ML20248F422

From kanterella
Jump to navigation Jump to search

Requests Addl Info Re 970818 & 971031 Applications to Amend Coc GDP-1 & GDP-2,updating Application Sars.Provide Info within 30 Days Requested
ML20248F422
Person / Time
Site: Portsmouth Gaseous Diffusion Plant, 07007001
Issue date: 06/02/1998
From: Cox C
NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS)
To: John Miller
UNITED STATES ENRICHMENT CORP. (USEC)
References
TAC-L32043, TAC-L32044, NUDOCS 9806040254
Download: ML20248F422 (23)
v • d • e


Text

_ - - _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ -

+

i, ,M 4 8 W Mr. James H. Miller Vice Presiderst. Production U. S. Enrichment Corporation 2 Ddmocracy Center 6903 Rockledge Drive Bethesda, MD 20817

SUBJECT:

PADUCAH AND PORTSMOUTH CERTIFICATE AMENDMENT REQUESTS,-

UPDATE OF THE APPLICATION SAFETY ANALYSIS REPORTS (TAC NOS.

L32044 and L32043)

Dear Mr. Miller:

This refers to your applications to amend Certificates of Compliance GDP-1 and GDP-2 transmitted by letters dated August 18,1997, and October 31,1997, updating the application i Safety Analysis Reports (SARs).

Our review of your application has identified additionalinformation that is needed before final 1 action can be taken on your request. The additional information, specified in the enclosure should be provided within 30 days of tnis letter. Please reference the above TAC Nos. in future correspondence related to this request.

If you have questions, please contact me at (301) 415-6755.

l Sincerely, Osfcl1f\Y W W '

Charles Cox Mechanical Systems Engineer Enrichment Section Special Projects Branch Division of Fuel Cycle Safety and Safeguards, NMSS Dockets 70-7001/70-7002 Certificates GDP-1/GDP-2

{ 1

Enclosure:

As stated f[ )

cc: Mr. Randall DeVault, DOE Mr Steve Toelle, USEC {} g ggu-p gA m tp qq~'

Mr. Steve Polston, PGDP

l. Mr. J. Morris Brown, PORTS l

DISTRIBUTION:(Control Nos.180S,300S)(TAC Nos. L32044,L32043)

Dockets 70-7001/70-7002 t NRC File Center,PUBLIC KO'Brien, Rlli CCox, SPB NMSS r/f FCSS r/f WSchwink, FCOB

!. MHorn. SPB FCSP r/f PHiland, Rlli Region ll1 DMartin, SPB YFaraz. SPB DHartland. Rlli OFC SPB_ SPB CPB E (SPB SP_8 4 [ SP34 NAME ,4 YFaraz orn DHoadley in Rl rson EATE 5/J498 SM4/98 5/Sl/98 5/7I//98 h98 /l /98 C = COVER E m COVER & ENCLOSURE N = NO COPY l OFFICIAL RECORD COPY l <. 'C~% n

l. 9806040254 980602 ~'

t PDR ADOCK 07007001 C PDR;

_ _ _ . . _ - _ _ _ _ - _ _ _ _ __ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _ - _ _ - _ - _ _ _ - _ _ _ _ ~

  • l Request for Additional Information i

. Application Dated August 18,1997 U.S. Enrichment Corporation Paducah and Portsmouth Gaseous Diffusion Plant l

Dockets 70-7001 and 70-7002 Chapter 2 Specific Comme _nta/RAl's:

1. On page 2.4-8: the SARUP indicates cooling water supply to the enrichment cascades can be affected under extreme flood conditions, but this would not result in a release of uranium
hexafluoride. This would seem to impact the cooling of the freon, which might result in higher freon pressures and a potential leak into the cascade, over-pressurization, and uranium leakage. While floods are not prompt events, the SARUP should clarify the potentialimpact of floods and estimate the frequency.

Chapter 3 Generah

1. Provide more detail on how the structures, systems, and components (SSCs) meet their functional requirements. If the SSCs do not meet that requirement by fail safe mechanism, l ie battery back-up, air reservoirs, identify the surveillance used to ensure that the safety j system can meet that functional requirement. If the SSC has a Technical Safety Requirement (TSR) that surveillance should be in the TSR.
2. For those SSCs that have identified exceptions in their ability to perform their required safety function, provide furtherjustification that would explain why those SSCs should be considered " operable" (as defined in the TSRs).

Spgit]p Comments /RAl's:

3. On page 3.8-1/3.15-1: the SARUP should clarify the O/AQ SSC designation to include anticipated events (AE) in addition to evaluation basis events (EBE) meeting the evaluation guidelines.
4. 3.8.2.1/3.15.2.1 Autoclave Shell High Pressure Containment Shutdown System:
a. The description should include a diagram identifying the valves and other key components.
b. The text should explain the temperatures and pressures and the bases behind them -

for example, if the autoclave pressure limit is 15 psig, then the text should explain why considerably higher steam pressures (60 and 100 psig are mentioned elsewhere in the text; these have temperatures of 308 and 338 F, respectively) are being used; the starting temperatures of 225 and 240 F also need explanation; and the text should explain why 15 psig (250 F) steam is not used.

c. The text should identify the normal and hich levels for condensate in the autoclave, and use whichever bounds the analysis (i.e., potential for greatest impact).

l l

l

2

d. The valve arrangements on page 3.8-4 need a clearer explanation; it is not usual practice to.have a rupture disk and a relief valve in series. Also, the text should explain how debris from a rupture disk impacts the operation of the relief valve, and identify the destination (s) of the relief valve line (i.e., discharge to a room, scrubber).
e. The statement on page 3.8-4, *No corrective action is necessary because multiple failures are required for a release .
  • should be clarified and supported with numerical analysis showing that the probability of the (now mitigated) system not performing its l safety function is incredible (less than 1E 6).

l f. The text notes loss of power / plant air events resulting in failure of the feed control valve

' to close and isolate, allowing the potential for reaction products to enter the cascade.

This should be explained better, and the rationale for it not being categorized as a safety l hazard substantiated.

g. The potential effects of loss of power and plant air should be discussed.
5. 3.8.2.2/3.15.2.2 Remote Feed isolation System:
a. The description should include a diagram identifying valves and other key components,
b. The basis for the 30 second activation time requirement should be provided.

, c. . The presence or absence of sensors for releases should be clarified.

I d. The system is noted as not being independent of the 120 VAC power supply - this ,

should be explained as 120 VAC independence is a functional requirement.  !

e. The text should clarify if there are sensors and controls that automatically trigger the ]

system upon detection of releases. l

f. A numerical analysis should be included demonstrating that the probability of the (now I mitigated) system not performing its safety function is incredible (less than 1E-6).

i 6.- 3.8.2.3/3.15.2.3 Autoclave Primary Containment System:

a. The description should include a diagram identifying key components.
b. The valving and its arrangement should be explained.  ;
c. The steam pressures should be explained, including the basis for limiting it to 60 psig.  ;

The volume of steam should also be identified.

di The text should describe the autoclave in more detail, inc!uding the basis for the condensate' level used in the analysis (i.e., does it correspond to the hirih limit) and the ;

associated mass of water.

e. A calculation should be provided showing the expected pressure rise from the uranium

~

hexafluoride/ water reaction.

f. The use of 90 psig test pressures for periodic leak testing should be explained given an autoclave pressure limit of 15 psig. Also, typical actual versus allowable leak rates

? should be noted. A 12 SCFM allowable leak rate seems rather high and should be explained.

L g. A numerical analysis should be included demonstrating that the probability (now L mitigated) of the~ system not performing its safety function is incredible (less than 1E-6).

h. Explain the use for the 2.5 ton cylinder as the limiting case since the 14 ton cylinder is used in Chapter 4.
7. 3.8.2.4/3.15.2.4 UF6 Primary System:
a. The description should include a diagram identifying key components.
b. The type, functions, and ranges of the pressure / flow reducing devices should be

3 explained.

c. The text should clarify the basis for categorizing the system as Q and AQ, depending upon the location with respect to the isolation valves; it is not apparent how the isolation valves would inhibit liquid UF6 flow if both valves are open (which would be the case during norma! operations). ,

I

d. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less than 1E-6).
8. 3.8.2.5/3.15.2.5 Autoclave High Condensate Level Cutoff System
a. The description should include a diagram identifying key components.
b. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less than 1E-6).
c. his system has two safety functions, NCS and personnel protection. While it may be considered to preserve initial conditions in an accident analysis, more justification is needed to explain why this system is not considered as a system to prevent or mitigate an accident since the water inventory does provide a mitigation factor for the pressure i inside of the autoclave during the scenario and therefore would warrant a Q categorization.
9. 3.8.2.6/3.15.2.6 High Pressure Steam Cutoff This system has a safety function to ensure a cylinder is not overheated and hydraulically rupture. Preserving initial conditions appears to be a narrow approach to this SSC's safety function. Using this logic a reactor overpower trip could be considered preserving initial conditions of the accident analysis and need not be a Q system. The high pressure steam cutoff prevents overheating a cylinder causing a hydraulic rupture, an active systems that prevents an accident. Provide furtherjustification why tus should not be a Q system.
10. 3.8.2.7/3.15.2.7 UF6 Cylinder High Temperature Cutoff System / Autoclave Steam Pressure Control System:
a. The description should include a diagram identifying key components.
b. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less than 1 ~-6).
c. The text should clarify the location (e.g., en the cyhnder, in the steam, autoclave wall, in the header) and type of temperature measurement, and, if multiple measurements are made, the control logic (average,3 out of 4 high etc.).
d. The dynamics of the system should be presented -length of transient, maximum temperature / pressure, UF6 release rate etc. - along with supporting calculations.
e. The system has multiple set points, depending upon the heating mode and cylinder type. The text should explain how operator errors on set points are avoided.
f. The technical, quantitative basis for defining the system as AQ-NCS and not Q (see 9 above) should be provided.
11. 3.8.2.8 Autoclave Locking Ring interlock System:
a. The description should include a diagram identifying key componerits.
b. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less then 1E-6).
c. The description should explain terminology and location of sensors; ambiguous terms t

i**

4 I

include actuation pressure and emergency autoclave operation switen.

d. The inter-operability between this system, the emergency autociave bypass switch, and the autoclave shell high pressure containment system should be explained better.
e. It is not clear how this system can receive an AQ designation, as it complements a Q system and prevents the potential for significant offsite effects (i.e., a Q system requirement); the AQ designation should be explained-
f. Information should be provided to explain how this unit functicns without electrical power, as stated in the functional requirements.
12. The 6iscussion about autoclave systems should explain how the different safety categories wPI be maintained on what is essentially the same SSC. Also, the contractor may wish to discuss the relative merits of a uniform categorization for the autoclave as compared to a piecemeal approach.
13. 3.8.3.1/3.15.3.1 UF6 Compressor Motor Manual Trip System: i
a. The description should include a diagram identifying key components, locations, power supply systems, control power supply etc
b. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less than 1E-6).
c. The vanous control rooms and their locations and staffing should be explained.
d. The text should identify the switchgear DC control power supply functions better, as these appear to be important to safety and required for tripping of the motors.
e. The text implies that compressors can be tripped from the switchyard and thus eliminate the need for DC control power. The text should identify the time impact associated with i a switchyard tripping route, as it may take a considerably Icnger period of time than an I ACRIPCR trip, and an additional source term may result.
f. The text should supply the numerical values to justify releases from the purge cascade not exceeding 10 mg U uptake at the site boundary.
g. The text states multiple failures of the tripping are highly unlikely. Houver, this I

appears to overlook the potential for common mode failures (e.g., no DC control power).

h. Numerical values should be provided to justify the dismissal of tunnel flooding as an I incredible event - presumably some flooding may have occurred in the past in these  ;

tunne!s and flooding may only affect the control (tripping) wiring, not the motor supply j conduits, thus. preventing the motors from being tripped.

I. The text should identify these areas of the cascades which are above atmospheric pressure and represent a potentially greater hazard than cascade sections below atmospheric pressure.

J. It is not clear why the booster compressors are designated as NS (not safety) because they perform a redundancy role to the two adjacent, Q designated compressor trip systems.

k. The text should explain why the trip capability from the PCF associated with enrichment cells in X-330 and X-333 are categorized as AQ; it would seem that their function is I necessary to protect the public during a facility evacuation.  ;

l i 14. 3.8.3.2/3.15.3.2 DC Power Distribution System:

j l a. The description should include a diagram identifying key components, locations, power f supply systems, control power supply etc. {

l ]

1 1

- - - -- 9

4 5

k A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less than 1E-6).

c. Numerical values should be included in the description of tne system, including current capacity, current required to trip breakers, reliability, monitors / controls on the system etc.
d. The rationale for this system not being NPH resistant is not clear, given its designation as Q and AQ (i.e., important to safety). Also, manual tripping of motors via the switchgear is likely to significantly increase response time in an event, and may result in an additional, larger source term. This time and its components (e.g., time to realize DC power out, time to get to switchgear [ distance and locks], time to find correct breaker) should be presented and discussed.
e. The text should explain and clearly define the Q and AQ portions of the system, and explain how one system can have multiple safety designations.
15. 3.8.3.3/ '.15.3.3 UF6 Primary System:
a. The description should include a diagram identifying key components, locations, pcwer supply systems, control power supply etc.
b. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its cafety function is incredible (less than 1E-6).
c. The text should clarify if there is any piping less than 2 inches in diameter, and, if it performs a confinement function, where it is discussed and its safety categorization.
d. The text should clarify the discussion on subatmospheric sections of the cascade as in leakage into a subatmospheric cascade may result in a retease, and the release may be of sufficient magnitude to impact at least the nearby workers (this has been shown for subatmospheric cylinders subsequently exposed to in leakage by the removal of the valve).
e. The text identifies components within the cascade that has a seismic capacity less than the 250 year return period earthquake. However, the text notes the pressure boundary is unlikely to be affected. This apparent contradiction should be explained.
16. 3.8.3.4/3.15 3.4 High Pressure Relief Systems:
a. The description should include a diagram identifying key components, locations, power supply systems, control power supply etc.
b. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less than 1E-6).
c. Numerical values should be provided for the system pressures and the relief valve / rupture disk settings. These should include normal pressure, MAWP, failure pressure (estimated), and relief set points.
d. A lock-out/ tag-out program should be identified for those re!ief valves / rupture disks that are separated from the coolant system by a manual block valve.
c. The description of the Freezer / sublimer systems contains several apparent i discrepancies that should be clarified. Also, a numerical analysis should be presented l showing the source term from potential events. l
f. The destination of the downstream pipir,3 from the relief devices should be identified (i.e., relief to the roof, to a scrubber).
17. 3.0.3.5/3.15.3.5 Freezer-Sublimers High-High Weight Trip System

l l

6 l a. The description should include a diagram identifying key components, locations, power l supply systems, control power supply etc.

l b. A numerical analysis should be included demonstrating that tbc probability of the (now mitigated) system not performing its safety function is incredible (less than 1E-6).

c. The number of these systems should be identified.
d. The total volume and weight of these systems should be identified.
18. 3.8.3.6/3.15.3.6 Motor Load Indicators:
a. The c'escription should include a diagram identifying key components, locations, power  !

supply systems, control power supp!y etc. j

b. A numerical analysis should be included demonstrating that the probability of the (now mitigated) system not performing its safety function is incredible (less than 1E-6).

I c. There should be a better explanation of the smmeter indications and the operator response to/ investigation of " inexplicable change."

d it would seem that the motor load indicators are essential for detecting and avoiding compressor surge events, precursors to releases producing offsite effects.

Consequently, the text should explain the basis for an "AO" designation instead of a "Q" designation.

1

19. 3.8.4.1/3.15.4.1 Pigtail I.ine Isolation System / Withdrawal Station isolation :
a. Operation with the automatic system out of service, surveillance, and manualisolation need to be explained in more detail, including how the assurance of timely initiation of isolation is accomplished. Also, the SARUP should discuss manual surveillance and operation, and the imoacts upon response times.
b. The text should explain the manualisolation capability from the perspective of operator protection during an event, as the text indicates only limited protection is provided by a door.
c. The independent operability of the isolation systems in the event of power and air failures should be explained in more detail. In particular, the testing of the isolation systems requires clarification - i.e., are they tested with the power / air on or off, and is the testing frequency adequate?

20, 3.8.4.2/3.15.4.2 Compressor f fotor Manual Trip System.

a. The text presents a qualitative safety function analysis; without numerical values, it is difficult to assess its adequacy. A more quantitative safety function analysis is recommended.
b. The text refers to reducing the need for UF6 cooling, without further explanation. This should be clarified, and any cooling system identified.
21. 3.8,4.5/3.15.4.5 UF6 Primary System:
a. The text should explain the statement, " Pressure reducing devices are used where the design of the UF6 primary system is not the same value as that encountered at the discharge of the compression source for the withdrawal piping," as thic implies the comp assors can over pressurize the system.
b. The text should explain how the distinction between primary system (piping) containing I

liquid hexafluoride (and categorized as Q) and primary system containing gaseous hexafluoride are maintained, it would seem that a failure of piping containing gaseous l

l

+- .

7

. hexafluoride but connected to a liquid source (e.g., the accumulator) might Fave a lower

release rate but a longer duration, giving a comparable source term as a failure of a L primary system section containing liquid hexafluoride. i
c. Please verify that the AQ sections of the withdrawal primary sysis a
e included in Table 3.8-2/3.15-2.

j I

22< 3.8.5.1/3.15.5.1 Autoclave Shell High Pressure Containment System: l a The analysis should provide more information and numerical values on the intermediate calculations supporting the conclusions of adequate temperature contrel and cylinder ullage space. This additionalinformation should show the entha!py calculations and

. assumed volumes of materials.

b. There should be an explanation for the use of high pressure steam (>250 F/15 psig) that h exceeds the pressure limit settings, and the reasons for not using a more passive

. system (steam <250 F/15 psig, or even steam with conditions be!ow the zero ullage temperature of the cylinder) included.' The text should also clarify the actual steam pressures used in the calculations (60 or 100 psig) and if intermediate pressures (say, in

the 15-100 or 15-60 psig ranges) represent a greater potential hazard because of a longer time period (for heating) prior to reaching the autoclave pressure limit of 15 psig.
c. A probability analysis should be presented to support the conclusion of meeting its safety function requirement.
'd. The text should clarify (by calculation) that a cylinder failure event does not result in L excessive pressures and leakage from the autoclave, due to the cylinder's pressure and L hydrolysis reactions.
e. The reliability of the pressure relief lines should be based upon probability calculations,  ;

and numerical values'provided.

f. . As noted in the text, the loss of power operability of the isolation valves and positive-I indications of position need to be established.

l 23, 3.8.5.2 Remote Transfer Isolation System:

l a. The calculations supporting the safety function analysis should be provided.

b. As noted in the text, continued operability of the pigtail /line isolation valves upon loss of air power needs to established. l
c. The text mentions "other deficiencies" - these should be described.

L 24. 3.8.5.3.2/3.15.5.3 Autoclave Primary Containment System (Sampling and Transfer -

, Facilities):

[ a. The description should include a diagram identifying key components.

l b. The valving and its arrangement should be explained.

l. c. The steam pressures should be' explained, including the basis for limiting it to 60 psig at Portsmouth. -The volume of steam should also be identified.

'd. The text should describe the autoclave in more detail, including the basis for the condensate level used in the analysis (i.e., does it correspond to the high limit) and the associated mass of water,

e. A calculation should be provided showing the expected pressure rise from the uranium hexafluoride/ water reaction.
f. The use of 90 psig test pressures for periodic leak testing should be explained given an autoclave pressure limit of 15 psig. Also, typical actual versus allowable leak rates k -

1 l:

8

(

l should be noted. A 12 SCFM allowable leak rate seems rather high and should be

[ explained.

g. A numerical analysis should be included demonstrating that the probability (now mitigated) of the system not performing its safety function is incredible (less than 1E-6).

1

25. 3.8.5.5/3.15.5.5 Autoclave High Condensate Level Cutoff System see question 8. I 1
26. 3.8.5.6 UF6 Cylinder High Pressure Steam Cutoff System see question 9.
27. 3.8.5.7 UF6 Cylinder High Temperature Cutoff System see question 10,
28. 3.8.5.8 Autoclave Locking Ring Interlock System see question 11.

l

29. 3.8.6.1/3.15.6.1 the cylinders are identified as either Q or AQ safety equipment, depending on the amount of hexafluoride they contain, with 500 lbs as the maximum quantity for an AQ cylinder (i.e., the 500 lb quantity provides a uranium uptake of 30 mg (the limit) at the site boundary). This calculation should be provided and discussed.

i

30. 3.8.6.2/3.15.6.2 liquid UF6 cranes and handling equipment are described. Quantitative values should be provided for earthquake and wind loading capacities of the components as compared to the limits. Also, the "small additional movement" due to swinging when the crane stops should be quantified and the crane path should be  !

verified for lack of an effect from a swinging load. The basis for testing should be '

provided (i.e., a probability / risk calculation, manufacturers recommendation, code).

Finally, as noted in the text, additional information should be provided on the seismic response of the railcars (PORTS).

31. 3.8.6.4/3.15.6.4 Cylinder Weighing System:
a. The discussion on the safety functions, functional requirements, and system evaluation should be more quantitfive, mentioning weights, accuracies, and demonstrating how the accuracies are adequate to avoid overfilled cylinders.
b. Since an overfilled cylinder could rupture once heated in an autoclave, and such a ruptured cylinder would have offsite effects, the text should explain and discuss why this system has an AQ instead of a Q designation.
32. 3.8.7.2/3.15.7.2 Fire Protection System:
a. The text should provide the basis for the sprinkler operating areas and the estimated, average sprinkler discharge densities and fire water flow rates.

l b. Based upon the analyses in Section 4, it would seem that a large fire could result in offsite consequences. Consequently, the text should explain why some areas are not categorized as Q systems. '

33. 3.8.7.4/3.15.7.5 the text should explain why the Public Warning System is categorized as an AQ instead of a O system.
34. 3.8.9.2/3.15.9.2 Building cranes:
a. Numerical values and results from the analysis should be provided, including frequency l

l l

9 numbers for movements and movements over parts of the cascades.

b.. Frequency numbers from industry should be used to demonstrate functionality for holding heavy loads during no power and activation events.

35. Tables 3.8-1/3.15-1 provides the boundary definitions for Q SSC's. As noted in the previous comments, consideration should be given to including additional items on the Q

.i list, such as portions of the fire systems, building confinement, ammeters / indicators, and block valves. Also, clarification should be provided for the exceptions listed in the table (primarily due to loss of power / air) as not all of these are captured in the text.

37. Tables 3.8 2/3.15-2 provides the boundary definitions for AQ SSC's.- As noted under the previous RAI, several items appear to reconsidered for the Q designation, including _

the public warning system. There are items on the list that do not appear to be mentioned elsewhere in the text - such as covers for the ports of removed equipment -

these should be described. Various power and air sources are required for several of the AQ systems to operate (e.g., criticality alarms); the text should clarify that these power and air sources are also AQ designated or that the safety system can function -

without them.

Chapter 4 General:

1. Qualitative Arguments instead of Quantitative Analyses The accident scenarios include a significant amount of qualitative discussion in the text, but l with few quantitative numbers to support some of the conclusions, such as frequencies and l bounding source terms. This contributes to uneven analyses in some areas. The SARUP l should include quantitative values for as many of the scenarios as possible, particularly for j the source terms and probabilities, and for the determination of bounding accidents. Use of j

^

quantitative analyses are a benefit to be able to determine if adequate safety if ensured and i a benefit for future 76.68 change reviews for unreviewed safety questions. l

2. Mitigated and Unmitigated Consequences The discussion of the accident scenarios mixes mitigated and unmitigated approaches,
particularly in the discussion on accident frequencies and the evaluation guideline bins. It is  !

recommended that the scenario development clearly focuses on unmitigated consequences first, before applying the effects of mitigation upon the scenario.

3. ' Operator Action Requirements A significant number of the accident scenarios require operator notification, interpretation,'

and action for avoidance or mitigation of accidents. The SARUP's are not clear on the human factors and time frames involved; some of the stated time periods seem optimistically short and it is not clear that the operator can be notified, and interpret and act  !

upon the information, and the equipment operate (e.g., valve closure or compressor motor

e 10 trip) in the needed time frames, particularly if the operator has multiple duties or if the event

occurs during break or shift-changing times that might divert attention or otherwise distract j the operator. The licensee should discuss human factors, training, conduct of operations, j etc. in more detail, and explain the interactions between the different control locations (e.g.,

LCR, ACR, main control room, outside panet) and the time frames.

4. Site Boundary and Distance to the Public l

l r in many parts of the SARUP's, the analyses use the site boundary, and this is usually over 1,000 meters away from the point of release. However, based upon the site maps, this site boundary is to the edge of the DOE property. The fence line is within the site, not at the site l l boundary. Thus, the licensee's controlled area (i.e., limit for public access) is significantly l closer, in some cases as close as 200 meters. Furthermore, these areas are frequented by the public; the perimeter road around Portsmouth routinely carries public traffic and hunters l use the wildlife areas around Paducah. Also, the distance to the public for consequence <

l evaluation appears to vary with the accident scenario; for example, cylinder yard events should have a significantly shorter distance to the public because of their proximity to the fence. Consequences should be given both for the site boundary and the fence line with i appropriate caveats for the accuracy of the plume models for the closer-in receptor points.

5. Source Term Truncation and Thermodynamic Limits The accident analyses do not always clearly state the material at risk, and, in some cases, appear to truncate the release even when there is material remaining. Sometimes, the thermodynamic properties of uranium hexafluoride are used to justify a termination point after the vapor pressure of the hexafluoride material falls below atmospheric pressure.

However, materials may continue to be released. The SARUP's should revise the analyses to include these additional amounts in the material at risk calculations.

6. Historical Data and Evaluation Basis Events (EBE)

The text cites historical plant data and experiences in several parts of the text, including the use of this data and experience for EBE. It is not clear how events that have occurred several times over the 40 year plus operational history of the GDP's can constitute EBE's (i.e., less than one in 100 year occurrence). Also, events are placed into the EBE category using qualitative arguments instead of a numerical estimate The SARUP's should clarify the bases for placement of events in the EBE category and use numerical estimates.

7. GDP Experience The GDP's have operated for over 40 years. While there have been events, the impacts and consequences of these events have been relatively benign. This may produce a

! certain complacency towards the analysis of potential accidents and events, and, in the SARUP's, some potential events and their consequences are downplayed or dismissed because of the operating history of the plant. It is recommended that events and their consequences be analyzed rigorously on an even basis, using historical experience for data purposes but not as a basis for dismissing or mitigating postulated events.

1 l

i l1

8. Chro,1 ology of Events ,

Several of the accident scenarios rely upon prompt operator action, which may be neither realistic nor conservative. Consequently, the sequence and chronology of these events should be clarified. For example, while valve closure times are mentioned, it is not clear that the other, preceding time periods (undetected release time, detection / location time, notification time, operator comprehension of the event, and operator reaction time) are adequately considered. Also, the text refers to the local, area, and central control rooms, without an explanation of the iiter-relationships and the human factor considerations; for example, an operator observing / monitoring just a few indicators / controls usually responds faster and more correctly than an operator observing / monitoring many controls.

Consideration should be given to the potential impacts of shift tumover and break periods.

A summary of the results from drills and training exercises may be useful for giving a lower bound for the operator time periods.

9. Frequency, Probability, and Operating Time The SARUP's group and compare the events based upon frequency, i.e. on a per year basis or with a return year period. It is not clear if the SARUP's consistently factor the number of components into the analyses. However, nuclear industry practice routinely uses probability over the operating period of the facility, which includes the effects of the number of components /SSC's and the operating time of the facility. These increase the probability to a larger value than the stated frequency. For example, an individual component might have a failure rate of 1E-5/yr, but if the number of these components is 2,000 (in operation) over an operating time period of 10 years, then the probability of failure is 0.2, and this becomes an anticipated event instead of an evaluation basis event.
10. Reasonably Conservative and Bounding The text uses a lot of different bases for its analyses. However, it appears that many of these correspond to normal operating conditions or bound conditions only 70-80% of the time, and do not represent "high" set points (i.e., the situation prior to a controller activation); potential examples include the withdrawal accumulators and the autoclave condensate systems, it is recommended that reasonably conservative, bounding j parameters are used for the analyses, and that the corresponding text explains the basis for I the conservatism.

Specific Comments /RAl's*

11. In Sections 4.2,4.3, and elsewhere, relief valves and rupture disks are mentioned as safety devices for avoiding overpressurization of vessels and compcnents. However, no  ;

l mention is made of the environment of the relief device itself, i.e., does it relieve through I a filter to a stack, does it exhaust into the operating area near workers etc.? The text ,

should discuss the relief device location and the potential effects of its activation upon i potential onsite and offsite accidents. I

12

12. - 4.3.2.1.1' Compressor failure - UF6/ Hot Metal Reaction:
a. The text notes compressor failure / reaction as an anticipated event (AE), but indicates I only a small percentage of compressor failure events result in the actual, metal reaction.

The text should also note compressor failure as an anticipated event, and provide numerical estimates of the two failure rates.

b. The source term for this event should be quantitatively defined - it is not intuitively  !

obvious that this is bounded by another source term, and a " hot metal reaction" seems

' to imply a different mechanism with potentially significant dispersive energy.

c. The text does not mention cellisolation. The text should clarify the presence or absence of isolating means for the failed compressor / cell.

, d. The time sequence should be clarified, including the location and response method / time of the UF6 release detection alarms.

f. The elevated point for building releases should be identified.
13. 4.3.2.1.2 Stage Control Valve Closure (Pressure increase):
a. This is listed as an AE event.
b. The source term for this event should be quantitatively defined - it is not intuitively obvious that this is bounded by another source term.
c. The text should describe the system better and include a diagram, as the location and arrangement of the instrument lines and valves are not obvious.  ;
d. The text does not mention cell isolation. The text should clarify the presence or . '

absence of isolating means for the failed cell.

e. The text notes no significant consequences beyond the immediate area are anticipated if the cell is in the off-stream mode; the impact on an operating, on-stream cell should be

. noted.

14. . 4.3.2.1.3 B-Stream Block Valve Closure:
a. The text should describe and explain the scenario better, including referencing a diagram, and explaining the AE and EBE portions of the scenario.
b. . The text should explain the control approach of the equipment better - are the compressor trips manually (by operators) or automatically (by controls) initiated, is the  ;

indication based upon cascade pressure, motor amps / load, other?

c. The time sequence of the scenario should be explained better, for both the unmitigated response and for the mitigated response (i.e., include the times for operator actions).
d. The analysis indicates approximately 90 seconds of the release will result in offsite

. uranium values exceeding 10 mg; the total length of the release should be identified and the distance of its effects offsite noted.  !

( e. The text should provide the calculational basis for a release rate of 130 lb/sec as gaseous UF6. )

f. . The text does not mention' cell isolation. The text should clarify the presence or absence of isolating means for the failed cell.
g. - This section' notes the EG (Evaluation Guideline) is likely to be met because no failures I

have occurred from this transient. Numerical analysis should be provided to support this statement.

4

15. - 4.3.2.1.4 Limited UF6 Release to Atmosphere:

a; This is listed as an AE event - numericaljustification should be provided.

4

13

b. No description of the sr.,enario is provided - such a description should be included, along with a schematic / diagram.
c. This event is stated to be the most limiting primary system failure for the AE category, but no numerical estimates are given. At a minimum, source terms should be quantified for this scenario.
d. The scenario should estimate the impact of in leakage, and demonstrate that its effect is relatively smell.
e. The text states the primary concern as controlling the release, yet it only mentions building holdup and evacuation (sce and flee). Other control mechanisms should be mentioned and discussed, such as compressor tripping, cell isolation, valve closure etc.
16. 4.3.2.1.5 Evacuation of Cascade Process Buildings (external events):
a. This is listed as an AE event - numericaljustification should be provided.
b. No source term is previded; a source term should be estimated for the various possibilities on page 4.3-53, along with process parameters (e.g., pressures).
c. It would seem that evacuation could be the first step in an accident scenario. This, the subsequent steps, and their conseqt 9es should be discussed and described more fully in the text. -
d. The motor load indicators, compressor trips, and various control rooms should be described and discussed in more detcil. Also, the "certain compressors" without indication or trip control in the primary control facility (PCF) should be specifically identified and the potential ramifications for accident sequences discussed.
17. 4.3.2.1.6 Coolant Tube Rupture into Primary System:
a. This event is listed as an AE event based upon operational history - the text should provide more quantitative values for the number / frequency of events and observed parameters (e.g., pressure transients, failures, and releases).
b. A better description should be provided, with a schematic.
c. For the on-stream raode cell, it is not clear that expansion of the coolant will not have significant preannzation effects for the cell with the leaking coolant and several adjacent cells (based on flow), as the many system compenents (e.g., compressors, barriers, valves) and potentially choking flow conditions will produce significant localized pressurization effects before accommodation by the entire cascade. A quantitative analysis should be performed.
d. For the off-stream cell, numerical values should be provided to support the threshold consequence analysis conclucion of no offsite consequences. The total release of 11,000 lbs seems comparable to other accident scenarios with offsite consequences (e.g., B stream block valve closure event).
e. The average release rate of 73 lb/sec should be explained better, with the calculation and its basis provided.
f. The potential effects of the pressure transient (presumably starting at circa 200 psia) on the other components in the cell and the isolation valves (if off-stream), and of the loss of coolant / cooling of other cells (presumably on-stream, but on the same coolant circuit) should be described and presented, with numerical values.
g. Detection and mitigating methods should be presented and discussed. Presumably, there are indicators on the coolant circuits for leaks and failures, and there should be isolation valves that can be activated'.

14

h. The ted *uld discuss any toxic or adverse effects from the coolant, such as anoxia, that may impede operator actions.
l. In your April 21,1998 response to NRC letter 2/25/98 question 6, the rupture disc was identified as not an active SSC. Rupture disc and relief valves serve the same purposes of preventing overpressure events from damaging the primary system. Relief valves are active systems and the rupture disc has a protective function it must serve by mechanically yielding. As such the TSR should remain.
18. 4.3.2.1.2.7 Large Release of UF6 to Atmosphere:
a. This is listed as an EBE, although the two potentialinitiating events are listed as AE.

This apparent contradiction should be explained. Cascade operating experience is stated as a basis for the iow frequency of an AE progressing toine point of a large release. This should also be explained, using specific operational history examples.

b. The basis for the hole size, release rate, and release quantity should be explained.
c. The text should explain the use of MELCOR, particularly with respect to the UF6 reactions and the basis for all of the material to have reacted by the time it leaves the building. Fundamentally, is there sufficient water in the building air to react 62,400 lbs of UFS? I
d. The text needs to explain the ventilation parameters and buoyancy effects better. It is not clear how there can be significant releases of a dense gas via roof vents when the predominant air flow appears to be exhaust through the MED's. Also, the recirculation via building intakes is not clear, as exhaust and intakes are usually on opposite sides of thn building.
e. The text notes that U and HF guidelines are exceeded beyond the site boundary.
f. Concentrations should also be checked at the point of closest public approach, either the fence line or the perimeter road.
g. The text should explain how evacuation of the buildings would be effective with a large release like this.
h. The text does not describe prevention or mitigation methods to protect the public and the workers.
19. 4.3.2.1.8 Heavy Equipment Drop:
a. This is stated to be an EBE because of the different controis required to detect uranium releases; such a statement is confusing. It is recommended that the CARUP is revised to include a probability analysis based upon number of mewments and industry (or site) values for dropped loads.
b. Potential source terms should be quantified for the analyses.
c. Part of the discussion indicates release rates exceeding the "large UF6 release to atmosphere" event, while another part indicates this event is bounded by the large UF6 event; this apparent discrepancy should be corrected.
d. Preventive and mitigative measures need to be quantified.
20. 4.3.2.1.9 Large Fire (external event):
a. The text statec a large amount of lubricating oil is present in the process buildings; the actual amounts should be quantified (some estimates are in the hundreds of thousands of gal!ons).
b. The corresponding fire protection and suppression systems should also be discussed,

l l

. 1 15

. i

, vis-a-vis their potential for mitigating fires and potential uranium releases. l

c. A quantitative analysis should be presented to support this as an EBE, as several fire scenarios seem possible, and some may be in the AE category.
d. A diagram of the lube oil system and potential fire areas should be presented and discussed, and potential hexafluoride inventories at risk identified.
e. The text notes the entire cascade inventory (including freezer-sublimers) is considered to be at risk, but the accident is not analyzed - only an analogy to a cylinder fire is used.

Given the much larger inventory of the cascade, it is recommended that the actual fire scenario (s) is (are) analyzed. This may identify uranium and HF values for the public exceeding the evaluation guidelines.

f. The analysis notes a buoyant plume results from the fire, which raises the accident plume abovc the ground. The analyses shou;d also check if, upon cooling, any downwin 1 concentrations exceed the guidelines from the plume retuming to the ground.
21. 4.3.2.2.1 Compressor Failure (Handling / Storage Facilities):
a. A diagram of the system (s) should be included.
b. The text notes compressor failure / reaction as an anticipated event (AE), but indicates

, only a small percentage of compressor failure events result in the actual, metal reaction.

The text should also note compressor failure as an anticipated event, and provide numerical estimates of the two failure rates.

c. The source term for this event should be quantitatively defined - it is not intuitively obvious that this is bounded by another source term, and a " hot metal reaction" seems i to imply a different mechanism with potentially significant dispersive energy.
d. The text should explain the use of the "see and flee" policy as the first line of response -

it would seem automatic detection and compressor tripping would oe first, immediately followed by isolation valve closing on the affected cell (s), tripping of any booster compressors, enhanced ventilation etc.

e. The text does not mention cell isolation. The text should clarify the presence or absence of isolating means for the failed compressor / cell.
f. The time sequence should be clarified, including the location and response method / time of the UF6 release detection alarms.
g. The nature of the emergency response by site personnel should be described.
h. The elevated point for building releases should be identified.
l. The text states, " . due to differences in equipment configuration, the source term . . is assumed to be similar to the source term developed for a process line failure at a compression discharge scenario." The text should explain the apparent contradiction within this statement.

J. The text should clarify the discussion about the height differences between the compressor, condenser, and accumulator, and the basis for the 1.31 (gaseous) and 6.73 (liquid) [lbs/sec) hexafluoride releases.

k. The discussion about the accumulators should be improved, and a diagram included. It
is not clear if the 5 x 10 ft tank exists or is just a modeling simplification. Also, the text

! should indicate the total quantity of liquid uranium hexafluoride (possible and capacity) in the accumulators (it appears to be around 45,000 lbs).

l. The text should clarify the basis for the consequence analysis - does this correspond to all of the hexafluoride in this part of the system? Does the release terminate at 30 minutes or does it continue? Have all enthalpy effects been considered? Can a partially l

l l

l

. l 16 filled cylinder contribute to the release? (The release of 30 minutes corresponds to about 14,000 lbs, while the source of hexafluoride is stated as 21,000 lbs, and may even be 45,000 lbs.)

m. The consequence analysis states 9.8 mg U at 1,000 meters. This is essentidly the AE guideline, and, with the potential of a larger inventory / source term, the text should explain if the AE limit is being exceeded (i.e.., should this be a Q SSC).  ;
n. The text should note if there are valves that can be used to isolate the leak and terminate the release.
o. Any automatic mitigating features should be identified before the "see and flee" evacuation.
p. : The text should note the existence of any hexaflucvide detectors.
22. 4.3.2.2.2 Autoclave Steam Control Valve Fa2s Open:
a. The text should include a calculation or a historical basis for the failure frequency in l

order to justify the C' (anticipated event) categorization.

l~ _ b. A diagram of the autoclave system should be included with the text, and limits and controls identified. The valves should also be noted.

l l c. The steam temperature (s) should be presented; the text should also discuss if a steam l . temperature limit can be applied, i.e., a maximum steam temperature of 235 F (the limit l for the 48G cylinder - it is steam temperature, not pressure, that can adversely affect the

! cylinder).

d. The heating situation should be explained in more detail as it is not clear what the controls are that would avoid a 48G being heated to temperatures corresponding to Type A cylinders, which could rupture the 48G cylinder,
e. The text should provide the calculational basis behind Figure 4.3-16 (the steam temperature transient) and the response and reliability of the autoclave high pressure -

shutdown system.

f. - The source term should be identified (presumably, this is the material in one cylinder --

L 14 tonnes). .

g. The text should perform a probability analysis on the autoclave to justify this as an incredible ' accident, requiring no further analysis. If not, the consequences of the accident should be numerically estimated, and the Q/AQ determination made based upon the result.
23. 4.3.2.2.3 Releases of Solid / Gaseous UF6 to Atmosphere: j
a. This is identified as an AE event - a calculational or a historical basis for probabilities  !

should be used to justify this designation.

b. The source term analysis mentions 63 pounds of hexafluoride vapor. It states there is

]

i sufficient sensible heat to vaporize another 700 lbs of hexafluoride; however, it states _

that the heat is lost through the metal cylinder wall even though the solid UF6 has a low I thermal conductivity (i.e., low liest transfer). The apparent contradiction should be j J verified, as it would appear that a significant fraction of the 700 lbs should be included in j the source term analysis. ]

c. The source term calculation for the cylinder at ambient conditions should explain the -  !

calculation; in particular, the HF value seems low.

d. The text indicates no dispersion analyses were performed for this event. Thus, how can it be stated that EG's are satisfied. Consequently, the text should state.the i'

I 17 consequence of the release for the worker and clearly show that consequences would

! not be exceeded at the closest location of public access.

24. 4.3.2.2.4 Evacuation of the UF6 Handling and Storage Facilities: i
a. This is listed as an AE event - a calculation or historical basis should be provided for  !

such a designation. l

, b. Evacuation is usually a precursor to subsequer t events (or potential events) in an 1 l accident scenario. These should be presented and discussed. For example, evacuation for a fire could result in significant damage and releases. Also, the equipment may drift into an unsafe operating regime during an evacuation event - this should be discussed.

c. The text indicates no source term for the event, based upon the objective of the j analysis, and further states that source term analysis is not app!icable to this event. It )

would seem that significant source terms exist if full cylinders and liquid UF6 are involved. Also, offsite consequences may result from liquid filled cylinders and other l sources, it is recommended that source terms are numerically estimated.

d. The text should identify any remote or automatic controls, particularly if the evacuation )

period is extended. '

c. The April 21,1998 response to the NRC February 25,1998 letter question 7 pointed out that Paducah did not take credit for a four hour evacuation time. Rather it relies on the UF6 release detection system and remote shutdowns in the ACR or CMR. However, no explanation is given about the effects of the cause of the evacuation has on these facilities and their ability to shut down the autoclaves. In that same response, the transients mentioned indicate an initiating event that results in a UF6 release within the autoclave. One such scenario is analyzed in 4.3.2.2.2 in which it is stated that it is an incredib;e event and no consequence analysis is not necessary. That is inconsistent.

From the differences between Paducah and Portsmouth it would appear that this scenario is trying to address a UFS release in the building after an evacuation. The leak would have to be outside the autoclave or the autoclave containment isolation protective features would have isolated the autoclave and the release would have been terminated. Such a leak would be in the UF6 feed piping where Paducah is taking credit for its UF6 leak detection system and remote shutdown while Portsmouth does not.

Provide further clarification on the Paducah scenario about the habitability of the ACR and OMR and in both scenarios, the magnitude of the expected release and consequences and why Portsmouth does not take credit for its leak detection and remote shutdown system.

d. The withdrawal systems should be described in more detail, particularly from the perspective of operability during a prolonged evacuation event. For example, it is not clear how nperations can continue if there is limited monitoring capability and automatic controls. Also, line withdrawal position operation vis-a-vis a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, maximum period for compressor operation seems contradictory.
15. 4.3.2.2.5 Limited UF6 Release to Atmosphere:
a. This is listed as an AE event - a calculation or historical basis should be provided for such a designation.
b. The scenario should be described, including referencing a diagram of the facility. It is not obvious that a line or joint failure constitutes a small event / release of material.

18

c. The text should describe the emergency response by local personnel, and how this r response maintains the limits within the evaluation guidelines.

i d. The source term is not defined, but is stated to result in very small UF6 release rates. A quantitative analysis and description of the source term (both release rates and total quantities) should be included.

! e. The text states, "Since the exact release mechanism is not defined . . no essential l

actions are required of operational personnel . " This should be clarified, as it would seem some actions would be performed (e.g., valve closure, isolation etc.).

16. 4.3.2.2.6 Heating of a Cylinder with Excessive UF6:
a. The text notes this as an EBE because it can only occur as the result of multiple operator errors. Such a rationale is ambiguous; a calculation or historical basis should be provided. (it should be noted that an overfilled cylinder rupture event has occurred in the past 15 years.)
b. The text should explain the concerns with an overfilled cylinder clearly. For example, it is not clear that a pressure control system will be effective if the materialliquefiea ..nd j expands at relatively low temperatures and hydraulically ruptures the cylinder.

l- c. Cold-feeding of a cylinder should be described.

d. The source term should be determined as it is not clear how an overfilled cylinder event i is bounded by a regular (not overfilled) cylinder accident.
17. 4.3.2.2.7 Heating of a Cylinder with Excessive Noncondensibles:
a. The text notes this as an EBE because it can only occur as the resuit of mu!tiple operator errors. Such a rationale is ambiguous; a calculation or historical basis should l

! be provided. I I

! b. Burping and cold-burping should be explained.

c. The conct rns with the accelerated cooling process used for the " Russian Cylinders" should be explained, along with the methods to avoid confusion between these cylinders l and the ones with excessive noncondensibles.
d. The text should explain t.".e mechanism / scenario by which a cylinder with excessive i non ,ondensibles undergoes hydraulic rupture.  !
e. The text should estimate the source term; it is not clear that this event is bounded by the  !

l cylinder in autoclave event.

l 18. 4.3.2.2.8 Heavy Equipment Drop!

l a. The aiTangement of the withdrawal equipment should te desenbad vis-a-vis the loads

! and the crane routes (both typical and potential). Diagrams would be beneficial.

b. There should be a numerical basis (inventory, source term etc.) for t!ating this is bounded or included in other scenarios.
c. The text should note if multiple failures are possib!e (e.g., one cylinder dropped on another). j l

i l 19. 4.3.2.2.9 Heating a Damaged Cylinder:

a. The text notes this as an EBE because it can only occw as the result of multiple operator errors. Such a rationale is ambiguous; a calculation or histoiical basis should be provided.
b. The inspection program, its methods, and criteria should be described; as currently l

. l l ** j 19 l presented, inspection is only visual, looking for obvious damage and leakage, and it is I not clear how substandard cylinders or cylinders with non-visual flaws (e.g., thinned walls or interior cracks) would be detected and not placed in the autoclave.

c. The text should explain the failure mechanism (s)in more detail, along with a numerical estimate of the source term. For example, a cylinder that has hidden damage or flaws may fail in a manner that is different from and has greater dispersive energy (and -

potential missiles) than " normal" failure. Then, the SARUP should indicate if this is bounded by another, similar event or if it requires a complete consequence analysis.

20. 4.3.2.2.10 Pigtail /Line Failure Outside Autoclave:
a. The text notes this as an EBE because it can only occur as the result of multiple operator errors. Such a rationale is ambiguous; a calculation or historical basis should be provided. Given that these events have happened in the past, it would appear this l should be categorized as AE.
b. The text should clarify the different autoclave systems and scenarios.
c. The source terms should be developed numerically for each scenario, and then decisions made regarding bounding accidents,
d. The text should explain the statement, " . there are no systems available that would  ;

isolate the cylinder should a failure of the pigtail occur ..." / .re there any mitigating  !

features in the area to reduce the consequences of the event? l

e. The external pining / tie-line failure would seem to belong to a separate category of l events. l
f. The Toll facility should be described in more detail, includiis a schematic, identification  !

of isolation valves / systems / methods, and exposed piping. Th 3 text should note if two pared cylinders can be attached and feeding at the same time (i.e., for blending enr.' nmants).

g. The text should note any residual heating means or other sources of potentially dispersive energy.
h. The bases for the time periods and operator actions need to be presented and discussed in more depth.
1. The 45 second release indicates effects above the EG's out to several hundred meters; the text should indicate if this impacts the perimeter road around the facility.

J. The longer release (30 minutes) results in estimated impacts out to 3 miles. Means to prvent and mitigate this accident should be described, along with a numerical analysis to support their effectiveness.

k. The text shoulo describe and explain the remote transfer and feed isolation systems, their efficacy, and the time periods involved. The "manualisolation to terminate release" should also be explained.
l. The " shelter in place or take cover" instructions for workers should be explained -is the shelter place equipped with a self-contained or isolated air supply for the duration of the event?
21. 4.3.2.2.11 Pigtail /Line Failure at the Withdrawai Station:
a. The text notes this as an EBE because it can only occur as tl.e result of multiple operator errors. Such a ration 51e is ambiguous; a calculation or historical basis should be provided.
b. The text should explain the basis for the assumed times in the source term anal) sis, and

1 20 state the actual source term.

c. A description of the system should be provided, and the isolation system (s) identified.  ;
22. 4.3.2.2.12 Process Line Failure at Compression Discharge:  ;
a. The numerical calculations or historical basis for an EBE designation should be I provided.
b. The basis for the release rates and the source terms should be provided - the accumulator is modeled as a vessel witn a circa 40,000 UF6 capacity, while the accumulator pairs total somewhere around 24,400 lbs maximum capacity.
c. A description and explanation should be included for the system and the control rooms. ,

in particular, the time frames for operator actions should be presented.  !

d. The text should clarify if the uranium uptake includes the effect of the material (inventory) continually leaking from the condenser and accumulator, which would seem ,

to increase the source term considerably and produce offsite effects. j l

23. 4.3.2.2.13 Pigtail Failure Inside Autoclave:
a. The text notes this as an EBE because it can only occur as the result of multiple operator errors. Such a rationale is ambiguous; a calculation or historical basis should l be provided.
b. The source terms should be given numerical values to support the accident being

- bounded by another event.

c. The tex'should note the bounding event, and, by implication, this event, have public ,

consequences.

24. 4.3.2.2.14 Cylinder Failure Inside Autoclave: )
a. The text notes this is an EBE based upon autoclave and administrative controls. A calculation or a historical basis should be provided and a numerical value determined to support this designation.
b. The text states the event is bounded by a pigtail /line failure event discussed on pages 4.3-94 et seq. It is not clear how an internal autoclave event is bounded by a line failure  ;

event external to the autoclave. This needs to be clarified.

c. Calculations should be performed and a numerical basis presented for the source term and its discussion. For example, the pressure rise in the autoclave should be presented and shown to be lower than the MAWP of the autoclave.
25. 4.3.2.2.15 Cylinder Failure Outside Autoclave:
a. The text notes this is an EBE even though this event has occurred at Portsmouth; improved training and inspection are cited. The text should support this designation with a numerical calculation.
b. The text states an administrative control prohibiting lifting a cylinder or similar weight load over a cylinder containing liquid UF6. The reported, historical, cylinder accident at Portsmouth corresponds to a drop of only 9 inches, implying some limits on weight and height of drop beyond a "similar weight load" statement may be appropriate. If possible, this should be quantified.
c. The basis for the 5 minute release duration should be presented and discussed.
d. The analysis indicates significant uranium releases offsite exceeding evaluation guidelines. The text should explain the contingency actions in the Emergency Plan that

} .

s 21 can be taken to minimize public exposure. The text should also identify any mitigative items and actions to control and reduce the impact to the public.

26. 4.3.2.2.16 Large Fire:
a. Numericalinformation should be provided on the feed and toll transfer facilities to show that they do not contain significant quantities of flammable and cornbustible materials.

Also, their fire suppression system should be described.

b. The time basis for operator response to a fire in the cylinder yards should be provided.
c. The text should explain the basis for only one cylinder. While most transfers are one cylinder at a time, the different yards contain hundreds of cylinders in close proximity to l the transfer vehicle. Hence, it would seem reasonable to expect several- perhaps two or three - cylinders (and their inventories) to be involved.
d. The text considers this an EBE - a numerical analysis should be provided to support this )

i designation, using site or industry data on transfers, collisions, fires etc.

e. The source term analysis indicates large fuel tanks on the trucks, with capacities of 450 gallons of diesel fuel. It also notes that there are large, unspecified quantities of hydraulic fluid on some of the vehicles. The text should compare these values to the 74 gallon fuel limit in the LES EIS.
f. It is not clear why the 400,4,000, and 8,000 lb quantities of liquid UF6 were used to generate a correlation for uranium exposure and distance; this should be explained.

The validity of the equation for 28,000 lbs (and higher multiples) needs to be substantiated. Also, the ground level effects are including the ' mitigation" provided by the buoyant plume. The results should be checked for when the plume cools and recontacts the ground. Finally, the 845 m distance calculated for the 28,000 lb release wou!d seem to include the perimeter road and other public areas. Thus, it would seem the offsite EG's for this event have been exceeded.

g. The text should note that a vehicle containing 450 galle of fuel has a sufficient combustible inventory to rupture 5 cylinders, for a rela. a approaching 140,000 lbs.
h. The text should note if there are any mitigation features that could actively reduce the source term, such as local fogging heads temporarily setup in the areas of the yards with machine operations, having the fire department stand by etc.
1. The text should note any fuel limits on the vehicles working in the cylinder yards.
j. Potential effects of other external events (e.g., plane or truck crash) are not considered  ;

and evaluated. j l

27. 4.3.2.3 Large Fire (Waste and Support Facihties):
a. The text considers this an EBE - a numerical analysis sl:ould be provided to support such a designation.
b. The facilities should be listed and described, and schemath.s included as appropriate.
c. The controls and inspection / verification / surveillance measures should be identified and described.
d. The source term development does not have a specific source term identified for these l facilities, but identifies a release of toxic material as having potentially significant onsite l l impact. Such a conclusion is not supported arid needs to be explained, with l identification of inventories and source terms, and the toxic materials involved. A l numerical consequence analysis should be performed.

l

lo .

l 22 4

28. 4.3.2.5.2 High Wind events are discussed. It would seem that X-326 has a significant quantity of uranium (17,000 lbs in equipment and unspecified, additional amounts of liquid hexafluoride in a withdrawal station). The text should explain this in more detail, I with analyses. For the Tie-Line situation, the source term should be numerically developed to show it's smaller than other cases. Also, X-326 and X-343 analyses should consider the scenario of two or more cylinders involved in the wind-caused collapse. Finally, storms with strong winds capable of affecting these structures tend to be intermittent, with gusts, particularly with tornados. Thus, without supporting analysis, it is inappropriate to use a C4 stability class and dismiss offsite consequences.
29. 4.3.2.2.5.5 earthquakes are discussed:
a. As noted previously, the analyses use an earthquake magnitude limit based upon a 250 year return period. At this level, relatively few SSC's fail. However, the analysis does i not appear to include failure of the joins / elbows which are not qualified for this seismic level. Such failures could include 26 additional release points. Obviously, this should be included.
b. The analyzed releases do not appear to include the maximum, potentialinventories of the accumulators, and it is not clear if the accumulators have been analyzed for the liquid filled condition.
c. There is the potential for liquid filled cylinders in these facilities. It is not clear if such cylinders and potentially seismic induced failures have been considered, for example, while they are cooling on carts / racks /railcars, or being moved by the cranes.
d. The evaluation notes that a small number of components (e.g., cranes, carts, and autoclaves) haw a structuralintegrity less than the 250 year earthquake, but their impacts were not evaluated. The analysis should include these potential impacts.
e. Earthquakes are often initiators of other events, such as fires. The text should state if the oil, freon, and water systems are designed to survive the earthquake scenarios, and,
in the event of a failure, what their contributing effect to the accident scenario would be.

For example, the lube oil analysis on page 4.3-141 is incomplete as the water will be ineffective for putting out a large oil-based fire.

f. Numbers or calculations should be provided for the criticality scenario initiated by a seismic event and water line break, as presented on page 4.3-140.
g. The text should note.if there are any SSC's that can mitigate the releases and should be seismically qualified.

b The text should verify that there are no impacts to the public after redoing these a ,alyses.

30. 4.3.2.6 Criticality Events:
a. It is not clear that the three criticality scenarios considered and analyzed adequately encompass potential criticality events at the facility; for example, it would seem that a liquid filled, product cylinder leaking or failing in an autoclave might provide a greater consequence from an accidental criticality event than the situations presented.
b. Also, the potential quantity of anriched material available usually affects the number of fissions in the criticality calculation -i.e., more mass, more fissions and a longer duration. There is a similar effect from the enrichment level. The SARUP should clearly state the basis for the presented scenarios adequately bounding the number of fissions from potential events.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - - _ _ - - . .__ _ _ _ - _ - . - _ _ _ .

Retrieved from "https://kanterella.com/w/index.php?title=ML20248F422&oldid=3216285"