ML20235A128
Text
- _ - _ _
a i
I l
SUPPLDIENT NO.1 TO THE SAFETY EVALUATION REPORT BY THE DIRECTORATE OF LICENSING U.S. ATOMIC ENERGY COMMISSION IN THE MATTER OF GENERAL ELECTRIC COMPANY GENERAL ELECTRIC STANDARD SAFETY EVALUATION REPORT DOCKET NO. STN 50-447 l
i I
l I
l J
l l
I l
l December 7, 1974 l
87070B0323 B70610 PDR FDIA
{
PDR THOMASB7-40,
1
4 i
TABLE OF CONTENTS
1.0 INTRODUCTION
1-1 3.0 DESIGN OF STRUCTURES, SYSTDiS AND COMPONENTS 3-1 3.2.2 SYSTDI QUALITY GROUP CLASSIFICATION 3-1 3.6 PROTECTION AGAINST DYNAMIC EFFECTS ASSOCIATED WITH TIIE POSTULATED RUPTURE OF PIPING 3-2 3.10 SEISMIC DESIGN OF CATEGORY I INSTRUMENTATION AND ELECTRICAL EQUIPMENT 3_3 3.11 ENVIRONMENTAL DESIGN OF MECHANICAL AND ELECTRICAL EQUIPMENT 3-5 3.12 SEPARATION CRITERIA FOR SAFETY-RELATED MECHANICAL i
AND ELECTRICAL EQUIPMENT 3-9 i
4.0 REACTOR 4-1 4.3 NUCLEAR DESIGN 4-1 4.3.4 CONTROL R0D PATTERNS AND REACTIVITY WORTHS 4-1 4.3.7 ANALYTICAL METHODS 4-2 4.4 THERMAL AND HYDRUALIC DESIGN 4-3 5.0 REACTOR COOLANT SYSTDI 5-1 5.2 INTEGRITY OF P'EACTOR COOLANT PRESSURE BOUNDARY 5-1 I
5.2.1 DESIGN OF REACTOR COOLANT PRESSLTE BOUNDARY COMPONENTS 5-1 6.0 ENGINEERED SAFETY FEATURES 6-1 6.2 CONTAIICIENT SYSTEMS 6-1 6.2.1.2 SHORT TERM PRESSURE RESPONSE 6-1 6.2.1.3 LONG TERM PRESSURE RESPONSE 6-2 J
6.2.1.4 SUPPRESSION POOL MAKEUP SYSTEM 6-3 6.2.1.5 EXTERNAL PRESSURE DESIGN 6-4 6.2.3 SECONDARY CONTAIICIENT FUNCTIONAL DESIGN 6-5 6.2.4 CONTAINMENT ISOLATION SYSTDI 6-6 6.2.5 COMBUSTIBLE GAS CONTROL 6-7 6.3 EMERGENCY CORE COOLING SYSTDIS 6-8 6.3.1 SYSTDI DESCRIPTION 6-8 i
l
'd-4 s
T i
'.0 INSTRUMENTATION AND CONTROLS 7-1
7.1 INTRODUCTION
7-1 7.2 REACTOR TRIP SYSTDI 7-2
'7.3
. ENGINEERED SAFETY FEATURE SYSTDiS 7-8 7.4 SAFE SHUTDOWN SYSTDI 7-25 7.5.
' SAFETY RELATED DISPLAY INSTRUMENTATION 7-27 7.6-ALL OTHER : INSTRUMENTATION-SYSTDIS REQUIRED FOR SAFETY
'7-29 7.7 CONTROL SYSTEiS -
.7-32 7.8 INSTRUMENTATION:I!nERFACES WITH BALANCE DE. PLANT 7-38' 8.0 ELECTRIC POWER SYSTDIS 8-1 11.0 RADIOACTIVE WASTE MANAGDIENT, 11-1 11.4' SOLID WASTE MANAGDIENT SYSTDIS 11-1 g,.
- f' i
9 f
l 1
1-1 l
l
1.0 INTRODUCTION
)
l
'The Atomic Energy Commission's Safety Evaluation Report (SER) in the matter of the General Electric Standard Safety Analysis Report (GESSAR,\\
f was issued on November 13, 1974.
In that report, the Regulatory staff noted that there were (1) areas where the applicant had not supplied enough information for the staff to complete its review, (2) items where the staff had only recently received information from GE and had not completed its review, and (3) certain Regulatory staff requirements that would be made conditions of the Preliminary Design Approval (PDA) unless
.GE made commitments to meet these requirements.
The purpose of this supplement is to update the SER by providing the staff's evaluation of additional information received since the issuance of the SER.
In addition, a review of the SER has revealed areas 1
where corrections or furth~er explanations are in order. Each of the following sections in this supplement is numbered the same as the section of the SER that is being updated.
Sections addressing new issues are identified as such.
Appendix A to this supplement is a continuation of the chronology of the principal actions related to the processing of this application.
Appendix F is a listing of errata of this SER.
Where appropriate, item j
numbers af ter each topic refer to the list of outstanding issues dated November 5,1974, and issued with the staff SER.
1
l l
3-1 3.0 DESIGN OF STRUCTURES, SYSTEMS AND COMPONENTS 3.2 Classification of Structures, Systems and Compohents 3.2.2 System Quality Group Classification (Item 1, part)
GE originally classified the liquid and gaseous radwaste treatment systems as Quality Group D.. Our SER deated that GE should
\\
supplement the cisssification of these systems with the additional requirements identified in Appendix B of that report.
These requirements providedforadditionalQualityAssuranceprovisions,r$commendedwelded construction for pressure retaining system components, reducing screwed or flanged fittings and pressure testing the system to the extent practicable.
In Amendment 23, GE provided -additional information that meets the requirements discussed in Appendix B to our SER for Quality Group D 1
(Augmented). We consider this item resolved.
i
l a
\\
3-2 s.6 PROTECTION AGAINST DYNAMIC EFFECTS ASSOCIATED WITH THE POSTULATED 3
RUPTURE OF PIPING (Item 3) f We stated in the Safety Evaluation Report that acceptable P pe i
break criteria for those portions of piping passing through containment 1
had not been provided.
In revisions to Section 3.6.1.4.4 to GESSAR, I
GE provided additional criteria fo r fluid system piping between containment isolation valves. These criteria a.idress welded attachments to the pipe, the type of pipe to be used, the design of pipe anchors and restraints, and design and testing criteria for guard pipes. We have reviewed these i
revisions and conclude that the criteria used for the identification, design and analysis of high and moderate energy piping passing through containment where postulated breaks may occur meet our criteria listed in Appendix G and constitutes an acceptable design basis for satisfying the requirements of General Design Criterion 4 We consider this item resolved.
I l
l G
em>=
1 i
s
~
3-3 3.10 Seismic Design of Category I Instrumentation and Electrical Equipment i
General Design Criterion 2 (GDC-2) requires, in part, that structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as earthquakes. Regulatory Guide 1.29 specifies the structures, systems, and components which are designated j
as Category I and which should be designed to remain functional during and following the occurrence of a safetshutdown earthquake. As part of our review for the PDA, we reviewed the material presented in GESSAR to determine whether the requirements of GDC-2 will be met and whether the scope of the seismic qualification program will conform to the staff position set forth in Regulatory Guide 1.29.
The specific areas covered by the staff l
review are:
1.
The criteria for seismic qualification, 2.
The methods and procedures used to implement the criteria by tests or a combination of tests and analyses, and 3.
The scope of the seismic qualification program, i.e.,
the specific equipment to be seismically qualified.
GESSAR previously referenced the topical report NED0-10678, " Seismic I
Qualification of Class I Electrical Equipment," November 1972. We reviewed that report and determined that the report applies principally to the equipment used in previous BWR plants and that the qualification procedures are not based on current seismic design criteria.
On the basis of our review, we concluded that this topical report is not applicable to GESSAR.
In Amendment No. 24 to GESSAR, GE stated that topical report NEDO-10678 is not an applicable reference for GESSAR and deleted references to this report.
GE has stated in Section 3.10.1.3 of GESSAR that all Category I
- - - -. - - - - - - - - - - - - - - - - - - ~ _ - - - - _ - - - - -
D 3-4 i
electrical equipment will be seismically qualified in accordance with the staff position dated December, 1973. We conclude that the criteria set forth in the staff position which was adopted by GE are acceptable as a basis for seismic qualification of Category I instrumentation and electrical equipment.
We have not completed our review of the methods and procedures to be used in implementing the seismic design criteria nor of the scope of-the seismic qualification program. During a meeting with GE on October 29, 1974, it was agreed that GE would submit for staff review:
(1) a list of the specific equipment which will be seismically qualified and (2) the qualification procedures to be used in implementing the seismic design qualification criteria.
It was also agreed that these two aspects of I
the review would be conducted as post-PDA items requiring resolution prior i
to the final design approval review.
In Amendment No. 24 to GESSAR, GB 1
documented these agreements except that GE stated that these two aspects of the review will be conducted as post-PDA items requiring resolution during, rather than prior to, the final design review.
It is our position that these two items must be resolved prior to the FDA review.
Ve have concluded that the c.ommitnent by GE to comply with the seietic design criteria set forth in the staff position, " Electrical and Mechanical Equipment Seismic Qualification Program," dated December 5, 1973, is an acceppable basis for the PDA subject to staff review and approval of the qualification methods and procedures and the scope of the seismic qualification program.
It is expected that these two aspects of the review can be completed during our review of the preliminary designs
4 3-5 i
' for the instrumentation systems which will also be conducted as a post-PDA item as discussed in Section 7.1 of this SER. We will report the-results of our review of.these two items in a supplement to the SER.
3.11. Environmental Design of Mechanical and Electrical Equipment General Design Criterion 4 (GDC 4) requires, in part, that structures,-
systems, and components important to safety be designed'to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, incluoing loss-of-coolant accidents. As part of our review i
- for the PDA, we reviewed the material presented in GESSAR to determine whether the requirements of GDC 4 with respect to the environmental design j
i' of safety-related mechanical and electrical equipment will be met.
The
- specific areas
,vered by the staff review are:
J i
1)
The criteria'for environmental qualification of safety-related equipment,
)
4 1
.-__m.
_._m_.____.______
5'.
i o
3-6 1
l c
- 2) The methods and procedures to be used to implement the criteria by tests or by a combination of tests'and analyses, and
- 3) The scope of the environmental qual'ification program, i.e.,
i i
the specific equipment to be environmentally qualified.
I GESSAR previously referenced the topical report NED0-10698, l
" Environmental Qualification of Class I Control and Instrumentation Equipment," November, 1972. We reviewed that report and determined l
that the report applies principally to equipment used in previous BWR plants and that the qualification procedures are not based on
(
current criteria. On the basis of our review, we concluded that this topical report is not applicable to GESSAR.
In Amendment No. 20 to GESSAR,. references to this topical report were deleted and in Amendment No. 24 GE stated that topical report NEDO-10698 is not an applicable reference for GESSAR.
In response to our requests for additional information, GE stated that a program is underway to qualify all Class IE equipment to the requirements of IEEE Std 323-1974, "IEEE Standard for Qualifying Class IE Equipment for Nuclear Power Generating Stations."
In Amendment No. 24 to GESSAR, GE stated that it vill develop an instrumentation and control aging program as a method of implementing the aging requirements of IEEE Std 323-1974 and that such a program' 7
(
1
f l
.o 3-7 to obtain a qualified life of 40 years may require participation f
by utility-users. GE has also stated that it will comply with the requirements of IEEE Std 382-1972, " Trial-Use Guide for Type Test of Class I Electric Valve Operators for Nuclear Power i
t Generating Stations," as modified Regulatory Guide 1.73.
With respect to compliance with the. requiremen ts of IEEE Std. 334-1971,
" Trial-Use Guide for Type Tests of Continuous Duty Class I Motors Installed Inside the Containment of Nuclear' Power Generating
-Stations," as modified by Regulatory Guide 1.40, GE has stated that the design described in GESSAP. does not use any continuous d6cy Class I motors ir. side the containment.
If the GESSAR design is revised to include Class I motors inside the containment, we will require that the design niso comply with the requirements of IEEE
')
l Std 334-1971 or, if the staff determines it to be appr6priate, with the requirements of IEEE Std 334-1974.
i s We have not completed our review of the methods and procedures to be' usa d to implement the environmental qualification criteria nor of the scope of the environmental qualification program.
During a meeting with GE on October 29, 1974, it was agreed that GE would submit for staff review:
- 1) a list hf the specific equipment that will be environmentally qualified <and 2) the qualification procedures to be used in implementing the environmental qualifica-i
(
tion criteria.
It was also agreed that these two aspects of the review would be conducted as post-PDA items requiring resolution prior to the final dpsign approval review.
In Amendment No. 24 to t
i
p
,e 3-8 I
GESSAR, GE documented these agreements except that GE stated that these two aspects of the review will be conducted as post-PDA items requiring resolution during, rather than prior to, the final design review.
It is our position that resolution of these items should occur prior to the FDA review. In addition, since some of the methods that may be used to comply
.with the requirements of IEEE Std 323-1974 involve der,fgn changes such as installing additiona1Lequipment, resolution of the methods to be used to implemene IEEE Std 323-1974 must occuc before the design is established.
We hvie concluded that the commitments by GE to comply with the requirements of IEEE Std'323-1974 and IEEE Std 382-1972 as modified by Regulatory Guide 1.73'are an acceptab12 basis for the PuA 6ubject to the following conditions.
If the design is revised to include use of Class I motors inside containment, we.will require conformance with the latest applicable edition of IEEE Std 334.
In addition, the PDA will be conditional upon staff review and approvt.1 of the methods and procedures to be used to environmentally qualify Class IE equipment and the scope of the environ-mental qualification program.
3.11.1 Electric Penetrations in the Shield Building, Containment and Drywell Walls We have reviewed the information presented in Sections 3.8.6.2 and 7.1.24 of GESSAR pertaining to the electric penetrations for the shield building, containment and drywell. During a~n:ecting with GE in October, 1974, we reached agreement with GE that the preliminary design for the I
drywell penetrations would be submitted and reviewed as a post-PDA item.
However, in Amendment No. 24, GE stated that this information would be submitted during the final design review.
It is our position that resolution
'i I
__-_-_m..c
____._m.-__
m
+ ',
P, ;
E, 3-9
(
of this itdm should occur. prior to the FDA review.
GE has'taken exception to the requirements of IEEE Std'317-1972',
with respect'to the requirement that penetrations be energized during the environmental qualification tests. We have reviewed the analysis presented by GE in support of this exception. We have concluded that
. exception to the requirements of IEEE Std 317-1972, as modified by.
Regulatory Guide-1.63, is not acceptable. We will require conformance with IEEE Std 217-1972 and, Regulatory Guide 1.63 as a condition of the l
l PDA.
We have concluded that the review of the preliminary design for the drywell penetrations and the procedures and methods to be used to qualify i~
i the shield building, containment, and drywell penetrations can be conducted i
' during the post-PDA review phase. We will report the results of this 1
.)
review in a supplement to the SER.
)
i 3.12 Separation Criteria for Safety-Related Mechanical and Electrical Equipment i
We have reviewed the proposed, design criteria for the separation of redundant safety-equipment as set forth in Section 3.12 of GESSAR. We i
have concluded that these criteria meet the requirements of General Design 3
Criteria 3,17 and 21 pertaining to physical independence of Class IE circuits and the regulatory position of Regulatory Guide 1.75 and are i
L therefore acceptable, q
j We will review the implementation of these criteria af ter receipt of a preliminary design for the instrumentation systems. Particular emphasis will be placed on the review of the design of the isolation devices used I
l q'
u___ _- __-
J
3 4
3-10
{
where signals are transmitted between redundant divisions of equipment.
We will report the results of our review of the implementation methods in a supplement to the SER. We have concluded that these criteria are acceptable for the PDA subject to staff review and approval of the implementation methods. This aspect of our review will be conducted as a post-PDA item in conjunction with our review of the preliminary design of the instrumentation systems.
it 4
4-1
. l.
-4.0 RFACTOR 4.3 ' Nuclear Design 4.3.4 Control Rod Patterns and' Reactivity Worths (Item 5) 15.1 Abnormal Operational Transients.(Item'5)
We noted in our SER that all affected transients had not been evaluated using the "D" scram reactivity curve. This is the curve GE currently considers as the boundary in defining the worst ~ case curve expected'in the life of the plant and is based on analyses of the core parameters at maximum core average exposures.
r GE has provided.-this information. The results of the Chapter 15 analyses indicate that the evaluations of the preliminary design of the~ plant f.
i are acceptable.
During.our review of GESSAR at the FDA stage, GE will reevaluate the consequences of the Chapter 15 accidents and transients l,
l using the scram reactivity curve based on the final design'of the plant.
We consider this item resolved for the PDA.
+
1
- + - - -
...i
42
.(
ANALYTICAL METHODS (Item 6)
.3.7 We stated in Section 4.3.7 of our SER that GE needed to more fully describe and document their ' analytical methods in terms of '
equations, numerical -techniques, and methods of solution.1 The neutron data bases also needs to be further described' and documented. Certain.
of the. analytical methods need'more experimental verification and documentation over. a variety of BUR operating states and' discussion and evaluation of uncertainties needs to be provided.
In Amendment 23, GE proposed to the staff a. schedule for submittal of topical reports. These topicals would address the lattice physics i
f methods, the BWR simulation code, the verification of the lattice-physics methods and the verification of the core calculational methods.
i' We conclude that-resolution of our concerns related to the core physics analytical methods will be accomplished as a.part of our review of these I
I topical reports.
Therefore, the previously outstanding issues concerning physics methods and their verification is considered resolved for GESSAR.
1 i
I 1
i l
t
'l 4-3
(
4.4 Thermal and Hydraulic Design (Item 7)
'We stated in our SER that we had completed our review of the General Electric Thermal Analysis Basis (CETAB), but we had not completed our review of the application of GETAB to CESSAR. In Amendment 19 GE -
provided additional information to permit us to continue our review for the PDA.
Typical values of' the 'MCPR are presented in Chapter 15 for various transients and accidents. These results indicate that the evaluation of the preliminary design of the core is acceptable.-
Based on estimates of uncertai.nties in the GESSAR plant operating 1
parameters, GE has calculated for GESSAR that a' MCPR of 1.07 will satisfy 1
i the safety limit criterion, that is, boiling transition would be expected to occur for less than 0.1% of the fuel rods.
In Chapter 15, GE has I
L evaluated all anticipated transients and concluded that this safety limit will not be exceeded if the steady state MCPR remains above 1.21.
We conclude that using the GETAB thermal design methods, the reactor design described in GESEAR can meet all thermal-hydraulic safety limits.
i I
l i
9 4
ls f
a 5-1
(
s.O REACTOR COOLANT SYSTEM 5.2 Integrity of Reactor Coolant Pressure Boundary 5.2.1 Design of Reactor Coolant pressure Boundary Components (Item 31)
Va -t_..a in our SER that GE would have to define the upset loading condition as upset plant con1.tions plus a concomitant OBE, unless they could demonstrate that such a combination is not required. GE recently, revised Tables 3.2.4, 3.2.5, and 3.2.6.
This revision includes listing l
all of the upset transients plus an OBE as upset conditions. The plant will meet upset limits for these loading combinations. GE contends, however, that an OBE is an upset plant condition and when it's combined with another upset condition (an upset transient ), the probability of occurrence is comparable to GE's probability of an emergency condition.
Therefore, GE feels that an upset transient plus an OBE should meet emergency limits.
Nevertheless, they are combining upset transients with the OBE and these combinations will meet upset limits in Amendment 25.
We consider this item resolved.
j l
I l
I I
I l
l t
1 1
p j
a
'a' l --
.I 6-1
(
) ENGINEERED SAFETY FEATURES I
6.2: Containment Systems I
6.2.1.2 Short Term Pressure Response On page 6-17 of our SER, we noted that GE had not provided details of-their containment analytical model concerning the use of two nodes for.the containment short term pressure response. These two nodes are the wetwell, which is the volume between the pool and the'HCU floor,-and the remainder of. the containment volume.
'GE has stated that details of the modified containment analytical model, which includes a separate wetwell node, will be available April 1, N
1975. We will complete our review at that time. This commitment is acceptable for the PDA for GESSAR, provided 'GE makes the following commitment.
-c Should our review indicate the necessity, the available flow area at the-HCU floor will be increased as required to maintain adequate design margins 1
on'drywell and containment pressure. With the above commitment, this ite'm is resolved.
(
j
6-2 o
6.2.1.3' Long Term Pressure Response GE originally calculated the long-term containment response 4
to a' loss-of-coolant accident based on a single node' representation 1
of the suppression pool; 1.e., the water volume in the drywell 3
'(about 50,000 f t ) and the water volume in the containment. (about.
3 100,000.ft ) were lumped and treated homogeneously. Resultant containment atmospheric conditions were calculated based 'on.
saturation pressure at the pool temperature.
I GE is now employing a two-node pool model for containment calculations with the water volumes in the drywell and in the containment being treated separately. We have reviewed the details of the two-node modeling and the results;of a comparative analysis p
with the one-node model. This comparison indicates about a 2 F.
- [c increase in peak calculated suppression pool temperature in going to the'two-node approach.
Based on our review we find'this i
j revised analytical method to be acceptable; however, we will require l
GE to revise.the values of peak containment temperature and pressure in GESSAR accordingly.
i
}
l r --
_A--_-____._____
t 6-3 6.2,1.4 Suppression Pool Makeup System (SPMS) (Item 10)
As noted in the Safety Evaluation Renort, GE had made a commitment to locate SPMS dump lines, valves and instrumentation in a manner such that pool dynamic effects on the system become negligible.
In Amendment 23, GE provided additional clarification stating that the valves will be located near the top of drywell, above the pool swell effects level; the dump lines will be routed
?
down the side of and supported by the drywell wall; and the water level instrumentation will be located outside of the suppression pool. We find these provisions to be acceptable and we will review the design details at the FDA. We consider this item resolved for the PDA.
Section 7.3.7 of this report discusses a single failure i
}-
that could cause inadvertent dump of the pool.
i I
1 l
6-4 I
f 6.2.1.3 External Pressure Design (Item 11)
Tha stated in our SER that certain assumptions used in the containment vacuum breaker analysis may not be sufficiently conservative. CE has recently provided the results of an additional analysis for sizing of the containment vacuum breakers. The event under consideration is depressuriza-tion of the containment due to inadvertent containment spray operation with the containment at low initial humidity. As recently discussed with GE, the assumptions and analytical methods used in this analysis should be provided as a post-PDA item. We consider this item resolved for GESSAR at this time.
)
i u
1 i
e.
l I
{
6-5 j
6.2.3 Secondary Containment Functional Design (Item 14)
In our Safety Evaluation Report we noted that GE needed to provide analyses of the post-LOCA pressure transients for the fuel building and the ECCS and RWCU pump rooms. GE has submitted information concerning the post-accident pressure transients in a
)
the fuel building and ECCS and RWCU rooms. These volumes are I
maintained at -0.25"w.g. during normal operation but experience a i
pressure transient following loss of offsite power and prior to startup of the Standby Gas Treatment System. GE has previously demonstrated
]
I that the pressure will remain negative (but not always less than
-0.25"w.g.) in the ECCS and RWCU rooms. We find this to be i
acceptable since these are internal rooms of the auxiliary building and therefore not subject to' wind loads which could cause exfiltra-tion at small negative pressures.
In the case of the fuel building GE has also shown that the pressure remains negative; however, for I
a certain time period the pressure is greater than -0.25"w.g.
Since l
this volume is subject to wind loads we consider that containment l
1eakage to the fuel building during this time period goes directly to the environment. Therefore GE should specify the fraction of total containment leakage which goes to the fuel building and the time period during which the pressure is greater than -0.25"w.g.
I Alternatively GE could propose to maintain the fuel building at a l
greater negative pressure during normal operation to ensure post-accident pressures less than -0.25"w.g. at all times which we would find acceptable.
l i
)
________-___ O
.t' N,,
'6-6.
p j
]
..s
.6.2.4'
' Containment Isolation System (Item 33)
~
'[-
~We stated in our SER that GE had not provided a consistent
~ description of instrument line penetrations of the containment.
t We also noted that GE should justify that the provisions of Reg.
l l
Guide 1.11 were met.
GE has provided the additional information necessary to clarify the design and demonstrate conformance to Reg. Guide 1.11-and this item is considered resolved.
4 We also' noted that GE should clarify their environmental.
design criteria'for safety related equipment located in the drywell j
and' containment. GE has clarified their. design criteria and we have completed our review of these revisions.
Based on our review, we require that Table 3.11.1 should specify 0 psia as the lower pressure bound'for equipment located within the drywell and Table 4
3.11.2,'which lists environmental criteria for safety related components in the containment, should include the combustible gas control systems and the Suppression Pool Makeup System.-
4 i
i i
i 6
I l
i r-t
6-7 6.2.5 Combustible Gas Control (new) 4 As discussed in Section 6.2.5 of the Safety Evaluation Report we had deferred our review of the combustible gas control systems because of pending revisions to Regulatory Guide 1.7.
Since then, we have advised the applicant that due to the conservative plant operating conditions, we conclude that the assumption of one percent metal-water reaction provides a sufficiently conservative basis for combustible gas control system design. GE should submit the design details of such systems on the GESSAR docket in order that we may complete our review. We have previously discussed the contemplated changes to Reg. Guide 1.7 with GE and they have described to us a design that could handle the combustibic gas generated following a loss-of-coolant accident. GE has not presented this design in 2
GESSAR at this time nor have we reviewed it outside of GESSAR. We I
do conclude that this issue can be resolved in a timely manner and
)
(
we will report the resolution in a suoplemantto the SER.
j l
l i
l I
i m-
.4'.
9 6 6I Emergency' Core Cooling Systems.
6.a.1 System Description. (Item 16)
We stated in our SER that GE had not presented analyses of performance j
of the ECCS over.the complete spectrum of breaks' assuming that two LPCI pumps are diverted from core cooling to containment spray 10 minutes after-a LOCA occurs.
In Amendment 23, GE presented the results of their analyses.
These results show that for various combinations of ECCS and liquid.line breaks that the peak clad temperatures do not change for breaka greater than 0.02 ft2 (2 in diameter pipe) assuming a single ECCS failure.
For 2
breahm smaller than 0.02 f t, the HPCS failure is the only one that results i
in peak clad temperature differences. For these breaks, the peak clad temperature increases about 50-100 F (to about 700* or 800*F), as shoun.
i l
on Figure 6.3-39 of GESSAR.
We have reviewed the information submitted by GE and have determined that the performance of the ECCS is not significantly affected by the transferral of two LPCI pumps from core cooling to containment spray.
We' conclude that transferral after 10 minutes is acceptable, and we consider this item resolved.
l i
1 e
- ee -
p er o.w ee en=
ma -%
=
eas
l 7-1 7.0 INSTRUMENTATION AND CONTROLS
(
.1 Introduction Major portions of the designs for the instrumentation and control systems proposed in GESSAR are different from those utilized in previously licensed BWR plants.
The design criteria and the conceputal designs for the instrumentation and control systems are discussed in GESSAR but the preliminary designs for these systems have not yet been submitted for staff review.
Therefore, our review of the instrumentation and control systems i
is not complete and will continue after the PDA is issued.
This section of the staff's safety evaluation report discusses the status of our review and is based on the infor-
[
1 mation provided in GESSAR, as amended through aLd including i
Amendment No. 24, dated November 8, 1974, and on discussions
)
I with GE representatives.
Our review has concentrated on
{
1 4
assessing the adequacy of the conceptual design and the proposed design criteria and on identifying those areas which will require l
}
1 additional effort after the preliminary designs are available j
and submitted to the staff.
In assessing the adequacy of the i
1 proposed design criteria and the conceputal designs, we have based our conclusions on the requirements of the Commission's General Design Criteria and applicable Regulatory Guides for f
Power Reactors.
Guidance used by the Regulatory staff in the review of GESSAR was published in a report entitled, " Programmatic Infor-i mation for the Licensing of Standardized Nuclear Power Plants,"
l l
l l
1
[
'~
7-2
{
' dated August,-1974.. As discussed in this report, the staff
.[
anticipated that a' fairly heavy review effort would be necessary during the' post-PDA phase. In'accordance with these procedures, the staff concludes that the specification of a functional design
-and an acceptable set of design criteria are adequate for the PDA and that the detailed review and approval of.the preliminary
-designs for the instrumentation and control systems can be conducted as a post-PDA item.
For the GESSAR review, the present schedule is that the preliminary designs'and the applicant's
~ evaluation.of those designs will be submitted'to the staff in the first quarter of 1975 and the staff's. detailed, review is expected to be completed in the summer of 1975.
The results of-l that review will be reported in a supplement to the GESSAR safety
-l f
I evaluation report, and presented to the ACRS for their consideration.
7.2 Reactor Trip System-1 The design of the reactor trip system is in a conceputal design phase and GE has not yet developed a preliminary design for the equipment to be used in implement,ing the proposed 1
conceputal design. However, it is known that the GESSAR j
design will utilize equipment and logic that are vastly different
~l from all previous BWR designs.
The monitored system variables from which the reactor trip system input signals will be derived are the same as the variables l
l monitored on previous BWR plants.
However, the sensors will be j;
l l
-1.
J 7.-
i 1
,1 analog _ devices with control room readout indication rather than l
l
- the previously used digital, non-indicating sensors..The only.
j i
exceptions to this are the input signals derived from valve I
)
position switches and the scram discharge volume water level
' switches.
GE has stated that all protection system sensors that do'
{
1 not have analog readout ind.icators will be testable during l
reactor power operation.
In addition, GE has stated that for i
all sensors that must be removed from service during such tests, l
the design will include provisions for automatic indication of these bypasses in accordance'with Regulatory Guide 1.47.
GE and the staff have also reached agreement on the design criteria to be used in establishing the range of instrumentation'and in i
+e lI selecting trip set points dor safety related functions.
These l
.1, I
criteria are:
~
- 1) The range selection for instrumentation shall be such as to exceed the expected range of the process variable being monitored.
- 2) The accuracy of all the safety trip points will not be numerically larger than the accuracy that wac assumed in the accident analysis.
- 3) The trip set points should be located in that portion i
of an= instrument's range which is most accurate and must be located in a region with the required accuracy.
i
. a,,,a 4
m..
r,.
x.
g 7-4 y
- 4) All safety trip points will be chosen to allow for the n
(
normal expected instrument system set point drift such-l that the technica1' specification limit will not be exceeded.
- 5) Verification of the above criteria'shall be demonstrated as a part of the' qualification test program required by IEEE Std. 323-1974.
Although the monitored system variables are the same for GESSAR as on previous plants, the significance of the. scrams initiated from detection of turbine stop valve closure'and 1
turbine control valve fast closure has changed.
Previously, we understood that these scrams were non-essential or back-up
-functions and that scrams : initiated from high reactor pressure and high neutron flux were adequate to prevent exceeding safety limits.- We now understand that a reactor trip initiated directly from sensing a' turbine trip is essential in order to assure that-i established safety 10mits for normal operation and expected transients are not exceeded.
GE has also proposed the addition of a prompt relief trip (PRT) system to assist the reactor trip system in rapidly reducing core power in the event of,a turbine trip. The PRT system as propcsed would open the reactor safety /
~
4 relief valves upon detection of a turbine trip during reactor power operation. We have not completed our review of the turbine trip event.
If it is determined that a direct reactor trip from l
7-5 sensing turbine trip and opening of the safety / relief valves I
by the PRT system are necessary to prevent exceeding safety limits,,we will evaluate the preliminary design for the PRT system instrumentation provided that we find the concept of a PRT system acceptable. Refer to Sections 7.6.2 of-this report and 15.1 of the SER for additional information on our review of the PRT system.
As stated earlier, the proposed conceptual design for the reactor trip system will utilize logic that is different from all previous BWR plant des'igns. There will be four identical divisional logic channels and each of these four channels will receive input signals from four sensors per monitored system i
variable. Each of the four sensors associated with each monitored
.i variable provides an input signal to each of the four divisional logic channels through isolation devices.
The divisional logic i
channels utilize "2-out-of-4" logic for each set of four input signals to generate a trip signal, i.e., when 2-out-of-4 signals for a given input variable exceed the trip set point, a divisional logic trip output signal is produced.
The divisional logic output signals are the input signals for the actuator logics which control the electric power for the scram pilot solenoid valves.
l The actuator logics utilize "1-out-of-2 taken twice" logic to initiate a reactor trip by deenergizing the scram pilot solenoid valves. The conceputal design arrangement described above is
r O.
h 7-6
(
illustrated in Figures 7.2-3a through 7.2-3f of GESSAR. The manual scram logic' and back-up scram valve logic will be "1-out-of-2 taken twice" as in present.BWR designs.
The functional arrangement of the solenoid-operated pilot scram valves, the solenoid-operated back-up scram valves, and the' air-operated scram valves will also remain the same as in current BWR plant designs.
In' Amendment No. 24 to GESSAR, the conceptual design of the reactor trip system was again changed but we have not completed-our review of these recent design changes.
The most significant changes' appear to be that the reactor trip system busses and power supplies were reclassified as non-Class IE and a feature was added
.h to' trip open the power supply breakers on a LOCA signal. We do not understand the purpose of this. feature, the source of the LOCA signal,
.l j
or the method of implementing'this feature since.it appears that opening the breakers will also result in deenergizing portions of the neutron monitoring system, the nuclear boiler instrumentation system and the process radiation monitoring system. Amendment No. 24 did not include any discussion of the design change for our evaluation.
Another design change presented involves the conceptual design for bypassing the reactor trip from closure of the main steamline isolation valves.
The design was chan.ged such that this reactor trip signal can be bypassed by the reactor operator without regard to main steamline pressure. Previously the design proposed was such that the
- - ~. -
n.
p
~
f 7-7 main steamline pressure signal also served to automatically. remove ~the t
L I
bypass when permissive conditions no. longer existed.
The design
'now proposed appears to be 1n violation of the requirements of IEEE-Std. 279-1971 which. requires that_the design include positive means to assure that operating bypasses are removed whenever permissive conditions are not: met. We will report the results of our evaluation of these two recent design changes in a supplement to the GESSAR safety evaluation report.
In response to our request,.GE has described a pulse testing-scheme ~that.will be used for periodic testing of the reactor-1 trip system as well as other portions of the new solid state protection system.
Since a preliminary design has not yet been developed, it is not yet known which particular components will f
be included in the pulse testing. However, in response to a staff position,'GE, stated that the design will include provisions i7 for manual testing to supplement the pulse testing prov1sions.
We have concluded that the concept of a pulse testing scheme can form part of acceptable design provisions for periodic testing.
When the preliminary design is developed and submitted for our review, we will perform an independent evaluation of the design to assure that the total periodic testing capability provides a means of duplicating as closely as practical the performance required to accomplish the safety function, e.g., a reactor trip.
We will also assure that the requirements of IEEE Std. 279-1971,
. ~.
..m___..___._._m
7 l
A
(
a 7-8 l
1EEE Std 379-1972, General Design Criteria 21 and 22, and other
(
applicable requirements are -met.
The results of that review will be reported in a supplement to the GESSAR safety evaluation report.
Since a preliminary design of the reactor trip system has not been submitted, our review efforts have been directed principally toward understanding the proposed conceptual design and insuring that the proposed design criteria satisfy the Commission's regu-lations. With respect to the criteria listed or referenced in Figure 7.1-2 of GESSAR and identified by GE as applicable to the reactor trip system, we have concluded that those criteria form a generally acceptable basis for proceeding with development of a preliminary design and are acceptable for the PDA. The staff review and approval of a preliminary design will he conducted as a post-PDA item and the results will be reported in a supplement to the GESSAR safety evaluation report.
7.3 Engineered Safety Feature Systems 7.3.1 Introduction The design of the instrumentation and controls for the engineered safety feature systems, like the protection systems, is in a conceptual design phase. Although the functional performance required of the engineered safety feature systems is fundamentally the same as in previous BWR plant designs, the instru-mentation and controls (i.e., the actuators, logic, and sensors) are not similar to any previous BWR designs. Figure 7.1-1 of GESSAR identifies some of the engineered safety feature systems and Table W
I l'
'.g*
t 7-10 i
criteria used in designing the engineered safety feature systems I
they support. We have concluded that proposed design criteria 1
for the engineered safety feature systems and-their essential auxiliary supporting systems are acceptable for the PDA, subject to the detailed staff review and approval.of the preliminary l
designs.
The review of the preliminary designs for these systems will be conducted during the post-PDA review phase.
The results of that review will be reported:in a supplement to i
the GESSAR safety evaluation report.
i 7.3.2 Emergency Core Cooling Systems
- 7.3.2.1 High Pressure Core Spray System The high pressure core spray (HPCS) system is automatically L
started by either low reactor vessel water level or high drywell pressure. signals.
In the course of our review of the conceputal design for the HPCS instrumentation, we identified two major i
I i
aspects of the design where we disagreed with the proposed design.
In the first of these, the proposed conceputal design for the HPCS system _ included provisions to automatically terminate flow by closing the injection valve (valve M0 F004 on Figure 6.3-lb of GESSAR) when both of two independent vessel water level measure-mento indicated a high water level. We concluded that this feature was unacceptabic because: any one of several single failures could prevent termination of HPCS flow; failure to terminate flow has no identified safety consequences; inclusion of the termination 1
l 7-11 i
function increases the probability of failure of the HPCS I
safety function which is, needed in the event of a LOCA, and; inclusion of the termination function defeats the advantages j
otherwise provided by the high drywell pressure initiation i
I signal which is functionally diverse to the reactor vessel water i
level signal.
In response to our requests for additional infor-mation, GE stated that "...the high level trip of HPCS is not required for safety reasons but is desirable operationally in instances where HPCS is inadvertently initiated." GE also 4
stated that "...it is operationally desirable to prevent flooding i
l of the main steam lines in a hot standby condition (because) this I
water could flash to steam and potentially result in inadvertent j
actuation of the safety relief valves." We do not fully understand the applicant's apparent concern over the potential for inadvertent j
initiation of HPCS, The proposed conceputal design utilizes logic that requires either two low water level signals or two high dyrwell pressure signals to initiate operation of HPCS.
(Depending on the method used to implement the conceputal design, HPCS might also be initiated by one level signal in coincidence with one pressure signal.) Furthermore, the applicant is currently proposing a Prompt Relief Trip System designed to open the safety /
)
relief valves in the event of a turbine trip which itself is an expected operational occurrence. During a meeting with GE in j
October,1974, this matter was resolved to the satisfaction of t
I i
1
)
7-12 the staff by a change in the conceptual design. The feature to
(
automatically terminate flow on high water level will be retained but it will be effective only if no high drywell pressure signal exists. This change satisfies the staff's requirement for diverse initiation signals since failure of the reactor vessel water level signals will not prevent initiation of HPCS in the event of high drywell pressure.
It also retains the feature, desired by CE for operational reasons, to terminate flow when HPCS may be inadvertently actuated because any inadvertent actuation is expected to be caused by low vessel water level rather than high drywell pressure.
In the second area of staff disagreement with the GE design, the proposed conceputal design for the HPCS system included interlocks on the pump suction valve from the suppression pool (valve M0 F015 of Figure 6.3-lb of GESSAR) and the two valves in series in a test line to the condensate storage tank (M0 F010 and M0 F011). The proposed design would:
a) Prevent opening the suppression ~ pool suction valve unless both test bypass valves to the condensate storage tank are fully closed.
b) Signal both test bypass valves to close if the suppression pool suction valve is not fully closed.
c)
Signal both test bypass valves to close upon receipt of either a manual or automatic HPCS initiation signal.
i., F 7-13 j..
GE stated that the purpose of these interlocks is to b
('
maintain the' quality of the water in the condensate storage y
S tank. We informed the applicant of our conclusion that the inter-I lock described in a) above is unacceptable. The. bases for this conclusion are that the interlock does not meet the single failure criterion, failure of the interlock could result in failure of the HPCS system by preventing opening the suppression pool suction valve, and the interlock is unnecessary because of the interlocks-described in b) and c) above.
In response to our request for additional information, GE stated that the "... redundant inter-
-locks are provided for testing to prevent the.(HPCS pump) taking water from the suppression pool and pumping it to the condensate j
storage tank following a single failure of the suppression pool suction valve (position) sensing instrumentation." GE also
[ -[.
stated that "...it is conceivable that without the backup inter-lock, the suppression pool could be lowered to a point below E
acceptable operating limits." We evaluated this response and concluded that an interlock which serves no safety function, which I
does not meet the single failure criterion, and which if it fails can disable a necessary safety function is unacceptable. We informed GE that if it concluded that it is desirable to have a backup interlock to protect against a coincident operator error i
and an equipment failure in order to prevent contaminating the
]
]
condensate storage tank with suppression pool water during l
j
4 7-14 periodic testing, the design should be revised so that the i
backup interlock does not degrade the reliability of the EPCS t-1 safety function.
This matter was resolved to our satisfaction
~
by a change to,the conceputa3 design. The interlock described in a) above will be retained but the interlock will be effective only for manual control (at the component level) of the suppression pool suction valve.
The interlock will not be effective for either automatic initiation or manual initiation (at the system level).of the EPOS system.- Therefore, failure of the interlock cannot result in loss of the safety function.
This resolution improves the reliability of the HPCS safety function and retains I
l' the feature of a backup interlock to prevent contamination of l
the condensate storage tank which was desired by GE.
i,
We have concluded that the proposed design criteria and the conceputal design for the HPCS system are acceptable for the PDA subject to the detailed staff review and approval of the preliminary design. We will report the results of our review of the preliminary design in a supplement to'the GESSAR safety evaluation report.
7.3.2.2 Automatic Dcpressurization System The design of the automatic depressurizatica system (ADS) is identical in concept to previous BWR plant designs. We have concentrated our review of the conceptual design on attempts to resolve long-standing generic issues. At this time, the design l
ph Mite Er wh
=+4**4
7-15 i
i incorporates no new features to improve testability of the ADS l
pilot solenoid valves.
In addition, the proposed conceputal
{
design does not meet the proposed design criterion that no single failure shall result in inadvertent opening of more than one l
relief valve.
GE has stated that they are "... currently studying 1
the effects of relief valve blowdown for various operating states." Based on discussions with GE, we understand that one goal of these studies is to demonstrate that inadvertent actuation of the ADS has acceptable safety consequences and therefore that the design criterion discussed above is unnecessary.
For the reasons discussed above and the fact that a pre-liminary design has not ye't been submitted, we have not completed
~~
our review of the ADS.
During'a meeting with GE in October, 1974, i
we discussed the subject $f testability and the alternatives that would be acceptable to the staff pending completion of the' GE study of the effects of inadvertent actuation of the safety /
relief valves. As a result of these discussions, GE documented (in Amendment No. 24) its commitment that if the study results show that it is necessary, the design will be such that no single failure can result in opening of more than one safety / relief valve. We have concluded that this commitment is acceptable for the PDA and that if design changes are necessary they can be reviewed as a post-PDA item. We will report the resolution of this item in a supplement to the GESSAR safety evaluation report.
l l
l l
L.
~
- o 7-16
(.
With respect to periodic testing provisions in'the ADS design, we have informed GE that it is our' position that for the GESSAR -
i design, improvements in the testability of the ADS are required.
We have concluded that the design must include provisions for testing the pilot solenoid valves which control compressed air to the safety / relief valves but that the relief valves themselves need not be tested during reactor operation.
In Amendment No. 24 to GESSAR, GE stated that a study is being made of methods to improve testability. We have concluded that identification of this development program is acceptable for the PDA-subject to staff review and approval of the preliminary design for the ADS, including the design provisions for testing.
This aspect of the review will be conducted as a post-PDA item and the results will be reported in a supplement to the GESSAR safety evaluat1on report.
7.3.2.3 Low Pressure Core Spray and Low Pressure Coolant Injection Systems The.conceputal design of the instrumentation and controls 4
for the Low Pressure Core Spray (LPCS) system and the Low Pressure Coolant Injection (LPCI) mode of operation of the Residual Heat Removal (RHR) system are identical to previous BWR P ant designs l
in their functional arrangement.
There are many changes in the conceptual design of the instrumentation and controls used for other operating modes of the RHR system.
These changes are discussed elsewhere in this report and are necessitated by the major changes in containment design.
l l
l i
7-17 The low pressure ECCS are divided as in previous plants with RHR Loop 'A' and LPCS comprising one division and RHR Loops 'B' and 'C' comprising the second division. The initiation logic is illustrated in Figures 7.3-3 and 7.3-8 of GESSAR.
Two low reactor vessel water level signals or two high drywell pressure signals will initiate operation of the low pressure systems.
Separate sensors will be used for each low pressure division and a third set of sensors will be used for HPCS which is the third ECCS division.
Since a preliminary design of the hardware to be used in implementing the concept is not yet available, we have concentrated on assuring that generic items will be resolved on GESSAR.
The conceptual designs of both the LPCS and LPCI systems include features that would prevent opening the injection valves until "the differential across the valves is reduced to a differential pressure equal to rated reactor vessel pressure minus discharge pressure of the ECCS loop with zero flow into the vessel," (CESSAR Page 7.6-83a).
In response to our reques't, the applicant stated that "This feature reduces the size and power of the valve operation (sic) required.
The reduction in valve stem and mechanical drive loads result in a more reliable valve drive train which is less susceptible to wear on repeated opening and closing during surveillance testing." In view of the proposed conceptual design, we do not fully understand this response. The
j 7-18 1
)
differentia 3 pressure interlock is effective on both the manual
(
signal used for surveillance testing as well as the automatic j
initiation signal used in the event of a LOCA.
In addition, j
administrative procedures in the form of surveillance testing procedures could be used in lieu of an interlock to insure testing is not routinely conducted at high pressures.
In response to a further request for additional information, the applicant stated that " General Electric is, however, considering deletion of these (differential pressure) switches and replacing them with switches which would not permit injection valves to open unless reactor pressure is below system design pressure as required by the current draft of ANSI N193." ANSI N193 is a draft standard currently in preparation by ANS Working Group No. 55.4.
It has neither been approved by that committee nor accepted by the staff as a licensing basis.
In any event, a recent drcft, 1st Draft-Rev 1 June 1974, identifies several proposed methods of providing isolation of low pressure systems connected to the reactor coolant pressure boundary. However, no particular method is required over another.
In fact the draft indicates that its proposed criteria should be used in conjunction with other requirements that must be considered in implementing the system requirements.
During a meeting with GE in October, 1974, it was agreed 1
that GE would modify the LPCS and LPCI designs to provide diverse initiation signals that are not dependent on a non-diverse inter-
}
}
1 1
7-19 lock.
In conjunction with the changes that are necessary to
{
accomplish this, GE will evaluate the new design to assure that l
adequate protection against high pressure is provided for the low pressure portion of these systems. These commitments were documented in Amendment No. 24 to GESSAR. We have concludt.d that these commitments are acceptable for the PDA. We will review the methods used to implement these commitments as post-PDA items and will report the results of our review in a supplement to the GESSAR safety evaluation report.
7.3.3 Containment and Reactor V;ssel Isolation Control System, The proposed conceputal design for the containment and reactor vessel isolation control system (CRVICS) is not similar to any i
previous BWR plant.
The main steam line isolation control system will utilize different equipment' and a d1fferent functional arrangement.
Four instrument channels will be provided for each measured variable, The measured variables are the same as those used on previous plants. The instrument channels will be combined using "2-out-of-4" logic in cach of four divisions. The four divisions will be arranged such that two divisions control the outboard isolation valves and the other two divisions control the inboard valves.
Both divisions controlling a set of valves must trip to initiate closure of the main steam line isolation valves. The control arrangement for the main steam line isolation valves is illustrated
's 7 1 in Figure 7.3-13 of GESSAR. The addition of a second air-operated-I l
valve in parallel with a'similar valve provides'two flow paths ito vent compressed air from the operating piston'of the main j
steam line isolation-valve.. However, the design includes no provisions to test the two valves independently.
j We are currently reviewing the topical report ' APED-5750, j
" Design and Performance of General Electric Boiling Water Reactor.
Main Steam Isolation Valves," which was designated as an' applicable-reference in Amendment No. 24 to GESSAR. During a meeting with-GE in October, 1974, the staff.and GE agreed that the review of the new control arrangement for the main steam isolation valves would be conducted on the topical report-rather than as i
part of the GESSAR review. We have concluded that this is-7 acceptabic for'the PDA. We will report the results of our review of the topical report-APED-5750 and their applicability to GESSAR in a supplement to the GESSAR safety evaluation report.
l Other portions of the CRVICS will utilize logic similar to previous designs, i.e., 2-out-of-2 lov vessel water level or high drywell pressure signals. We have concluded that these conceptual designs are acceptable for the PDA subject to the detailed staff review post-PDA and approval of the preliminary designs. This aspect of the review will be conducted as a post-PDA item and we will report the results of our review in a supplement to the GESSAR safety evaluation report.
g.
s 7-21 l
(
' 7.3.4 Essential Service' Water System i
GE has not supplied all of the information requested in j
Regulatory Guide 1.70, " Standard Format of Safety Analysis Reports for Nuclear Power Plants". A preliminary diagram of the essential i
1 service water (ESW) system is provided in Figure 9.2-1 of'GESSAR.
1 it is expected that the preliminary design of the instrumentation and controls will not be available until after a more detailed design of the fluid system is developed. However, GE has stated that the
-i ESW system will be initiated'by the engineered cafety feature actuation circuitry of the solid state protection system.
The ESW instrumentation, control and power supplies sill be separated into three divisions as i
j are the engineered safety. feature systems. As stated earlier in this I
?
I report, GE has committed to designing all essential auxiliary supporting
?
systems, such as ESW, in accordance with the same criteria applied 1
in the design of the supported safety systems such as ECCS.
We have concluded 'that this commitment is acceptable for cl4e PDA subject to staff review and approval of the preliminary design.
This aspect of the review will be conducted as a post-PDA item and we will report the results of our review in a supplement to the GESSAR safety evaluation report.
7.3.5 Flammability Control System At the present time there is no information available regarding the conceptual design for the instrumentation and controls for the flammability control system.
The information on this system,(formerly called the combustible gas control system or the hydrogen control system) now in Chapter 7 of GESSAR
7-22 1
1 is in general no longer valid since GE is considering design
(
changes based on our statements in Section 6.2.5 of this report concerning the use of 1% metal water reaction following the LOCA.
However,'in Amendment No. 24 to GESSAR, GE listed'the basic criteria for the design of this system in F.igure 7.1-2.
We are not able to judge the adequacy on the proposed design criteria in the absence of even a corceptual design for the system because, as stated in Section 3.11 of this report, the particular design employed will affect our evaluation of the proposed design criteria. Therefore, we have concluded that the PDA for GESSAR will be subject to st.aff review and approval of the design criteria and the preliminary design for the instrumentation, I
controls and electrical equipment for the flammability control system.
7.3.6 Standby Gas Treatment System The standby gas treatment system (SGTS) will be automatically initiated by the following signals:
a) LOCA signal b) Auxiliary building ECCS pump room high radiation c) Shield building high radiation d) Fuel building high radiation
7-23 e)
Containment pressure control exhaust high
(
radiation f) Drywell bleed-off pressure line open I
We have reviewed the description of the proposed design of the instrumentation and controls for the SGTS, the simplified functional control diagram provided in Figure 7.3-20 and the proposed design criteria identified in Figure 7.1-2.
We have concluded that the proposed design criteria are unacceptable because IEEE Std. 308-1971 (as modified by Regulatory Guide
,1 1.32), Regulatory Guide 1.6 and General Design Criteria 17 and 18 are not included.
These criteria have been identified by GE as applicable to other engineered safety feature systems and we have concluded that they are equally applicable to the SGTS. We vill report the resolution of this item and the results of our detailed post-PDA review of the preliminary design in a supplement to the GESSAR safety evaluation report.
7-24 7<3.7 Suppression Pool Makeup System I
The suppression pool makeup system (SPMS) transfers water
\\
from the upper containment pool to the suppression pool following a loss-of-coolant accident. The conceptual design for the instru-mentation is illustrated in Figure 7.3-25 of GESSAR. The dumping of the upper pool is initiated automatically by either a LOCA signal in coincidence with 1-out-of-2 low suppression pool water level signals or by a 30-minute timer that is started by a LOCA signal. These initiation signals are interlocked with the reactor mode switch such that these signals are blocked when the mode switch is in the refueling position. The purpose of this interlock is to prevent dumping the upper pool when fuel assemblies are being moved in the upper pool during refueling. The dumping of the upper t
pool may also be initiated manually.
There will be two independent instrumentation systems designed as described above. One system controls the two normally closed valves in series in one dump line and the other system controls the valves in the second dump line.
1 We have reviewed the proposed conceptual design, the proposed l
design criteria and the applicant's evaluation of the effects of inadvertent dump of the upper pool. We have concluded that the proposed design criteria are acceptable for the FDA subject to completion of our review of the effects of inadvertent dump'of the upper pool. We have concluded that the proposed design is susceptibic to single failures that could cause inadvertent dumping.
l_
i 7-25
(
We have not completed our review of this aspect of the design. We will report the results of our review on this item and the post-PDA-review of the preliminary design in a supplement to the GESSAR safety evaluation report.
7.3.8 Containment Spray System During a meeting with GE in October, 1974, we were informed that the descriptive information presently contained in GESSAR pertaining to the instrumentation and controls for initiation of containment spray was no longer valid. We therefore have not used that information in preparing this report.
In Amendment No. 24 to GESSAR, GE documented
[
the agreement reached during the meeting of Octobcr,1974, between 3
CE and the staff that the criteria to be used in designing the instrumentation and controls for automatic initiation of containment spray would be identical to criteria used for other engineered safety a
feature systems.
We have concluded that the proposed design criteria committed to be GE are generally acceptable for proceeding with the develop-I ment of a design and are acceptable for the PDA.
We will report the results of our detailed post-PDA review of the preliminary design in a supplement to the GESSAR safety evaluation report.
7.4 Safe Shutdown Systems 7.4.1 Reactor Core Isolation Cooling System The reactor core isolation cooling (RCIC) system provides coolant inventory makeup during reactor shutdown and is activated in time to preclude conditions that lead to a need for the ECCS.
In addition to being classified as a safe shutdown system, RCIC is also classified l..
7-26 as an engineered safety feature because together'with the HPCS it provides the protection necessary in the event of a rod drop accident.
'The RCIC system actuators, logic and sensors function differently.
than previous plants. The system is' initiated by low reactor vessel water level signals utilizing a "1-out-of-2-taken twice" logic.
GE has stated that the RCIC system will be designed in accordance with all.the criteria and design requirements applicable to an engineered.
safety feature as shown in Figure 7.1-2 of GESSAR.
We have concluded that the proposed design criteria for RCIC j
are acceptable for the PDA subject to detailed staff review and approval of the preliminary design.
This' aspect of the review k
will be conducted as a post-PDA item and we will report the results.
i:
of our review In a supplement to the GESSAR safety' evaluation report.
t l
7.4.2 Standby Liquid Control System CE has stated that the standby liquid control system (SLCS) is identical to the design used in the Zimmer Nuclear Plant.
Since a preliminary design is not yet available, we have not completed the review necessary to assure resolution of the generic i
problems associated with the interlock which prevents operation of both pumps. The concern is that improper implementation of this interlock could result in a design such that a single failure could disable both pumps. We will report further on this aspect of the design in a supplement to the GESSAR safety evaluation report.
The design of the SLCS and the reactor water cleanup (RWCU) system includes an interlock designed to isolate the RWCU system when the SLCS is initiated. We have concluded that this interlock
__________-.__.m__..
7-27 can be disabled by a single failure.
In Amendment No. 24 to I
GESSAR, GE stated that a study has been conducted to evaluate the effects of simultaneous operation of the SLCS and the RWCU system. GE stated that the analysis indicates that under such conditions, the SLCS will continue to accomplish its intended I
safety function with substantial margin. On_the basis of these statements, we agree with the conclusion reached by GE that interlock design changes are not needed.
We have reviewed the proposed design criteria for the SLCS listed in Figure 7.1-2 of GESSAR. We have concluded that these criteria are acceptable for the PDA subject to staff review and approval of the preliminary 7 design. This as ect of the review will be conducted as a post-PDA item and we will report the results
)
of our review in a supplement to the GESSAR safety evaluation
~
report.
7.5 Safety Related Display Instrumentation This section of GESSAR presently does not completely satisfy the information specified in Regulatory Guide 1. 70.
In response to our i
request that GE be required to eliminate obsolete information, GE l
deleted certain figures in GESSAR and stated that the main control I
board arrangements for BWR-6 would be submitted in the first quarter of 1975. During a meeting with GE in October 1974, it was agreed that s
GE will provide specific information such as lists of the indications and controls to be provided and the physical arrangements of control board i
)
f' l
7-28 e
panels and that we will review this information during the post-PDA
(
pha se.
In the course of our review we have also reached agreement with GE on the design criteria for some of the safety related display instrumentation. The two major areas on which agreement was reached are:
(1) Post-accident monitoring and safe shutdown display instru-mentation will be qualified for the accident environment, will utilize redundant channels with at least one channel recorded, will be capable of being energized from onsite emergency power supplies, and will be designed in accordance with IEEE Std 279-1971. GE also agreed that the indicators and recorders will be designed to function satisfactorily following (but not necessarily during) the safe shutdown earthquake without any maintenance or repair following the earthquake.
(2) Safety related display instrumentation which is used to indicate the need for manual action by the reactor operator will be designed in accordance with protection system criteria if the accident analysis takes credit for correct performance of that manual action.
We have concluded that these agreements and the information pertaining to safety related display instrumentation presently l
contained in GESSAR are an acceptable basis for the PDA. We will
4 7-29 report the results of our review of the specific information
(
which will be submitted in 1975 in a supplement to the GESSAR safety evaluation report.
7.6 All Other Instrumentation Systems Required for Safety 7.6.1 General The systems discussed in this section of this report are:
a) Refueling interlocks b)
Reactor vesselainstrumentation and controls (excluding those used for cafety systems, engineered safety features and control systems which are discussed in other sections of this report) c) Process radiation monitoring system d) Area radiation monitoring system e) Reactor water cleanup system f) Leak detection systen g)
Process computer systen h) Containment atmosphere monitoring system
- 1) Neutron monitoring system i
j) Fuel pool cooling and cleanup system 4
We have reviewed the information provided in Table 7.1-1 which describes the changes in the designs compared to previous plants.
We have concluded that the identified differences are primarily in the electronic equipment used or are attributable to the larger plant size described in GESSAR. On this basis we have concluded that these systems are acceptab e for the PDA.
It is l
intended that the safety evaluation report for a standard design application be a self-sufficient document in order to provide a firm and clear baseline for utility application reviews in the future.
Therefore, we will continue our review of these systems during the post-PDA review phase without reliancc on the conparison with previously approved designs. We will report the results of our r-
l 7-30 evaluation of the preliminary designs in a supplement to the I
GESSAR safety evaluation report.
7.6. 2 -
Prempt Relief Trip System The prompt relle.f trip (PRT) system consists of the instru-mentation used to initiate safety / relief valve opening following turbine trip. GE has stated that the purpose of this system is to reduce the peak reactor pressure and peak heat flux resulting from a turbine trip coincident with failure of the turbine bypass system. We are evaluating the need for this system, an alternative system, or limitations on plant operation in order to prevent exceeding safety limits in the event of a turbine trip.
We iave not completed this evaluation and therefore have not reachec a
conclusion on whether the concept of a PRT system is acceptable, i
(Refer to Section 15.1 of our safety evaluation report for additional information.)
1 If we conclude that the concept of a PRT system in acceptable, we will require GE to submit a preliminary design of the instru-mentation proposed for this system. We an'ticipate some problems with this review based on the conceptual design provided in GESSAR.
One potential problem area is that the system as proposed would i
have no safe failure mode. The proporad design criteria are that no single failure cause inadvertent actuation of more than one relief valve and that no single failure prevent actuation of all relief valves in the event of a turbine trip.
However, as discussed l
l l
I 7-31 in Section 7.3.2.2 of this report, GE is conducting studies in
(
an attempt 'to show that the prohibition against inadvertent actuation is an unnecessary design criterion. Another potential problem is that the proposed conceptual design appears to lack adequate provisions for periodic testing.
This is similar to the problem with the ADS design which is also discussed in Section 7.3.2.2 of this report.
We have concluded that if PRT is permitted in GESSAR, our review of the preliminary design for the PRT system can be conducted during the post-PDA review phase. We will report the results of our evaluation of whether the concept of a PRT system is acceptabic and, if so, the results of our review of the PRT instrumentation in a supplement to the GESSAR safety evaluation report.
7.6.3 Reactor Pressure Relief Instrumentation i
In Amendment No. 23 to GESSAR, GE provided additional infor-mation pertaining to the effects of the reduction in the number of relief valves to be provided for the GESSAR standard design.
l Initially the proposed design had 22 relief valves for the reactor coolant system. The design now proposed has 19 valves. Although i
the relief capacity per valve has been increased, the reduction in the number of valves resulted in less total relief capacity.
The effect of this design change is that the safety analysis now net takes credit for 50% of the safety / relief valves opening at their lower relief set points. The previous design relied on all valves
--n-.
M
- o 7-32 (except one which was assumed failed) opening at their higher i
safety valve spring set point pressure.
In previous designs the instrumentation used to open the valves at the relief set point was classified as non-safety. Now this instrumentation must be classified as a protecticn system since it is relied on to initiate opening of the valves at their relief set point.
We have not completed our review of this instrumentation.
However, in Amendment No. 23 to GESSAR, GE stated that this l
instrumentation will be upgraded to provide redundancy and independence equal to that required for protection systems, e.g.,
ADS. We have concluded that this commitment is acceptable for i
the PDA. We will report the results of our review of the specific design criteria and the preliminary design for this instrumentation in a supplement to the GESSAR safety evaluation report.
7.7 Control Systems I
7.7.1 Reactor Manual Control System (RMCS)
GE provided the following description of the function of the Rod Pattern Control System and its provisions for ganged rod with-drawal. This information was provided in a letter from John A.
Hinds, Manager, Safety & Licensing, General Electric Company to John F. Stolz, Directorate of Licensing, USAEC, dated December 28, 1973.
"The purpose of the rod pattern control system is to limit the worth of any ceatrol rod such that no undes rable effects will result s
from a rod dro:: accident. The rod pattern control system will enforce operational procedural controls by applying rod blocks before any rod motion can produce high worth rod patterns.
p
?
- .27
..,-33
- 'l' A.
System Description - Definition of Terms o
\\
1.
The rod pattern control system (RPCS) is a dual channel system using like components in each channel. The l
control logic for the RPCS is contained in a logic device such as the processor portion of a mini computer.
This logic device, has, in permanent storage, the identification of all rod groups and logic control information required ~to prevent high worth rods. The logic device' is hardwired and is not to be site program-mable, except through controlled engineering design change.
2.
There is a logic device for each channel. The logic for these two devices is the same and both channels receive the same data inputs but from different sources, a) There is a dual rod position probe for each drive.
Two sets of reed switches are provided for rod i
position information and provides, through different connectors, inputs to different rod position multi-plexer cabinets.
b) Two different rbd position multiplexer cabinets are provided, one for each channel.
These cabinets i
transmit rod position data to the rod position
{
information cab'inets. A rod position information cabinet is provided for each channel. These cabinets decode the multiplexed data and provide rod position data to the RPCS logic devices for all rods. Rod position is the primary data input for RPCS.
c) Other inputs to the RPCS logic devices include reactor power level mode of operation, identification of selected rod, drive mode requested by the operation (sic) and special modes of op'eration such as shutdown margin tasts.
d) A means of comparing the outputs of the RPCS logic devices provide a way of monitoring the performance of the two channels. Both channels must be operable and with identical outputs before rod motion is permitted. Failed comparisons and logic device failures are indicated in the control room, e) RPCS outputs are transmitted to the two activlty control sections of the Reactor llanual Control System in the form of a rod select and drive permissive interlock. The two RPCS channels provide inputs separately to the two separate activity controls.
These two inputs are then treated as other rod block interlocks and are further compared to the analyzer portion of reactor manual control.
l
+
7-34 f) An addition to the existing full core status display,
[
a continuous full core rod position display is provided from one of the rod position system cabinets.
A new display is provided which will show the LPRM values for all the rods in any RPCS rod group.
i B.
System Operation a) Fron 0% power and with all rods full in to 50% rod density, only rods in the same sequence can be moved.
Once a sequence is selected and rods moved, startup must proceed in the chosen sequence, either A or B.
Up to 50% rod density a rod may be continuously withdrawn or notched out.
I b) From 50% rod density to 25% reactor power level, only rods in a defined group may be moved.
The rods in a given group are symmetrically distributed in the core and permanently identified in the RPCS.
The position of the group rods must remain within 1 notch or a rod block will occur. All rods in the core will belong to a group which typically numbers from 2 to 8 rods.
Rods in a group must therefore be notched out in rotation until all group rods are again in the same position.
c) Above 25% power level in the RPCS is no longer needed because no high worth rod pattern can be established.
This is due to the core void fraction established.
The RPCS is therefore switched off. From this point up to 100% power, the Rod Block monitor is in service j
to limit flux peaking.
j i
d) Coming down in power the above sequence of operation occurs but in reverse order. At 35% reactor power level decreasing, an alarm will be initiated to alert the operator of pending RPCS constraints. At this point, the operator must get into proper sequence for shutdown.
C.
Allowable System Bypasses a) Upon failure of one channel of the RPCS the failed 3
channel may be taken out of service.
By procedural i
control the output of the remaining good channel l
would then be input to both activity controls of
{
reactor manual control.
l l
l 1
~
1
7-35 b) At time of startup or shutdown both channels of RPCS must be operable.
~
I c) A means for bypassing failed reed switches will be provided for unique failures, d) A means for handling drives which are valved out of service will be provided.
The purpose of ganged rod withdrawal is to facilitate startup or shutdown between 50% rod density and 25% power.
A.
Description cf System and Operation 1.
At p' resent each rod has its own binary code identification determined by identification cards mounted on the trans-ponder card. To incorporate ganged rod withdrawal, each rod has two identifications--its unique identification and its group identification.
a) The above group identification contains thetsame identical rods as used in the RPCS group for that rod.
b) Reactor manual control syster is modified to give group rod identification commends as well as single rod commands. An operator action is required to move rods in the ganged rod withdrawat mode.
c) Using the whole core rod position display it ir possible to monitor the motion of all rods in any rod group. The LPRM strings associated with the rods in the rod group are displayed on a new separate control room display.
2.
Operation in the ganged rod mode allows continuous with-drawal of an RPCS rod group above 50% rod density and below 25% power.
a) The requirement for all rods in a group to be within il notch position is still in effect. A rod block will occur whenever any rod in a rod group is more than il notch out of step. The out of step rod may be operated in the single notch mode to correct the rod pattern fault. Upon correction of the 1 notch block, ganged rod withdrawal may be then initiated."
7-36 Although GE classifies the reactor manual control system as a power generation system and non-essential to safety, we have reached agreement with GE that the system shall meet the following safety design bases:
(1) The circuitry provided for the manipulation of control rods shall be designed so that no single failure can negate the effectiveness of a reactor scram.
l (2) Repair, replacement or adjustment of any failed or mal-
]
functioning component shall not require that any element j
1 needed for reactor scram be bypassed unless a bypass is i
normally allowed.
(3) The reactor manual control system instrumentation and controls are designed in accordance with the specific regulation requirements shown in Figure 7.1-2.
(4)
Inhibit control rod motion whenever instrumentation is incapable of monitoring core response to rod movement.
(5)
Inhibit control rod withdrawai in time to prevent local fuel damage as a result of erroneous cont,rol rod manipulation.
GE has also documented its commitment to comply with our position that these portions of the RMCS which provide safety l
functions must be designed in 'accordance with all requirements applicable to a protection system.
k'e have concluded that the safety I
design bases above and this commitment are acceptable for the PDA.
Af ter GE submits a preliminary design for the equipment for the RMCS, we will review that design to assure that the safety design bases above have been implemented in accordance with protection system
- ~
n
+,
7-37
. design criteria. We will report the results of our evaluation i
(
in a supplement to the GESSAR safety evaluation report.
7.7.2-Other Control Systems GE has stated that the following control systems do not have a safety design basis: the Feddwater Control System and the Pressure Regulator and Turbine-Generator Controls.
GE has also stated that the effects of failures in these control systems have been analyzed.- (Refer to Section.15 of the GESSAR safety evaluation report.for the results of our evaluation i
of those analyses.)
When the preliminary design of the safety systems is submitted for review, we will review.the interaction between these control i
j systems and the safety systems to assure that the requirements of IEEE Std 279-1971,- Section 4.7 are met.
't Other control systems do have a safety design basis identified L
i by GE.
These systems and their safety design bases are:
(1) Recirculation Flow Control System - The recirculation flow control system shall function so tha t no abnormal operational transient resulting from a malfunction in the recirculation flow control system can result in damaging the fuel or exceeding nuclear system pressure.
(2) Gaseous Radwaste Control System - The safety objective of the gaseous radwaste system is to process and control the release of gaseous radioactive waste to the site environs so that the total radiation exposure to persons outside the controlled area is as low as practicable and does not exceed applicable i
regulations.
s
7-38 A
(3) Liquid Radwaste Control System - The safety objective of the liquid radwaste system is to control the release of liquid and solid radioactive vaste material to the environs and to package these wastes in suitable containers for offsite shipment and burial.
We have concluded that this information is acceptable for the PDA.
After receipt of a preliminary design for this instrumentation, we will review the design to determine that the safety design bases have been implemented in conformance with appropriate safety system design criteria, including IEEE Std 279-1971, Section 4.7, Control and Protection System Interaction. We will report the results of this post-PDA review in a supplement to the SER.
(Refer to Section 11 of i
the SER for additional information on our evaluation of the radwaste systems.)
i 7.8 Instrumentation Interfaces with Balance of Plant Systems The Regulatory staff study on Methods for Achieving Standard-ization on Nuclear Power Plants, March 5,1973, stated that all interface conditions with the remainder of the plant must be clearly identified and specified. With respect to the instrumentation, control and electric power systems, we have notified GE that we will need a list of systems or components which are not within the
" nuclear island" but which are necessary to support the conclusion-that the " nuclear island" systems are acceptable. For each such system, the GESSAR application must specify the criteria and design bases which must be met by the balance of plant systems to insure that the nuclear island systems perform acceptably.
l 7-39 l
l l
[
The goal of our review is to insure that these interface requirements are sufficiently specific in order to preclude the need to re-evaluate the GESSAR design on specific plant applications utilizing the GESSAR design.
~
Since the preliminary designs for several instrumentation systems have not yet been developed, we have been unable to proceed to a review of the interface requirements for the balance of plant system. We vill report the results of this effort in a supplement to the GESSAR safety evaluation report.
e 0
- +op--
y
)
8,
1 8.0 ELECTRIC POWER SYSTEMS l
I-
'The design of the electric power systems is primarily the responsibility of the applicant submitting a utility _ application for a construction' permit or submitting a balance-of-plant j
standard design application for a PDA.
Therefore, although a
much of the information contained in Chapter 8 of GESSAR is typical of the information to be supplied by future applicants, we have concluded that it is not within the scope of the GESSAR PDA.. We have. reached agreement with GE that additional specific o
information in the interface area will be provided by GE for
~
our review during the Final Design Approval (FDA) review phase for GESSAR.
Our evaluation of GESSAR for the PDA is discussed l-below.
We have reviewed the proposed design criteria for the standby power instrumentation and control systems. We have concluded
.I that the criteria listed in Figure 7.1-2 of GESSAR form a generally acceptable basis for developing a design for the electric power systems on any paint referencing GESSAR in its construction permit application.
The conceputal design for the electric power systems provides for a three division arrangement.for both I
the a-c and d-c power systems. We have concluded that this l
arrangement is compatible with the functional requirements of i
the engineered safety feature systems which also have three divisions and that this is in accordance with Regulatory Guide 1.6 and is therefore acceptable.
8-2 The HPCS onsite power supply is within the scope of GESSAR.
GE has referenced the topical report NEDO-10905, "High Pressure Core Spray System Power Supply Unit," May 1973. We are reviewing this topical report separately from the GESSAR application.
The instruments. tion and controls for the HPCS power supply system are being reviewed on the GESSAR docket and are discussed in GESSAR Section 7.3.
As stated in Section 7.3.2.1 of this report, the preliminary design for the HPCS instrumentation will be reviewed during the post-PDA phase and we will report the results of our review in a supplement to the GESSAR safety evaluation report.
O
l 1
11-1 i
11.0 RADIOACTIVE WASTE MANACDENT
]
11.4 Solid Waste Management Systems (Item 29) l We stated in our SER that provisions should be made to i
l verify the absence of free water in drummed solid wastes.
GE has recently stated that they will work with various industry committees and the Regulatory staff to develop equipment that will detect the presence of free water in drummed wastes.
We consider this item resolved.
-w wse=
a APPENDIX A l
CONTINUATION OF C11RONOLOGY November 6, 1974 Amendment 23 filed. This amendment addresses the outstanding items listed in the September 12, 1974 staff letter to GE.
November 8, 1974 Amendment 24 filed. This amendment addresses the agreements reached at the I & C meetings between GE and the staff on October 29, 1974 through November 1, 1974.
i I
L__________.m__._____
___.__.__._m_
j i
APPENDIX F ERRATA TO THE SAFETY EVALUATION REPORT
'Page Line 1-13 40,41 Under " Grand Gulf" change " freestanding steel" to " reinforced concrete'.'
3-5 4
Change " require" to " required" 6-17 11 Change"Hydrualic" to " Hydraulic" 6-49 5
Change "LPCS" to "LPCI" 9-5 20 Change " plant" to " plate" 11-23 3
Delete "scismic and" and change "classifica-tions" to " classification" 15-8 16 Change "1700" to "2700"
APPENDIX G 9/23/74.
I BRANCH TECHNICAI. POSITION - MED No. 1 POSTULAIED URE/K AND LEAKAGE LOCATIONS IN L y:'.D SYSTEM PIPING OUTSIDE CONTAINMENT The following crite;$a are the revicu. responsibility of the Mechanical Engineering Drcnch with the exception of I.A.,
II.A., and II.D. which are the responsibility of the Aux 111ary Power and Conversion Systems tranch.
These items are included in.this Branch Technical Position to provide clarity and continuity.
I.
Fich-Dwreno Fluid Sucicm Piping A.
Fluid Systems Scparated from Eccential Systems and Copponents For the purpose of satisfying the separation provisions of plant arrangement as specified in C.I.a of the Regulatory Position,* a review of the, piping layout and plant arrangement drawings should c1carly show that the effects of post'ulated piping brcoks at any location are isolated or physically remote from csscntial cystems and compor.cnts.
At the designer's option, break locations as determined fren I.C and I.D of this Branch Technical Position may bi assumcd for this purpose.
B.
Fluid System Piping Between Containment Isolation Valves.
Breaks need not be postulated in those portions of piping identified in C.2.c. of the Regulatory Position
- provt they meet the requirc-ments of the ASME Code,Section III, Subarticle NE-1120 and the follouing additional design requirements:
1.
The following design stress and fatigue limits should not be exceeded:
For ASME Code,Section III, Class 1 Piping (a) The maximum stress range should not exceed 2.4S, (b)
The maximum stress range between any two load sets (including the zero load set) should bc calculated by Eq. (10) in Paragraph NE-3653, AS"E Code,Section III, for upcet plant conditions and an operating basis carthquake (OBE) event transient.
'Sce Attachment A 1
I 4
l
r i
0 t
If the calculated maximum stress range of Eq. (10) exceeds the limit of I.B.1(a) but is not greater than 3S,, the limit of I.B.1(c) should be met.
If the calculated maximum stress range of Eq. (10) exceeds 3S, the stress ranges calculated by both m
Eq. (12) and Eq. (13) in Paragraph ND-3653 should meet the limit of I.B.1(a) and the limit of I.B.1(c).
e (c)
The cumulative usage factor should be less than 0.1 if consideration of fatigue limits is required I
according to I.B.1(b).
(d) The maximum stress, as calculated by Tq. (9) in Paragraph NB-3652 under the loadings resulting from a postulated piping failure beyond these portions ofpipingshouldnotexeecd2.25Sy.
For ASME Code,Section III, Class 2 Piping (a)
The maximum stress ranges as calculated by Eq. (9) and (10) in Paragraph NC-3652, ASME Code,Section III, considering upset plant condiiions (i.e., sustained loads, occasional loads, and thermal expansion) and an OBE event should not exceed,0.8(1.2Sh+S)*
A (b) The maximum stress, as calculated by Eq. (9) in Paragraph NC-3652 under the loadings resulting from a postulated piping f ailure of fluid system piping beyond these portions of piping should not exceed 1.8S
- h 2.
Welded attachments, for pipe supports or other purposes, to these portions of piping should be avoided except
{
i where detailed stress analyses, or tests, are performed f
to demonstrate compliance with the limits of I.B.1.
3.
The number of circumferential and longitudinal piping velds and branch connections should be minimized. Where guard pipes are used, the enclosed portion of fluid system piping should be seam 1 css construction unless specific access provisions are made to permit inservice volumetric examina-tion of the longitudinal welds.
l
l l'
' 4.
The icngth of these portions of piping should be reduced to the minimum length practical.
4 5.
The design of pipe anchors or restraints (e.g., connections to containment penetrations and pipe whip restraints) should l
not require welding directly to the outer surface of the piping (e.g., flued integrally forged pipe fittings may be used) except where such welds are 100 percent volumetrically examinable in service and a detailed stress analysis is performed to demonstrate compliance with the limits of I.B.1.
6.
Guard pipes provided for those portions of piping identified in C.2.c.(2) of the Regulatory Position
- should be constructed in accordance with rules of Class MC, Subsection ME of the ASME Code,Section III, where the guard pipe is part of the containment boundary.
In addition, the entire guard pipe should be designed to meet the following requirements and tests:
(a) The design pressure and temperature should not be less than the maximum operating pressure and temperature of the enclosed pipe under normal plant conditions.
(b) The design stress limits of Paragraph NE-3131(c) should not be execeded under the loading associated with design pressure and temperature in combination i
with the safe shutdoun carthquake.
s (c) Guard pipe assemblies should be subjected to a single pressure test at a prcosure not in excess of design pressure.
C.
Fluid Systems Enclosed Within Protective Structures 1.
With the exception of those portions of piping identified in I.B., breaks in Class 2 and 3 piping (ASME Code,Section III) should be postuinted at the following locations in those portions of each piping and branch run within a protective structure or compartment designed to satisfy the plant arrangement provisions of C.1.h. or C.1.c. of the Regula-tory Position:*
- See Attachment A 1
i
1 n
1 a.
At terminal ends of the run if located within the protective structure.
b.
At intermediate locations selected by one of the 4
following criteria:
l l
(1) At each pipe fitting (e.g., elbow, tee, cross, l
finnge, and non-standard fitting), ucided attach-ment, and valve. Uhcrc the piping contains no fittings, wcIded attachments, or valves, at one location at cach extrene of the piping within the protective structure.
(A terninal end, as determined by C.I.a, may be considered as one of these extremes.)
(ii) At each location where the stresses 1/ exceed 0.8(1.2Sh + S ) but at not less than two separatec locationschosenonthebasisofhigheststress.2; j
Where the piping consists of a straight run without fittings, welded attachment, and valves, and all stresses are below 0.8(1.2Sh + S ), a minimun of A
one location chosen on the basis of highest stress.
2.
Breaks in non-nucacar class piping should be postulated at the following locations in each piping or branch run:
a.
At terminal ends of the run if located within the protective structure.
b.
At each intermediate pipe fitting, ucided attachment, and valve.
1/Stresses under normal and upcot plant conditions, and an OBE cvent as calculated by Eq. (9) and (10), Parag. NC-3652 of the ASP 2 Code,Section III.
2/ cicct S
two locations with at least 10% difference in stress, or, if stresses differ by less than 10%, tuo locations separated by a change of direction of the pipe run.
C
.=
-,. rt
.n p
D.
Fluid Syst:. is ' Enclosed Within Protective Structures 1.
With th, aptions of those portions of piping identified in 1.B.,
caks in Class 2 and 3 piping (ASME Code,Section III) should i qostulated at the following locations in those portiona a ' t..ch piping and branch run routed outside of, but alor;
, above, or below, a protective structure or
- ontatning ccecntial cyctcms and components comparti and asi-.Eto satisfy the plant arrangement provisions of C.1.b o
?.l.c. of the Regulatory Position.*
Such piping should be considered as located adjacent to a protective structure if the distance between the piping and structure is insufficient to preclude inpairment of the integrity.f the structure from the effects of a postulating piping failure assuming the piping is unrestrained, a.
At terminal ends of the run if located adjacent to the protective structure.
b.
At intermediate locations selected by one of the following criteria:
(
l (1) At each pipe fitting (e.g, elbow, tee, cross, fl,ange, and non-standard fitting), velded attach-ment, and valve.
Where the piping contains no s
fittings, welded attachments, or valves, at one location at each extrene of the piping run adjacent to the protective structure.
(ii) At each location where the stressea /
1 exceed 0.8(1.2Sh + SW) but at not less than two separated locations chosen on the basis of highest stress.2/
Where the piping consists of a straight run without fittings, welded attachments, or valves, and all stresses are below 0.8(1.2S3 + SW), a minimum of one location chosen on the basis of highest stress.
2.
Breaks in non-nuclear class piping should be postuinted at che following locations in each piping or branch run:
a.
At terminal cnds of the run if located adjacent to the protective structure.
b.
At each intermediate pipe fitting, welded attachment, and valve.
- See Attachment A w
e l
l-
. I l
l
{
l l
'l l
11.
Modcrato-D:cray Fluid 3yotem Piping A.
Fluid Systcmo Separated from Ecocntial Systenc and Components For the purpose of satisfying the separation provisions of plant arrangement as specified in C.l.a. of' the Regulatory l
Position,* a review of the piping layout and plant arrangement drmrings should clearly show that the effects of through-wall
)
Icakage cracks at any location are isolated or physically
{
remote from cccontial cystcmo and ccmponcnto.
1 E.
Fluid System Piping Between Containment Iso 1'ation Valves Leakage cracks need not be postulated in those portions of piping identified in C.2.c. of the Regulatory Position
- pro-vided they meet the requirements of ASVE Code,Section III, Subarticle EE-1120, and are designed such that the maximum h + S ) f r ASME Code, stress range does not excned 0.4(1.2S A
Section III, Class 2 piping.
C.
Fluid Systems Within, or Outside and Adjacent to, Protective Structure t
Through-wall leakage cracks should be postulated in fluid systcm piping located within, or outside and adjacent to, protective structures designed to satisfy the plant arrange-ment provisions of C.l.b. or C.l.c of the Reguintory Position,*
cxcept (1) where exempted by II.B and II.D, or (2) where the maximum stress range in these portions of Class 2 or 3 piping (ASME Code,Section III), or non-nuclear piping is Icss than
- 0. 4 (1. 2Sg + Sg ).
The cracks should be postulated to occur individually at locations that result in the maximum effects from fluid spraying and flooding, with 'the consequent hazards or environmental conditions developad.
i D.
Modcrate-D2crgy Fluid Systemc in Proximity to High-Energy Fluid Syctcmo Cracks need not be postulated in modcrate-cncrgy fluid systcm piping located in an area in which a break in high-energy fluid system piping is postulated, provided such cracks would not result in more limiting environmental conditions than the high energy piping break. Where a postulated leakage crack in the moderate-energy fluid syctem piping results in more limiting l
environmental conditions than the break in proximate high-cncrgy fluid cyctcm piping, the provisions of II.C should be applied.
'See Attachment A l
1
a 4
-7_
E.
Fluid Systcmc Qualiiying as High-Energy or Moderate-Encrgy Systcmc Through-wall leakage cracks instead'of breaks may be postulated in the piping of those fluid cyctcms that qualifg as high-energy fluid cyctems for only short operational perioda_/ but qualify as modcrate-cncrgy fluid cystema for the major operational period.
III. Type of Breaks and Leakane Cracks in Fluid System Piping A.
Circumferential Pipe Breaks The following circumferential breaks should be postulated in high-energy fluid eyctem piping at the locations specified in Section 1 of this Branch Technical Position.
1.
Circumferential breaks should be postulated in fluid syston piping and branch runs exceeding a nominal pip / exceeds the e size of 1 inch, except where the maximum stress rangel limits specified in I.C.1.b. (ii) and I.D.1.b. (ii) but the circumferential stre's's range is at least 1.5 times the axial stress range.
Instrument lines, one inch and less nominal pipe.cnr tubing size should meet the provisions of' Regulatory Guide 1.11.
l' 2.
Where break locations are se3ceted without the benefit of stress calculations, breaks should be postulated at each i
piping veld joint to fitting, valve or welded attachment.
Alternatively, a sing 3e breah location at the section of maximum stress range may be selected as determined by detailed stress analyses (e.g., finite element analyses) or tests on a pipe fitting.
3.
Circumferential breaks should be assumed to result in pipe severance and separation amounting to at 1 cast a one-diancter lateral displacement of the ruptured piping sections unless physically limited by piping restraints, structural members, or piping stiffness as may be demonstrated by inelastic limit analysis (e.g., a plastic hinge in the piping is not developed under loading).
'/
An operational period is considered "short" if the fraction of time that the system operates within the pressure-temperature conditions specified for high-energy fluid cycrees is less than 2 percent of the time that the system operates as a modcrate-cncrgy fluid system (e.g., systems such as -
the reactor decay heat removal systems qualify as modcrats-cncrgy fluid, systems; however, systems such as auxiliary feedwater systems operated during PER reactor startup, hot standby, or shutdoun qualify as high-energy fluid cyctems)
-_______________.______m__._____.___._-_w
s.
i 4.
The dynamic force of the jet discharge at the break location
)
should be based on the effective cross-sectional flow area of the pipe and on a calculated fluid pressure as modified by an analytically or experimentally determined thrust co-efficient.
Limited pipe displacement at the break location, line restrictions, flow limiters, positive pump-controlled flow, and the absence of energy reservoirs may be taken into account, as applicabic, in the reduction of jet discharge.
5.
Pipe uhipping should be assumed to occur in the planc defined by the piping geometry and configuration, and to cause pipe movement in the direction of the jet reaction.
B.
Longitudinal Pipe Breaks The follouing longitudinal breaks should be postulated in high-energy fluid systen piping at the locations of each circumfer-ential break specified in III.A:
1.
Longitudinal breaks in fluid systcm piping and branch runs should be postulated in nominal pipe sizes 4-inch and larger, except uhcre the maximum stress rangel/ exceeds the limits specified in I.C.1.b. (ii) and I.D.1.b. (ii) but the axial stress range is at least 1.5 times the circumferential stress range.
2.
Longitudinal
- breaks need not be postulated at:
(a) tenminal ends provided the piping at the terminal ends contains no longitudinal pipe velds (if longitudinal welds are used, the requirements of 111.E.1 apply).
(b) at intermediate locations where the criterion for a minimum number of break locations must be satisfied.
3.
Longitudinal breaks should be assumed to result in an axial split without pipe severance.
Splits should be oriented (but not concurrently) at two diametrically-opposed points on the piping circumference such that the jet reaction causes out-of-plane bending of the piping configuration.
Alternatively, a singic split may be assumed at the section of highest tensile stress as determined by detailed stress analysis (e.g., finite element analysis).
4.
The dynamic force of the fluid jet discharge should be based on a circular or elliptical (2D x 1/2D) break area equal to the effective cross-sectional flow area of the
[.
k
_9-pipe at the break location and on a calculated fluid pressure modified by an analytically or experimentally determined thrust coefficient as determined for a circumferential break at the same location.
Line restrictions, flow limiters, positive,pur.p-controlled flow, and the absence of energy reservoirs may be taken into account, as applicable, in the reduction of jet discharge.
- 5..
Piping movement should be assumed to occur in the direction of the jet reaction unless limited by structural members, l
piping restraints, or piping stiffncss as demonstrated by inclastic limit analysis.
C.
Through-Wall Leakage Cracks
{
The following through-wall Acakage cracks should be postulated i
in modcrate-onergy fluid cyntcm piping at the locations specified in Section II of this Branch Technical Position.
l 1.
Cracks should be postulated in moderate-energy fluid system l
piping and branch runs exceeding a nominal pipe size of 1 inch, j
2.
Fluid flow from a crack should be based on a circular opening of area' equal to that of a rectangle one-half pipc-diameter in length and one-half pipe wall thickness in width.
i 3.
The flow from the crack should be assumed to result in an environment that vets all unprotected components within the compartment, with consequent flooding in the compartment t
and communicating compartments. Flooding effects should be determined on the basis of a conse'rvatively estimated time period required to effect corrective actions.
)
l
-~-
(.
l*
ATTACHMENT A
SUMMARY
OF APPLICABLE REGULATORY POSITIONS Regulatory' Position C.1.a Plant arrangements should separate fluid system piping from casential systems and ecmponents.
Separation should be achieved by plant physical layouts that provide suf ficient distances between assential systems and components and fluid system piping such that the effects of any.
postulated piping failLme therein (i.e., pipe whip, jet impingement, and the environmental conditions resulting from the escape of contained fluids as appropriate to high or moderata-energy fluid system piping) cannot impair the integrity or operability of essantial systems and componcnts.
Regulatory Position C.1.b Fluid systam piping or portions thereof not satisfying the provisions of C.1.a should be enclosed within structures or compartments designed to protect nearby cssential sysicms and components.
Alternatively,
/
cescntial systems add ccmponcnts may be enclosed within structures or
' compartments designed to withstand the effects of postulated piping failurcs in nearby fluid sysicms.
Regulatory Position C.1.c Plant arrangements or system features that do not satisfy the provisions of either C.1.a or C.1.b. should be limited t o those for uhich the above provisions are impractical becsuse of the stage of design or construction of the plant; beccuse the plant desi n is based upon that of an earlier C
i plant accepted by the staf: ns a base plant under the Commission's stand-ardization and replication policy; or for other substantive reasons such as particular design features of the f7uid systems.
Such cases may arise for exampic, (1) at interconnections between fluid systems and ecscntial systems and components, or (2) in fluid systems having dual functions (i.e., required to operate during normal plant conditions as veil as to
]
shut down the reactor).
In these cases, redundant design features that I
are separated or otherwise protected from postulated piping failures, or additional protection, should be provided'so that the effects of postulated piping failurcs are shown by the analyses and guidelines of C.3 to be acceptable. Additional protection may be provided by restraints and barriers or by designing or testing cceential systems and components to withstand the effects associated with postulated piping failurcs.
l l
s i
e A-2 l
l l
.tegulatory Position C.2.c Fluid systew piping between containment isolation valves should meet the following design provisions:
1.
Portions of fluid cyctem piping between isolation valves of single barrier containment structures (including any rigid connection to the containment penetration) that connect, on a continous or inter-mittent basis, to the reactor coolant pressure boundary, or the steam and feedwater systems of PUR plants, should be designed to the stress limits specified in 1.B or II.B. of the Branch Technical Position.
These portions of high-energy fluid cystem piping should be provided with pipe uhip restraints that are capable of resisting bending and torsional moments produced by a postulated piping failure either upstream or dounstream of the containment isolation valves. The restraints should be located reasonably cloce to the containment isolation valves and should be designed to withstand the loadings resulting from a postulated piping failure beyond these portions of piping so that neither valve operability nor the Icaktight integrity of the containment will be impaired.
2.
Portions of fluid system piping between isointion valves of dual barrier containment structures should also meer.the design provisions of 1 above.
In addition, those portions of piping that pass through the containment annulus, and whose postulated f ai]ure could aff ect the leaktight integrity of the containment structure or result in pressurization of the containment annulus beyond design limits should be provided uith an enclosing pr'otectivd structure.
For the purpose of establishing the design par 3 meters (i.e.,
pressure, temperature) of the enclosing protective structure, a full flow area opening should be assumed in that portion of pipirg within the enclosing structure taking into account vent areas, if provided, in the enclosing structure. Where guard piper for individual process pipes are used as an enclosing protective structure, such guard pipes should be designed to meet the re-quirements specified in I.B.6 of the Branch Technical Position.
3.
TermincZ cnds of the piping runs extending beyond these portions of high-encrgy fluid sysicm piping should be considered to originate at a point adjacent to these required pipe whip restraints located inside and outside containment.
ATTACHMENT E DEFINITIONS Eccential Sysicrcs and Comoonents. Systems and components required to shut down the reactor and mitigate the consequences of a postulated piping failurc, without off-site power.
Fluid Systems. High and modnrato energy fluid cysicmo that are subject to the postulation of piping failures outside containment against which pro-tection of cccential cycicmc and componento is needed.
High-Encrpy Fluid Syntems. Fluid systems that, during normal plant conditionc, are either in operation or maintained pressurized under conditions where either or both of the following are met:
a.
maximum operating temperature exceeds 200*F, or b.
maximum operating pressure exceeds 275 psig.
Modcrate-Encrpp F79fd Systems.
Fluid systems that, during normal plant conditionc, are either in operation or maintained pressurized (above atmospheric pressure) under conditions where both of the following are met:
a.
maximum operating temperature is 200*F or less, and b.
maximum operating pressure is 275 psig or less s
Normal PZant Conditices.
Plant operating conditions during reactor startup, operation at power, hot standby, or reactor cooldown to cold shutdown condition.
Upset Plant Ccnditionc. Plant operation conditions during system transients that may occur with nederate frequency during plant service life and are anticipated operational occurrences, but not during system testing.
Postulated Piring Poilurec.
Longitudinal and circumferential breaks in high-cncrgy fluid cysten piping and through-vall leakage cracks in modcrata-energy fluid systcm piping postulated according to the previsions of the Branch Technical Position.
S andSj. All wabic stresses at maximum (hot) temperature and allowable h
stress range for thermal expansion, respectively, as defined in Article NC-3600 of :he ASME Code,Section III.
p
B-2 S,
Design stress intensity as defined in Article NB-3600 of the ASME Code,
.2.
Section 111.
Sino2c Active CC'morent Poi 2nre.
Malfunction or loss of function of a
~~ omponent of electrical or fluid systems. The failure of an active com-pone.it of a fluid system is considered to be a loss of component function as a result of mechanical, hydraulic, pneumatic, or electrical malfunction, but not the loss of component structural integrity. The direct consequences of a sing 2c active component failure are considered to be part of the single failure.
Terminal Ende.
Extremities of piping runs that connect to structures, components (e.g., vessels, pumps, valves), or pipe anchors that act as rigid constraints to piping thermal' expansion. A branch connection to a main piping run is a terminal cnd of the branch run.
In piping runs which are maintained, pressurized during normal pZant conditions for only a portion of the run (i.e., up to the first normally closed valve) a terminal and of such runs is the piping connection to this closed valve.
\\
l J
y w l. < *.,~
'Y C'
JY h <W
^
?
GENER AL h ELECTRIC J. -6 NUCLEAR ENE GY l
DIVISION GENERAL ELgg,TflC COMPANY,175 CURTNER AVENUE. SAN JOSE, CALIFORNIA 95125 BWR PROJECTS DEPARTMENT Mall Code - 003 Phone (408) 297 3000. TWX NO. 910-338-0116
['
.nt (.,
h [() ~
AD'us.... (,,
I:20E SHLA'.a L.S. A.LC.
l May 14, 1975 JUi') 5 1975 kk)A10441:2,y[d RECElED
/
Mr. A. Birkhofer MAY 2 71975 Laboratorium fur Reaktorregelung L ELECM C mo, und Anlagensicherung Technische Universitst Ifdchen n? n, D C.
L S. G.FFORD 8046 Garching-Rektorstation y
Munich, GERMANY
Dear Mr. Birkhofer:
At an Advisory Committee on Reactors Safeguards (ACRS) meeting on the 238 General Electric Standard Safety Analysis Report (CESSAR),
a crittaue was presented on your artic1A which appeared in Nuclear Tec 6 gy, Volume 24, October 1974.
The ACRS Committee recommended that we forward to you a copy of our critique, and invite your com-ments.
Should you desire to comment, you should recognize that corsnents will be made available to the ACRS, and thus will become public information.
Enclosed is a copy of a letter sent to the U.S.
i Nuclear Regulatory Commission which contains the critique.
Please do not hesitate to contact me if you need further information.
Sincerely, l
A
\\
LL w
J. li.'Imbley, Manager BWR Standardization
/emd Enclosure
.4 B..a?? W :PF9V, s
n ! JA m
o bdLE V
E k 'd b u ',. +
a.-
Jo Not Remove from ACTS 0ffice 4
'a EE SURE TO INCLUDE MAIL CODE ON RETURN CORRESPONDENCE
)