ML20151C633
| ML20151C633 | |
| Person / Time | |
|---|---|
| Issue date: | 04/06/1988 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| References | |
| ACRS-T-1657, NUDOCS 8804130114 | |
| Download: ML20151C633 (137) | |
Text
{{#Wiki_filter:__ DR 3hA- ~ ~ O UNITED STATES NUCLEAR REGULATORY COMMISSION . --======= -====m-m.m==. In the Matter of: y ) ADVANCED PRESSURIZED NATER REACTORS. ) O i Pages: 1 through 133 Place: Washington, D.C. Date: April 6, 1988 ..,,.sy, -s r-s l .,,-o----------------------==..,-== (
- ,,.i s
HERITAGE REPORTING CORPORATION \\ O ou a,- 1124 L Street, N.W., Sake 600 l Weakingce, D.C. 20005 IION 9304130114 090406 POR ACRS T-1657 DCD
1 PUBLIC NOTICE BY THE 2 UNITED STATES NUCLEAR REGULATORY COMMISSION'S s 3 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 4 5 6 7 The contents of this stenographic transcript of the 8 proceedings of the United States Nuclear Regulatory 9 . Commission's A,dvisory Committee on Reactor Safeguards (ACRS), 10 as reported herein, is an uncorrected record of the discussions 11 recorded at the meeting held on the above date. 12 No member of the ACRS Staff and no participant at 13 this meeting accepts any responsibility for errors or s 14 inaccuracies of statement or data contained in this transcript. () 15 16 17 18 19 20 21 22 23 24 25 ( j' Heritage Reporting Corporation (202) 628-4888 m
1 ( 1 UNITED STATES NUCLEAR REGULATORY COMf!ISSION 2 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 3-i 4 In'the Matter of: ) ) 5 ) f 6 NcCnesday. 7 April 6, 1988 f 8 The above-entitled matter came on for hearing, 9. pursuant to notice, at 8:30 a.m. 10 BEFORE: DAVID A. WARD, Chairman Research Manager on Special Assignment 11 E.I. du Pont de Nemours & Company Savannah River Laboratory 12 Aiken, South Carolina 13 ACRS MEMBERS PRESENT: 0 14 CHARLES J. WYLIE Retired Chief Engineer 15 Electrical Division Duke Power Company i 16 Charlotte, North Carolina 17 MR. CARLYLE MICHELSON l Retired Principal Nuclear Engineer t 18 Tennessee Valley Authority i Knoxville, Tennessee, and, 19 Retired Director, Office for Analysis and Evolution of Operatioinal Data i 20 U.S. Nuclear Regulatory Commission Washington, D.C. 21 l DR. WILLIAM KERR i 22 Professor of Nuclear Engineering l Director, Office of Energy Research l 23 University of Michigan Ann Arbor, Michigan i 24 l 25 l ( Heritage Reporting Corporation (202) 628-4888 i 1 [ --- c. .. -.. ~. -. - ~,,.
LM) i' s 2 [(). 1 ACRS MEMBERS PRESENT - (Continued)- 2 DR. FORREST J. RE!!ICK Associate Vice President for Research 3 Professor of Nuclear Engineering The Pennsylvania State University '4 Univeralty Park, Pennsylvania 5 ACRS COGNIZANT STAFF MEMBER: 6 Medhat El-Zeftavy 7 NRC STAFF PRESENTERS: 8 Tom Kenyon 9 10. 11 12 13 14 15 16 17 10 19 20 21 22 l 23 24 25 O Heritage Reporting Corporation (202) 620-4888
4 3-4
- O
- 1 > R o C.e e D r u o S 2 MR. WARD: Good morning. The meeting will now come 3 to order. This is a meeting of'the Advisory Committee on 4 Reactor Safeguards Subcommittee on Advanced Pressurized Water 5 Reactors. I am David Ward, the subcommittee chairman. ~ 6 The other ACPS members in attendance is Mr. Charlie-- 7 Wylie. Later in the day, we expected Mr. Michelson, f 4 8 Mr. Remick and Mr. Korr. Also in, attendance is ACRS I ~ 9 . consultent, Peter Davis. 10 The purpose of the meeting is to discuss and hear 11 presentations from 'festinghouse representatives and from the 12 NRC Staff and thei.r contractors regarding the PRA for the 13 so-called RESAR SP-90 design. GD 14 Mr. Medhat El-Zeftawy is the cognizant ACRS Staff 15 Member for the meeting. h 16 The rules for participation in today's meeting have 17 been announced as part of the notice of the meeting previously 10 published in the Federal Register on March 31, 1988. 19 To the extent practical, the meeting will be open to 20 public attendance, llowever, portions of the meeting may be 21 closed to discuss Westinghouse proprietary information. 22 A transcript of the meeting is being kept and will be 23 made available as stated in the Federal Register Notice. It is 24 requested that each speaker identify himself or herself and 25 speak with suf ficient clueity and volume so that he or she can O Heritage Reporting Corporation i I (202) 628-4888 i - r e, u,--,,-y m-- s -m.s, ---,7--m,y,., _, -...
4 mij 1 be readily heard. 2 with regard to closing the meeting when necessary, I 3 am going to assume that the Staff presentations will not be 4 proprietary but that the Westinghouse presentations may be. And 5 I will be looking for guidance from Westinghouse folks or from 6 the Staff when you get to something that is proprietary and 7 then we can just take a couple of minutes and close the 8 meeting. So, it will be'open unless you tell me. 9 Charlie, did you have anything you wanted to say at 10 this time? 11 MR. WYLIE: No. 12 MR. WARD: Let's go right to the Staff, then. 'lom 13 Kenyon. _) 14 MR. KENYON: Dr. Ward, as a point of clarification, I 15 asked BNL if some of their information may contain proprietary 16 information and they say they have probably two or three slides 17 that ntay also contain Westinghouse information. 18 MR. WARD: All right. 19 MR. KENYON: My name is Tom Kenyon and I am the 20 project manager for the RESAR SP-90 project. Before we get 21 into a discussion on the PRA, I would like to take a few 22 minutes of your time to discuss the current review schedule and 23 the current review status of the entire review. 24 (Slides shown.) 25 The Staff is planning on issuing three draft SERs in O Heritage Reporting Corporation I (202) 628-4888 J l
'O. 5 i (A,) 1 March, Aprjl and June of this year prior to issuing the final 2 SER. The purpose'of the draft SER is intended to indicate the i 3 review status of where the Staff is today and, more 4 importantly, to delineate open issues that have arison from the 5 review, including open issues that may have to be resolved 6 prior to the issuance of the preli:Jinary design approval. 7-Tla March '88 draft SER is one you have already J 8 received which concerns the front-end portion of the PRA on the 9 SP-90. The April draft SER is intended to cover a variety of 10 subjects, including instrumentation and centrol, radiation 11 protection, physical security and the remainder of the work on 12 the PRA. The June draft SER will discuss the remainder of the 13 revice topics-which the Staff looks at, including reector p. t U 14 systems, plant and auxiliary systems, containment systems and 15 the main control room design. i 16 If I could go back to the second slide on the review 17 schedule, the Staff is t. ommending that we meet with the r i, 18 subcommittee five times. Today, of course, is the discussion i 19 on the PRA. In May, we are proposing -- at the end of May, we i i 20 are proposing that we meet to discuss the contents of the April 21 draft SER. During the summer, in July and August, we are 22 proposing to discuss the remainder of the review of the plant 23 design. 24 September of 1988 has been set aside to serve as sort l' 25 of a wrap-up meeting in which we can discuss issues that may l Heritage Repor*.ing Corporation (202) 628-4888 1'
6 (')/ s_ 1 not have been covered in previous SERs and discuss the review 2 status of the Staff's review and methods of resolution. 3 At the end of the summer, the Staff is propnsing that 4 wa meet with the full committee in August and September, after 5 which the Staff expects to be prepared to request a letter in 6 support of the preliminary design approval. 7 The Staff is planning on issuing the final SER in 8 October of 1988 which will cover the entire review of the SP-9 90. The final SER will address concerns raised by the ACRS as 10 appropriate as well as discuss how the open issues in the draft 11 3ERs had been resolved. Subsequent to issuance of the final 12 SER, the Staff intends to issua the PDA decision no later than 13 the end of 1988. 14 This review schedule we believe can be met. It is 15 kind of an ambitious schedule and with the continued support of 16 Nestinghouse, we expect to be sble to meet it. Are there any 17 questions? 18 MR. WARD: Tom, how much manpower do you have? What 19 sort of staff resources are being devoted to this? 20 MR. KCNYON: Hell, we have staffs, you know, an 21 individual per review branch designated to handle the review 22 when all the responses cru in arid the review is ready for 23 completion Exact FDEs, to tell you the trut.h, I can't 24 remember what they are. The Staff is behind it right now in 25 supporting the review. /3 k-) Heritage Reporting Corporation (202) (28-4888 U
1 ce a o l nQ r /L 7 k-1 MR. HARD ' This is realistic from the standpoint from t 2-the resources? You have been promised. Is that right? 3 MR. KENYON: Assuming thet major problems don't arise 4 that. pull the resources away, and assuming that Westinghouse 5 responds to our neads, it is a realistic one. Like I say,.it 6 is going to be a tight one. We are going to have to really work 7 at it. 8 MR. MisHELSON: A general question. How are you 9 factoring in the unresolved issues of the generic issues into 10 this PDA? What cutoff date are you using? What approach? 11 MR. KENYON: Well, the Staff is considering the 12 unresolved issues as part of their review, the deterministic 13 portion of it. I) l (/ 14 MR. MICHELSON: Well, I am sure they are, but the 15 more apecific question: Which ones are they cor.sidering? Some j i I 16 .are under development, some are in the process af resolution, r l 17 Some of them have been resolved. Which ones are going to be I 18 included in this and how do you include them? I didn't see it l i 19 on the agenda later, so, I was going to ask it now. 20 MR. KENYON: Well, we really hadn't intended to i 21 discuss it. [ 22 MR. MICHELSON: Are we going to do that later, then? 23 MR. KENYON: Well, we can address that at later l 24 subcommittee meetings. 25 MR. MICHELSON: Well, it does get involved, of l (} l Heritage Roporting Corporation (202) 628-4880 l l w
l 8 i f} 1 course, An PRAs because the PRAs ssem co ignore certain kinds-2 of situation. And then the question is: Well, are you looking 13 at them?. Why aren't you looking at them? And I think you f '4 should be because they are covered under a USI. 5 MR.'KENYON: Now, Westinghouse had provided a 6 specific module to discuss the USIs and generic issues. And 7 that is apparently under review by the Staff. 9 MR. MICHELSON: I see. Which one is that? 9 MR. KENYON: It's Module 2. [ i 10 MR. MICHELSON: So, when we get the Module 2 -- it is l 11-kind of funny to do the PRA first before we look at the plant, 1 12 before we look at how wa are going to use USIs and so forth. 13 Because these are all do aftect which scenarios you look at in 14 the PRA. l-15 MR. KENYON: Well, Dr. Michelson, we ran into this 16 chicken-egg type situation: Whjch do we review first. And the j 17 way we have decided to approach it was to provide an f a la introduction into the design of the plar.t and, cf ccurse, we t l 19 have been -- Westinghouse has been informing the committee for L 1 j 20 the last couple of years, I guess they have had about a meeting i l 21 a year to discuss basic design features of the plant. Then we 4 22 proposed to have the discussion for the next several months on 23 the deterministic and then, at the summary, we can address 24 issue that may -- you feel may need to be discussed as a result 25 of the PRA. ( i I Heritage Reporting Corporation (202) 628-4888
q u r 9 ()' 1 MR. MICHELSON: Lot me ask you a little different i 2 question, then. To what extent, if at all, do you considor the 1 3 RPRI improved light water reactor criteria in evaluatjng this 4 particular projec't? 5 MR. KENYON: Woli, Westinghouse is not committed to ,a l 6 the EPRI project. We are taking it into account. but we are 7 not -- you will notice that many of the issues that come up on 8 the SP-90 are also issues that are being looked at in the EPRI 4 9 project. 10 MR. MICHELSON: Now, if this goes beyond PDA to an e 11 FDA, is that same statement still going to be the care? i 12 MR. KENYON: Well, I don't think so. Maybe t t i i 13 Westinghouse can answer that better, but it is our 14 understandinJ that if they go to the FDA stage, they will, of i t 15 course, have to address the EPRI requirements document. 16 MR. MICHELSON: But for some reason, because it is a I t 17 PDA and I am not sure what that even meane in this case, but t i 18 for some reason, we are not going to consider the EPRI criteria 19 at this stage. It seems a little odd. Why are we doing a PDA7 20 Maybe that would be a better question to ask. f 21 MR. KENYON: Well, Westinghouse -- correct me if I am i 4 22 wrong, but Westinghouse submitted their TDA prior to the } l 23 development of the plan to put together the EPRI requirements f' a 24 document. 25 MR. MICHELSON: Okay. r O Heritage Reporting Corporation (202) 628-4888 ].
/ 10 1 MR. S11ANNON : Bud Shannon from Westinghouse. If I 2 might address myself to your question? We originally s g out 3 to do a PDA in conjunction with a joint design program we have 4 that we are in the process of doing.with our partners in Japan, i 5 And oor idea was to get a preliminary Staff review v2 the plans 6 prior to entering into more complete and expensive final-design 7 process on the SP-90 plan. So, originally, we went into a PDA 8 effort with that in mind. As Mr. Kenyon points out, we started u 0 that in '82 or '83 and the review has stretched out a year or 10 two longer than we originally anticipated. Of course, at that 11 point, the EPRI requirements document was not even really being 12 considered. So, it was difficult to make any sort of f 13 commitmants before that document existed. V 14 I believe in the FDA stage, as we go forward with the 15 licensing process on this, will factor into our licensing 16 documents appropriate comparisons with the EPRI requirements 17 document. 18 On the other side of the coin, we have been active in 19 the EPRI requirements document area and I think I could make a 20 stronger statement than Tom made that most of the EPRI 21 requirements are reflected in our design today. j 22 MR. MICl!ELSON: But we can'P. really talk about them, l 23 yet, as a part of this PDA. l 24 MR. SHANNON: They don't have a licensing status. l 25 So, it would be difficult, I think, to a rigorous licensing. O l lieritage Reporting Corporation (202) 628-4888 l
11 ( 1 MR. MICHELSON: Could you tell me from Westinghouse ~ 2 viewpoint how you are approaching the USIs and the GIs? 3 MR. SHANNON: Our approach has been to design this 4 plan with the idea of complying with all existing NRC 5 requirements and anticipated NRC requirements. So, the thought j 6 is we are trying to anticipate resolution to a station blackout 7 and the other issues and build features into this plant to deal 8 with them. 1 9 MR. MICHELSON: Okay. So, it is fair game to ask 10 about certain USIs to see at least how Westinghouse views them 11 at the present' time? j 12 MR. SHANNON: Yes. I 13 MR. MICHELSON: Thank you. v 14 MR. WARD: Any more questions? [ 15 (No response.) 16 I think that's all, Tom. Thank you. j 17 MR. KENYON: I have a couple of brief introductory l 18 remarks regarding the Staff's review of the PRA and the SP-90. 19 In 1985, the NRC contracted with Brookhaven National l 20 Laboratories to assist us in ou review of the PRA. And after 21 interaction between Westinghouse and BNL and, of course, 22 Brookhaven. Brookhaven produced two reports which we provided l l 23 to you las month regarding the s;atus of their review. As a g i j 24 result of the information that was provided by Brookhaven, the 25 NRC's Office of Research, in accordance with our memorandum of l O Heritage Reporting Corporation (202) 628-4888
12 .() i understanding between NRR and Research, provided the draft SER 2 and the front-end portion of the PRA, which was provided to you a 3 last month, also. T 4 The Office of Research is currently putting together 5 thn draft SER on the remainder of the PRA and which will, like l l 6 I said, be provided in the April draft SER. With that ) 7 introduction, unless you have any general questions, I will I 8 turn it over to Westinghouse. We have a rather full schedule 9 and we have a lot to cover between now and 3:30. 10 MR. WARD: Okay. I think that's fine. 9 11 Let see. As far as the schedule is concerned, the 2 12 subcommittee doesn't have any problem with going beyond 3:30. 13 I don't know what your schedules are, i 14 MR. KENYON: That's fine with us. l 15 MR. WAUD Mike, do you have a problem with that? 16 MR. SHANNON: No. We can support the meeting as long 17 as it is necessary. L i 18 MR. WARD: We will just see what's necessary as we go r 19 along. 20 MR. SHANNON: I'm Mike Shannon, manager of plant and [ l 21 systems evaluation licensing with Westinghouse. And I am l l 22 responsible for the licensing prograrc on the SP-90 plant. I i 23 had planned on making just a couple of introductory remarks and I E j 24 then turning the meeting over to our engineering manager. I l 25 As Staff has stated, the purpose of this meeting is l l ( Heritage Reporting Corporation l (202) 628-4888 1 ( l I
13 () I to review the safety evaluations on the PRA for SP-90. And, as 2 Dr. Michelson pointed out, we struggled with how best to 3 structure this review, whether we should do the PRA first or 4 last. We arrived at this approach figuring that if we started S with the PRA, then-if other questions came up, a lot of other 6 questions came up that we couldn't cover off today, then at 7 least that gave us an agenda for future meetings with the 8 subcommittee. So, I think that is the best that we could do at 9 this point, considering that you have got to talk about PRA at.J 4 10 plant design all at the same time. So, that has been kind of 11 our approach. And, again, as Staff pointed out, th9re is a 12, schedule for ACRS meetings that they have put together that we 13 stand ready to support. 14 MR. WARD: Mike, just to help give some perspective, 15 when did you -- let's see. I guess I haven't quite been able 16 to figure it out. The design has been evolving, I guess, 17 continuously. Or is the design frozen now? Or has it -- 18 MR, SHANNON: No. The design is moving forward. 19 There are design activities. The final design activity and 20 just to put a handle on to differentiate between the 21 preliminary and the final really started in March of last year 22 when we started a little bit of an upgrade program with our 23 partners. And that will be kicking into full gear as this year 24 goes on. 25 MR. WARD: But the PRA was completed when? That was O-Heritage Reporting Corporation (202) 628-4888
14 p) 1 really completed sometime ago. ( 2 MR. SHANNON: 7t really was camp.1.eted in '84 or '85. 3 And what we did was our preliminary design. And we 4 differentJate, we froze it at a preliminary design is what we 5 did the licensing description on, the entire safety analysis 6 report that we submitted in modules, including the 7 probabilistic risk assessment. 8 MR. WARD: So the PRA was -- is consistent with the, 9 completed preliminary design? 10 MR. SHANNONr Yes. It is completely consistent with 11 the design we have described in our safety analysis report. 12 MR. WARD: That is the design that is going to be 13 given the design approval, so, I guess that's the question of 14 whether you are going to update the PRA as you develop the 15 final design or whether you find it necessary or what? 16 MR. SHANNON: Our plan would be to do that in the 17 follow-on activity, the FDA activity would be to start where wo 18 left off on the PDA and then go forward from there. We are not 19 attempting to make the PDA submittal a living document and 20 updating it monthly or yearly as the design is going forward. 21 MR. WARD: That clarifies it for me. 22 MR. DAVIS: I have a related question. Did you use 23 the PRA in the design process, itself? Or was it kept 24 independent of the design? 25 MR. SHANNON: No. We very much did that. Our Heritage Reporting Corporation (202) 628-4888
i 15 (]) 1 approach was -- the words we use are to use PRA as a design 2 tool. We have an iterative process going where we would look 3 at the design using the PRA as one of the things to look at it [ 4 with. And then identifying key dominant sequences or whatever, 5 going back, looking at, adding design features or subtracting 6 design features to eliminate or reduce the probability of those i 7 sequences and going back through and running the PRA again. 8 So, it has been an iterative process on our part. 9 MR. DAVIS: That has worked fairly well for you? 10 M R., SHANNON: We think so. We think it has given us a 11 real good handle on where the risk is and where it isn't, i 12 MR. DAVIS: Thank you, i l 13 MR. MICHELSON: A general question. I have seen 14 SP-90 and I have seen an SP-90 plus, I guess, and an APWR. 15 What is the difference between the three? 16 MR. SRANNON: SP-90 is the same as APWR. 17 MR. MICHELSON: Okay. What is this SP-90 plus? 18 MR. SRANNON: I have never heard of SP-90 plus. 19 MR. KENYON: Dr. Michelson, you may be thinking of 20 the System 80 plus? 21 MR. MICHELSON: Maybe that was an 80 plus. Okay. 22 What is the difference between 80 plus and 90? 23 MR. WARD: That is a different vendor. 24 MR. MICHELSON: Okay. CE is the 80. Okay, just the 25 two: SP-90 and the APWR, Those are synonymous. O Heritage Reporting Corporation (202) 628-4888
16 . () 1 MR. KENYON: Correct. 2 MR. MICHELSON: Okay. I got you. You are right. f 3 MR. SHANNON: I'm trying to get everybody in our 4 _ company to use SP-90 because APWR is a little too generic a i 5 term'-for us. SP-90 is this plant. 6 MR. MICHELSON: I was trying to see if you had 7 something in'your pocket that you were pulling out at a later 8 date and we were just playing around with this one for awhile 9 and it was gting to be a different name. 10 Okay. This is it as far as even what you will come i 11: in under advanced light water reactor.. i 12 MR. SHANNON: There is another plant that we are 13 working on in conjunction with the Department of energy. The 14 AP-600 plant, the small, passive -- i 15 MR. MICHELSON: Yes. That's wasn't -- 16 MR. SHANNON: That is not the subject of this, but ( 17 Westinghouse is very involved in that activity. l 18 MR. MICHELSON: This is the same plant that you are 19 designing with the Japanese, then? l l 20 MR. SHANNON: Yes. 4 i 21 MR. MICHELSON: Okay, thank you. j 22 (Continued on next pege.) 23 L 24 25 O Heritage Reporting Corporation (202) 628-4888
i 17 _() 1 MR. SHANNON: I think we have touched on this t. 2 discussion. I wanted to point out or remind you that we did l 3 have a full ~ committee meeting back in September of '86 where we j 4 came down and spent about six hours going through the plan l 5 design features. 6 And then in November of '87, we came down and just 7 did a brief meeting dealing with the 12 items that the ACRS had 8 indicated in their January '87 letter, 9 So there has been some discussion with the committee 10 on the plant design. 11 Our agenda this morning, as soon as I am completed 12 here, Theo van de venne, who is our engineering manager, will [ 13 opend about an hour and review the plant design features, and j ) 14 he will focus that review on those design features that have a 15 strong bearing on the problems of risk assessment. 16 So hopefully we can ease you into the PRA review that 17 way this morning. 18 In terms of the closed meeting status that you 19 mentioned before, our thought was that starting with the 20 presentation that's on the agenda beginning at 10:15, we have 21 pretty much all proprietary information from that point through l 22 the Brookhaven presentation at I think 11:15, and then the 23 afternoon session, i 14 So I think what we would like to do is close the l 25 meeting starting with the 10:15 presentation. i l Heritage Reporting Corporation j (202) 628-4888 l 4
18 .() 1 MR.' WARD: That's fine. That will be convenient. 2 MR. SHANNON: That's all I had to say at this point, 2 3 and I would itko to bring Theo up now and get started on the 4 review. 5 MR. WARD: Okay, thank you very much. 6 MR. VAN DE VENNE: My name is Theo van de Venne. I 7 am engineering manager for the -- I hate to say it -- APWR. 8 APWR really is the designation for the plant that is to be 9 built in J pan. SP-90 is the plant really that we have i 10 submitted for licensing for PDA in the United States. There I 11 are some minor differences which are really related to some 12 specific licensing requirements th'at exist in the U.S. and that 13 do not exist in Japan, or the other way around, but they are 14 relatively small, and have not too much bearing, I think, on 15 the subject matter today. l 16 One example would be we have included reactor vessel 17 level instrumentation which is really not required in Japan. j 18 So the Japanese plant would not include that. l 19 And I really can't think of any other ones that l 20 immediately come to mind. So there may be some other small 21 ones, but in general, APWR and SP-90 are identical, and we have 22 tried to keep them identical to the extent practical. 23 MR. WARD: Does the PRA tell you anything about i 24 whether the Japanese decision to not use the reactor level 25 instrumentation is a good one, or a bad one, or an indifferent () Heritage Reporting Corporation l (202) 628-4888 e I
19 (m_) 1 cno? 2 MR. VAN DE VENNE: No, I don't think so. The only 3 instances where you really get into that situation is really 4 when you are getting close to core melt, and I think it 5 reflects more on operating procedures than on actual -- I think 6 there are even plants in the U.S. that really do not rely on 7 reactor vessel level instrumentation in their operating 8 procedures. I think they may use T-set monitor or some'ching 9 like that to make the appropriate decisions. 10 So I think even in the U.S. some plants do rely on it 11 and other plants don't. It's a difficult subject, and I think 12 EPRI is wrestling with the same subject right now. I know 13 there have been several meetings, you know, whether to include 14 it or not. 15 MR. WARD: Do you think that the requirement for the 16 level of instrumentation in the U.S. design is an inappropriate 17 requirement? 18 MR. VAN DE '?2NNE: I can't say it's inappropriate, 19 no. I think it's another tool that the operator can use. I 20 think where the tradeoff has to be made is that it's my 21 understanding that there have been a number of problems in 22 operating plants with the accuracy and operational problems, 23 maintenance and that kind of stuff. And I think if there is a 24 reliable system, it has its use. 25 You know, if the system is not reliable, then you O Heritage Reporting Corporation (202) 628-4888
y;
- . p
.. ( c 1 L. ' 4 20 O -1 have to make some traeeeffs as te what vee can de. 2 MR. WYLIE: I understand the value is just in the 3 refueling, knowing what.the water. level is without having to 4 rig up to find cut and lowering the level as far as -- at least 5 'my discretion of the operators at the last utility I was with - 6 That's the only use they ever make_of it. 7 MR. MICHELSON: Well, we haven't had many accidents [ 8 to find out what its true value is wjth a lot of other accident-9 features, so it's hard to make a judgment as to whether it's-10' useful.when you-don't have many accidents. 11 MR. WARD: We had one some people thought it would l 12 have been useful. 13 MR. MICHELSON It might he'e been useful there. 14 MR. WARD: Yes. [ 15-MR. MICHELSON: Might have saved th9m a billion I 16 bucks. f 17 MR. WARD: It's a little bit of a puzzle, 18 MR. VAN DE VENNE: We have discussed, you know, the 19 appropriateness of putting PRA first or last, and obviously 20 it'c.a difficult subject. 21 What I have tried to do in my presentation is to run 22 basically through the engineer safety features which have a 23 large bearing on PRA, not exclusive. The risk is not 24 exclusively dependent on the engineer safety features. It's 25 also dependent upon the basic plant design. But to a Idrge O Heritage Reporting Corporation (202) 628-4888
21 (} l' extent, it has a bearing on it. 2 So what I am trying to do here is'run through the 3 engineer safety features and point out those things that.are 4 different from plants that cre operating today, or plants that 5 you are most familiar with, to be able to highlight later on 6-how does differences impact PRA. 7 There are other features in the APWR that I will not 8 discuss that do have a bearing on PRA. For instance, the fact 9 that we have a relatively lower power density core design, the 10 fact that 9 have a large pressurizer that's able to run 11 through transient with opening PORVs. We have a relatively 12 large steam generator that has relatively increased inventory 13 which will help you in transients. Those things are very () 14 difficult to quantify in a PRA. The fact that you have maybe ) 15 10 minutes more of inventory in the steam generator to point in 16 a particular sequence and say this is going to buy you this 17 much is very, very difficult. 18 And, in general, when we did the PRA, we haven't 19 really taken credit for those things. So we have in many cases 20 used standard PRA methodology but reflected the new system 21 features. 22 If you have, for instance, like we have an AC 23 independent seal injection, that will show up very clearly in 24 the PRA. The fact that you have low power density is very 25 difficulty to quantity. In general, we have not tried to O. Heritage Reporting Corporation (202) 628-4888
22 '(p 1 quantitled it and we have just assumed that things were pretty 2-much the way they are. 4, That's really one reason why I want to focus on the -3 4 engineer safety features because I-think because-of the 5 engineer safety features, a lot of the-sequences are different 6 and will lead to-lower core melt probability. 7 MR. MICHELSON: May I ask a general. question before 8 you get into it? 9 MR. VAN DE VENNE: Sure. 10 MR. MICHELSON: I notice you are using in many cases i 11 that you will show in just a moment four trains of fluid ~12 systems. 13 MR. VAN DE VENNE: Right. 14 MR. MICHELSON: But clarify for me. Indeed, there 15 are only two trains of electrical systems? 16 MR. VAN DE VENNE: There are two trains of emergency 17 AC power. There are four trains of emergency DC power. j 18 MR. MICHELSON: Okay. And how about the 19 instrumentation end control to the individual four fluid 20 systems? 21 MR. VAN DE VENNE: I will touch on that, but j 22 basically it's a -- 23 MR. MICHELSON: Up front I would like to have a 24 general discussion of why you didn't go four train on the 25 emergency power, for instance. eritage Reporting Corporation 1 (202) 628-4888 im ,e
23 (]) 1 MR. VAN DE VENNE: We looked -- well, first of all as 2 background, the Japanese APWR has two trains of emergency 3 electrical power. So we start at that as a reference. 4 We did consider in the Japanese plant a four train 5 emergency electrical system, and we did benefit the cost 6 evaluations which included capital cost, you know, tech spec 7 relaxation, potential tech spec relaxation, and as a result of 8 that maybe some improvement availability on the one hand, so 9 that was the benefit side, and the capital cost side. 10 On the other hand, we look at the impact on PRA. 11 In Japan, the diesel reliability has generally been, 12 you know, not perfect, but certainly good. The probability of 13 failing both diesels on a demand is about an order of magnitude 14 lower than it would be in the U.S. if you believe or, you know, 15 based on an operational experience which the data was provided 16 to us by Mitsubishi and by the utilities. 17 So in Japan, clearly there was no -- there was very 18 little incentive to include four diesels. The cost was 19 relatively high. It was -- if I remember, back in '82 - '83, 20 it was on the order of $30 million to provide a full four-way 21 separated emergency electrical system. And the benefits in PRA 22 were really tiny. 23 MR. MICHELSON: Well, did your PRA include external 24 events when you decided it was tiny benefit? 25 MR. VAN DE VENNE: No, it did not include -- O Heritage Reporting Corporation (202) 628-4888
24 (}I 1 MR. MICHELSON: Isn't that where~the big benefits 2 come and not necessarily in the hard wired systems? 3 MR. VAN DE VENNE: Well, external events -- I guess 4 seismic would be one. 5 MR. MICHELSON: Well, fire is another one. 6 MR. VAN DE VENNE: Fire is another one. 7 MR. MICHELSON: Flooding. 8 MR. VAN DE VENNE: Well, I think fire and flooding, 9 are addressed in this design by separation. 10 MR. MICHELSON: Well, we will get-to that later. T 11 don't think it did, but that's where the big benefits of 12 physical separation generally show up. 13 MR. VAN DE VENNEt Yes. 14 MR. MICHELSON: And if you haven't evaluated'those as 15 a part of your decision, then I don't think you 1: ave made your 16 decision on the right basis, that's all. 17 MR. VAN DE VENNE: Yes, I understand your point. 18 We,did look at fire protection, not for this plant 19 but for a similar plant. We evaluated the risk of fire and 20 found it to be very, very low if we had -- 21 MR. MICHELSON: That's another issue which we will 22 get into -- 23 MR. VAN DE VENNE: Yes. 24 MR MICHELSON: -- later on when that module comes 25 up. O Heritage Reporting Corporation (202) 628-4888
25 /^ ( )\\ 1 MR. VAN DE VENNE: Yes, that's appropriate. 2 (Slide.) 3 MR. VAN DE VENNE: The first system is what we call 4 the integrated safeguard system which really combines the ECCS, 5 the containment spray and the RHR systems. 6 This is a general overview of the system. If I look 7 at the features that we have here, we have four separate 8 subsystems. Each has one high-head pump, and one accumulator 9 and one core reflect tank which is basically the ECCS portion. 10 But it has a low-head pump which functions as a containment 11 spray and an RHR pump, and it has one heat exchanger which 12 operates both in the ECCS and in the RHR mode. 13 We have an in containment fuel and water storage 14 tank. Each pump has its own individual suction line from the 15 EWST diesel. We have eight suction lines. We use direct 16 vessel injection. That means we have no branch lines inside 17 containment. 18 We have included full-flow pump test capability for 19 each pump. This test capability is available during shutdown 20 or during power operation, whenever needed. 21 The system performs the function of safety-grate 22 letdown and boration, and it has a designed-in feed -- or bleed 23 and feed capability. 24 MR. MICHELSON: Question. 25 MR. VAN DE VENNE: Yes. Heritage Reporting Corporation (202) 628-4888
t 1 MR. MICHELSON: You are stating that you have four 2 . separate subsystems and, of course, we have already clarified ] l 3 that there are only two electrical systems. So there are l 4 really two subsystems, each containing two fluid trains; is 5 that right? 6 MR. VAN DE VENNE: Yes. l 7 MR. MICHELSON: Besides the electrical commonality, 8 what other supplies are only in two train configuration?
- You, 9
know, water supplies, for instance, air supplies, whatever. 10 MR. VAN DE VENNE: Well, the water supply, of course, 11 is from the in-containment refuel -- 12 MR. MICHELSON: I'm thinking now to kind of keep the 13 plant going, cooling water and so forth. 14 MR. VAN DE VENNE: Oh, cooling water. Well, I will 15 get to the component cooling and service water, but basically 16 they are -- 17 MR. MICHELSON: You are not claiming this is a four-18 train configuration, are you? 19 MR. VAN DE VENNE: No. 20 MR. MICHELSON: Okay, just the two-train. 21 MR. VAN DE VENNE: That's why I used the word "four 22 subsystems". 23 MR. MICHELSON: Okay, thank you. 24 MR. VAN DE VENNE: If we look at each subsystem in a 25 little bit more detail, the ECCS pump is the higher pump. It's O Heritage Reporting Corporation (202) 628-4888
'\\ { 27' () 1 located here. It's normr11y a line to the emergency water 2 storage tank which is an angular tank located in the base mat j 3 of the containment. 4 The pump is normally aligned on an S-signal. The j. 5 pump would start and it would deliver tnto the reactor vessel. 4 6 Similarly, the low-head pump is normally aligned for 7 containment spray duty, and it would on a start signal provide 8 containment spray. In order to prevent or minimize the 9 possibility of inadvertent spray, this discharge valve is 10 normally closed. It would open on a spray signal. 11 There is no switch over to recirculation, because the '12 pump is normally aligned to the containment. The sequence is l 13 if there is a break, water would spill on the containment 14-floor. The layout is such that it would first flood the cavity 15 below the reactor. It would then fill up to a certain level 16 inside the containment and flow back into the tank. 17 The emergency water storage tank is about 600,000 19 gallons. After about 200,000 gallons, there is enough water in i 19 the containment that it starts flowing back into the tank. 20 MR. MICHELSON: Question. On your emergency water i 21 supply you show only one isolation valve normally opened for 22 the containment. 1 23 MR. VAN DE VENNE: Right. 24 MR. MICHELSON: Why don't have have to have two i 25 isolation valves? ( ) Heritage Reporting Corporation (202) 628-4888 m.
28 () 1 MR. VAN DE VENNE: .I think isolation' recirculation 2 valves, the normal practice even in today's plant I think is to 3 have a single valve. i 4 MR. MICHELSON: Well, on the argument that that's 5 some kind of a closed system outside of-containment? What is 6 the -- what does the staff say about requirement for isolation 7 valves on containment? 8 I thought it was one. If one is normally open, you 9 have to have a second one. If it's normally closed, you don't 10 perhaps under certain circumstances. But when it's normally 11 open, which these I guess are, don't you have to have a second 12 isolation valve? 13 MR. KENYON: Sir, we don't have anybody here who can 14 answer that. It's my understanding that there are certain 15 conditions -- well, I had better not even -- 16 MR. MICHELSON: Okay, could somebody check that 17 before the end of the day just for my own edification? Why, if 18 you normally have an open isolation valve, do you not have to 19 have e second one? 20 MR. VAN DE VENNE: The other main duty of the system 21 is the normal residual heat removal function. If we need to go l 22 to RHR operation, this valve here is closed, this valve is t 23 closed, these two let-down valves are open, and we are on a 24 residual heat removal path. 1 l 25 The capacity of the various -- Heritage Reporting Corporation (202) 628-4988 l
29 () 1 MR. WARD: And that's a full-pressure heat exchanger? 2 MR. VAN DE VENNE: That is a full-pressure heat 3 exchanger.. But this path is not designed for full pressure, 4 and particularly the seal of the pump is really not designed to 5 take 2500 or 2250 PSI. 6 The normal mode of high pressure, what we could calt 7 high pressure heat removal, or bleed and feed, is to take steam 8 from the pressurizer steam space. We have dedicated bleed and 9 feed valves that are open that go into the emergency water 10 storage tank and the high-head pumps pump the water back into 11 the vessel. 12 So that's what we mean by designed-in feed, or bleed 13 and feed capability. 14 This RHR system is really designed for the normal 15. type of RHR, although its design pressure is higher than for 16 current plants. 17 MR. MICHELSON: What is the design pressure for the 18 suction -- 19 MR. VAN DE VENNE: It's Schedule 901, and that is 20 good to about 2,000 PSI assuming yield. 21 MR. MICHELSON: On the suction side of the pump? 22 MR. VAN DE VENNE: Right. 23 MR. MICHELSON: The pump suction itself, the pump 24 design is designed for 2,000 pound,s did you say? 25 MR. VAN DE VENNE: Designed, the casing and suction O Heritage Reporting Corporation (202) 628-4888
k 30 1 . piping -- 2 MR. MICHELSON: Is 2,000. 3 MR.-VAN DE VENNE: -- is around 2,000. 4 MR.-MICHELSON: So all the way back'to these 5 isolation. valves is-2,000.also. .6, MR. VAN DE VENNE: Right, right.. 7 MR. MICHELSON: The ones I-mean are on the sump. 8 MR. VAN DE VENNE: This here, yes. 9 MR. MICHELSON: Yeah, that's all'2,000 pounds? 10 MR.-VAN DE VENNE: Yes, right. 11 MR. WARD: Well, what's the point of that if the 12 seals on the pump won't take that pressure? 13 MR. VAN DE VENtlEt Well, the main reason is the V ) 14 sequence. If these vnives were to open at power by some means, 15 or were to fail, you are going to get a blow down here which 16 will go back into the emergency water storage tank. But you 17 will see some pressure at the pump. l 18 And we-have run some analysis of this event, and the 19 pressure that you will see, there is going to be a pressure 20 drop through this line and through these valves as you blow 21 down. The pump may see on the order of between a thousand, i 22 1200 PSI. l 23 Now you will get a leak under these circumstances, 24 but you will not get gross failure. 25 MR. WARD: A leak at the seals. i Heritage Reporting Corporation (202) 628-4888 i
31 [~) 1 MR. VAN DE VENNE: At the seals, but you will not get v 2 gross failure. And based on that, we can reduce the risk of a 3 V sequence in this plant. 4 MR. WARD: Okay, and that pump is inside -- that pump 5 is inside the containment. 6 MR. VAN DE VENNE: No, no, this is outside. 7 MR. WARD: Oh, okay. 8 MR. VAN DE VENNE: So a V sequence in this plant will 9 lead to a leak, but not to a major break. 10 MR. MICHELSON: I think what you said before was the 11 entire pump is designed for 2,000 pounds pressure. 12 Now the fact that the seals leak is a second matter. 13 MR. VAN DE VENNE: Right. ("N J (_) 14 MR. MICHELSON For the code requirements, you 15 have the -- the metal design, the mechanical design is 2,000 16 pounds. 17 MR. VAN DE VENNE: We will not get gross failure 18 outside containment. 19 MR. MICHELSON: You won't get any failure. You say 20 it was a 2,000 pound design. 21 MR. VAN DE VENNE: Well, you will get some leak from 22 the seals. 23 MR. MICHELSON: Only from the seal? 24 MR. VAN DE VENNE: Yes, right. 25 MR. MICHELSON: Thank you. O Heritage Reporting Corporation (202) 628-4888
32 i () 1 MR. WARD:
- Okay, So the whole idea of the high 2
pressure RHR system is V sequence protection. 3 MR. VAN DE VENNE: Right. It's not operational. 4 MR. WARD: It's not operational. 5 MR. VAN DE VENNE: It's to minimize the potential for 6 V sequence. 7 MR. WARD: I didn't understand. 8 MR. VAN DE VENNE: So I mentioned the bleed and feed 9 capability which is really -- the pressurizer is not shown, but 10 you blow down into this tank taking suction with the high-head 11 pump, and you inject it into the vessel. 12 Now this mode of operation is the only action that's 13 required is to open the PORV, or the blow-down valve. We still 14 call it PORV. 15 To open it, the pressure will be reduced and the 16 high-head pumps will come on automatically once the pressure 17 drops to about 1800, or below 2000 ISI. 18 Because this event will not lead to a major spill 19 inside containment, we feel that the reluctance of the operator r 20 to go to this mode of operation should be a lot less than it is 21 in a current plant. 22 In a current plant if you get a bleed and feed, you 23 basically spill. You know, you flood the containment. In this 24 case, you will not. So it's -- although it's not a totally 25 closed circuit, we call it a semi-closed circuit. O Heritage Reporting Corporation (202) 628-4888
33 (3 (_) 1 MR. DAVIS: Excuse me. There are a couple of 2 questions on the bleed and feed that I came across in the 3 Brookhaven report. 4 MR. VAN DE VENNE: Right. 5 MR. DAVIS: And one of them was how many PORVs do you 6 need to open to effectively institute feed and bleed? 7 MR. VAN DE VENNE: Yes, it's a little -- we have 8 three PORVs, and we have four high-head pumps. But the four 9 high-head pumps are really electrically, are two and two. And 10 I think in the response we provided to Brookhaven was that we 11 would have to open all three PORVs and have two high-head pumps 12 operating. 13 So the success was opening all PORVs, and having two N-14 high-head pumps operating. 15 Since that time we ran some analyses on bleed and 16 feed, and another success would be to open two PORVs and have 17 all four pumps running. 18 So we can either take one single failure in the 19 PORVs, or we can take one single failure in the electrical 20 power supply. In either case we will still have adequate heat 21 removal capability out, you know, indefinitely. 22 MR. DAVIS: Second question. 23 On the PORVs I understand you have automatic block 24 valves downstream? 25 MR. VAN DE VENNE: Right. O Heritage Reporting Corporation (202) 628-4888
i 34 -( ) 1 MR. DAVIS: Do you normally operate with those open 2 or closed? 3 MR. VAN DE VENNEr Normally open. And the block 4 valves are blocked if there is a manual bleed and feed ~5 operation. In other words,.if the operator goes to manual 6 bleed and feed, which is a button on the control board, the 7 block valves are not operable. 8 MR. DAVIS: They are locked open. 9 MR. VAN DE VENNE: They are locked open in that mode. 10 There would have to be an operator action to close them. 11 Okay? 12 MR. DAVIS: Thank you. 13 MR. MICHELSON: Do the safety valves on the reactor 14 side also dump the emergency water tank? 15 MR. VAN DE VENNE: Currently, yes, yes. 16 MR MICHELSON: Does that mean you are thinking of 17 not dumping into the tank? 18 MR. VAN DE VENNE: There has been some thought given 19 to -- in the Japanese plant there has been some thought given 20 to discharging directly to containment. 21 And the reason is, is really that these spargers are 22 getting very large with that kind of flow, and we try to 23 minimize any structural problems in EWST. And the safety 24 valves, at least as far as Westinghouse and Westinghouse 25 licensee plants are concerned, there has never really been an O Heritage Reporting Corporation (202) 628-4888
J 35 ( ) 1 instance of safety valve opening. 2 MR. MICHELSON: How about leaking? 3 MR. VAN DE VENNE: There is leaking, but in the case 4 of the safety valves here, they would have a safety valve with 5 a low pressure rupture disk, say 100 PSI rupture disk. 6 MR. MICHELSON: That won't help you any. If the 7 valve is leaking, it will soon blow the disk. 8 MR. VAN DE VENNE: No, if there is a leak off from 9 the -- that goes to the reactor cool and drain tanks. So ,10 that's an idea that's being considered, but that hasn't been 11 implemented in this design. 12 MR. MICHELSON: Okay. 13 MR. WARD: Well, what about the adequacy sequence -14 where you are relieving though the SRVs. They would be pretty 15 exciting in the emergency water storage tank then, huh, I 16 guess? 17 MR. VAN DE VENNE: Right. Right now in this design 18 it would discharge in the emergency water storage tank. If we 19 change the design to direct containment discharge, it would 20 discharge directly into containment. 21 MR. WARD: But I mean do you have a structural 22 problem in the angular tank under those conditions? 23 MR. VAN DE VENNE: It can be designed, but it becomes 24 rather massive. 25 MR. WARD: Well, what does the design say about it O Heritage Reporting Corporation (202) 628-4888
i i i 36
- ()
1 ~ tight now? 2 MR. VAN DE VENNE: Right now we have them -- we_have 3 them in the tank, so we would have to design for it. But one 4 of the reasons we are looking at changing the design is to 5 minim 1Le the -- you know, the kind of structural problems. I i 6 The PRVs are relatively slow opening, and the safety l 7 valves, you know, it's almost instantaneous, so you get a 8 really huge blow down, and that's one -- h 9 MR. MICHELSON: I guess you have looked at the uplift + 1 10 of the water and that sort of thing. 11 MR. VAN DE VENNE: Right. l 12 MR. MICHELSON: And on that slab, and maybe -- 13 MR. VAN DE VENNE: It's big blows. It can be f 14 designed -- we have concluded it can be designed for it, but it 15 becomes rather massive, and we would like to avoid that i 1 16 complication if possible. So that's one thing that we are j I 17 considering. [ 18 MR. WARD: Sounds like a familiar problem. [ 4 e 19 MR. VAN DE VENNE: Right, it is a familiar problem. [ i 20 MR. WARD: I was a little slow. Could you show mo 21 the path from the PORV to the suppression pool? f 22 MR. VAN DE VENNE: Right, now the PORV is on the I 23 pressurizer. i 24 MR. WARD: Yeah. i 25 MR. VAN DE VENNE: It goes into the pressurizer a (:) Heritage Reporting Corporation j (202) 628-4888 [ i I i
37 (} 1 relief tank, and from the pressurizer relief tank there is a 2 rupture disk that opens and from the FRT, the pressurizer 3 relief tank,'it would go into this tank. 4 MR. WARD: Okay. 5 MR. VAN'DE VENNE: So there is an intermediate stage 6 there that would tend to -- 7 MR. WARD: And that PRT looks sort of like the 8 existing -- 9 MR. VAN DE VENNE: It's the same as the current PRT. 10 ~~ MR. WARD: Okay. But the difference is it relieves 11 through that line there. 12 MR. VAN DE VENNE: Instead of a rupture disk that 13 opens to containment, we have a rupture disk that opens to a 14 pipe that leads down to the EWST. 15 MR. WARD: So that PRT itself has the capacity to 16 handle whatever -- I don't know -- whatever intermediate 17 pressure you get under that circumstance. 18 MR. VAN DE VENNE: Right. Yes. 19 MR. WARD: Is that right? 20 MR. VAN DE VENNE: I think the rupture disk opens at 21 150 PSI or so. 22 MR. WARD: Yes, but conceivable the pressure in that 23 vessel could be much higher than that. 24 MR. VAN DE VENNE: The pressure in that tank could be 25 much higher than that when a safety valve here, yeah. O Heritage Reporting Corporation (202) 628-4888
38 (]} 1 1 think on a PORV opening, the tank may last 30 2 seconds or so, or 40 seconds. On a safety valve opening, the 3 tank would only last a few seconds and it would rupture, the 4 disk would rupture. It's a very short for safety valve type 5 discharge. 6 MR. MICHELSON: Does the safety valve actually also Y 7 go to the relief tank? 8 MR. VAN DE VENNE: Yes. 9 MR. MICHELSON: Okay, in both cases. 10 MR. VAN DE VENNE: That's common for current designs 11 too. 12 MR. MICHELSON: Yes, yes. 13 (Continued on next page.) ) 14 15 16 17 18 19 20 21 22 23 24 25 O Heritage Reporting Corporation (202) 628-4888
J 39 1 MR. VAN DE VENNE: The only other item I would I () 2 mention is what we call emergency let-down paths. There are 3 only two of these paths, and they would be used during safety 4 grade cold shut-down, in which case we add borated water via 5 the high head pumps, and we would relieve water into the tank. 6 This is a relatively small flow. I think that it is a three 7 inch line. It is an orifice that we are talking about, a few 8 hundred GPM. And it is basically there to allcw boration of 9 the plant independent of the chemical and volume control 10 system, which in our case is not safety related. 13 MR. WARD: Now is this whole system that you are 12 showing here including the feed and bleed capability all 13 regarded as safety grade in the design? k_) 14 MR. VAN DE VENNE: Everything is safety grade, yes, 15 including the specialized relief capability. 16 MR. DAVIS: Could you say a couple of words about why 17 you felt that you needed both core reflect tanks and 18 accumulators? 19 MR. VAN DE VENNE: The accumulators take the normal 20 function of refilling the lower plenum and the downcomer 21 following a large LOCA. So you want to refill these relatively 22 quickly. Now we do not really have low head pumps. We only 23 have high head pumps. And once the downcomer and the lower 24 plenum are refilled, you have got to reflood the core. 25 And you need on the order of in this plant 500 pounds Heritage Reporting Corporation (202) 628-4088 l
t 40 l [} 1 a second. 'And to design high head pumps that have that 2 capability is possible but rather wasteful. The pumps would 3 get to be very, very large. l 4 Now once the core is reflooded, all you really need j 5 to do is really remove the K-heat. And that is on the order of j 6 100 pounds a second, about a 100 pounds the second. 7 So the choice that we had was either to have high r 8 head pumps that are designed to meet the flow requirement once j i 9 the accumulator is empty and have very large high head pumps, 10 or to provide an intermediate tank that would run for about 11 ten to fifteen minutes to reflood the core, and then size the 12 high head pumps for whatever flow requirement exists at the 13 time. () I 14 So it is really an economic evaluation that we did I 15 that led to this particular design. Now the core reflect tanks i 16 are useful in that if the pumps would not start, it would give l 17 you maybe half an hour before you get into a situation where 18 you would uncover the core. They are completely passive, i l l 19 So if you have a large LOCA and you lose power, the [ i i 20 diesels would not start, and it would give you an additional I 21 window. Again in PRA space, that is probably a small benefit, 22 but it is there. So these tanks are passive. The core reflect r 23 tanks are 200 psi, and they provide initially about 500 pounds t l 24 a second. And their flow delivery, of course, tails off until [ 25 after about ten to fifteen minutes, they are empty. I I l O Heritage Reporting Corporation [ 4 (202) 628-4888 t 5
41 A'(). 1 MR. MICHELSON: A question on EWST. You show the 2 little doghouses of some sort coming out around the valves. 3 Where is the boundary area, are there two boundaries? 4 There is just a screen there. 5 MR. VAN DE VENNE: This is a fine screen, t 6 MR. MICHELSON: No, I am talking about the doghouse 7 out on the valve. 8 MR. VAN DE VENNE: Oh, here. These ere the double 9 guard pipe and the cans around the valve that are typical. 10 MR. MICHELSON: What side of the valve on, is it 11 considered to be inside a containment, is that the idea? 12 MR. VAN DE VENNE: It is considered to be really 13 inside the containment. 7s 14 MR. MICHELSON: But yet it is not underwater 15 obviously. 16 MR. VAN DE VENNE: Yes, right. That doghouse is an 17 extension of the containment. 18 MR. MICHELSON: But it is not underwater. 19 MR. VAN DE VENNE: Oh, no, no. It is dry, 20 MR. MICHELSON: Then it is a separate containment 21 vessul outside of the normal containment vessel. It has got to 22 be dry. 23 MR. VAN DE VENNE: It is dry, it is dry. It is not 24 open. 25 MR. MICHELSON: So it is an appendage to the O Heritage Reporting Corporation (202) 628-4888
42 (^T 1 containment, but not open to the containment. %) 2 MR. VAN DE VENNE: Not open to the containment, 3 right. 4 MR. MICHELSON: It is another containment. 5 MR. VAN DE VENNE: Right. It is connected to the 6 liner of the containment. 7 MR. MICHELSON: Okay. 8 MR. VAN DE VENNE: That is really the same as the 9 current plant. Now that is one of the EPRI requirements that 10 we would like to eliminate. 11 MR. MICHELSON: I think that is why you can get by 12 with the one normally open valve, but the staff is going to 13 tell us for sure what the criteria is. 14 MR. VAN DE VENNE: Okay. 15 MR. MICHELSON: But that is open, it is an 16 environment of its own. 17 MR. VAN DE VENNE: Right. 18 MR. MICHELSON: Is it sealed? 19 MR. VAN DE VENNE: Yes. The main purpose is if you 20 close this valve and the valve stem would leak, that you would 21 not leakage that would be basically uncontained. That is my 22 understanding of what the purpose of that can is. 23 MR. MICHELSON: Later on when we talk about 24 containments, I have a number of questions about it. Leaks 25 when it is under a 2000 pressure at the time, how do you O Heritage Reporting Corporation (202) 628-4888
43 () I relieve the containment because it is a closed box and so 2 forth. I guess that you have got to figure out all of those 3 things. Okay, thank you. That clarifies what your appendage 4 i s.- 5 MR. VAN DE VENNE: Yes. The only other thing that I 6 would like to mention is this line here which is the test line, 7 which is one closed gate valve and one swallow valve which also 8 is normally closed, which allows testing of either pump in a 9 ciosed path to the EWST. So you can test each pump at any 10 point on its curve. And that is what we mean by full flow test 11 capability which is built in. You can do that at power or at 12 shutdown, whatever. 13 MR. MICHELSON: What is the design pressure then for 14 the suction side of your high head pump? 15 MR. VAN DE VENNE: The suction side of the high head 16 pump is low pressuro pipe. 17 MR. MICHELSON: By that, you mean 100 poundc? 18 MR. VAN DE VENNE: 150 or 151, Schedule 1, 19 Classification 151, 20 I should mention that the containment shown here, and 21 I really do not have a separate slide on that, but the 22 containment fan cores in this plant are also safety grado, and 23 provide another means of removing heat from the containment. 24 There is no containment spray heat exchange per se. 25 And you know, the EPRI requirements were brought up. O Heritage Reporting Corporation (202) 628-4888
i 44 i O 1 If you look at Chapter 5 of the EPRI requirements, this system 2 is in compliance with what is written there on ECCS and RHR f 1' 3 except for that one item. C The major exception is that EPRI would 1the to see j 4 ) 5 spray heat exchanges and non-safety grade fan cores. That is a 6 difference that needs to be reconciled at the appropriate time. r 7 But that is really the only major difference. In other words, 8 EPRI requirements specify an emergency water storage tank, 9 four high head pumps, direct vessel injection, pump dust 10 capability. -All of these things are required, and they are in f 11 this design. 12 The next item that I would like to discuss is what we 13 call the secondary safeguard system, which in our ccse we mean 14 to include everything associated with the steam generator. And 15 there are two pieces to that. That is the steam generator ( 16 isolation system, and there is the backup feedwater supply. [ 17 The steam generator isolation system is fairly, j 18 conventional. The main steam lines have a two-way isolation f 19 valve. They have one power operated relief valve, this block l 20 valve, and I should mention here that these are safety grade, [ 1 21 and five safety valves. I d l 22 Each feedwater line has a check valve inside 23 containment, an isolation valve outside containment, and a i 24 control valve which is located in the turbine building and t 25 which is not non-safety. i O Heritage Reporting Corporation (202) 628-4888 } i i I
45 () 1 The major change in this design is on the steam 2 generator where we have an overflow line to the EWST, which 3 actuates automatically on high-high steam generator level and 4 is'for tube rupture mitigation. 5 MR. MICHELSON: Before you leave that, on your 6 overfill protection. It apparently is just an overfill 7 protection. 8 MR. VAN DE VENNE: Right. 9 MR. MICHELSON: And is it designed for valve wide 10 open main feedwater? 11 MR. VAN DE VENNE: No. 12 MR. MICHELSON: Then how do you protect against valve 13 wide open main feedwater? Since your trip mechanisms, all they 14 do is open up the overflow path, and they do not etop the flow 15 from coming into tho generator. Which is the main way that you 16 will get into an overfill, by the way, is that you lose your 17 air or whatever, and your valses go wide open, and your turbine 18 drive does not trip, and you fill a generator and flood the 19 lines. That is the scenario that we generally have considered 20 in that particular USI, and this does not provide any 21 protection against that. ?2 MR. WYLIE: Are you using turbine driven feed pumps? 23 MR. MICHELSON: I assume that they are turbine drive. 24 MR. WYLIE: I do not think so. 25 MR. VAN DE VENNE: The EPRI requirements. At this O Heritage Reporting Corporation (202) 628-4888
j i 46 (} 1 plant, we really do not -- 2 MR. MICHELSON: Turbine driven would not make any 3 difference anyway. } i 4 MR. VAN DE VENNE: The EPRI requirements do require 5 motor driven feed pumps which is really a pretty strong -l 6 departure. l .i i 7 MR. MICHELSON: It would not make any difference if l 8 you do not trip them. i 9 MR. VAN DE VENNE: The Japanese plan has turbine 10 driven. I 11 The main feedwater isolation, there are three ways of e 12 isolating main feedwater, which is to stop the pump. 13 /R. MICHELSON: I know how you could do it. The L () 14 question is how do you do it when you are getting into an 1 15 overfili. j 1 16 MR. VAN DE VENNE: The main feedwater isolation in I l 17 this plant is done by closing this valve and tripping. l j 18 MR. MICHELSON: But I did not gather that it is done 1 19 on overfill. The overfill signal does not trip the main ] 20 feedwater line. It only opens up the bypass of the drain line, j t 21 as I understood it. j i 22 MR. VAN DE VENNE: I cannot answer the question, h 4 i 23 MR. MICHELSON: Well, it is a question maybe before j i 24 the end of the day again that you could clarify. It is written 25 up in your report. It appears that the overfill protection has I l I () Heritage Reporting Corporation (202) 628-4888 l I
a 47 () 1 got a very nico electronic arrangement. It has drain valves, I 2 think two four inch drain valves that take the water away. 3 MR. VAN DE VENNE: Yes. 4 MR. MICHELSON: But it did not say anything about 5 what happens when it is being overfilled by main feedwater, 6 because that would not be big enough to spit in the window 7 even. 8 3R. VAN DE VENNE: No, it would t.ot-But the main 9 intent the overfill protection system here is really tube i 10 rupture. 11 MR. MICHELSON: So if you tell me that this overfill 12 protection also does trip tut w>in feedwater supply, then that 13 is great. 14 MR. VAN DE VENNE: We would have to chuck that. 15 MR. MICHELSON: Yes. 16 MR. WYLIE: These are then turbine driven feed pumps i 17 in your design. 18 MR. VAN DE VENNE: Well, in our design, our submittal 19 is nuclear power block. And we have specified the interface 20 requirements on the turbino plant. So basically the scope of 21 this SP-90 is a nuclear island including the structure and 22 including all of this. But it basically ends here, and the 23 rest is specified through interface requirements. 24 And I am not quite sure what is in there with regard 25 to this particular item. However, main feedwater isolation l () Heritage Reporting Corporation (202) 628-4888 l
48 3-(s) 1 should be part of our scope, of the nuclear power block scope. 2 And these valves certainly are in our scope, and they could be -3 actuated. I just do not know whether they are in relation to 4 the problem that you have mentioned, and which I am really not 5 very familiar with, to be_ perfectly honest. 6 MR. MICHELSON: They were not identified in your 7 report as being isolated. 8 MR. WARD: So you ar saying that one can do a PRA on the design without knowing whether the main feedwater pumps are le electric or turbine driven? 11 MR. VAN DE VENNE: As far as tripping these pumps, I 12 do not think that it really makes a difference. If you want to 13 shut off the pumps, you provide a signal, and there is a 14 certain probability that they will stop. Now I do not know 15 whether the probability is largely diff? rent from whether these 16 pumps are turbine driven or motor driven. I would think not. 1.1 MR. MICHELSON: I think that it would make quite a 18 difference in the scenario if you overfilled the main steam 19 line, and that water runs down into that turbine driven 20 feedwater pump. You know, if it is turbine driven and you do 21 not trip it and you do not isolate it, the water will go into 22 the pump, and that gets kind of exciting too. 23 MR. VAN DE VENNE: Well, of course, if you overfill 24 the generator, there is much need for feeding that generator 25 for quite awhile. O i Heritage Reporting Corporation I (202) 628-4888 m
49 () 1 MR. MICHELSON: That is not the excitement that I 2 worry about. I worry about rupturing a pipe out outside of 3 containment with a further aggravation of the other things that 4 are happening. Including if you do not isolate your auxiliary 5 feedwater at the same time, that 3.ou might blow the auxiliary-6 feedwater pump, and that is right down in the basement of where 7 your safeguard systems are. 8 So I think that it makes quite a difference in the 9 scenario. That is the whole reason for the USI is to get this 10 straightened out. 11 MR. VAN DE VENNE: Well, the reason that I am saying 12 whether you have turbine driven or feedwater driven is if you 13 want to stop that pump, that you will have to provide a signal 14 to stop the pump. What I am saying is that even if you provide 15 a signal, there is some probability that the pump will not in 16 fact not stop. And I do not know if that probability is very 17 different for turbine driven or motor driven pumps. 18 MR. MICHELSON: But if it is turbine driven, the 19 consequence can be quite different. On the electric driven, 20 you will not add to your aggravation, because no water can 21 enter a turbine and blow it up. But if it is electric driven, 22 you are in much better shape from that particular viewpoint. 23 MR. WARD: You mean it would have implications for 24 sort of long-term control of the incident. 25 MR. MICHELSON: Well, aggravation. Further expansion O Heritage Reporting Corporation (202) 628-4888
50 f) 1 of the incident now into-the' rupturing outside of containment-2 of one of the main steam feedwater pumps and whatever it does,. 3 and also the auxiliary feedwater pump which is even more 4 worrisome. And that is why we have got the USI dealing with 5 overfill of the generator. 6 MR. VAN DE VENNE: Which specific USI is this? 7 MR. MICHELSON: That is A-47. You probably have not 8 done anything with it, because it is just now reaching 9-resolution and it still in the argumentative stage in fact. 10 But you will address it, I assume, before this plant gets'a 11 PDA. 12 MR. VAN DE VENNE: The steam generator overfill 13 protection, the gentleman asked the question about did we use 14 PRA in the design. It really is an example of a feature that 15 was added based on PRA. Because after we had improved the 1 16 supply of feedwater, and we had improved the ECCS, and we 17 improved the RCP seal injection reliability, it was found that 18 in fact the tube rupture was becoming a dominant sequence. It 19 was taking 99 percent of the risk. 20 And the scenario that provided the risk was failure i 21 of the operator to maintain a steam generator level at an i 22 appropriate value, and overfilling the steam lines and 23 discharging water through the safety valves. That became the 24 limiting scenario in this design which was responsible for 25 90 or 99 percent of the risk. ( Heritage Reporting Corporation (202) 628-4888
51 1 So in response to that, we did add this overfill ' (} 2 which can handle several tubes ruptured, and maintain the steam 3. generator level below where it can get into the steam lines. 4 And its actuation is automatic on high-high wide' range steam 5 generator levels. 6 MR. MICHELSON: Now you will be blowing down I guess 7 from time to time steam through that line, liquid, or steam 8 liquid, or mixed? 9 MR. VAN DE VENNE: Yes. 10 MR. MICHELSON: And you are going to design those 11 valves I guess for that kind of a service. 12 MR. VAN DE VENNE: Yes, right. 13 Again if the operator handles a steam generator tube () 14 rupture in an efficient manner, this line would really not have 15 to open. Because if he equalizes pressure quickly enough, you i 16 will not get a large inflow of primary water into the 17 generator. But it is there to basically handle those abnormal 18 cases where the operator does not perform well. 19 MR. WARD: What is the capacity of that in terms of i 20 how many tube ruptures it can handle? 21 MR. VAN DE VENNE: It can handle about between four 22 and six tube ruptures depending on the size of each flow. t 23 The only other things that I want to mention here is 24 the connection to the start-up feedwater, what we call 25 start-up feedwater, and the connections for emergency. l Heritage Reporting Corporation (202) 628-4888 l l
52 ( )- 1 Feedwater, that is a. system that I will get to on the next 2 overhead. 3 The traditional auxiliary feedwater system here has 4 been split up into really two systems,'a start-up feedwater 5 system and an emergency feedwater system. In most plants 6 today, the auxiliary feedwater is used during start-up, during 7 cool-down, during reactor trip situations, and in accident 8 situations. 9 The intent here is to use the start-up feedwater 10 system during start-up and cool-down, and following a reactor 11 trip. And to use the emergency feedwater system during a lost 12 of off-site power or any accident scenario, faulted generators, 13 small breaks, whatever. 14 So normally, we try to rely on the start-up feedwater 15 system which takes suction from a dearating heater in the 16 turbine building, which provides heated water to the steam 17 generators, and therefore lainimizes any potential for feedline 18 cracking and stratification problems. As an alternate source, 19 this pump can take suction from the condensate storage tank, 20 and it is a singlo pump. 21 MR. MICHELSON: It is electric driven, is it not? 22 MR. VAN DE VENNE: Single electric driven pump. 23 The emergency feedwater system has two motor driven 24 pumps, and two turbine driven pumps, and two dedicated storage 25 tanks, which are located inside the building. O Heritage Reporting Corporation (202) 628-4888
~ 53 .I ) 1 The design features are summarized on the next slide, ~2 and I also have a more detailed flow diagram of
- emergency 3
feedwater system. 4 I mentioned the start-up feedwater system. One motor 5 driven pump, suction pump, dearating heating. -It starts-6 automatically on a reactor trip. And it includes automatic 7 steam generator level control. This in operating plants is 8 shown to be a problem, the level control. It is generally done 9 by manually starting and stopping the aux feed system. In this 10 case, it is automatic level control. 11 MR. MICHELSON: On the overfill protection that you 12 have added, would it handle the inadvertent operation of the 13 start-up feedwater system? 14 MP. VAN DE VENNE: Yes, it would have sufficient 15 capacity for that. 16 MR. MICHELSON: It is big enough for that, is it not? 17 MR. VAN DE VENNE: Right. 18 MR. MICHELSON: Thank you. 19 MR. WARD: The automated level control is by starting 20 and shutting down the pump or by valve? 21 MR. VAN DE VENNE: By valve, modulating valves, 22 dedicated modulating valves specifically for this system. 23 MR. WARD: What is the capacity of the start-up 24 feedwater pump versus the emergency feedwater pumps? 25 MR. VAN DE VENNE: The start-up feedwater pump is a O Heritage Reporting Corporation (202) 628-4888
54 () 1 900 GPM pump, and each emergency feedwater pump delivers about 2 350 GPM. So it is quite a bit larger in an emergency feedwater 3 pump. 4 The start-up feedwater pump is designed, given the 5 most. unfavorable level in the steam generator at the point of 6 reactor trip, is to prevent hitting the level in the steam 7 generator where you would get concern and where you have to 8 start the emergency feedwater pumps. So it really prevents the i 9 steam generator from losing too much level after a trip. 10 Generally, the sequence will be that you lose level. 11 After a trip and the start-up feedwater pump comes on, you 12 would lose level in a steam generator for about five minutes or 13 so. After that time, you would pretty much stabilize. And O.. 14 after about fifteen minutes, you would start exceeding the 15 K-heat and you would be starting to add level in the steam 16 generator again. 17 MR. WARD: So it matches the K-heat at about five 18 minutes post-trip? 19 MR. VAN DE VENNE: Right. 20 MR. WARD: And you have got enough inventory. 21 MR. VAN DE VENNE: You have got enough inventory that 22 you would not reach the set point, but you would actuate this l 23 emergency feedwater system, which you really do not want to do 24 following a trip. 25 MR. WARD: All right. Ov l Heritage Reporting Corporation (202) 628-4888
J 55 ( )- 1 Now what about the 350 GPM pumps then, what does that 2 mean? 3 MR. VAN DE VENNE: One pump would be sufficient 4 following a trip. You would not match the K-heat until much 5 later. But there is enough inventory in the steam generators 6 that one pump could maintain the plant in a safe condition. 7 MR. WARD: You obviously go much lowar in the steam 8 generator level. 9 MR. VAN DE VENNE: You go much lower in level, but 10 you would not have any concerns at this point. 11 And I mentioned the emergency feedwater system, two 12 motor driven and two turbine driven pumps and two feedwater l 13 storage tanks. And again, we have the separation between the b \\_/ 14 two subsystems. We have included cavitating venturies to limit 15 the flow. And we also have automatic isolation of a faulted 16 steam generator. 17 MR. MICHELSON: The overfill protection, is it going 18 -to be safety grade? } 19 MR. VAN DE VENNE: Yes. 20 MR. MICHELSON: It will be functional at all times? l 21 MR. VAN DE VENNE: Right. 22 MR. MICHELSON: Thank you. 23 MR. WARD: Now how are those divided up, the 24 emergency feedwater system, is that divided into two with a l l 25 separate electrical supply? O Heritage Reporting Corporation (202) 628-4888 l
{ 56 ) 1 MR. VAN DE VENNE: Right. 2 MR. WARD: Maybe-you are going to show that. 3 MR.. VAN DE VENNE: That is the.next figure. .] 4 MR. WARD: That is fine. -5 MR.. VAN DE VENNE: We have the two tanks, and the one 6 motor driven pump, and the one turbine driven pump for the 7 subsystem. And basically, between these two subsystems, there' 8 are no interconnections, except that'~we can manually 9 interconnect the tanks to have some flexibility in water 10 storage. 11 The tank sizing is based on safety grade cold 12 shut-down, the usual six hours at hot standby, plus a number of 13 hours of boration, plus a numbar of hours of cool-down. So n k_) 14 that is the sizing basis for the tank. The make-up of these 15 tanks is provided through the condensate storage tank, which is 16 not safety grade, but it does provide the means of make-up. 17 Each turbine driven pump is only connected to one 18 steam generator, to its associated steam generator. And the 19 cavitating venturies are located here. They basically limit 20 the spilled flow to a faulted generator to prevent the pumps 21 from running out. 22 And these valves which are normally open isolate a 23 faulted generator. Thay operate on high delta between 24 generators, which would be an indication of a fault. 25 There are some manual cross-connects here to allow O Heritage Reporting Corporation (202) 628-4888
57 ) l' the operator say in a black-out scenario where only the turbine 2 pumps would work to feed more generators if they so desire. It 3 -is not really necessary, but it does provide a little bit 4 better to prevent steam generators from dry-out. 5 MR. DAVIS: On that issue, how long can you operate 6 this system on loss of all AC? 7 MR. VAN DE VENNE: The turbine driven pumps are 8 independent of AC/DC or air. They are purely mechanical 9 devices. These inlet valves here open on loss of DC, for 10
- instance, 11 MR. DAVIS:
DO you not need DC to control level in a 12 steam generator? 13 MR. VAN DE VENNE: Level control is not really 14 automatic. On emergency feed, it generally runs and it is not 15 automatic. Any level control would have to be done by the 16 operator. Now he would need to control these valves here 17 either remotely or locally. 18 MR. DAVIS: You will not know what the level is, if 19 you do not know the level. 20 MR. VAN DE VENNE: Well, you know the level from your 21 INC. 22 MR. MICHELSON: You have lost power, I thought that 23 you just speculated. You do not need power to make this thing 24 work. But you do need level though I think to make it work, 25 and you need power to have level. O Heritage Reporting Corporation (202) 628-4888 4 x-
58 '_) \\ 1 MR. VAN DE VENNE: If you lose all DC power you mean 2 in the plant? 3 MR. MICHELSON: For instance. 4 MR. VAN DE VENNE:' Then you would not really have 5 level indication, 6 MR. DAVIS: And you could not operate the system? 7 MR. VAN DE VENNE: Well, the system would operate 8 itself. The question that the operator would be faced with is, 9 does he want to swallow back the system. 10 MR. DAVIS: Well, how long is your DC battery live? 11 MR. VAN DE VENNE: Eight hours. 12 MR. DAVIS: Eight hours? 13 MR. VAN DE VENNE: Yes. \\ 14 MR. DAVIS: In the Brookhaven report, there was a 15' suggestion that you had assumed that you could operate this 16 system successfully for 24 hours after loss of all AC. 17 MR. VAN DE VENNE: After loss of all AC. 18 MR. DAVIS: But you lose batteries in eight hours, 19 and I do not see how you can operate it after eight hours. 20 MR. VAN DE VENNE: It would be difficult. 21 MR. MICHELSON: It would be totally blind. 22 MR. VAN DE VENNE: You would be basically blind. The 23 only way, if you had no indication whatsoever, it would be very 24 difficult to do it. Well, maybe when we get to the PRA, we 25 should look at the success criteria. I do not believe that you O Heritage Reporting Corporation (202) 628-4888
59 1 get to eight hours and you are getting to a cliff where you '( } 2-fall off. You can operate. If the level in the steam 3 generator is at eight houra, roughly at nominal, you may be 4 able to go another four hours before you either dry out or 5 overfill. But I do not know how long that is. 6 MR. MICHELSON: Do these turbines use electronic 7 governors? 8 MR. VAN DE VENNE: No, mechanical. 9 MR. MICHELSON: Only mechanical? 10 MR. VAN DE VENNE: Yes. 11 MR. MICHELSON: At all times? 12 MR. VAN DE VENNE: Yes. 13 MR. MICHELSON: What type.of turbine do you have in ) 14 mind? 15 MR. VAN DE VENNE: This is a turbine driven feed pump 16 which is an integral turbine pump unit. And it is not the 17 usual unit where you have a turbine and a pump. 18 MR. MICHELSON: Have you ever used one of these 19 before? 20 MR. VAN DE VENNE: They are used extremely 21 extensively on ships. They are basically boiler feed pumps on 22 ships. 23 MR. MICHELSON: So it is some new design that has not 24 been used in nuclear plants? 25 MR. VAN DE VENNE: No. These pumps, believe it or 1 Heritage Reporting Corporation (202) 628-4888
r 60 ({ J 1 not, have_ existed for forty or fifty years. 2 MR. MICHELSON: No, I do not doubt that.. I am aware 3 of that. 4 MR. VAN DE VENNE: There are hundreds of them. The 5 Japanese plants use this particular turbine driven pump their 6 plants, and they have been very satisfied with it. It is a 7 manufacturer in New Jersey. 8 MR. MICHELSON: In their nuclear plants? 9 MR. VAN DE VENNE: Yes, they use it in their nuclear 10 plants. The only real problem that we have right now is that 11 this vendor does not have an end stamp, and we would have to 12 get to some arrangement where these pumps are built and 13 qualified by Westinghouse.. ) 14 MR. MICHELSON: Lo they have redundant overspeed 15 trips that are mechanical and that sort of thing? 16 MR. VAN DE VENNE: Well, that is too detailed a 17 question for me. 18 MR. MICHELSON: But they will eventually be safety 19 grade? 20 MR. VAN DE VENNE: Right. 21 MR. MICHELSON: And will not require any electric 22 power to operate? 23 MR. VAN DE VENNE: Right. 24 MR. MICHELSON: And how do you start them then? 25 MR. VAN DE VENNE: You just open the emission valve. {Nl i Heritage Reporting 3rporation (202) 628-4888
61 1 MR. MICHELSON: But you have to go down to the local 2 station and open that particular valve? 3 MR. VAN DE VENNE: Well, like I mentioned, this valve 4 is a fail open valve, which means that -- 5 MR. MICHELSON: Well, I sincerely hope that it does 6 not fail on loss of air when you start all of these things up. 7 MR. VAN DE VENNE: No, the valve is held open 8 by -- oh, it is a solenoid valve, it is a solenoid valve, so if 9 you lose AC. 10 MR. MICHELSON: If it is solenoid operated, it is an 11 air operated valve. 12 MR. VAN DE VENNE: Yes, right. 13 MR. MICHELSON: It has a solenoid set on it, p) _ ( 14 obviously. But if you lose the air or if you lose power, this 15 valve props open and the turbine starts. 16 MR. VAN DE VENNE: Yes. 17 MR. MICHELSON: And that may or may not.be very 18 desirable, but that we will get into later. 19 MR. WARD: If you lose air, it does not necessarily 20 open. 21 MR. MICHELSON: Sure, it will. It is a fail open 22 valve and it is air operated, as shown on the drawing. It has 23 to. 24 MR. DAVIS: How long did you say that your emergency 25 feedwater tanks are good for? Heritage Reporting Corporation (202) 628-4888
62 1 MR. VAN DE'VENNE: Well, I mentioned that the design- {) 2 basis is a safety grade cold shut-down which I think.is twenty 3 hours, but that includes a cold shut-down. At hot standby, 4 they are probably good for about thirty hours or so. They do 5 exceed battery life. 6 MR. WARD: Well, let's see now. If you were in this-7 post-eight hour situation and these pumps would tend to be 8 running just full out, would they not? 9 MR. VAN DE VENNE: No, I do not think so. I think 10 that the operators would have throttled back the pumps in this 11 scenario to sort of maintain level at nominal. So the pumps 12 would be running probably at like half capacity or something 13 like that. One would really have to run a transient to N 14 determine. 15 MR. WARD: Okay. Your argument is that the operators 16 would have zeroed in on the appropriate flow before you ran out 17 of the battery. 18 MR. VAN DE VENNE: Yes. 19 MR. WARD: So it is reasonable to expect some 20 extrapolation beyond that. 21 MR. VAN DE VENNE: There would be some time. I just 22 do not know how long it would be. 23 MR. MICHELSON: If you could provide a curve of some 24 sort of what position of valve versus time would keep you in 25 about the right range, and you could precalculate that. It 1 0 ( v Heritage Reporting Corporation (202) 628-4888 \\
63 l( f 1 would be about the best that you could hope for. '2 MR. VAN DE VENNE: The big question is what the 3 operating procedures for this type of event would be. t 4 MR. MICHELSON: I noticed on your previous slide that 5 you showed one normally open valve between the two steam 6 generators, and here you show two. 7 Are there really two or one, or was the other just 8 very schematic? 9 MR. VAN DE VENNE: The other was just schematic. 10 MR. MICHELSON: Very schematic, okay. 11 Are you going to leave auxiliary feedwater now? l 1 12 MR. VAN DE VENNE: Yes. 13 MR. MICHELSON: I wanted to ask. According to the 14 plant design, these turbines are very kind of way down at the L 15 lowest elevation in the plant in a cubicle, and one on each 16 side of apparently a concrete wall. 17 MR. VAN DE VENNE: Right. 18 MR. MICHELSON: And what kind of pressure relief do 19 you provide being that deep in the building, how do you relieve 20 the pressure from that cubicle if you bust the auxiliary t 21 feedwater steam line in that area? 22 MR. VAN DE VENNE: There is a dedicated pipe trace. 23 It is probably about six foot square. 24 MR. MICHELSON: By dedicated, do you mean just for l c 25 this purpose? O Heritage Reporting Corporation (202) 628-4888
s 64-Ihl 1 MR. VAN DE VENNE: Well, it contains this particular-2 line, too. And it goes all the.way up to the roof. 3 MR. MICHELSON: So that vents the pressure off. 4 MR. VAN DE VENNE: Right. 5 MR. MICHELSON: And that steam line, if it ruptures 6 anywhere along, it is vented through atmosphere is what you are 7 saying. 8 MR. VAN DE VENNE: Right. 9 MR. MICHELSON: And then it passes through at some 10 point into the main steam line trace, I guess. 11 MR. VAN DE VENNE: Yes, right. That dedicated trace 12 runs along the main steam line trace. 13 MR. MICHELSON: So a rupture of that line at any 14 point including within the cubicle will always be vented to 15 atmosphere withoat any interference from the rest of the plant? 16 MR. VAN DE VENNE: Right. 17 MR. MICHELSON: Okay, thank you. 18 MR. VAN DE VENNE: Now I should mention here that we 19 have two levels of feedwater then, the start-up feedwater and 20 the emergency feedwater. And then the next level would be 21 bleed and feed obviously. If all of this were to fail, then 22 the bleed and feed would be the next level of K-heat removal 23 protection. 24 The next set of systems are the cooling systems, 25 which of course provide services to all of the primary systems O Heritage Reporting Corporation (202) 628-4888
i. 65 I that I have mentioned here. The component cooling and the ) 2 essential service water are both laid out as two separated 3 piping systems without interconnections. Each of these systems 4 has two pumps per subsystem with one pump normally operating, ~ 5 and the second being on standby. 6 The component cooling water has also two heat 7 exchangers with one being normally valve out, and only being 8 used for RHR cool-down. Any one of these pumps is really 9 100 percent capacity following any e'.7nt. Although both are 10 normally started automatically on a S signal, only one of them 11 really has to operate. 12 Very schematically, the component cooling water 13 system looks like this. Two pumps, two heat exchangers, two () 14 surge tanks, and no interconnections. So any passage failure 15 would not propagate to the other piping system. 16 One heat exchanger is normally valve out, and is only 17 used for cool-down. However, if there were a problem, for 18 instance, with this heat exchanger during operation, you could 19 valve this one out and valve this one in, so that you could 20 continue to operate the plant and always have minimum 21 safeguards available even if one heat exchanger were taken out 22 for repair or maintenance during plant operations. So from 23 this point of view, this arrangement provides some advantages. I 24 Like I mentioned, one pump is normally running in 25 each subsystem. If this pump fails, this one would start on Heritage Reporting Corporation (202) 628-4888
66 () 1 low pressure in the discharge header. Each subsystem feeds 2 some non-safety loads and some safety loads inside the reactor 3 containment. The non-safety loads are normally isolated on a S 4 signal. However, failure of the isolation would not 5 necessarily lead to failure of the subsystem. 6 MR. MICHELSON: Why not? 7 MR. VAN DE VENNE: Because initially, some of the 8 safety loads like the RHR heat exchanger are not brought on 9 line right on a S signal. The RHR heat exchanger is not 10 brought on until the temperature in the EWST hits the 11 predetermined value. So one pump has sufficient flow 12 capability to keep on feeding to non-safety loads. 13 MR. MICHELSON: Well, I was thinking that the surge f\\) \\- 14 tank has very limited capability. It is a limited volume. And 15 if you break a non-safety line down here, you lose the entire 16 thing. 17 MR. VAN DE VENNE: Then you do, yes. 18 MR. MICHELSON: So any rupture or loss of any of that 19 will not knock out the entire thing? 20 MR. VAN DE VENNE: Right. f 21 MR. MICHELSON: Okay. Because that is probably a 22 small surge tank. 23 MR. VAN DE VENNE: Yes. f i 24 MR. WARD: It can take the heat load. 25 MR. VAN DE VENNE: It can take the heat load to ( Heritage Reporting Corporation (202) 628-4888 i
67 () 1 prevent the pump from running out. That is the number one ~ 2 concern, the pump run out and overspeed, and failure of the 3 pump. It can take that. 4 A more detailed picture of one of the subsystems is 5 given_here. And you can see the RHR heat exchangers, the 6 reactor cool pumps, the safety grade coolers inside 7 containment, and the ISS pamps, and the spent fuel heat 8 exchanger. And then the non-safety modes are shown here. 9 Well, they are not shown, but they would be connected here. 10 The heat exchangers that we are using are plate heat 11 exchangers, by the way. 12 MR. MICHELSON: Do you know offhand how large a leak 13 you can handle with the make-up capabilities of the surge tank? 14 When you get low level in a surge tank, you start trying to 15 fill it as fast as you can. 16 MR. VAN DE VENNE: Right. 17 MR. MICHELSON: How big a leak can you handle? 18 MR. VAN DE VENNE: I really do not know, but I would 19 imagine something like 50 to 100 GPM, in that range. 20 MR. MICHELSON: It is a fairly small leak? 21 MR. VAN DE VENNE: It is a fairly small, yes. 22 MR. REMICK: What was your statement about the heat 23 exchangers? 24 MR. VAN DE VENNE: Plate, plate type heat exchangers. 25 MR. REMICK: And what are plate type heat exchangers? Heritage Reporting Corporation (202) 628-4888
68 p-() 1 MR. VAN DE VENNE: They use plates instead of tubes. 2 I do not know whether it is significant but -- 3 MR. REMICK: Is there water in the plates or water on 4 one side of the plate? 5 MR. VAN DE VENNE: There is cooling water on one side 6 and component cooling water on the other side. It is a 7 different type of heat exchanger that is more compact. 8 MR. REMICK: Are these flat plates with alternating 9 water? 10 MR. VAN DE VENNE: Yes. 11 MR. REMICK: I see, okay. 12 MR. VAN DE VENNE: Salem has back-fitted these type 13 of heat exchanger to the plant after the one that they has (\\-) 14 originally installed failed. And they seem to be more reliable 15 than tube heat exchangers. But the main advantage is that they 16 fairly small and fairly compact. They do not require a lot of 17 space. 18 MR. REMICK: How about cleanability? 19 MR. VAN DE VENNE: You can clean them just like tube 20 heat exchangers basically. 21 MR. REMICF: How do they clean them? 22 MR. VAN DE VENNE: The plates can be moved apart and 23 cleaned, and then put together again. 24 MR. MICHELSON: I would like to pursue this question 25 of the make-up of the surge tank just a moment. If you have a Heritage Reporting Corporation (202) 628-4888
69 -{ } reactor coolant pump leak through a seal of fifty gallons a 1 2 minute and all four of them, let's speculate for a moment, all 3 four were leaking, you would lose all component cooling water, 4 because you could not keep the surge tanks full of water. That 5 might be the case depending on what your answer might be to the 6 surge tank make-up. p 7 But it looks like you might have the potential to 8 lose all component cooling water, if you had all of your 9 reactor coolant pumps leaking. Of course, now you get into the 10 question of on loss of off-site power. 11 Do you drain the surge tanks during the loss of 12 an off-site power event? 13 MR. VAN DE VENNE: No. () 14 MR. MICHELSON: If your reactor coolant pump seals 15 are leaking. 16 MR. VAN DE VENNE: Well, the seals are cooled in two 17 ways. One is by injecting seal water into the reactor coolant 18 pumps. i 19 MR. MICHELSON: Okay. 20 MR. VAN DE VENNE: These are coils in the seals. Now 21 you can get a leak there, and there are special provisions in 22 the design to prevent over-pressurization through safety valves 23 and to isolate. There are special provisions. They are not 24 shown on this simplified, but there is a more detailed flow i 25 diagram in the module itself. i Heritage Reporting Corporation (202) 628-4888
70 7(j 1 MR. MICHELSON: But that is just the cooler 2 arrangement that is completely isolated from the seal leakage 3 situation? 4 MR. VAN DE VENNE: Right. 5 MR. MICHELSON: Okay, thank you. 6 MR. VAN DE VENNE: And the service water follows this 7 general arrangement where we have two separated systems. .And 8 each one feeding the diesel generator, the chillers, and the 9 component coolant heat exchangers. 10 MR. MICHELSON: On this one, I would like to ask 11 about the chiller units. All of the engineered safeguard 12 features, the pumps, are in the basement apparently in 13 cubicles. It looks like fairly small volume cubicles. 14 Therefore, I guess that you are using chilled water to take the 15 heat uut of those rooms. 16 MR. VAN DE VENNE: Well, there are two ways.
- One, 17 the motor driven pumps, the motors are cooled by component 18 cooling water.
19 MR. MICHELSON: By cooled, how do you mean? 20 MR. VAN DE VENNE: Projected cooling. 21 MR. MICHELSON: Projected on the motor itself? 22 MR. VAN DE VENNE: Right. 23 MR. MICHELSON: Okay. 24 MR. VAN DE VENNE: Now the room will heat up to some 25 extent, because some of the piping is hot. And that is taken O Heritage Reporting Corporation (202) 628-4888
d 71 ,,) . 1 care of by chilled water and room coolers, but they are a i s_ 2 fairly small capacity, 3 MR. MICHELSON: You are saying that the component 4 cooling water is cooling the motor jackets? c 5 MR. VAN DE VENNE: Right. 6 MR. MICHELSON: So it is a very essential system 7 then. 8 MR. VAN DE VENNE: Right, yes. 9 MR. MICHELSON: And the chiller units are taking a 10 residual heat out of the room. 11 MR. VAN DE VENNE: Residual heat out of the room.j 12 MR. MICHELSON: Less essential, but still considered I 13 essential, I guess. l 14 MR. VAN DE VENNE: Right, yes. l 15 MR. MICHELSON: Now in the case of the auxiliary 16 feedwater turbine rooms, what is your logic for heat removal? 17 MR. VAN DE VENNE: Well, we use basically run-through 18 ventilation. j 19 MR. MICHELSON: But that does not run when you lose l 20 power. 1 4 21 MR. VAN DE VENNE: That does not run when you lose 22 power. On the other hand, these pumps can take quite a bit of i 23 heat in the room. l 24 MR. MICHELSON: No electronic devices, you are 25 saying? Heritage Reporting Corporation (202) 629-4888 i e -
72 () 1 MR. VAN DE VENNE: No, we have no electronic devices 2 in the room. We are looking at using the exhaust steam to 3 provide some cooling in the room through an air ejector 4 mechanism. One of our guys have applied for a patent, and we 5 are still working on that. 6 MR. MICHELSON: Well, you might consider taking the 7 water that you are taking out of the storage tank to feed and 8 cool the room a little bit on the way into feeding, and a 9 little warmer water would be even more desirable anyway, which 10 is the way that some plants have taken care of the cooling 11 problem. 12 MR. VAN DE VENNE: That is another mechanism. 13 MR. MICHELSON: But you are not using chillers as l 14 essential in the turbine room? 15 MR. VAN DE VENNE: No. 16 MR. MICHELSON: I guess that you do have chilled 17 water in there for normal operation? 18 MR. VAN DE VENNE: For normal operation. 19 MR. MICHELSON: Now these chillers again, you are not i 20 going to tell us anymore apparently. But eventually, we will 21 inquire about the chiller arrangements as to how many things 22 are on one chiller. 23 MR. VAN DE VENNE: Yes. 24 MR. MICHELSON: I only saw two chillers in the plant 25 layout, and I just wondered is everything on two chillers? i ( l Heritage Reporting Corporation (202) 628-4888
b 73 g(,) 1 MR. VAN DE VENNE: We have four chillers. There 2 should be four on the layout. 3 MP. MICHELSON: I may have missed the other two. 4 MR. VAN DE VENNE: There are two on each side. 5 MR. MICHELSON: Oh, okay. 6 MR. VAN DE VENNE: Basjcally the same arrangement as 7 component cooling with two chillers and two pumps in each 8 subsystem. 9 MR. MICHELSON: Okay. And two subsystems for the 10 plant, but two chillers on each one. 11 MR. VAN DE VENNE: Yes. 12 MR. MICHELSON: Okay, good. [ 13 But that goes throughout the electrical? 14 MR. VAN DE VENNE: That cools basically the f 15 electrical, switch gear room, the protection system rooms, and 16 the control room. 17 MR. MICHELSON: It goes all the way through on two 18 trains. t 19 MR. VAN DE VENNE: Right. [ 20 MR. MICHELSON: And a failure of a pipe along that 21 way for whatever reason, a leak now leads to that loss. On { t 22 some areas, you cannot stand a loss of cooling even on one i 23 train, like in prot 9ction system rooms. You are going to tell 24 us at some future time about the arrangement. I 25 MR. VAN DE VENNE: Right. I i () Heritage Reporting Corporation (202) 628-4888 r-
74 C\\ (_) 1 MR. MICHELSON: I will be interested in hearing more 2 about how you do this. 3 MR. VAN DE VENNE: The title here is wrong. This 4 somehow got in'there. 5 MR. WAPD: That is a third designation? 6 MR. VAN DE VENNE: Well, I can tell you that we are 7 working in the longer term with some foreign countries on a 8 1000 megawatt version. 9 MR. MICHELSON: What power is this one? 10 MR. VAN DE VENNE: 1000 megawatts. This one is 1350. 11 MR. MICHELSON: This is 1350. 12 MR. VAN DE VENNE: This is a four loop, and this 13 would be a three loop plant. And somehow it got in here, and I 14 do not know how it happened. So I ask you to ignore that. At 15 this point, we have no plans to submit that design in the U.S. 16 The chemical and volume control system. As I 17 mentioned before, it has no safety functions. We use two 18 centrifugal charging pumps. We use one positive displacement 19 pump powered by a non-nuclear safety DC generator. The 20 let-down heat exchanger it inside containment, so we do not 21 have any high energy piping, you know, hot piping outside 22 containment. 23 Generally, we have a reduced safety classification. 24 Most of the system is Class 3, and part of the system is 25 non-nuclear safety. And there are no technical specifications O Heritage Reporting Corporation (202) 628-4888
~. -. s 75 (G i _j 1 associated with the system. 2 I mentioned before.that safety injection is not 3 performed by the system. Safety grade let-down and boration is 4 also not performed by the system. It can all be done by the 5 integrated safeguard system. 6 The main differences are really the let-down heat 7 exchanger and containment. 1 mentioned that. Since we do not 8 have any safety functions for this part, we have only one boric 9 acid tank compared to the typical two that you have in the 10 current. plant. But this is just one large tank. 11 And I mentioned the independent, AC independent 12 positive displacement pump that we use as backup seal 13 injection, which takes normally suction from the spent fuel pit 14 and injects into the reactor coolant pump seals through its own 15 dedicated filter. The starting of this system is from the i 16 control system, and it starts on loss of normal seal injection. 17 So we have seal injection here. And if we lose it, 18 we start the DC generator that starts the pump. And the mala 19 objective here is on a loss of all AC to protect the seals from 20 leaking. 21 Now as you are aware, we have run some tests in 22 France, and I think that some additional tests are being done 23 on the RCP seals. And the leakage that was measured was l 24 generally less than what has been originally assumed. But this 25 punp would provide further assurance or further means of i O Heritage Reporting Corporation (202) 628-4888 l l
76 (]) 1 preventing seal leakage. And it is basically a loss of all AC. 2 type of event that is being considered here, although it may 3 have'some uses. You know, we have lost pump seals during plant 4 start-ups and emergency power not being available. 5 So we see it also as an economic protection for the 6 utility. Because if you lose both cooling and scal injection, 7 you have generally bent the shaft and it is a big hassle. So 8 we see it as partly economic protection to the utility and a 9 loss of all AC, another degree of loss of all AC protection. 10 MR. DAVIS: What is the capacity of that pump? 11 MR. VAN DE VENNE: It is about 35 GPM, enough to 12 provide the seal for. 13 MR. DAVIS: There is no chance that you will pump all 14 of the water out of the spent fuel? 15 MR. VAN DE VENNE: No. In any case, the connection 16 is located about four foot below the surface, but that is a lot 17 of water. It can go for days without hitting that level. It 18 is not located at a point where you could empty the spent fuel. 19 MR. MICHELSON: How large a let-down line are you 20 proposing? 21 MR. VAN DE VENNE: The let-down line is four inch. 22 MR. MICHELSON: And if you were to lose that outside 1 23 of containment for any reason, what kind of blow-down ratas do 24 you think that you have in mind, because you have some 25 orificing restriction? O Heritage Reporting Corporation (202) 628-4888
77 c"s i, ) 1 MR. VAN DE VENNE: Right. 2 MR. MICHELSON: What kind of blow-down rates? 3 MR. VAN DE VENNE: First of all, the water is going 4 to be cold, and then we have the orifice. 5 MR. MICHELSON: Well, it will not be cold very long 6 if you bust a pipe out there and start blowing the reactor 7 through it. The reactor temperatures will go up very quickly. 8 Your heat exchangers do not keep up with that. 9 MR. VAN DE VENNE: Well, max let-down is about 10 250 GPM. 11 MR. MICHELSON: Yes, normal let-down is about 250 12 max. 13 And what is the pipe break let-down or do you know? 7,) t\\/ 14 MR. VAN DE VENNE: It should not be a lot more. 15 Because the only additional pressure drop that you normally 16 have is through here. So maybe 300 or 350 GPM. 17 MR. MICHELSON: But you are doing some more 18 throttling. You are normally throttling quite a bit. I just 19 wondered. 20 MR. VAN DE VENNE: Basically, the orifices are 21 designed. For instance, if you are in a normal charging 22 situation, this orifice would basically limit the flow to the 23 normal let-down flow, which is on the order of 125 GPM without 24 any additieral throttling. We are trying to prevent from doing 25 really too much throttling and wearing our valves. So the O(-) Heritage Reporting Corporation (202) 628-4888
78 () 1 orifices are designed to limit that flow. 2 Now if you are doing a max let-down situation, all of 3 these would be open. So then you would have 150 GPM. But 4 there is not must additional throttling dow.istream of this. So 5 I think that if you had a rupture that the flow would be a 6 little bit larger. Because there is a little bit of back 7 pressure in here, and there is a little bit of pressure here, 8 but it is not huge. Most of the pressure drops are taken 9 across the orifice. 10 MR. MICHELSON: That would be what one would 11 anticipate? 12 MR. VAN DE VENNE: Yes. 13 MR. MICHELSON: Where does that let-down line enter 14 into the outside containment, where does it come out? 15 MR. VAN DE VENNE: There is CVCS portion of that 16 below the sphere of the charg ng pumps. It comes out above 17 that. 18 MR. MICHELSON: But right in the cubicle with the 19 charging pumps? 20 MR. VAN DE VENNE: Above the cubicle. 21 MR. MICHELSON: And is that an area occupied by other 22 kinds of electrical equipment or whatever? 23 MR. VAN DE VENNE: There is no electrical equipment 24 on that side of the containment. The only penetrations that 25 are there are mechanical non-safety related penetrations. All nL) Heritage Reporting Corporation (202) 628-4888
79 (} 1 of the safety related radioactive penetrations are above the 2 high head and low head pumps. And all of the clean 3 penetrations are towards the electrical end of the building. 4 MR. MICHELSON: Thank you. 5 MR. VAN DE VENNE: I mean the clean safety related. 6 MR. WARD: When you naid the backup seal injection 7 pump had a capacity of 35 GPM, now that is for all four pump 8 seals? 9 MR. VAN DE VENNE: Yes, normal injection into pump 10 seals goes at about 5 or 6 GPM. That is the normal rate for 11 each pump. So it is the normal rate plus about fifty percent 12 for margin. 13 MR. WARD: All right. ) 14 MR. VAN DE VENNE: And the generator would be about 15 75 KW. So it is small. It is a little bit more than you would 16 use for say a house, but it is typical what you would use for a 17 small building as a backup generator. 18 MR. MICHELSON: What is the excess let-down heat 19 exchanger? 20 MR. VAN DE VENNE: It is really a backup to this 21 arrangement. If you had any leakage here or there, the excess 22 let-down heat exchanger would allow you to operate for maybe 23 another 24 hours at much reduced let-down rates. 24 MR. MICHELSON: So it is a standby unit? 25 MR. VAN DE VENNE: It is really a standby unit. It O Heritage Reporting Corporation (202) 628-4888
80 1 is normally not used. In fact, it is used very rarely. And {} 2 people have said why do we not eliminate it, it is just another 3 piece of equipment that we do not use an'way. / 4 But the rate of this heat exchanger would allow you 5 to let down sufficient flow to use seal injection only and no 6 other injection. So this injection path would be closed. So 7 it is about a 35 GPM type heat exchanger that would allow you 8 to et least maintain seal injection, but would not allow any 9 major clean-up of the system. So after some time, your system 10 would become relatively radioactive and you would have to shut 11 down. 12 The next area is the I&C, what we call the whole 13 conglomerate of all of the systems that are in the plant. And () 14 there will be a more detailed presentation on this later, but I 15 would like to focus on the protection system part of it, but 16 maybe I should briefly go through all of it. 17 Of course, we have the main control room. We have 18 the integrated protection system, which is essentially four 19 protection cabinets and two engineered safety features 20 actuation trains. We have the integrated control system which 21 is separate, which is also a redundant system. 22 The main control loops of this plant have redundancy 23 in order to minimize availability problems or failure problems 24 causing outages. 25 MR. MICHELSON: Is there some reason why your slide Heritage Reporting Corporation (202) 628-4888
81 1 is different than our slido? (~';l \\v 2 MR. VAN DE VENNE: Is it? 3 MR. MICHELSON: It looks like it. I do not see the 4 same comparable things everywhere. Like on the blue, you have 5 got a four block down underneath. I do not have such a four 6 block underneath that part of it. 7 MR. VAN DE VENNE: You do not have this? 8 MR. MICHELSON: No. And the next block over, I have 9 got two twins and you only have one. 10 MR. VAN DE VENNE: It may just be an oversight on my 11 part. I thought that they were the same, but I did not look 12 very closely. 13 MR. MICHELSON: I would like to have a copy of this n(,) 14 one, if I may. 15 MR. VAN DE VENNE: Okay, we can take care of that. 16 The protection system, the control system, the 17 turbine generator, and alarm system, monitoring system, remote 18 shut-down panels are all shown on here. 19 MR. MICHELSON: Where are these located in the 20 building roughly? 21 MR. VAN DE VENNE: They are all located close to the 22 control room. In fact, access to the protection system is from 23 the control room only. 24 MR. MICHELSON: Do they share the common environment 25 of the control room? Heritage Reporting Ccrporation (202) 628-4888
t 82 () 1 MR. VAN DE VENNE: No, they have separate ventilation I 2 systems. 3 MR. MICHELSON: But they will be on this two train 4 . chiller arrangement? 5 MR. VAN DE VENNE: Yes, right. I 6 MR. MICHELSON: Do they have any backup if the 7 chillers fail for any reason? 8 MR. VAN DE VENNE: The only backup is that they are 9 somewhat more rugged than typical systems, in that they have t 10 been tested up to 120 degrees. 11 MR. MICHELSON: Ambient? 12 MR. VAN DE VENNE: Ambient, yes. l 13 MR. MICHELSON: So they can operate any of these up l \\_ 14 to 120 F ambient? 15 MR. VAN DE VENNE: Yes, right. 16 The protection system, the main feature of the [ 17 protection system is four what we call integrated protection 18 cabinets which do the signal conditioning and perform the t } 19 reactor trip function. We have the engineered safety features r 20 actuation cabinets, which actually provide the system level i 21 actuation. For instance, the air signal, the P signal, or i 22 blackout, etcetera. I 23 And then we have what we call the logic cabinets, 24 which provide the component level actuation. In other words, l i I 25 they would start a pump or move a valve, etcetera. These l l t t i Heritage Reporting Corporation (202) 628-4888 l -......- --a
83 O inteeretea 1o2 c cedinete in cerrent e1ene ere eometimee ce11ea 1 1 2 interpoeing logic. It le e eimilar termino 1ogy.
- 1 i
3 (Continued on next page.) 4 5 4 J 6 l 7 8 9 l l 10 i l 11 i 12 13 14 1 15 16 17 l 18 s t l 19 20 21 22 1 l 23 24 2D l 4 O Heritage Reporting Corporation (202) 628-4888
~ 84 () 1 The integrated _ protection cabinet -- this is one of_the four 2 sets of cabinets. So, you are looking at the total, really, we 3 call this one cabinet -- each cabinet has what we call four 4 bays. 5 The main items here to_look at are the reactor trip 6 subsystems. Each cabinet has two reactor trip subsystems. As 7 you.are aware, most events are protected by several reactor 8 trips. For instance, LOCA, your first actuation would probably 9 be low pressurizer level, but you also actuate on low 10 pressurizer pressure and there may be other ones. So, most 11 events are handled by different trips. What we have done here 12 is split up the various trips, of 'chich there are about 14 and 13 split them up between two subsystems Jn here in such a way that 14 all events would be protected for by just one of these. 15 Now, you have to remember, we have two here; we have 16 four other onec. Four other ones of these cabinets. So, we 17 really have eight of these subsystems. In the other cabinets, 18 they would be spread out the same way. f q 19 MR. MICHELSON: In other words, those are all in what { 20 you call Relay M room? 21 MR. VAN DE VENNE: No. Relay A or B. 22 MR. MICHELSON: Relay A or B. 23 MR. VAN DE VENNE: So, we h ave two in Relay A and 24 two in Relay B. Relay M is the control system. 25 The signal that is coming in is -- the signal O Heritage Reporting Corporation (202) 628-4888
85 () 1 conditioning is done in these subsystems and the trip state is 2 determined. If the signal exceeds a certain level or it would 3 indicate an unsafe condition, a trip signal would be sent out 4 from these subsystems. Now, each of the other four cabinets i 5 feeds into here. So, that would be two out of four here and if 6 two out of the four would indicate an unsafe condition, then a 7 signal goes to the trip breaker associated with this cabinet. e The trip breakers are shown in the next picture. 9 Also in this cabinet are the engineered safety 10 features, signal conditioning. In other words, the signals 11 that are coming in, for instance, pressurizer pressure coming 12 in here goes into this, signal conditioning. If the pressure 13 exceeds 2400 PSI, you are going to get a high pressure reactor 14 trip. So, this one here, if pressure comes in here, this 15 subsystem will look att Is the pressure higher than 2400. If 16 so, it goes to a trip mode. It looks at the signals from the 17 other four cabinets. If they are also high, it will send a 4 18 trip signal to the breaker. 19 MR. WARD: Let's take that example of the 20 pressurizer, high pressure. Are those four separate sensors on 21 the pressurizer? 22 MR. VAN DE VENNE: Right. One sensor comes in here. 23 The other sensor goes into the other four cabinets. Each i 24 computer looks at that particular -- well, first, the signal is 25 conditioned to whatever is needed. It looks at it. Says: Is () l Heritage Reporting Corporation l (202) 628-4888
( i 86 l () 1 it greater than 2400? It's a trip mode. Then it takes the 2 inputs from the other cabinets which are multi-flexed fiber 3 optic cables which are all coming in here and it does a voting. 4 If there is two, more than two -- if there are two or more, 5 two, three or four, it will send a trip signal out to the trip 6 breaker. The other cabinets do the same. They will send-7 signals out to their trip breakers. There are a total of eight 8 trip breakers. Two signals from here cp> te two trip breakers. 9 Two signals from channel 2, from channel 3, from channel 4 go 10 to their own trip breakers. So, there is a lot of voting and 11' looking and preparing. f 12 Now, in this case, pressure goes in here. Some other 13' signal goes in here and the same voting goes on for the same 14 transient on that particular signal as a backup trip. 15 MR. WARD: Is this logic all -- 16 MR. VAN DE VENNE: Micro processed., 17 MR. WARD: Is it all burned in or is it programmable? i 13 MR. VAN DE VENNE: It is programmable, i 19 MR. WARD: And are you going to say anything about 20 how the software is controlled? 21 MR. VAN DE VENNE: Not in this meeting, but that is 22 obviously an issue. l 23 MR. MICHELSON: Is that cabinet natural gas cooled? 24 MR. VAN DE VENNE: It has a cooling assembly. It has 25 a f an that cools and rejects the heat to the environment of the i l ( Heritage Reporting Corporation (202) 628-4888
C 87 'l-room. And the room is cooled by air. 2 MR. MICHELSON: Is there just a fan-up there? Is 3 that what that cooling assembly means? 4 MR.-VAN DE VENNE: It is basically a set of fans, 5 yes. 6 MR. MICHELSON: A set. Two fans? 7 MR. VAN DE VENNE: Two fans, yes. 8 MR. MICHELSON: And that's all? 9 MR. VAN DE VENNE: Yes. 10 Now, I mentioned on the signal conditioning for the ( 11 engineered safety features, in most or at least in our 12 protection systems today, signal conditioning is only done l 13 once. In other words, pressurizer pressure will come in. The 14 signal is conditioned and it, is then sent either to the trip 15 function or the ESP function. Here, we have an independent 16 signal conditioning for the ESF function. And the signal is 17 then sent on to the ESF actuation cabinets which I will discuss 18
- later, i
19 MR. MICHELSON: The rating on these cabinets you said 20 was 120 ambient. That is assuming the two fans are running? 21 MR. VAN DE VENNE: Normally, these cabinets are kept 22 much lower than that. They are kept like 70. 23 MR. MICHELSON: I understand. But you said they 24 could take up to 120 Fahrenheit. 25 MR. VAN DE VENNE: Right. (:) Heritage Reporting Corporation (202) 628-4888 i
88 1 MR. MICHELSON: That's with the two fans running? 2 MR. VAN DE VENNE: I don't know. 3 MR. MICHELSON: I would assume so, but I was just 4 asking. And are those fans safety grade fans? 5 MR. VAN DE VENNE: Right. 6 MR. MICHELSON: Are they supplied by DC7 7 MR. VAN DE VENNE: No. AC instrument power which is 8 what is coming in here. 9 MR. MICHELSON: So, on loss of off-site power and 10 on-site, at a station blackout, those fans go dead? 11 MR. VAN DE VENNE: No. Because the Vital AC is 12 battery backed up. 13 MR. MICHELSON: So, these will be a drain on those 14 batteries for the duration. 15 MR. VAN DE VENNE: Right. Yes. They are part of the 16 power consumption of each of these cabinets. 17 The other parts, there are a bunch of power supplies. 18 The other parts are the nuclear instrumentation subsystem. The 19 nuclear instrumentation requires some special signal condition 20 and calibration. So, it has its own subsystem here. There is 21 an aittomatic tester system which -- there is two types of 22 testing here. There is on-line testing which goes on 23 continuously to monitor the performance of the various board, 24 micro processors, et cetera. Also to check to compare the 25 various signals on pressure, for instance, that I mentioned are O Heritage Reporting Corporation (202) 628-4888
89 1 coming in. If one of the signals goes out of range, there will 2 be some kind of en alarm to indicate that either the sensor is 3 bad or the electronics are bad or, you know, to indicate 4 something is wrong. But in addition to that, there is a 5 subsystem that will handle the periodic like monthly testing 6 and simplifies the procedure for that testing by having 7 prearranged sequences programmed in that can be tested. And it 8 allows testing of the whole system. 9 MR. MICHELSON: And you have both safety grade and 10 non-safety grade functions being performed by these cabinets; 11 don't you? ( 12 MR. VAN DE VENNE: No. Only safety grade. 13 MR. MICHELSON: Only safety grade. No non-safety () 14 circuits enter this room? 15 MR. VAN DE VENNE: No. 16 MR. MICHELSON: Not even monitoring? 17 .MR. VAN DE VENNE: No. The signals that are coming 18 in, if they are needed for, for instance, control, they are 19 sent again through fiber optic multi-flex data links out to the 20 control system which then uses that signal. 21 MR. MICHELSON: And that etuff is in the M room, I 22 guess. 23 MR. VAN DE VENNE: That's right. 24 MR. MICHELSON: This is a totally safety grade room? 25 MR. VAN DE VENNE: Totally grade room. Heritage Reporting Corporation (202) 628-4888
90 1 MR. MICHELSON: And fiber optic isolated from (} 2 non-safety. 3 MR. VAN DE VENNE: Right. 4 There is a communication subsystem which handles the 5 sending out of data to both the control rcom and the control 6 system. 7 So, again to emphasize: There is four of these 8 cabinets and there is voting going on in each of these 9 cabinets. Now, the trip breaker -- 10 MR. MICHELSON: This room has to have a chiller in 11 it, I guess. A chiller, air handling unit? ( 12 MR. VAN DE VENNE: There is an air handling unit with 13 chilled water, yes. () 14 MR. MICHELSON: So, this room does have water in it. 15 Namely, chilled water circulating -- l 16 MR. VAN DE VENNE: No, no, no. The chilled water is 17 located with the air handling unit. And the air is brought in 18 through ducts in and out. 19 MR. MICHELSON: But there is no chiller within the 20 air handler unit within the room. 21 MR. VAN DE VENNE: No. 22 MR. MICHELSON: It is chilled elsewhere and just the 23 cold air is brought in. 24 MR. VAN DE VENNE: Right. 25 MR. MICHELSON: Thank you. I Heritage Reporting Corporation (202) 628-4888 4 ,,-,-.-,w,,,, --.,-n,-------..,.--,n.c,--..----..-,~-.en-,-,, -y---
91 () 1 MR. VAN DE VENNE: The trip breaker arrangement is 2 shown here. I mentioned before that with each of the protection 3 cabinets, there are -- we call them, 1, 2, 3, and 4 -- each of 4 them sends out two trip signals to those breakers. So, there 5 are two breakers associated with each channel of protection 6 system. 7 For instance, if there is an inadvertent signal 8 through one, you will not trip the rods because your dispatch 9 will still be unaffected. And you can see from here that any 10 single signal, the trip two breakers will not cause a reactor 11 trip. But, on the other hand, any two signala from two channels ) 12 will definitely cause a reactor trip, assuming that all the 13 trip breakers are open. And this is mainly done to prevent &) \\- 14 spurious trip in case one of the channels sends a trip signal. 15 MR. MICHELSON: Are those breakers in the switch gear 16 room or are they in a separate room somewhere? 17 MR. VAN DE VENNE: The breakers are located in the 18 motor generator in what we call the rod control room, which is 19 opposite from control room on the other side of the building on 20 the same floor. 21 MR. MICHELSON: I don't see the rod control room on 22 that floor, but I presume it is there. 23 MR. VAN DE VENNE: Maybe rock power supply. Is that 24 the term? 25 MR. MICHELSON: Here it ist CRDM power room. O Heritage Reporting Corporation (202) 628-4888
i -r 92 (}, 1 MR. VAN.DE VENNE: _Right. 2 MR. MICHELSON: That's where they are. 3' MR. VAN DE VENNE: That's where they are, yes. 4 So, this interrupts from the M-G sets to the control 5 rod drives. And, physically, these are different cabinets as 6 shown here. 7 Finally, as far as the protection system, this is the 8 actuation cabinet of which there are two because we have two 9 electrical trains. So, each of these would tend to actuate 10 one-half of the safety systems. 11 If you remember the integrated protection cabinetc, 12 they had two signal conditioning, separate signal conditioning. 13 Those signals are sent in here and they will actually generate () 14 the system level actuation. 15 There are two independent actuation systems in here. 16 All the signals are sent like, again, say pressurizer level, 17 four signals are sent into here and a two out of four lower 18 pressurizer level will call an "S" signal, safety injection 19 signal to be generated and sent on down to the components. 20 Now, the two out of four voting will be done here. 21 It will also be done here. So, these two are really identical 22 and any one of these two will give you the actuation signal. 23 So, an inadvertent "S" signal will be transmitted to the pumps. 24 So, this is not a case where an inadvertent signal will not 25 cause a reactor trip like I mentioned before. In this case, an O Heritage Reporting Corporation (202) 628-4888
93 ( ) 1 inadvertent signal will cause an "S" signal. 2 So, this is really two identical subsystems, one out 3 of two or two out of two will provide the system level 4 actuation. Again, there is a communication module to send out 5 information to the control room. And there is an automatic 6 testing module. 7 HR. MICHELSON: Are these cabinets as well as the 8 previous ones all have bottom feed only? 9 MR. VAN DE VENNE: Yes. 10 The other thing that should be mentioned about the 11 actuation subsystem is that in some cases the failure of this 12 subsystem will cause a safety actuation to take place. But not 13 in all cases. 14 A good example is if you were to fail this whole 15 cabinet or you fail any of these subsystems, there would be a 16 signal generated to start the turbine and feed pumps, because 17 that almost never is a harmful action. And it almost always is 18 a positive action. But, for instance, if one of these fails, 19 we will not generate a main steam isolation signal because it 20 generally is not a good idea to close main steam isolation 21 valves while you are at power. 22 So, some judgment is done here as to whether a 23 particular safety action can have h'rmful effects. In that 24 case, failure of this will not cause that actuation. But in 25 other cases, it will -- failure of this cabinet will cause D. U Heritage Reporting Corporation (202) 628-4888
94 ,,) 1 certain safety actions to be taken. And I really don't have an ( 2 exhaustive list, but that is the way the system is set up. 3 Now, these signals are then sent to the integrated 4 logic cabinets which do the component level actuation. And the 5 integrated logic cabinets are generally located close to the 6 components to be actuated. For instance, in the switch gear 7 room, there will be an integrated logic cabinet that will 8 actually move the switch gear to start the pumps and move 9 valves and all of that. 10 MR. WARD: So, those are distributed around. 11 MR. VAN DE VENNE: Those are distributed, yes. That 12 is to minimize hard wiring. 13 MR. WARD: These are in the same room with the other <~s 14 components? s 15 MR. VAN DE VENNE: These are in the same room as the 16 protection cabinets. The logic cabinets are not. 17 MR. WYLIE: Are the input signals fiber optics? 18 MR. VAN DE VENNE: Yes. Multi-flex fiber optics. 19 MR. WYLIE: Let's see. Input. I am going from these 20 to the logic cabinets. 21 MR. VAN DE VENNE: Is what we call data highways 22 which are -- 23 MR. WYLIE: Piber optic multi-flex. 24 MR. VAN DE VENNE: And also the inputs from the 25 protection cabinets because the signals come in from the Heritage Reporting Corporation (202) 628-4888
95 () 1 protection cabinets. 2 Now, there are separate power supplies for all of 3 these things. So you see a lot of power supplies because the 4 equipment in here is broken down in groups and each of them has 5 its own power supply which it basically takes vital AC and 6 'which is battery backed up. It takes Vital AC and converts it f 7 to the appropriate DC that goes to each of the cards. 8 MR. WYLIE: Now, are you multi-flexing over in the i 9 reactor building to pick up all your signals to come into your 10 protection system? i 11 MR. VAN DE VENNE: No, not really. 12 MR. WYLIE: That's hard wired there? r 13 MR. VAN DE VENNE: Yes. 90 percent of the signals l 14 comes out of containment. There are rehlly no multi-plexus 15 that would be qualified for a post accident environment. We f 16 are looking at multi-plexing for monitoring non-safety related 17 functions just to minimize the number of wires. But in terms 18 of everything that comes inte here, it is basically hard 19
- wiring, f
20 We have looked at bringing the hard wired signals out I l 21 to the penetration room and then multi-plexing them back to i 22 here, but you really don't gain very much in terms of cable 23 reduction. f 24 This system is basically the Sizewell system. This 25 will be installed on the Sizewell Plant as the protection l (:) Heritage Reporting Corporation (202) 628-4888 i t ,m,-~- ,,,,, - - + <,, - -...,.,,,,.-, - ---e
96 () 1 system. This is prototype hardware for Sizewell, and in Japan, 2 they are building a prototype also. So, this is fairly well 3 advanced and developed. 4 MR. WARD: You mean just the ESF actuation cabinets? 5 MR. VAN DE VENNE: No. The protection cabinets -- 6 MR. WARD: The whole thing? 7 MR. VAN DE VENNE: Yes. One of the reasons this 8 system is -- and it has caused confusion. The term 9 "integrated" has caused confusion because some people are 10 looking at that as the integration of the control and the 11 protection system, which is not what it is. The integration is 12 meant to mean that this is an all in one system. 13 In the past, you know, we used to supply, say the \\_) 14 trip function; somebody else would supply safety and or the 15 containment spray function. Yet, somebody else would provide 16 the sequencing of the diesels. The interposing logic would be 17 yet another party. 18 The intent here is to have a fully comprehensive 19 plant-wide protection system and also a fully comprehensive 20 plant-wide control system. 21 Now, the control system is basically the same type of 22 equipment. It is non-Class lE, but it is identical because we 23 haven't really been able to -- it is easy to build the same 24 type of equipment again, but it is not qualified, but it is the 25 same design. It doesn't have the qualification pedigree. But O Heritage Reporting Corporation (202) 628-4888
l 97 i l (f 1 it is basically the same design, the control system. l 2 MR. WARD: This is not what'is in the SNUPPS? l 3 MR.-VAN DE VENNE: No, this is not what is in the 4 SNUPPS. No. There is no plant that has this in the U.S.
- Now,
{ 5 some of this technology is being considered for backfit, but it 6 is not SNUPPS I 7 MR. KERR: When you say you do not integrate the 8 control and'the protection system, what is the implication of, 9 that statement? You said that is not what you were doing. 10 MR. VAN DE VENNE: Well, some people have understood 11 we built one system that had both control and protection 12 functions. We have a protection system which is purely 13 dedicated to safety related actions and safety-related signals. I O 14 We have a control system which is separate, separate cabinets, f 15 separate power supplies, everything separate, which handles 16 control grade functions such as let-down flow control, rod l a r 17 control. Those kind of functions. 18 Now, in some cases, they use the same sensors as J 19 input. But they are physically separated and located 7 20 physically in separate rooms. 21 MR. KERR: If you did not have to operate in the face E 22 of existing regulations and were trying to design an efficient 23 and safe system, would you do it this way or would you j 1 24 integrate the two? l l 25 MR. VAN DE VENNE: No, I think you would do it that I l i i Heritage Reporting Corporation i l (202) 628-4888 l 7 r E
h 98 () I way because there are -- we have put certain functions into the 2 control system like, for instance, start-up feedwater system. 3 Which, because it is in the control system, now, it ber'mos 4 rather independent of the emergency feedwater system. And it 5 does provide some additional diversity because it has separate 6 power Jupplies, separate cabinets, separate location. So, it 7 does provide some additional degree of redundancy and diversity 8 that you maybe otherwise would not have. l l 9 MR. KERR Are you following what at least I think is 10 the regulatory philosophy which says that one does not require 11 any particular reliability of a control system, merely that its 12 failure not interfere with the operation of a safety system. 13 MR. VAN DE VENNE: That is generally the philosophy. 14 MR. KERR Rather than saying we want the control 15 system, itself, to be reliable -- maybe not as reliable as -- 16 MR. VAN DE VENNE: Well, there are several reasons 9 17 why you want the control syster,. reliable. You want to minimize 18 the number of trips. That is one big aspect. I think that 19 interrelates with safety. I mean that is one reason -- 20 MR. KERR: I do, too. This is the reason I asked the 21 question. 22 MR. VAN DE VENNE: There is no safety related 23 requirements on the control system, except that it not i 24 interfere with the protection. 25 MR. KERR: No. If you have a reliable control [ Heritage Reporting Corporation (202) 628-4888 l r
.I
99 (m (_) 1 system, I am sure the plant is safer than if you have an 2 unreliable one. 3 MR. VAN DE VENNE: Right. 4 MR. KERR And there are situations, it seems to me 5 in which one can't really tell whether one has a safety system 6 or a control system. The scram system is one such system. 7 Every time you lose a turbino, you want the scram system to 0 operate. Is it a control system or is it a safety system in, 9 that situation? It's both. So, I am not sure -- I am certain 10 tnat separation in terms of increased reliability and reduction 11 of common mode failures is a good thing. But it isn't obvious 12 to me that a complete separation of safety and non-safety 13 systems, in a sense, if you put all of your emphasis on one and 14 don't worry much about the other, that it's a good thing. 15 MR. VAN DE VENNE: Well, we do worry about the 16 controls. We do have redundancy in the control system. So, it 17 is not a matter where we are underdesigning the control system. 18 MR. KERR: But you don't have any particular criteria 19 for its performance. 20 MR. VAN DE VENNE: We have criteria like on the 21 spurious tiips, failure criteria. We have criteria on the 22 control system which are written in the design specs. 23 MR. KERR: But no reliability criteria? 24 MR. VAN DE VENNE: Yes. There is a reliability 25 criteria, yes. O Heritage Reporting Corporation (202) 628-4888
100 ([ ) 1 MR. KERR They are described somewhere? 2 MR. VAN DE VENNE: 1 really don't know. But if we 3 have an I&C presentation, which I presume we will have, we can 4 discuss what they are. 5 MR. KERR: All right. 6 MR. VAN DE VENNE: The final item here is the power 7 distribution system with some particular emphasis on the issue 8 of Vital AC. The generator, I think I mentioned before we do 9 have a generator breaker. We have a main transformer, standby 10 transformer and what we call an ESF transformer, which is 11 really sort of a backup. 12 We use two voltage levels in the plant: 13.8 KV and 13 4.16 KV. The class 1E, though, is restricted to 4.16 KV and, 14 of course, the low voltage, in this case, 480 volts. 15 We have two engineered safety features process in 16 which there is a diesel generator. We have four 480 volt buses 17 and the instrument power, the Vital AC is taken from the 480 18 volt buses. And the arrangement is shown here. 19 The normal supply would be through an embroider. 20 This would really be the normal supply and in the meantime, the 21 battery is kept charged by this connection here with a charger. 22 If this supply were t.o f all, there would be an alternate 23 supply. It is a reinverter which goes down to the 120 volt AC. 24 In addition, there is a backup supply that can be used directly 25 from the 480 volt bus. O Heritage Reporting Corporation (202) 628-4888
101 () 1 The assignment of the integrated protection and the 2 engineered safety features actuation cabinets is shown down 3 here. Four Vital AC buses, main buses, and the protection 4 channels 1, 2, 3, and 4 are taken from those. The engineered 5 safety features is also taken from two of those and there is 6 some additional backup here. 7 The issue has come up on total loss of the protection 8 system. 9 MR. KERR I'm sorry. Total loss of what? 10 MR. VAN DE VENNE: Protection system. I guess in the 11 Brookhaven review, that came up. And we have had some 12 discussions on it, but I don't think we have really resolved or 13 reconciled exactly what is meant by that. ) 14 Certainly one way of losing all of your protection 15 system is to lose all the DC and AC buses. That is one obvious 16 way of losing it. And we thought that was the main issue. And 17 that's a rod or low probability. If you calculate, even it you 18 applied common mode failure, it is a very low probability 19 because of the kind of redundancy, diversity and so on. 20 NR. KERR What do you estimate to be *.he 21 probability? 22 MR. VAN DE VENNE: 10 to the minus 8 test. 23 MR. KERR: I say what do you estimate to be the loss 24 probability of loss of off-site power? 25 O Heritage Reporting Corporation (202) 628-4888
102 1 MR. VAN DE VENNE: I think it is 10 to the minus one. 2 Point one-two, I think. Just loss of off-site power. Then i 3 loss of all AC I think is on the order of 10 to the minus 4 or 4 so. 5 (Continued on next pago.) 6 7 8 9 10 11 12 13 O 14 15 16 17 18 19 20 21 22 23 24 25 O Heritage Reporting Corporation (202) 628-4888
103 (]) 1 MR. VAN DE VENNE: Most of these 2 are on the order of 10 to the minus 3, couple that with -- 3 these are orders F1:at might be slightly different, but this is 4 roughly what we are ertimating. 5 MR. WYLIE: Let te ask a question. In your PRA, did 6 you use the Japanese or the U.S. -- 7 MR. VAN DE VENNE: U.S. reliability. 8 MR. WYLIE: Reliability of diesels? 9 MR. VAN DE VENNE: Yes. 10 MR. WYLIE: For diesels. 11 MR. VAN DE VENNE: Well, generally for everything. 12 We used U.S. reliability data. 13 MR. WYLIE: On the generator circuit breaker which I () 14 applaud you for your business, do you know why the Japanese l 15 chose not to do it? 16 MR. VAN DE VENNE: Cost, I think. 17 MR. WYLIE: Cost? 18 MR. VAN DE VENNE: Yes. 19 MR. WYLIE: I know they studied it, but chose not to 20 put it in. 21 MR. VAN DE VENNE: Yes. 22 MR. MICHELSON: Does that X above the generator mean 23 the --- the generator circuit breaker? 24 MR. VAN DE VENNE: Yes, right. 25 MR. MICHELPON: Okay. O Heritage Reporting Corporation (202) 628-4888 _d
-104 () 1 MR. VAN DE VENNE: So, you know, the loss of IPS.is'a 2' troublesome scenario in a way, because if you really lose all 3 the protection system, certain functions may be actuated. Like 4-I mentioned, the loss of IPS, for instance, there is a trip 5 signal. There would be a turbine-driving pump start signal 6' that would probably be an S signal, but there would be no 7 indication, or very limited indication. 8 There are a few signals associated with the rector 9 coolant system which are not safety-related which come directly 10 into the control system, wh'ich has its own batteries, its own 11 vital AC buses. There is two vital AC buses that are non-class 12 1E, and there is -- but unfortunately the amount of L 13 instrumentation that would be available is very, very small. t k,)s 14 I think there is a couple of pressure signals.and a 1 15 couple of temperature signals, and other than that there is no 16 steam level, no -- yeah, there is a pressurizer level. But in 17 any case, it's extremely limited. 18 And so it is a troublesome, very troublesome 19 scenario, and unfortunately as far as for instance this DC, 20 vital AC arrangement, there isn't a lot more than you can do 21 that is obvious that is going to improve the situation. 22 I mean you could say, well, let's add a couple of 23 bi.tteries, but I don't know that it is really going to buy you 24 very much. i 25 So loss of protection system I think is generally not O Heritage Reporting Corporation (202) 628-4888
105 (f 1 being considered in:PRAs, or maybe it has been, but in our 2 case, because the core melt frequency is slow, it becomes a -- 3 it can become a fairly big contributor. 4 And I, frankly, do not know how to calculate the 5 probability of that occurring. You have seen the cabinets-6 which have multiple power supplies, multiple subsystems, there 7 is four trains, and to lose all of that is, if-you have power, 8 seems very unlikely, but maybe it could happen. And this 9 arrangement does I think have a high degree of reliability, but 10 these are the kind of sequences that come into play when you 11 reduce everything else. Then some of these autliars that 12 historically never been looked at become maybe dominant. 13 MR. KENYON: Did you in the course of your 14 investigntion try to determine what change in risk would occur, 15 if any, it you eliminated the under-voltage trip from trip 16 breakers? 17 P.R. VAN DE VENNE: No, I don't think so. But again, 18 the TGC peopJe could probably -- I kncw the trip breakers havo 19 beer. changed. Generally there are two coils, one is a 20 positive, the other one is more like a permissive. I know that 21 the design of the trip breakers has been changed to have the 22 permissive coil to be more like an active coil in providing a 23 positive force to open the breakers. L 24 I know that change has been made in response to the 25 Salem incident, and that change is available as a backfeed on, O Heritage Reporting Corporation (202) 628-4888
106 -( ) 1 you know, current plans, and that would be the type of breakers 2 that we could use, or would use on this design, obviously. 3 I showed you the eight trip breakers. .It would 4 certainly be possible to have broakers of a different design. 5 There is two sets of every breaker. It would certainly be 6 possible. Again, whether that really provides a meaningful 7 reduction of risk, I really can't tell, because, you know, you 8 are getting down to levels of failure that are very, very low 9 and it's difficult to quantity some of these things. 10 MR. WYLIE: I assume integrated controls are fed off 11 these matters, or-is that a separate -- 12 MR. VAN DE VENNE: What, the generator control? 13 MR. WYLIE: Yeah, integrated control system. 14 MR. VAN DE VENNE: No, it has separate batteries. 13 MR. WYLIE: Separate batteries. 16 MR. VAN DE VENNE: And it has separate vital AC 1 17 buses, or AC ous, instrument buses. 18 There are a number of safety actuations that are done 19 from the control system. For instance, startup heat water 20 system would be actuated from the control system. But again, 21 that control set would be blind because it wouldn't see steam 22 generator level. So it would operate, it would operate with 23 the valves, discharge valves wide open, but it wouldn't allow 24 for steam generator level adjustment, and I am sure that after 25 some time, you know, you would get into problems. O Heritage Reporting Corporation (202) 628-4888
107 () 1 I don't know what the time is. It's several hours, I 2 presume. But unless the operator manually pushed back the 3_ valves, you would get into an overfill situation, and I guess 4 you can put a preprogrammed valve position in, but you are 5 still running blind. 6 Okay. 7 MR. WARD: We aren't to your 10:00 point yet on the 8 agenda, but that's okay. Let's take a break now. 9 MR. MICHELSON: Do you want me to ask a question now 10 or after the break on this part? 11 MR. WARD: Now. 12 MR. MICHELSON: Well, it's not a question 13 necessarily, but a comment which didn't get up picked up very ) 14 well in the PRA because it wasn't considered. And that is that 15 in this particular plant layout it's rather unique and ?6 troublesome that the emergency diesel generator is very close 17 to the control room on the same common corridor with entry to 18 the control rooms.. It happens to be, I think, the. only way to 19 get into the control room. And there has got to be some kind 20 of an interesting risk associated with fire, explosion or 21 whatever in that diesel compartment with a single door between 22 that and the corridor that leads to the control room. 23 You didn't consider it in the PRA, but I think it's i 24 going to have to get a very hard look, because it's unusually l l 25 close to a control room, for a dangerous piece of equipment () Heritage Reporting Corporation (202) 628-4888 l l
108 () 1 like a diesel generator set. It's just way too close, but we 2 will get to it. The PRA just didn't look at it. 3 MR. WARD: Okay, let's take break then until 11:15. 4 (Whereupon, a recess was taken.) 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 l i 25 1 0 Heritage Reporting Corporation (202) 628-4888
109 (])- 1 MR. WARD: Let's pick it up again. Let's see. I 2 think we are still on Section III of tF-agenda and have a 3 little bit more to that and then we'll go to IV. And that is 4 the proprietary section. 5 It looks like we are running at least an hour or a 6 little over an hour behind the schedule. I would anticipate 7 we would finish about 5:00 o' clock this afternoon. 8 MR. van de VENNE: As a conclusion here to my talk I 9 would like to provide sort of a qualitative tie-in between the 10 features that I have been discussing and how they affect the 11 classical events that are considered in the core melt frequency 12 analysis. 13 And I have just listed some of the, what I mean by ) 14 PRA issues addressed, I have listed those issues that have come 1S up in past PRAs that we have seen and that have been relatively i 16 large ccntributors to core melt. 17 The first sequence is really the loss of all AC. But 18 I included loss of cooling here because loss of cooling could 19 lead to really loss of all AC. So it is a very similar tree 20 and a very similar event. 21 As far as the initiating frequency is concernad, we I 22 have not really assumed any difference in loss of offset power 23 frequency in our PRA, so we pretty much used the standard like 24 once every ten years or so. 25 In the component cooling and the essential service O Heritage Reporting Corporation (202) 628-4888
110. () I water systems we have incorporated features, especially the 2 separation, that would tend to minimize the potential for loss 3 of cooling. In other words, capacitor failure would not 4 necessarily lead to a loss of all cooling, maybe to a loss of 5 one train. 6 So we feel that, as far as the initiating frequency 7 is concerned, we are probably a little bit better off than most 8 plants. i 9 MR. KERR: What does "minimize" mean in this context? 10 MR. van de VENNE: In this context it means that if 11 there were a capacitor failure, the re is no way that a 12 capacitor failure could lo'e both streams. Now, there are s 13 other failure mechanisms like ice or plugging of the intake or ) 14 something like that could still cause a loss of all cooling. 15 I'm not excluding it. But I'm saying as far as the system 16 design, we've tried to do it in such a way that there is really 17 no event, credible event, that could lose both streams. 16 In many cases, systems are interconnected and if you l 19 had a capacitor failure, you could lose it all. 20 MR. KERR: Does that mean you have a goal for some 21 low probability and you've achieved it, or does it just mean 22 you think you've done a good joo? 23 I'm trying to understand what "minimize" means. 24 MR. van de VENNE: Yes. l 25 To me, minimize means that you have reached a O Heritage Reporting Corporation (202) 628-4888 1
111 -()- 1 -minimum, based on something or other. 2 MR. van de VENNE: I guess the criteria was 'there was -3 .no, there is no capacitor failure that could cause loss'of all 4 coolant. 5 MR. DAVIS: But-isn't it true that you did not 6 consider that as an initiator in the PRA? 7 MR.' van de VENNE: Yes, we did consider loss of 8 cooling. 9 MR. DAVIS: You do have a probability associated with 10 loss of those systems? 11 MR. van de VENNE: Yes. 12 MR. DAVIS: Okay. 13 MR. van de VENNE: We have calculated a probability ) 14 based on common cause failure basical.ly of all pumps for both f' 15 the CCW and the essential service water. That is our ~ t 16 initiating frequency. 17 As far as mitigating features, the number of turbine 18 driven pumps in this ?)ar.t has been increased from the one 19 traditional to two so we have a more reliable feedwater supply 20 and in order to pump, to protect the coolant pump seals, we 21 have seal leakage testing and also we have the AC-independent 22 seal injection. 23 So that in general you will find that the risk 24 associated with these type of events is lower in this PRA that 25 it has traditionally been. And these are the main features O Heritage Reporting Corporation (202) 628-4888
112 () 1 that take~ care of that. 2 MR. WARD: Now, you said two turbine-driven emergency 3 feedwater pumps, but.you didn't mention the other, you know, 4 your startup feedwater pumps. 5 MR. van de VENNE: Well, there, on the loss of all 6 AC, they would be gone, basically. I mean if you lose all AC, 7 you lose diesels, you lose your motor driven, you lose any 8 motor driven pump basically in the plant. 9 So you are really down, in a conventional plant you 10 are down to no protection for your seals, and a single pump to 11 provide the heat removal capability. What I'm saying, we've 12 added another turbine-driven pump and we've added the AC-13 independent seal injection. So those~are two very large 14 contributors to reducing the risk of this sequence. 15 In terms of the transients, I think we could right 16 now assume a lower initiating frequency than historically we 17 have done for other PRAs, but in the RESAR SP-90 we haven't 18 really done that. 19 The two reasons are, this plant does have full load 20 rejection capability and also the ongoing reactor trip 21 reduction program. 22 Now, there is still a big disparity between the U.S. 23 and Japan. There is almost an order of magnitude difference in 24 the number of trips, even today. 25 But we have assumed ten transients in our PRA. O Heritage Reporting Corporation (202) 628-4888 L
113 () 1 In terms of mitigating features, we have increased' 2 the reliability of the feedwater system and here the startup 3 feedwater system comes in. We have a startup feedwater system 4 which is actuated from the control system. We have an 5 emergency feedwater system which is actuated from the 6 protection system. So we have built in some diversity in terms 7 of actuation, water supplies, number of pumps, and the 8 emergency feedwater system of course has the turbine-driven 9 pumps. It does have a little bit more diversity than we 10 generally have. And we have minimized -- or minimized -- we 11 have reduced the need for operator action by putting in 12-automatic controls on the startup feodwater system and by 13 reducing the size of the pumping capacity of the emergency ) 14 feedwater system. 15 Right now, emergency feedwater systems have been, are 16 basically overdesigned or auxiliary feedwater systems. They 17 have fairly large pumps. And the result of that is that if you 18 turn them on, the operator has to throttle back fairly rapidly 19 because you tend to overcool the system. We have tried to 20 reduce the size of these emergency feedwater pumps so we don't l 21 get in that situation as quickly. And of course if the startup 1 22 feedwater system works, we never get into that situation 23 because it is heated water and there is an automatic level. 24 MR. KERR: Excuse me. Let me make sure I understand. l 25 You new have the capability to start from zero power and bring l l O Heritage Reporting Corporation (202) 628-4888 i
114 f( 1 the power up gradually without manual control of feedwater. Is 2 that what you're telling us? 3 MR. van de VENNE: Right. But also, after reactor 4 trip, we don't need to control feedwater manually. We have 5 automatic level control, with a fair degree of~ probability of 6 success. 7 MR. KERR: You have had enough experience with it 8 that it will work, not just on paper? 9 MR. van de VENNE: Right. I think low power control 10 problems are basically, can be designed out by proper control 11 systems. And plans are looking at backfitting some of these 12 improvements. 13 MR. KERR: You are restoring my faith in American 14 technology because I have wondered for years why this couldn't 15 be done and you are telling me it can be done, f 16 HR._ van de VENNE: It can be done. 17 MR. KERR Good. 18 MR. MICHELSON: But aren't you doing it by adding 19 that emergency, I mean by adding the startup feedwater pump 20 instead of by altering the control arrangement? 21 MR. van de VENNE: Well, the startup feedwater pump 22 only gets you to a few percent power. 23 MR. MICHELSON: Yes. 24 MR. van de VENNE: I think d lot of the feedwater l 25 control problems are really -- O Heritage Reporting Corporation (202) 628-4888
m. 115 (). 1 MR. MICHELSON: 15 percent range. 2 MR. van de VENNE: -- between 5 and 15. 3 MR. MICHELSON: Yes. 4 MR. van'de VENNE: And what I'm saying there is there 5 are improvements in that area also. 6 MR. MICHELSON: You need-to work on the control 7 system as well? 8 MR. van de VENNE: Right. Yes. 9 MR. MICHELSON: Thank you. 10 MR. van de VENNE: Which I really didn't go over. 11 And then as a backup to the feedwater we have a 12 dedicated bleed and feed capability, which I mentioned the 13 semi-closed circuit, which should minimize the reluctance or 14 reduce the reluctance of the operator to use this mode of h 15 operation. 16 MR. WARD: Are any of these, I mean the feedwat.er' { 17 stuff in particular, is Sizewell B going to have any of those? 18 MR. van de VENNE: Sizewell B has a four-pump 19 emergency feedwater system but as far as I know they don't have 20 a startup feedwater system. But they do have the four-pump 21 system. And they do have the bleed and feed operation. 22 MR. WARD: Oh, they do? Well, let's see. We don't 23 want to talk about size. But they do have the feed and bleed, 24 I mean the sort of semi-closed? 25 MR. van de VENNE: No, no, they don't have the semi Heritage Reporting Corporation (202) 628-4888 .m
116 () 1 closed. But they have dedicated bleed valves, safety grade. At 2 least they have that. 3 MR. WARD: Okay. 4 MR. van de VENNE: The loss of coolant accidents -- 5 in the past, big contributors to small breaks have been PRV 6 opening on transients and also RCP LOCA, reactor-coolant pump 7 LOCAs. We have, in our PRA, generally these probabilities are 8 reduced because we have incorporated them into other sequences. 9 The mitigating features were the high head safety 10-injection pumps, the four pumps. We essentially have a one out 11 of four success criteria, so that is better than most plants 12 today. 13 We have eliminated the switchover. Switchover is a ) 14 very large contributor to core melt in the conventional plant. 15 So that is eliminated. We don't need that. And also an issue 16 is the long-term core cooling. We can use both the highest and 17 the lowest pumps for core cooling, if the operator so desires. 16 So we essentially have eight pumps available that take direct 19 suction from the sump so the long-term cooling situation is a 20 lot better than most plants where you really have only two 21 pumps. The two lowhead pumps are really the only two pumps l 22 that can take suction from the containment and pump the water 23 into the system. 24 MR. KERR: What is the meaning of automatic PORV l l 25 isolation? l l (:) Heritage Reporting Corporation (202) 628-4888 l
117 () 1 MR. van de VENNE: Low system pressure. 2 MR. KERR: So that if you try to blow down the 3 system, the PORV will be automatically blocked and you can't 4 blow it-down. Is that it? 5 MR. van de VENNE: I mentioned that before. In the 6 feed and bleed mode, there is what we call a bleed and feed 7 button. If you push that, automatic isolation of the PORVs is 8 blocked. But in other events, like a transient, it would 9 automatically close, if the pressure came too far down. 10 MR. WARD: I guess I'm going back a little bit. 11 MR. van de VENNE: Okay. 12 MR. WARD: But with regard to the highhead pumps and 13 what you just mentioned, you've got -- you can use the high 14 head pumps for long term cooling because they draw out of the 15 sump, or whatever you call a sump. 16 As I understood it, in a lot of designs of the past, 17 the highhead pumps didn't drav aut of the sump because of the 18 nature of the pump and they are more prone to fowling and 19 damage by dirty water or something that might be in the sump. 20 You don't really have a sump here. But is this 21 system markedly better from that standpoint? 22 MR. van de VENNE: Well, I think the main issue with 23 highhead pumps in the past has been that they are also used for 24 charging. And the pumps tend to be designed for two operating 25 points which are somewhat incompatible. l ( Heritage Reporting Corporation (202) 628-4888 l
118 .()' 1 Originally they were charging pumps, then when_the 2 need for high injection came people said well, these pumps can i 3 do that. And then as highhead injection requirements became-4 more and more eevere, the operating points got further and 5 further apart and these pumps really became a compromise. And 6 they have very poor MPSH, and a very large MPSH requirement. So 7 if you wanted to have direct suction on these pumps, you would 8 have to locate them very, very, at a very low elevation that, 9 generally was not available. And that is the main reason as I 10 understand it that they took suction from the discharge to the 11 lowhead pumps, one of the main reasons. 12 But these pumps, these highhead pumps are say similar 13 to South Texas where they take suction from the containment and \\s/ 14 where there has been a testing program to show that these pumps 15 are -- you know, they are multi-stage but they are not like 16 charging pumps. 17 MR. MICHELSON: A follow-up question. Are you 18 allowing fibrous insulation inside of containment? 19 MR. van de VENNE: No, I don't think so. I think we 20 have the reflective insulation. 21 MR. MICHELSON: That is an interesting question from 22 the viewpoint that a number of plants in this country now are 23 going from metallic to fibrous in replacement and now you are 24 going back to metallic. r 25 MR. van de VENNE: Well, I would have to -- O Heritage Reporting Corporation (202) 628-4888 l L!
119. (). 1 ^ MR.' MICHELSON: I'm not trying to push it either 2 way. 3 MR. van de VENNE:- Yes. 4' MR. MICHELSON: But if you do go the fibrous, then S-you do have to address the fibers in the fluids that are being 6 pumped by the highhead and RHR pumps. 7 MR. van de VENNE: Yes. 8 MR. MICHELSON: To be sure that they do not get into, 9 the seal systems or whatever. 10 MR. van de VENNE: Right. 11 MR. MICHELSON: But if you don't have any fibrous 12 materials inside of containment, then it's not a problem. 13 MR. van de VENNE: It is my recollection that we 14 specified insulation to not cause any problem in the sump water 15 because that is the main concern, I think. 16 MR. MICHELSON: Well, that is a little different 17 answer, of course. 18 MR. van da VENNE: Oh, the steam generator tube 19 rupture, the steam generator reliability as far as the tube 20 material, the tube supports, and also the sludge management has 21 been upgraded quite a bit over the years. Some of these 22 improvements are in replacements steam generators now, but they 23 are generally not in operating plants. That should reduce the 24 initiating frequency _unless foreign objects are the main 25 contributor, in which case, you know, it may not help that ( l Heritage Reporting Corporation (202) 628-4888
120 ( 1 much'. 2 So_in terms of steam generator tubeLrupture 3 frequency, I think we have generally assumed no change at this 4 point. 5 The mitigating features I mentioned. The main one is 6 the steam generator overfill protection system which protects 7 the safety valve water discharge in a tube rupture scenario if 8 the operator doesn't depressurize the system. 9 MR. MICHELSON: I guess this is as good a time as 10 any. I brought it up earlier, but now we're talking about the 11 PRA itself. 12 In the PRA you specifically say that your overfill 13 protection protects against the overfill of the generator and I 14 pointed out specifically you have made no provisions to protect 15 against feedwater overfill. 16 MR. van de VENNE: You know, we discussed that just 17 during the break here, and my recollection -- and I would have 18 to confirm it -- is this. If a maia feedwater line fails to 19 the extent that the feedwater control valve goes full open, t 20 that would normally cause a high level in the steam generator. 21 The high level in the steam generator would initiate 22 a reactor trip on the one hand and a main feedwater isolation 23 on the other hand. 24 MR. MICHELSON: That is the key point. 25 MR. van de VENNE: Yes. And that is what we l Heritage Reporting Corporation (202) 628-4888 i
121 '(). 1 understand the design to be, but we will confirm that.
- Now, 2
the main feedwater isolation would act on the main feedwater 3 isolation valve which is safety grade and it would act on the 4 control' valve and on tripping the feedwater pump which are both 5 nonsafety grade. 6 So there is triple isolation signals but only one of 7 them is fully safety grade. The other ones are nonsafety 8 grade. 9 So that is our understanding of the way the design 10 is. 11 But if all that would fail, you are quite right. 12 MR. MICHELSON: Well, that is not single failure 13 proof, it's control grade, I think. But it may-be at safety 14 grade. 15 MR. WARD: The valve is safety grade. 16 MR. van de VENNE: One valve is fully safety grade. 17 The signals are safety grade, but the components that they act 18 on like the main feedwater pump is not safety grade. I 19 MR. MICHELSON: One valve plus the actuating system 20 is safety grade? 21 MR. van de VENNE: Right. 22 MR. MICHELSON: Then you should be all right. 23 MR. van de VENNE: That's our recollection. 24 In terms of the initiating frequency of anticipated 25 transfers without "scram," less transients would help you i O Heritage Reporting Corporation (202) 628-4888 i
122 () 1 there, improved trip reliability would help you there. I 2 mentioned that the integrated protection system tends to fail 3 in the safe direction, if anything is going wrong. Also, the 4 trip breaker reliability has been improved, with the eight-5 breaker arrangement rather than the two-breaker arrangement 6 that you' generally have. .7 The mitigating features are I think that we have an 8 improved transient performance following such an event. We 9 have a large pressurizer relief capacity. We have safety l 10 valves plus the safety grade valves, PORVs. We have a more 11 core reactivity feedback situation than we generally have, and 12 also we have a larger steam generator inventory per megawatt, 13 about 20 to 30 percent larger than we have in current plants. 14 The mitigating features are independent of the trip 15 of the IPS portion that takes care of the trip, which provides 16 some diversity, and we have more feedwater. 17 The other thing that would help us would be if the 18 startup feedwater starts, which is actuated from the control 19 system, you are talking about some even more diversity but the 20 emergency feedwater system would also start, so both would 21 actually be operating. 22 MR. WARD: Is the pressurizer itself any bigger in 23 this design? 24 MR. van de VENNE: It is a lot bigger, yes, It is 25 2,500 cubic feet. Typically a plant has 1800; South Texas has O Heritage Reporting Corporation (202) 628-4888
123 i 1 2,100. 2 MR. WARD: I see. 3 MR. van de VENNE: South Texas has the same megawatt 4 rating as 2,100. This one has 2,500. 5 MR. WARD: Okay. Now, is that -- you haven't singled 6 that out. 7 MR. van de VENNE: No. When we run the transients, 8 you generally find that on an average, it may take, with a 9 larger pressurizer it may take a 1.ittle bit longer to hit the 10 point where you are relieving water, or at least a two-phase 11 mixture, where you are running out of steam. 12 But we are talking seconds here. Generally, ten to 13 15 seconds you start relieving water. So the larger !"h (,,j 14 pressurizer buys you maybe two seconds, which really in this 15 scenario is not significant. So you are running out of steam 16 in about 10, 12 secords, after, you know, on an average. 17 MR. WARD: I think I missed what you said about the 18 reactivity feedback. 19 MR. van de VENNE: Because of the core design, we 20 have low power density and a spectral shift. We have a more 21 negative moderator temperature coefficient than you 22 traditionally see on this plant. 23 MR. KERR: How much more? 24 MR. van de VENNE: I would say, you know, we are 25 starting out in the first cycle like minus 8 but on a reload (~h '~ Heritage Reporting Corporation (202) 628-4888
124-() 1 cycle-we are starting out at minus 16 which-is a lot, it's a 2 lot more negative than you typically see. 3 -MR. REMICK: Is it negative throughout life? 4 MR. van de VENNE: Oh, yes. .At zero power it'is 5 negative. At full power it is already significantly. negative 6 and then after one or two days it hits you know like minus 16, 7 minus 20. 8 And finally, on the interfacing L'CA, as far as the O 9 initiating frequency, because we have four RHR lines, we have a 10 slightly higher probability actually of having interfacing LOCA 11 as compared to the two lines that a conventional plant has or 12 older plants have or even one in some cases. 13 However, this is mitigated by the increased system 14 design pressure and by the vent paths back to the emergency 15 water storage tank, which combined, these things combined may 16 lead to a leak but not really to a rupture outside containment. 17 And that is a pretty significant improvement because although 18 this has always been a low core melt frequency contributor it 4 19 is a very large contributor in terms of severe releases because 20 it is a LOCA outsido containment. 21 MR. WARD: This is the vent path? Let's see, what 22 vent path is this? 23 MR. van de VENNE: I mention that if these valves 24 open. The relief will be this way. 25 MR. MICHELSON: That is a normally open valve? O Heritage Reporting Corporation (202) 628-4888
i 125 I ( }; 1 MR. van de VENNE: It is a normal.ly-open valve. 2 This valve only is closed when the pressure hits, 3 when you go in RHR operation, which is like 350 PSR. '4 - MR. MICHELSON: I think in present day generation 5 plants that is always a normally closed valve. 6 MR. van de VENNE: That is always a normally closed 7 valve because they take suction from the storage tank. 8 MR. MICHELSON: That is why I asked the question 9 about whether you still can get by with one isolation valve 10 when the one that is there is normally open, which is contrary 11 to, I think -- 12 MR. van de VENNE: Right. 13 MR. MICHELSON: -- requirements. ) 14 MR. van de VENNE: In a normal plant, we do have one 15 storage tank with a suction line to this pump and this valve is 16 closed. Now, once the refuel motor storage tank is open, you 17 isolate it you open this valve. So you are right, it is a 18 little different. The valve is normally open. 19 MR. MICHELSON: It is always open in this plant and I 20 just wondered if that still fits our criteria or not. You were 21 going to get an answer before the end of the day, I think. 22 MR. KENYON: Dr. Michelson, I have a tentative 23 answer. However, the staff member who was doing this review 24 isn't available today so I talked to another plant systems 25 engineer over there, described to him the situation. And he \\' Heritage Reporting Corporation (202) 628-4888 i
i 126 {} 1 was of the opinion the situation would possibly fall under 2 GDC-56, under the other defined basis provision. He said 3 although the two valves are normally required, as you have 4 indicated, sometimes the staff approves the use of one valve if 5 certain conditions are met. One, that it is a safety-related 6 system for which a high reliability for operation is desirable, 7 which I think this may fall into that category and two, if the 8 valve is in a leak-type exposure. 9 Now, Dale indicated that it was part of the 10 containment and we will have to take a look at that. 11 MR. MICHELSON: But did it make any difference 12 whether the valve was kept normally open or normally closed? 13 MR. KENYON: I didn't ask him that. ) 14 MR. MICHELSON: That's the key point in this case 15 which makes it quite different than past experience. Just 16 check on that key point. Normally closed I have no problem, no 17 question, rather. But normally open, I wonder. And it's the 18 same question for both the RHR and the -- 19 MR. KENYON: I understand. 20 MR. MICHELSON: It's the same kind of a question. 21 MR. WARD: And you are still left with the seal 22 leakage. 23 MR. van de VENNE: Still left with the seal leakage. 24 MR. WARD: I'm sort of curious why. Is it so 25 difficult or expensive to provido the seal on that pump that O Heritage Reporting Corporation (202) 628-4888
127 (J 1-would take the pressures that you would'see under these 2 circumstances? Or is the seal leakage really very, very minor? 3 MR. van de VENNE: Well, for instance,_the reactor 4 coolant pump seals, as an example, are seals that take full 5 syatem pressure. And I don't know exactly but I think those 6 seals may be like 40 percent of the cost of the pump. And those 7 are very expensive pumps. So I think sealing against that kind 8 of pressure, 2,500, is a significant engineering, I wouldn't 9 say a problem, but it does entail significant cost. 10 MR. WARD: Would that pump that you've got there have 11 mechanical seals? 12 MR. van de VENNE: Yes. It would normally have 13 mechanical seals. O) (_ 34 MR. MICHELSON: Along a similar line here, the 15 interfacing LOCA is generally by definition between a high and 16 a low pressure system -- 17 MP.. van de VENNE: Right. 18 MR. MICHELSON: -- where the high pressure is the 19 primary side. And we've looked at this so-called "Event B." l 20 But how do you take account of the other kinds of pipe breaks 21 that can occur that interface with the reactor system such as 22 the letdown line breaking? That is not, I think, classified as 23 an event B because it's all high pressure design but there is 24 nothing saying that it can't have erosion or whatever and get a l 25 thin wall and blow out a pipe. Where are those in your PRA? I O Heritage Reporting Corporation (202) 628-4888
128 (~'; 1 couldn't find where you ever picked that up. V 2 MR. van de VENNE: We've evaluated B sequences in 3 this system, for instance. This would be another one. 4 MR. MICHELSON: I don't doubt that you covered these 5 systems. 6 MR. van de VENNE: But I don't think that we've 7 looked at the CBCS. 8 MR. MICHELSON: For instance, are there any other 9 blowdown lines? Keeping in mind that ruptures sometimes are 10 not primary fluid losses but secondary size losses which might 11 aggravate the local environment and get into an important 12 system. And I just don't find pipe breaks outside of 13 containment as a part of your -- neither do I find it included ( ) 14 or omitted. I just don't find it even mentioned. Maybe I 15 missed it. 16 MR. van de VENNE: It hasn't been includea. 17 Mli. MICHELSON: If it is included then I have a 18 number of questions on whether you included certain kinds or 19 not and how you handled it. So you do claim to cover pipe 20 breaks outside of containment? 21 MR. van de VENNE: No, I said it was not included. 22 MR. MICHELSON: I'm sorry. I misunderstood. 23 MR. van de VENNE: I think it's not. They have not 24 been included. 25 MR. MICHELSON: Will that be a different PRA at a O k-Heritage Reporting Corporation (202) 628-4888
129 ' /' 1 later date? This is a kind of a high level PRA I guess, once - (y7 2 over lightly or something? 3 MR.-van de VENNE: I think this PRA has been modeled 4 after other plant PRAs that we've done. 5 MR. MICHELSON: Where do you even address the threat 6 that internal flooding would have to the. plant or internal pipe 7 breaks would have to the plant? Where is that covered? Do you 8 consider it such a low probability situation you don't worry 6 9 about it? 10 MR. van de VENNE: I think those events, although 11 they.are really internal, are generally classified as external 12 events, for whatever reason. 13 MR. MICHELdON: Depends on who you talk to. J () 14 MR. van de VENNE: Yes. 15 MR. MICHELSON: And I didn't find your definition in 16 here, whether you meant external being only flooding or whether 17 you meant even breaking a pipe on a system. I consider that 18 always an internal event. 19 MR. van de VENNE: It should be. I agree with you. 20 MR. MICHELSON: And then you also didn't cover fire 21 and a few other external events and I understood that and I 22 assume that's being picked up later. You certainly don't know 23 the risk that this plant involves until you've looked at 24 exter'nal events associated with the plant. j 25 MR. SHANNON: We'll discuss that in the next session. O Heritage Reporting Corporation (202) 628-4888 i e<-,.r,- --,_m,. _,_ - ,m,-_...-.,, ,,.,m,,m_.,,_,
130 cb') 1 MR. MICHELSON: Okay. thank you. 2 MR. van de VENNE: This concludes my part of the -- 3 MR. REMICK: Just a question. Why do you entitled 4 this Integrated Safeguard System versus safety System? Why the 5 safeguards? Is there something I am missing? 6 MR. van de VENNE: I don't know. I guess the 7 integrated comes from the integration of the -- 8 MR. REMICK: No, it's the safeguards veraus safety.. 9 MR. van de VENNE: I think the two are used 10 interchangeably. People use engineered safety features, people 11 use engineered safeguard systems. I really don't know. 12 MR. REMICK: So no significance? 13 MR. van de VENNE: I don't think there is any 14 significance. ~ 15 MR. REMICK: So sabotage protection here or anything 16 necessarily? 17 MR. van de VENNE: No, I don't think so. Although 18 the engineer that designed it is very cognizant of sabotage. 19 That's one of the reasons the separation is there, to allow the 20 separation in cubicles that prevents sabotage or that may help 21 prevent sabotage. t 22 MR. MICHELSON: Could you refresh my memory on the 23 size of that sump in the containment? 24 MR. van de VENNE. 600,000 gallons. 25 MR. MICHELSON: 600,000, thank you. O Heritage Reporting Corporation (202) 628-4888
131 1 MR..REMICK: Does that depict in general the design {} 2 of it versus a tank? -3 MR. van de VENNE: Yes. In the basemat there is a 4 stainless steel liner or similar to a liner in-t refueling 5 canal. 6' MR. REMICK: That is per each side is 600,000? 7 MR. van de VENNE: No, it's one tank, 600,000. 8 MR. REMICK: Is that wrapped all the way around? 9 MR. van de VENNE: It wraps all the way around. Yes. 10 MR. REMICK: No divider walls or anything? 11 MR. van de VENNE: No. i 12 MR. REMICK: I thought it was two separate pumps. So 13 it does have a commonality. () 14 MR. van de VENNE: Our next speaker is Mr. Sencaktar 15 who has been responsible for the actual PRA work that was done 16 and that is described in module 16. 17 MR. MICHELSON: Excuse me. One more question. As 18 long as that's a common alinular tank, if you ever were to 19 rupture an appendage to that tank outside of containment that 20 you couldn't isolate, you'd drain the whole tank? Or have you 21 made some provision? 22 MR. van de VENNE: We have made provisions by 23 locating each of these subsystems in its own separate area, 24 that if any of these lines, these two lines here would break, 25 which are really the only appendages there are. There are no O Heritage Repor*uG Corporation (202) 628-4888
r 132 (} 1 other connections to this tank except going in. 2 MR. MICHELSON: You mean there's only two pipes 3 -coming off? 4 MR. van de VENNE: Four times.two. 5 MR.*MICHELSON: Yes. 6 MR. van de VENNE: And each of these is in its own 7 common area. And if you get a break there, the water floods up 8 to a certain level where it equalizes with the tank and there',s 9 about 200,000 gallons left. 10 MR. MICHELSON: And that preserves enough suction so 11 that the other pumps have adequate MPSH? 12 MR. van de VENNE: Yes. 13 MR. MICHELSON: Okay. Thank you. Is there any () 14 reason why you didn't want to put a tighter wall on that 15 annulus? 16 MR. van de VENNE: Well, you know, if you have a 17 single failure for instance where you lose two substances on 18 one side of the containment, and you lose that part of the 19 tank, it's no longer available. 20 MR. MICHELSON: I thought you had argued you got the 21 two on the other side remote from this and those two had their 22 protective suctions yet. 23 MR. van de VENNE: The problem that you get into is 24 if all the water floods back to the other part -- 25 MR. MICHELSON: I think your answer is a good one. O Heritage Reporting Corporation (202) 628-4888
I ' 133 i. 1 Thank you. 2 MR. WARD: Unless there is a logical time for you to 3 break after half an hour or so,-~it might be better to take our 4 lunch break now. 5 Let's break for lunch now and come back at 12:55 and 6 we'll be in the proprietary mode when we come back. Thank you 7 very much. 8 (Whereupon, at 11:55 a.m. the lunch recess was taken, 9 the hearing to reconvene at 12:55 pm. the same day, Wednesday, 10 April 6, 1988 in a closed session which is documented in a 11 separate transcript.) 12 13 () 14 15 16 17 18 19 20 21 22 23 24 25 lieritage Reporting Corporation (202) 628-4888
O CERTIFICATE 2 3 This is to certify that the attached proceedings before the 4 United States Nuclear Regulatory Commission in the matter of: 5 Name: ADVANCEO PRE _SURIZED WATER REACTORS 6 7 Docket Number: 8 Places Washington, D.C. 9 Date: April 6, 1988 10 were held as herein appears, and that this is the original 11 transcript thereof for the file of the United States Nuclear 12 Regulatory Commission taken stenographically by me and, 13 thereafter reduced to typewriting by me or under the direction 14 of the court reporting company, and that the transcript is a 15 true and accurate record of the foregoing proceedings. 0 16 /S/ oh 17 (Signature typed): Joan Rose 18 Official Reporter 19 Heritage Reporting Corporation 20 21 22 23 24 25 O Heritage Reporting Corporation g202) 628-4888 e
A INTRODUCTORY STATEMENT BY THE ADVANCED PRESSURIZED WATER REACTORS N SUBCOMMITTEE CHAIRMAN (d APRIL 6, 1988 The meeting will now come to order. This is a meeting of the Advisory ~ Committee on Reactor Safeguards Subcoor +.ee on Advanced Pressurized Water Reactors. I am D. Ward, Subcomittee Chairman. The other ACRS Members in attendance are: W. Kerr, C. Michelson, F. Remick and C. Wylie. Also in attendance is ACRS Consultant:' P. Davis. The purpose of this meeting is to discuss and hear presentations from Westinghouse representatives and the NRC Staff regarding the PRA for WAPWR (RESAR SP/90) design. Medhat El-Zeftawy is the cognizant ACRS Staff Member for this meeting. The rules for participation in today's meeting have been announced as part of the notice of this meeting previously published in the Federal Register on March 31, 1988. To the extent practical, the meeting will be open to public attendance. However, portions of the meeting may be closed to discuss W proprietary information. A transcript of the meeting is being kept and will be made available as stated in the Federal Register Notice. It is requested that each speaker first identify himself or herself and speak with sufficient clarity and volume so that he or she can be readily heard. (Chaiman's Coments - if any) O We will proceed with the meeting and I call upon Mr. Rubenstein/NRC Staff.}}