plant transient and there is sufficient time, alarms, and indications to allow the operators to diagnose the problem and take the corrective actions required. !
The effects of this transient are bounded by the analysis presented in Chapter 6 of the AP600 SSAR.
Therefore, the AP600 design has addressed this potential adverse systems interaction.
l I l Complete failure of PCS water flow onto the' containment vessel following an event results in adverse
.I interactions with the containment. For this beyond-design-basis event where containment heat removal L l is provided by air cooling only, analysis has been pe formed, which shows that although containment I
l piessure can increase above design pressure, containment pressure is not expected to reach a pressure
,3- l . with a significant probability of containment vessel failure I
i, 2.3.7.1 Passive Containment Cooling / Containment - Steam Generator System
- As discussed in Section 2.3 in this WCAP, the focus of the PCS and SGS interactions is related to the -
1 .- effects on the integrity of the RCS and SGS pressure boundaries. The PCS is designed to maintain q long-term heat removal by condensing steam that is released to containment from either PRHR or
! ADS actuation.
1.
[; A steam generator tube rupture does not directly affect PCS operation, although it indirectly interacts with the PRHR HX and IRWST following this event, based on the interactions discussed in
[ subsections 2.3.3.4, 2.3.3.5, 2.3.5.2, and 2.3.5.3 of this document.
4 4
ntumw.nonso30m Revision 1
- m. _ 4 ,
. . - .-. .. . _. . - - =-.
1 2-62 1
A break in the SGS secondary system pressure boundary can discharge steam to containment, which results in an increase in containment pressure that directly affects the PCS actuation. The PCS actuates, condensing the steam that is discharged from the steam generator.
l 2.3.7.2 Passive Containment Cooling / Containment - Main Control Room Habitability There are no significant interactions between the PCS and the main control room habitability system.
2.3.7.3 Passive Containment Cooling / Containment - Reactor Coolant System The PCS is designed to provide long-term passive heat removal by condensing steam that is released ,
to containment from breaks such as a LOCA or main steam line break, and from IRWST steaming due to PRHR HX or ADS actuation. The PCS actuates on high containment pressure resulting from these steam releases to containment. The PCS is responsible for removing both sensible and decay heat from the RCS, and PCS operation impacts the containment pressure by condensing the steam and returning the condensate to either the IRWST or the containment recirculation area for subsequent injection into the RCS.
I Since the PCS controls the containment pressure, it indirectly affects RCS pressure. Containment I pressure is affected by either PRHR HX operation for non LOCA events or from break flow and I ADS flow, which removes core decay heat and sensible heat as the RCS depressurizes, for LOCA I events.
I l The PCS affects ADS performance (and RCS pressure) by cooling the containment, which condenses I the steam in the atmosphere and reduces the containment pressure following an event. At RCS l pressures that are much higher than the expected range of containment pressures (early in an event),
I critical flow exists from the ADS stages. Containment pressure variations and, therefore, PCS l operation have no significant impact on ADS performance and RCS pressure until the transition to I subcritical flow is approached as the RCS continues to depressurize.
I l Later in the ADS depressurization sequence when RCS pressure is much lower and decreasing, I approaching about twice the existing containment pressures, the operation of the ADS moves out of a l critical flow regime. At this late time in the depressurization, and later, the existing containment ,
I pressure, which is significantly affected by PCS operation, has more significant effects on both RCS I injection and ADS vent flow. This interaction is included in containment presst:re analyses I (Chapter 6) and in LOCA analyses (Chapter 15).
l l PCS operation and, therefore, containment pressure also impact the ADS vent flow (and RCS l conditions) since the discharge pressure in containment controls the ADS vent flow steam density, I increasing discharge steam density with increasing containment pressure.
l mA3577w.non:Ib-050M7 REVISloN 1
2-63 l
l Late in an event, the RCS affects PCS operation sinc core decay heat affects the ADS flow required l l to remove this decay heat, along with sensible heat as the RCS depressurizes. Core decay heat tends I to increase RCS pressure until sufficient ADS steam can be vented. Therefore, RCS conditions affect I how fast and how much total heat is released to the PCS over time. For non-LOCA events that do not l result in RCS depressurization, the core decay heat transferred to the IRWST by PRHR HX operation affects the PCS heat transfer rate. In addition, for LOCA events, the break size and location significantly affect the PCS heat addition rate. l l
2,3.8 Steam Generator System 2.3.8.1 Steam Generator System - Main Control Room Habitability i
There are no significant interactions between the accumulators and the main control room habitability system.
2.3.8.2 Steam Generator System - Reactor Coolant System The interactions between the RCS and the SGS are divided into two categories. The first category, that is not important for the purposes of this report, includes normal system functions to maintain system integrity and support normal system operation and power generation.
The second category of interactions is related to the interactions between the RCS and SGS and the associated safety-related passive systems following an accident. A loss of integrity for either the RCS or the SGS initiates an accident, such as a LOCA, SGTR, oc steam break from the secondary system.
The various interactions between these two systems and each of the safety-related passive components are discussed in the appropriate discussions throughout Section 2.3 of this document.
I The design interactions have been confirmed as part of the integral systems testing (References 5 l through 8) and plant analyses (Reference 1).
2.3.9 Main Control Room Habitability System
. The main control room habitability system only interacts with the main control room and not directly with any of the safety-related passive systems discussed in this Section 2.3, herein.
Spurious actuation of the main control room habitability system is an adverse system interaction that only affects the future operability of the main control room if the system were needed. Spurious actuation has no significant consequences on the main control room operation.
Actuation of this system occurs if either main control room habitability system isolation valve is l opened and causes the main control room habitability system emergency air storage tanks to vent I compressed air into the main control room. The spurious opening of these valves is prevented by the mA3577w.non:lb-050797 REVislON l
2 64 i
)
1 instrumentation and control design. His is not a significant interaction since it does not cause a plant transient and there is sufficient time, alarms, and indications to allow the operators to diagnose the problem and take the corrective actions required. The effects of this transient are discussed in Chapter 15 of the AP600 SSAR. Therefore, the AP600 design has addressed this potential adverse systems interaction.
I s
e 4
I e
s i
)
mil 577w.non:Ib-050797 REVISloN 1 l
3-1 3.0 EVALUATION OF POTENTIAL HUMAN COMMISSION ERRORS 3.1 Objectives and Method The adverse systems interactions are already studied from a functional point of view in Section 2.0 of this report. In this section, these interactions are examined from the point of view of potential human errors that may cause the same adverse interactions. Since the AP600 plant is designed to minimize
,, the reliance on operator actions to mitigate accident, cognitive operator actions are deemed to be the source of potential adverse system interactions, as opposed to omission errors that are routinely modeled in the AP600 Probabilistic Risk Assessment (PRA) (Reference 2).
Cognitive commission errors involve human errors in the decision-making process in dealing with event sequences studied in the PRA models. These errors may include the starting or stopping of safety systems that are neither called for nor include prematurely performed actions, and actions performed out of sequence in following procedures. Normally, the failure probabilities of such errors are very difficult to quantify. On the other hand, other actions such as non-response to a cue, omission, unable to complete an action due to lack of time, and commission errors associated with manipulation are routinely modeled and are quantified in the AP600 PRA model. This section, the potential for cognitive commission errors as they relate to the potential adverse system is studied qualitatively.
The most likely sources of cognitive commission errors are as follows:
- An accident sequence where there is a goal conflict that is not resolved by the procedure
- Too little or too much information that would either mislead or confuse the operator
- Procedures that allow or lead operators to make knowledge-based decisions To avoid cognitive commission errors, the AP600 design has placed requirements in task analysis, l Emergency Response Guidelines (ERGS)(Reference 3). The AP600 man-machine interface design
, process discussed in the AP600 Standard Safety Analysis Report (SSAR) (Reference 1) Chapter 18 includes the development of the following for this purpose:
- Function-based task analysis I = Symptom-based ERGS The function-based task analysis results identify the hierarchy of instrumentation for operator use and present it logically to the operators.
The emergency operating procedures address resolution of conflicting indications between nonsafety-I related and safety-related instrumentation. Moreover, the ERGS are symptom-based, thus they do not I allow the operator to make knowledge-based decisions contrary to the rule-based decision philosophy 1 of the ERGS. The ERGS are computerized to provide ease of access and self-checking.
m:\3577w.non:Ib-o3o797 REVislON 1
. - - . - . . . - . - - . . - . _ ~ - . - . . . - . . - . . . - - - - - -.. - - . - . - .- -
3-2 l
Another design feature that provides a diverse path to prevent cognitive' commission errors is the status trees that are monitored by an independent plant staff member, usually an engineer who is not a
~
l , member of the routine control room team. This engineer monitors the status trees, and when a red or 1 orange path is reached, instructs the operators to follow the ERG associated with that path. 'Ihus, the operators, regardless of the decisions made and actions taken to that point, go to a separate procedure to handle the current plant status. This allows recovery from, or mitigation of cognitive errors that might have lead to the current plant status, by breaking the operator team away from the path they -
have been following.
To provide a systematic evaluation of potential human commission errors that may cause adverse systems fueractions, each of the adverse system interactions already identified in Section 2.0 of this ,
report are examined from a human commission error point of view. In this examination, three questions are asked for each candidate adverse system interaction:
- Is there an opportunity for a commission error?
Namely, is there a procedure that the operators are following, in which the operator is supposed to manipulate the system causing the adverse interaction while the affected system is operational? :
- Are there safeguards against a commission error?
Namely, are there:
Proceduralized steps to avoid a specific commission error, or recovery steps to recover from such an error if it happens?
Only automatic actuation of both systems involved?
Automatic termination of a system function, when the adverse system interaction happens? *-
- Is the effect of adverse system interaction already modeled in the PRA? ,
Namely,is the effect modeled:
As a part of system models?
As a part of establishing success criteria basis?
l i
i-m:\)577w.non:Ib.0$0797 REvlSloN l
, ~ , . -
l l_ 3-3 The responses to these questions allow the adverse system interaction to be classified as follows:
-1. There is no credible concern for human commission error for this adverse system interaction to occur.
- 2. There is a credible way for this human commission error to occur, but there is sufficient time to recover. Thus, the overall effect is not significant.
l' 3. The error is credible and is already modeled in the PRA or is bounded by other failures or success criteria modeled in the PRA.
!' 4 I'
- 4. The error is credible md is not modeled in the PRA.
l 1 Each of the potential adverse system interactions identified in Section 2.0 of this report is examined I from the point of view of human errors of commission. For each adverse system interaction, the l l method described above is applied. The answers to the three questions in the method are evaluated to >
l reach a conclusion about each interaction from a human commission error point of view. Each item is 1, classified in one of the four categories described above. The items classified as category (4) are then l ,
I further discussed in Section 3.2 of this report. In addition, some items identified as category (3) that I merit further discussion and/or explanation are also discussed in Section 3.2.
I Section 3.3 has been provided to address a specific operator error of commission related to economic l consequences. This section has been included in response to specific concems raised by the NRC with l l . regard to the errors of commission that the operator may commit to avoid adverse economic I consequences. Specifically, the NRC has drawn comparisons with an incident that occurred at Davis-l Besse and the potential for such an incident at an AP600, due to the use of manual actuation of the I automatic depressmization system as specified in the AP600 ERGS (Reference 3) and credited in the r l PRA (Reference 2). !
l l
l Section 3.4 has been provided to address a specific operator error of commission related to l Q l instrumentation errors.
( 1
.i f '
L l
< m:U577w.non:lt450497 Revision 1
L d 6 y ta ,
j TABLE 3-1 E i
I TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS i N.
g Adverse Interaction Does opportunity for Are there safeguards Is adverse lateraction Conclusions p husaan error exist in against human error? already snedeled in the - [i] = ith category of .
3 Section Description procedures? PRA? classification I
Number 2.2.1 RCP - Core No; RCP trip is automatic. Yes: RCPs are No. There is no credible !
RCP restart criteria automatically tripped. concem for human [
provided ensures adequate Restart prevented unless commission enor for this [
RCS subcooling. Avo!Js safeguards signal is blocked. adverse system interaction
(
potential adverse to occur. [
interaction. [4] [
2.2.1 RCP-CMT Same as above (RCP - Samr. as above (RCP - Yes, this potential adverse There is no credible Core). Core). interaction is niodeled in concem for human >
the PRA in terms of failure commission error for this of RCP pump breakers to adverse system inter-action }
open. Thus, this failure to occur. Moreover, RCP f mode is captured in plant breaker " failure to open" risk profile as a mechanism failure mode captures the [
i that reduces CMT success concern in the PRA model. j probability. [I] .!
RCP - PRilR No; RCP trip is automatic Same as above (RCP - No, this potential adverse There is no credible h2.2.1 y
(during large steam line and there is no event Core). interaction is rd modeled concern for human [
break accidents only). related procedure where ti.e in the PRA.~ However, it is commission error for this l operators are instructed to observed that large steam adverse system interaction
[
restart RCP. line break events are not to occur.- [
important contributors to [1]
the plant risk.
E E
O
s . ~s( . .
e p !
@ TABLE 3-1 (Continued)
T TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS :
3 Ad5erse Interaction Does opportunity for Are there safeguards Is adverse interaction Conclusions i human error exist in against human error? already modeled in the [i] = ith category of s
I 6
y Section Description procedures? PRA? classificmion r
$ Number l 2.2.2 Pressuriier lleater - CMT No; pressurizer heaters are Yes, automatic tripping logic No, this potential adverse There is no credible [
and PRIIR (during SG tube tripped on a safegustds exists. interaction is not modeled concern for human i rupture ever.t). actuation signal; there are in the PRA. If the commission error for this l no procedure steps to turn automatic tripping of adverse system inter-action them on. pressure heaters fails, a to occur. Ilowever,if the !
potential adverse inter- auto trip fails, the functional I action exists. !!owever, the adverse inter-:: tion would b failure probability of still be valid. I automatic signal is small. [1]
= Procedures instruct the operator to trip the heater if automatic trip fails.
2.2.3 CVS Makeup Pump Yes, there are procedural Yes, auto tripping logic by No, this potential adverse There is no credible i interaction with non-LOCA steps for operator ta control PLS and PMS exits. interaction is not modeled in concern for human events CVS pumps to maintain the PRA. If the auto-matic commission error for this pressurizer level. tripping of CVS makeup adverse system inter-action pumps fails, a potential to occur. Ilowever, if the adverse inter action exir.Is. auto trip fails. the functional flowever, the failure adverse inter-action would probability of automatic still be valid.
signalis small. Pmcedures [1]
instruc' the operator to trip CVS pumps if automatic trip fails.
i s
!c l O .
- Y.
u t
R 6
TABLE 31 (Continued)
- f E
TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS E Adverse Interaction Does opportunity for Are there safeguards Is adverse interaction Conclusions
[ human error exist in against human error? sIready mod.' led in the y Section Description procedures?
[ij = ith category of.
8 PRA? classification Number 2.2.3 CVS Makeup Pump Yes, step 4 of ERG AE-3 Yes, CVS pumps are Yes. He automatic trip of Dere is the potential for interaction with SGTR instructs operator to start automatically tripped on the CVS pumps via PMS is human commission error.
one CVS pump. Hus. high SG water level. modeled for high SG level. Ilowever, this error would there is potential for a Procedures instruct the be neutralized by the auto commission error. operator to trip CVS pumps SG high level signal. Thus if auto-matic trip fails. the overall effect is negligibly small. The failure of the auto trip signal is already modeled in the PRA.
til 2.2.4 CVS Purification Imp No operator action needed. Not applicable, since there is No need to model in PRA. Dere is no credible adverse no operator action. operator action.
til 2.2.5 Makeup Control System No operator action needed. Not applicable, since there is No need to model in PRA. There is no credible adverse no operator action. operator action.
til 2.2.6 Letdown Line Interactions No. LOCA-related Yes. Line is automatically No. Dne is no credible adverse procedures instruct the isolated. operator action.
operator to close the
[1]
letdown line 2.2.7 flydrogen Addition Line Operator action does not Yes. Amount of hydrogen No. There is no credible adverse contribute to this adverse that can be introduced into operator action.
instruction. RCS is limited.
[1]
i k<
b h
me g ,a
xj o .
3 si TABLE 3-1 (Continued)
~
7 TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS
_ Adverse Interaction Does opportunity for Are there safeguards Is adverse interaction Conclusions
$ human error exist in against human error? already modeled in the [i] = ith category of
@ Section Description procedures? PRA? classification 3 Number 2.2.8 Main feedwater Pumps Yes. Potential operator Yes, MFW is automatically No. Potential for human commission ermr exists in isolated. Also step 3 cicarly commission error can be step 3 of ERG AES-0.1. states objective; instructs postulated but it is deemed closure of MFW control to be highly unlikely due to valves before establishing the safeguards discussed in feedwater flow to the SG. column 4. Even if the unlikely failure occurs,it will lead to a transient with a spurious SI signal which is not a dominant risk contributor.
[2]
2.2.9 Startup Feedwater Pumps - Operator is expected to Not needed. Not modeled. There is no concem.
PRilR utilize SFW if MFW is not [Ij available, as a preferred heat removal means after transients. Thus there is no concern.
2.2.9 SFW - SGTR Yes. With an SI event, the Yes. Automatic termination Yes. failure of automatic Modeled in the PRA.
operator is instmcted to of SFW flow on a high SG SFW termination is [3]
start SFW pumps (step 14 wara level. modeled in the PRA.
of AE-0).
s, v
b 2 w
~
U
^
t
!! Y' Ei TABLE 3-1 (Continued) -
M TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS P Adverse Interaction Does opportunity for Are there safeguards Is adverse interaction Conclusions
[ human error exist in against human error? already modeled in the [il = ith eategory of g Section Description procedures? PRA? classification j 3 Number 2.2.10 RNS-IRWST (drain Operator is expected to No. No. Operators are instructed to IRWST faster;if then RNS start RNS. start RNS. If RNS fails to pumps fail, S1 injection continue operating, the gravity head will be less). gravity head would be less i for Si injection. This is a property of the design; not a commission error.
[1]
2.2.11 SG Blowdown No. Auto isolation of SG No. Not a credible human blowdown. interaction concern.
[1]
2.2.12 Containment Fan Coolers No operator action. Not applicable, since there is No need to model in PRA. Not a credible human t no operator action. interaction concem. !
lil 2.2.13 Plant Control System No operator actions. Not applicable, since there is No need to model in PRA. Not a credible human ;
no operator action. interaction concern.
(I]
2.2.14 WLS - ADS No; the isolation valve Not needed since there are no No. 'Ihis potential adverse There is no credible closes automatically. required operator actions. system interaction does not concem for human '
affect the overall safety of commission error for this the Ap600, as discussed in adverse system interaction subsection 2.2.14. to occur.
[1]
L 2.2.15 Liquid Waste Processing No operator actions. Automatic isolation of Not modeled. Not a human interaction System / Containment Sump '
discharge line, concem.
Pumps
[1]
h i
- s m
5 z t i
i 9
. . ___________--__2
=~ $ .- .
B
$ TABLE 3-1 (Continued) f . TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS I Adverse Interaction Does opportunity for Are there safeguards Is adverse interaction Conclusions 7 human error exist in against human error? already modeled in the [i] = ith category of h Section Description procedures? PRA? classification !
$ Number 2.2.16 IWRST Gutter As explained in subsection 2.2.16, this is not a safety concem for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
2.2.17 CCS/RCPs No operator actions. Auto reactor trip on loss of Yes. Failure of RCP(s) Not a human interaction CCS cooling to RCPs leading to transient events concern. i (measured in terms of high is modeled in the PRA. [1]
RCP bearing water temperature). Since the RCPs are canned motor type. RCP seal LOCA due to loss of CCW cooling is not a concem for the AP600 design.
I 2.2.18 Primary Sampling No operator actions, until 8 Auto isolation on Yes. Evaluated in Not a human interaction System /RCS inventory hours post- accident. containment isolation signal, modeling of containment concem.
isolation failure. [ll I
i s
e O Y* I c
s 'r' Gi TABLE 3-1 (Continued) 5 h TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS s Adverse Interaction
- .
- . Does opportunity for Are there safeguards Is adverse interaction Conclusions !
$ human error exist in against human error? already modeled in the [i] = ith category of y Section Description procedures? PRA? classification 3 Number 2.2.19 Spent Fuel Pool Cooling As discussed in subsection System /CVS, IRWST. 2.2.19, the design prevents Containment isolation. CVS from overdraining SFS.
[1]
IRWST connections are administrative!y control!ed and IRWST level is monitored. Since there are two levels of defense, it is adequate to prevent or mitigate inadvertent opening.
til No. Yes, automatically isolated Considered for contain- Containment penetrations i on containment isolation ment isolation model. are automatically isolated.
l signal. There are no operator '
actions to open them.
[1]
s m
O Y
} S k
--~T
~
o is 2 TABLE 3-1 (Continued) 8 E.
Adverse Interaction TABLE OF ASSFSSMENT OF POTENTIAL ADVERSE IlUMAN COMMISSION ERRORS Does opportunity for Are there safeguards Is adverse interaction
$[ Section Description human error exist in procedures?
against human error? already modeled in the Conclusions S Number [i] = ith category of PRA?
classification 2.2.19 Spent Fuel Pool Cooling Yes, for maintenance No.
System / Fuel transfer canal. operations. No.
The SFS to fuel transfer canal connection is administratively controlled.
Since there is a single line of defense a cognitive operator error potential can be postulated. Ilowever, j
spent fuel pool accidents are not deemed to be of risk significance.
[4j Passive-Passive System Interactions 2.3.1.5 CMT/Accum. and ADS No. CMTs are expected to No.
g actuate before ADS. Yes, this adverse system Not a credible human Accum. not actuated by the interaction is considered in interaction concern.
operator. Thus, there is no the MAAP4 (Reference 9) [1]
oper:#cr commission error analyses that support the expected. PRA success criteria.
x E
m b
2 I
~~
i
6.)
~~
i y
' = i3
& TABLE 3-1 (Continued) 7 TABLE OF ASSESSMENT OF POTENTIAL ADVERSE IlUMAN COMMISSION ERRORS l Conclusions U
Does opportunity for Are there safeguards
- Is adverse interaction i Adverse Interaction already modeled in the [i! = ith category of human error exist in against human arror?
5 PRA? classification y Section Description procedures?
3 Number _
l Passive. Passive System Interactions (Continued)
Yes. Th re are procedures 4 the effect of such a This interaction is 2.3.1.9 CMT and RCS No. Here are no conservatively classified as (per AES.I.1) to isolate .isient is bounded by the procedures for main control CMTs when spuriou- CMT risk from the transients in category room operators to acteation is confirmed. AP600 PRA: the risk from [31 manipulate CMT to lead to spurious CMT actuation transients is not dominant during power operation. Also,if soft controls are for AP600.
Ilowever, even if one is used, MMIs will have postulated,it will lea:1 to a features to confirm the transient event, which is component to be actuated.
analyzed in C"upter 15 of AP600 SSAR. __
Classified as insignificant in 2.3.2.3 Accum. and PRilR subsection 2.3.2.3. It is not pursued any further We.
til Classified as insignificant in 2.3.2.7 Accum. and RCS Section 2.3.2.7. It is not pursued any further here.
til I
i E
- s w
z
. .- .. .. .~ . - - - - _ - _ - -
c--_---
m t
t B
si TABLE 3-1 (Continued) ,
M TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS E Adverse Interaction Does opportunity for Are there safeguards Is adverse interaction Conclumons
& human error exist in against human error? already modeled in the [i] = ith category of
{
?.
Section Number Description procedures? PRA? classificatim Passive-Passive System Interactions (Continued) 233.1 IRWST and Containment No. Yes. Even if the operator No. Not a credible human Recircule.m opens the containment interaction concern.
recirculation isolation valves [1]
during power operation, no reactor trip occurs. There is sufficient time, alarms, and indications to allow the operators to diagnose the problem and take the corrective actions required.
23.5.5 PRilR llX and RCS No. There ._: no operation No. Iif design is expected No. Ilowever, a spurious This interaction is procedures that would so miWs':. the spurious actuation of PRIIR IIX conservatively classified as require the main control signal msing actuation; during power operation category, room crew to manipulate however, no credit is taken would lead to a transient [3]
PRilR llX. Most likely a it in the present event, already analyzed in cause for human error discussion. SSAR. The effect of such would be a spurious signal a transient is bounded by during an I&C test. the risk from the transients in AP600 PRA: the risk from transients is not dominant for AP600.
1 N
N m
W Z .
- w
__- _ . . . _ . _ . ____m ..m. ._. _ . _ _ _ _ _ _ _ . _ __ _ .._ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _
s
d ~
TABLE 3-1 (Continued) h TABLE OF ASSESSMENT OF POTENTIAL ADVERSE HUMAN COMMISSION ERRORS Adverse Interaction Does oppo-wity for Are there safeguards Is adverse interaction Conclusions i
3 Section
' Number Description human evst exist in procedures?
against hurnan error? already modeled in the PRA?
[i] = ith category of classification Passive-Passive System Interactions (Continued) 23.6.4 ADS and RCS Yes. Spurious ADS Yes. Interlocks are provided Yes. The risk of spurious ne event is modeled in actuation during power to prevent the o, etors from ADS actuation is factored PRA.
operation would lead to a opening two AD3 salves in into the LOCA events in LOCA event. De most series during testing of the the PRA model. Here may be a potential likely human error may be ADS valves at-power. human ermr to related to test or inadvertently actuate ADS maintenance of during power operation.
instrumentation. [3]
23.7 PCS and Containment No. Moreover, spurious Yes. No. His interaction is opening caused by operator insignificant from a safety during power operatio'n is point of view.
inconsequential (does not [1]
cause a transient). After reactor trip, it is either insignificant, or beneficial.
23.9 MCR liabitaNtity System his interaction is insignificant from a safety point of view.
Ill
- n k
at 2 ;
,, , ,- .~, + -
i i
3-15 l 3.2 Results of Analysis In this section, the potemial adverse interactions discussed in Section 2.0 are evaluated systematically from a human commissioa error point of view. Table 3-1 shows the evalestion item by item. The last column in the table povides the conclusion as to the credibility and risk significance of any potential cognitive commiss;ca error that would lead to an adverse system interaction.
1 From Table 3-1, it is concluded that seven human actions can be classified as impacting adverse system interactions. These are discuwed below:
l 2.2.1 RCP - Core l
l This adverse intetaction is addressed i.: the design of the AP600. The automatic RCP trip significantly I reduces the potential for this interaction when compared to current plants. Inadvertent pump res: art is I prevented by the interlocks provided in the protect and safety monitoring system. Restart of the l pumps requires the operators to manually block the safeguards actuation signal, and restore RCS l conditions (that is, pressuiizer level) to pre-CMT actuation conditions. Subsequently, if pressurizer I level can not be maintained, then the CMT actuation signal will be re-established on low pressurizer l level, and the RCPs again will be tripped to allow proper CMT operation. Explicit RCP restart criteria l are provided in the ERGS that allow the operator to block the CMTs and restart the RCP3.
2.2.3 CVS Pump Interaction with SGTR Event l Operators are instructed in the ERGS to start one CVS pump (step 4 of ERG AE-3). Since the operator is following the ERG, this is technically not a commission error. The potential adverse interaction with overfilling the faulted steam generator (SG) is prevented by the design, that is, by automatic CVS pump trip on high SG level.
However, if the operator oveW-s the automatic CVS pump trip on high SG level, the adverse interaction would occur. TF - . ce no instructions in the procedures for overriding this auto trip.
Thus, this kind of commission enor is not deemed credible.
l/
J In conclusion, this operator action is a part of the expected response to the event.
i
! 2.2.8 N FW Pump - Continued Operation May Lead to Spurious SI Signal Due to RCS Overcooling During Transients During a transient event, step 3 of ERG AES-0.1, substep b, instructs the operator to close the MFW flow com al valves, followed by substep c, which instructs the operator to verify feed flow to SG (with SF N). It is conceivable that operators may provide this feed flow by MFW; thus a potential commission error coulo occur. However, this is unlikely since substep b clearly implies termination m:\3577w.non:ltr0$G497 REVISION l
3-16 MFW. Moreover, MFW flow to RCS is automatically terminated when a low RCS T,,, signal is ger.erated.
In conclusion, operator action to maintain MFW flow is highly unlikely, and would be automatically overridden, leading only to a spurious SI event, which would then be handled by the passive safety systems.
2.2.9 SFW Pump Interaction with a SG Tube Rupture Event During an SGTR event, the operators are instructed to start SFW pumps (step 14 of AE-0). This may have an adverse system interaction on the faulted SG later in the event. This has been anticipated, in .
that the AP600 design provides automatic termination of SFW flow on a high SG level.
This is already modeled in the AP600 PRA and its consequences are quantified. A potential failure to stop SFW pumps is not a dominant contributor to AP600 plant risk.
2.2.19 Spent Fuel Pool Cooling System Interaction with Connection to Fuel Transfer Canal
)
l The SFS to fuel transfer canal connection (normally closed manual valve SFS V040) is administratively controlled. Since there is a single line of defense, a cognitive ope,ator error potential can be postulated. However, spent fuel pool accidents are not deemed to be of risk significance (they are not studied in the PRA since their effect would develop slowly and involves a lesser fission product source than that of the RCS).
2.3.1.9 CMT Actuation During Power Operation !
A spurious actuation of the CMT during power operation would lead to a transient event, already analyzed in the SSAR. During such a transient, the operators would follow ERG AE-0 (response to l
reactor trip or safety injection). Step 26 of this ERG would direct the operators to ERG AES 1.1 l
(passive safety systems termination), which would allow termination of CMT in step 3.
In the AP600 PRA, the occurrence of one transient per year is postulated and its risk is calculated to ,
be not dominant. A spurious CMT actuation will be covered by this PRA model and would only be a ,
small fraction'of the postulated transient initiating event frequency. 1 2.3.5.5 Passive Residual Heat Removal Heat Er. changer Actuation During Power Operation A spurious actuation of PRHR HX during power ope ation would lead to a transient event, already analyzed in the SSAR. During such a transient, the operators would follow ERG AE-0 (response to reactor trip or safety injection), which instructs operators to verify / actuate PRHR HX in step 8. Later j on, step 26 of this ERG directs operators to ERG AES 1.1 (passive safety systems termination), which would allow termination of PRHR HX in step 6.
l 1
m:\3577w.non:lt45G497 REVISloN 1
.~~ - - . . . - - - ._ - . - . - - - .. - - .
3-17 I l
In the AP600 PRA, the occurrence of one transient per year is postulated and its risk is calculated to j be not dominant. A spurious PRHR HX actuation will be covered by this PRA model and would only
] be a small fraction of the postulated transient initiating event frequency.
2.3.6.4 ADS Actuation During Power Operation
- I There are two potential types of spurious ADS actuations
I \
~
l l
- A nonsystem-level actuation, such as a single ADS line that spuriously opens
} l
) l A spurious system-level ADS signal would lead to a reactor trip and safeguards actuation as discussed I in subsection 2.3.6.4 of this report. Following a reactor trip and/or safeguards actuation, the operators I are instructed to follow the emergency operating procedures (EOPs). Due to the dynamic response of
) I the plant during a spurious ADS, operator actions to terminate the event prior to ADS Stages 1-3 !
f I would not be achievable within the mies of usage for the ERGS /EOPs. It is not possible to provide !
l ques that would allow the operator to immediately and reliably diagnose a spurious ADS signal, and I the operators are thereby instructed to follow the procedures. The ERGS /EOPs direct the operator to I align the RNS pumps to inject water from the IRWST. For a spurious ADS signal, operation of the J l RNS pumps in this mode will prevent the CMTs from draining to the ADS Stage 4 actuation setpoint.
I In this manner, the operators can prevent the need for fourth stage actuation.
l l Safety-related actuation signals can be terminated only after specific termination criteria are met. In ,
i general, termination of any plant safeguards actuation signal in the EOPs is performed to restore the l plant after plant conditions have become stable and subsequent plant recovery is anticipated using I specific plant procedures. The AP600 ERGS specify termination criteria for the passive safety systems I including the CMTs, PRHR HX, and the accumulators. However, termination criteria for the ADS is I treated in a similar manner as recovery of the plant following an LOCA.
l l Proceduralized recovery from automatic depressurization has not been undertaken due to the various
/"' -l scenario-dependent decisions that would have to be made. Recovery of the plant following automatic p
I depressurization is not to be accomplished in the short-term within the context of the EOPs, but rather
)
J l . in a long-term recovery action administered by the plant management under the auspices of the l_ accident management plan.
I l As stated earlier, the opercors are not permitted to interfere with the Stages 1-3 sequence until it is I completed, and conditions to terminate safety-related systems are satisfied. If stable conditions exist
~
I that do not require the additional Stage 4 actuation on a continually decreasing CMT leve'. such as I through recovery of RCS inventory using the RNS, the operators could eventually isolate the CMTs, I and terminate ADS operation. The RNS would then be used for closed-loop cooling of the RCS.
memw.now nro50cn REVisloN 1
3-18 l For the case where a system-level actuation signal has not been genemted, but rather the spurious ADS l actuation involves spuriously opening two ADS valves in series, the operators would be allowed to I reclose the ADS valves prior to the generation of a reactor trip and/or safeguards actuation. These I operator actions would be equivalent to operator actions in currently licensed plants to close a l spuriously opened, atmospheric power-operated relief valve (in a safety-related steam generator), that T l was opened in a condition outside of its normal actuation conditions (due to a malfunction in the I automatic actuation circuitry) to stop a spurious steam generator depressurization.
I i 3.3 Commission Error Related to Economic Consequences I
s ! Another set of potential commission errors is related to economic consequences. In some event .
I sequences, the operators may be reluctant to actuate a safety-related system if it may have a large I adverse economic consequence to the plant. An example of such an action often cited is the i reluctance to stan emergene,v feed and bleed operations in a conventional plant. In current plants, I emergency feed and bleed operation can be required to mitigate loss of heat sink events, where the I operator needs to cool the core without the use of the steam generators. To accomplish this, the l operators " feed" with the high head safety injection pumps, and " bleed" with the pilot-operated relief l valves (PORVs) connected to the pressurizer. However, the operators are reluctant to perform this I operation since operation of the PORVs would lead to a cleanup of containmen: Screfore, this I operation is used as a last resort. A potential failure is that the operators may continue to try to l recover secondary cooling, rather than go to feed and bleed, until it is too late.
I g
l In the AP600, a counterpan to feed and bleed operation is related to actuation of the ADS. The ADS l valves, in conjunction with the CMTs, accumulators, and IRWST, provide automatic emergency core I cooling in response to LOCAs. However, the important differences between manual actuation of the i ADS in the AP600 and the use of feed and bleed cooling in current plants are:
l l
- The ques and man-machine interfaces available for manual ADS actuation l
- The consequences of manual ADS actuation l
I These differences are explained below.
I l The decision-making process that the operator is faced with in the AP600 is much different than that ,
I of current plants. To establish feed and bleed cooling in current plants, the operator must make a I decision to initiate feed and bleed solely based on conditions in the plant. Therefore, as the RCS i conditions slowly degrade due to the loss of the RCS heat sink, the operator may continue to try to re-I establish the normal, front-line safety system (that is, steam generator cooling) and forego the onset of I feed and bleed cooling.
l
{
i In the AP600, the ADS is an automatic safety feature that is used in response to design basis I accidents. It is not a last reson, but rather a front-line safety system that would be expected to actuate m.0577w.non:lb-osom REVislON 1
3 19 l for LOCAs. There are two kinds of beyond-design-basis event scenarios where manual actuation of I the ADS is appropriate. These are:
l l = Following failure of automatic actuation of the ADS on low CMT water level l e Following a loss of all RCS heat sinks (SGs and PRHR HX) l I The use of the ADS following a failure of automatic actuation of the ADS on low CMT water level is I not comparable to manual actuation of feed and bleed cooling in curmnt plants. In this case, the I automatic protection system should have automatically actuated the ADS, and therefore the operator I has a clear and unambiguous que that manual ADS actuation is required.
. 'l l The use of manual actuation of the ADS following a loss of all RCS heat sinks is more similar to feed I and bleed cooling in current plants. In current plants, the use of feed and bleed cocling is used in I beyond-design basis events, where multiple failures result in a loss of all RCS cooling via the steam I generators. In the AP600, the use of manual actuation of the ADS to provide feed and bleed cooling I is even more unlikely. The failure of an RCS heat sink occurs only after the failure of both the I normal and startup feedwater systems, and requires the complete failure of the safety-related PRHR a
l HX. It is only after the failure of the PRHR HX that the operators would then use feed and bleed via l manual actuation of the ADS.
I l In this scenario, the emergency procedures would have provided clear and unambiguous guidance to I actuate the ADS manually. In addition, the presentation of the EOPs via computerized procedures will I provide the operator with clearer guidance than provided in current plants. Due to the imponance of I the ADS, the presentation of the information necessary to que the operator to manually actuate the l ADS will be given a sufficiently high priority in the AP600 man-machine interface system (MMIS)
I design process.
I i The other major difference between current plants and the AP600 is that the AP600 is designed to i minimize the consequences of the ADS operation. In current plants, even limited feed and bleed can I result in mpturing of the pressurizer relief tank, causing reactor coolant to be spilled into containment.
j] I In the AP600, the first three stages of the ADS (connected to the pressurizer) discha ge to spargers j
/ l located in the IRWST. This minimizes the consequences of the first three stages of the ADS operation l to the containment environment. As discussed in Section 2.0 of this report, following an ADS without I an LOCA, if the RNS pumps were to operate, the CMTs would not drain to the fourth stage ADS l setpoint, and significant containment flooding would not occur. Even in the event of a full ADS (that i is, founh stage ADS opening), the RCS loop compartments would fill with water, but significant i flooding elsewhere in containment would be avoided.
l l In summary, failure by the operators to manually actuate the ADS is a very unlikely event. Operator I acts of commission to prevent automatic depressurization are not credible. Operator failure to I manually actuate the ADS would require the operators to ignore and/or override emergency l procedures. Whereas in current plants, the operator failure to actuate feed and bleed has been noted; it nM577w.non:lb-0$0797 REVistoN 1
. . -, . - - - - -. - . - . . ~ . - -. -._
i 3-20 l
l d
'l is much less likely in the AP600 due to the fundamental design difference between automatic l depressurization, and manual feed and bleed cooling. The use of advanced MMIS and computerized I procedures, as well as the chr and unambiguous guidance provided in the ERGS, provides assurance I that the operator will not be tempted to overrides system actuation of the ADS when required.
I Furthermore, the economic consequences of the ADS in the AP600 is much less severe than feed and I bleed in current plants, and it will not pose an undue temptation to the operators to avoid its use.
-l Therefore, errors of commission related to economic consequences have been sufficiently considered in I the design of the AP600 and are not considered credible.
l l 3.4 Commission Error Related to Instrumentation Errors l .
I Another set of potential commission errors is related to instnamentation errors. The issue is whether i the AP600 design has accounted for the potential of errors in instrumentation that cause the operators I to make an error of commission. This has been addressed in two ways. The ERGS have addressed I potential instrumentation errors due to adverse environments. This has been addressed by providing e I instrument setpoints for operator actions for conditions when an adverse environment exists, in I addition to the normal setpoints for when environmental conditions are normal. In addition, the l AP600 advanced control room and MMIS, with computerized procedures, will assist the operator in I determining when to utilize the setpoints for adverse environmelital conditions.
l l A description of the analysis of the AP600 post-accident monito ing instrumentation requirements is I provided in SSAR Section 7.5. The results of this analysis, conducted in accordance with Regulatory l Guide 1.97 (Reference 10), indicate that the AP600 post-accident monitoring instrumentation has I sufficient redundancy and diversity of qualified instruments to provide the operators with clear and I unambiguous information following an accident. In this manner, the potential for operator errors due i to failures in instrumentation has been addressed.
3.5 Conclusions l Based on the results discussed in Sections 3.2,3.3, and 3.4 of this document, no cognitive human error that might cause significant systems interactions and might be of significant concern to plant risk has ',
been identified. '
m \3577w.non:Ib450797 REvlslON 1
41 4.0 SPATIAL INTERACTIONS Spatial interactions are interactions resulting from the presence of two or more systems in proximate locations. The spatial interactions considered include the effects of fire, flood, pipe break, missile hazard, and seismic events. These interactions are addressed in the SSAR in Sections 9.5,3.4,3.6, 3.5, and 3.7. The protection required for safety-related systems and the potential for spatial interactions from nonsafety-related systems are largely independent of whether or not a nonsafety-related system is operating.
Safety-related systems are required to be protected from the effects of failures in safety-related and nonsafety related systems. Safety-related systems are limited in location to within the containment, containment shield building, and the auxiliary building. The restricted extent of the safety-related systems and components limits the number of nonsafety-related systems that need to be considered as ,
possible sources of adverse interactions. In addition to separation of safety-related and nonsafety-related systems, one of the important features previding protection is the exterior and interior structural ;
walls, floors and roof of the auxiliary building and the structure of the containment shield building. j Nonsafety-related systems, including systems with RTNSS missions and defense-in-depth missions, are generally not required to be protected from the effects of failures in nearby systems.
Specific considerations for the spatial interactions are provided in the following paragraphs.
Fire The key method of addressing fire hazard is the use of fire barriers (walls, floors, and fire-rated doors) i between fire zones in the auxiliary building. Redundant trains of safety-related equipment are located l in separate fire zones so that the effects of a fire or tire fighting efforts do not hinder shutdown or l accident mitigation capability. Automatic fire suppression systems are not provided in the containment l
or auxiliary buildings. This minimizes the potential for adverse effects of flooding or water spray due to fire fighting efforts on safety-related systems.
/I Significant quantities of combustible materials such as diesel fuel and hydrogen are not located in the
(, buildings containing safety-related systems. This also minimizes the potential for a fire-related adverse
!i system interaction.
! Flood .
3 Safety-related systems and components in containment are located above the maximum flood-up level or are designed to operate when under water. The approach of using water stored insid; containment for the safety-related core cooling and safety injection limits the amount of water available to flood the 2 containment to a known firdte amount.
i l
i i
m:\3577w.non:lb-050497 REVISION 1 l-O v
4-2 l
i Two primary sources were evaluated for potential f1roding in the auxiliary building. The first was water in pipes routed through compartments containing safety-related systems and components. In these areas, diains, vents, and other means ;oickly conduct water and steam out of the auxiliary building and away from the safety-related systems and components. The second significant source of potential flooding evaluated was water used for fire fighting. Fire fighting is provided by hand-held hoses connected to a water supply. The water for these hoses from the PXS tank above containment
]
. provides sufficient volume and water head.' Water from fire fighting efforts flows through drains, j under doors and down stairwells to the lowest level,of the auxiliary building. The amount of water [
available for fire fighting is limited. If all the water remains in the auxiliary building, the result could be several inches of water on the floor in the lowesi level. ;
Pipe Break ;
Safety-related systems are protected from the dynamic effects of pipe breaks and cracks in safety related and nonsafety-related, high-energy piping systems. Dynamic effects include pipe whip, jet ;
impingement, and subcompartment pressurization. Moderate energy line breaks are evaluated for spray wetting and environmental effects. The separation of safety-related from most nonsafety-related piping systems minimizes the potential for adverse interaction between safety-related and nonsafety-related systems.
A number of the safety-related high energy lines inside containment are shown to have leak-before-break characteristics. Dynamic effects of pipe breaks in these lines did not have to be ;
evaluated. The portions of nonsafety-related, high-energy lines that are not constructed to the criteria of the ASME Boiler and Pressure Vessel Code are not qualified as leak before-break lines. 3 l
[ The portion of piping adjacent to containment penetrations is in a break exclusien zone. Piping within :
the break exclusion zone is subject to additional limits on pipe stress, and the effects of pipe break did not have to be evaluated. An exception to this exclusion was the main steam and feedwater piping in l the steam tunnel subcompartment adjacent to the main control room complex. The main steam and l feedwater lines in this area do qualify as break exclusion zone piping. Because of the importance of i the function of the main control room and a safety-related battery room below, the wall and floor are evaluated for the effect of pipe whip, jet impingement, and subcompartment pressurization. High- ) ;
energy line breaks in the turbine building were also evaluated for dynamic effects on the control room. 3
- Missile Hazard l
I
( Safety-related systems and components are protected from the effects of potential missiles by
- separation from missile sources, the building structure, system and component design, and if necessary, 4 barriers. Missile sources may include fragments from failures of rotating elements including pump and l fan impellers, failure of pressurized components, and explosions. Because of the design requirements j and construction codes used, safety-related components are not considered to be credible sources of
, missiles due to impeller failures or failure of pressurized components, i !
I y mA3577*.non:Ib-054t97 REVISION 1 1
a
, . , , - . , - , 7 _ ,. _ - , _ _ . .
4-3 The exterior and interior structural walls, floors and roof of the auxiliary building and the structure of the containment shield building provide protection from potential sources not located in the same !
subcompartment for the safety-related systems and equipment. Where nonsafety-related equipment is
' located in the same compartment as safety-related systems and components, the equipment is built to requirements similar to safety-related equipment to preclude the generation of missiles or is located inside an enclosure constructed to retain missiles.
The AP600 turbine is oriented to preclude the impact of low trajectory turbine missiles in areas - !
containing safety-related systems and components. The design, metallurgy, and fabrication methods used for the AP600 turbine result in such a low probability of rotor failure that the impact of high
. trajectory missiles did not have to be evaluated.
Seismic Events Safety-related structures, systems, and components are designed, analyzed, and constructed to withstand the effects of a safe shutdown earthquake. These stmetures, systems, and components are classified as seismic category I. Nonsafety-related structures, systems, and components whose failure could have an adverse impact on a seismic category I structure, system, and component are classified as seismic category II. Seismic category II structures, systems, and components are designed and evaluated to provide that the failure of the seismic category II stmeture, system, or component does l not result in a failure of a seismic category I structure, system, or component.
I
/
J b
J l
i 4
l 4
3 4
m:\3577w.non:lb-050497 REVISION 1
?
._ _ . _ . _ _ _ . ._ .__..____..________.m __.. __ _ , _ . _ _ .
51
5.0 CONCLUSION
S This report summarizes the systematic and thorough approach that has been used to evaluate the AP600 for potential adverse system interactions. Potential adverse system interactions that reduce the capability or degrade the performance of the safety-related systems to perform their safety-related missions are identified. This report also documents that the AP600 Standard Safety Analysis Report (Reference 1) and the Probabilistic Risk Assessment (Reference 2) have properly considered these
, adverse system interactions.
Insights to the regulatory treatment of nonsafety-related systems have been obtained by identifying the
~ important interactions between nonsafety-related systems and the safety-related systems in the AP600.
By understanding the important interactions and potential adverse system interactions, the operation of the nonsafety-relatjd systems can be properly accounted for in the pertinent AP600 licensing submittals.
Insights to the AP600 Emergency Response Guidelines (Reference 3) and man-machine interface system (MMIS) design have been obtained from this report. By identifying important adverse system interactions, the AP600 emergency operating procedures and MMIS can be developed to avoid potential operator errors that result in unintended adverse interaction that leads to degradation of the plant safety during an accident.
h l-l' y i
[/
l
{
V i
4 l
i
)
1 1
mA3577w.non:lb-05Gl97 REVISloN I 1
. ~ , _ _ - - . . - . . _ - _ . _ _ . . . _ _ . . . . . _ . .- _ . . _ _ ..
6-1
6.0 REFERENCES
- 1. AP600 Standard Safety Analysis Report, Revision 11, Febmary 28,1997
- 2. AP600 Probabilistic Risk Assessinent, Revision 8, September 30,19%
( 3. AP600 Emergency Response Guidelines, Revision 2, lanuary 10,1997 l 4. Regulatory Guide 1.97 I
- l 5. ' . AP600 Low Pressure Integral Systems Test at Oregon State University, Final Data Report, l WCAP-14252, March 1995 (Westinghouse Proprietary Class 2) l l 6. AP600 Low-Pressure Integral Systems Test at Oregon State University, Test Analysis Report, I WCAP-14292, September 1995 (Westinghouse Proprietary Class 3) l l 1 7. AP600 Design Certification Program SPES-2 Tests Final Data Report, WCAP-14309, Rev.1, l l March 1995 (Westinghouse Proprietary Class 2) l l 8. AP600 SPES.2 Test Analysis Report, WCAP-14254, May 1995 (We.stinghouse Proprietary l Class 2) l i 9. EPRI MAAP 4.0 Users Manual l
l l
l l
i
,S
\ !
t, i4 t
I 4-f 1
1 e
i j.. m:\3577w.non:Ib oSO497 REVISION 1 1
i 1
--