ML21286A230
| ML21286A230 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 10/04/2021 |
| From: | Tennessee Valley Authority |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML21286A574 | List:
|
| References | |
| Download: ML21286A230 (57) | |
Text
BFN-16 APPENDIX I IDENTIFICATION-RESOLUTION OF CONSTRUCTION PERMIT CONCERNS I.1
SUMMARY
DESCRIPTION The content of this appendix is identical to what appeared as Appendix I in the Final Safety Analysis Report originally submitted as supporting information to the application for the operating license for Browns Ferry and amended through Amendment 66. Consequently the wording may indicate several items of concern on the part of the application reviewers to not be completely resolved. However, in view of the fact that licenses were issued authorizing full power operation of each of the three units of the Browns Ferry Nuclear Plant it is to be understood that all such open items of concern were subsequently resolved. This appendix is retained in the FSAR to provide for the preservation of historical records. A page of references is included at the end of Appendix I; the documents listed there are referenced by superscript numbers appearing throughout the Appendix I text.
The design of the General Electric boiling water reactor for this station is based upon proven technological concepts developed during the development, design, and operation of numerous similar reactors. The AEC regulatory staff, in reviewing the Browns Ferry dockets at the Construction Permit stage, identified several areas where further R&D efforts were required to more definitely assure safe operation of this station. Also, both the AEC Staff and Advisory Committee on Reactor Safeguards have, in their review of more recent reactor projects, identified several additional technical areas for which further detailed support information should be obtained. All of these development efforts, thus, are of three general types: (a) those which pertain to the broad category of water-cooled reactors, (b) those which pertain specifically to boiling water reactors, and (c) those which have been noted particularly for a facility during the construction permit licensing activities by the AEC Staff and ACRS reviews.
The following discussion is a complete, comprehensive examination of each of these concern areas indicating the planned or accomplished resolution. The discussion has been subdivided as follows:
- a. Areas specified in the Browns Ferry AEC-ACRS construction permit reports.
- b. Areas specified in the Browns Ferry AEC staff construction permit safety evaluation reports.
- c. Areas specified in other related AEC-ACRS construction permit and operating license reports.
I.0-1
BFN-16
- d. Areas specified in other somewhat related AEC-STAFF construction and operating license safety evaluation reports.
The scope of many of the areas of technology for items in a, b, and c above is discussed in detail as part of an official response1 by General Electric to the various ACRS concern subjects.
I.2 AREAS SPECIFIED IN THE BROWNS FERRY AEC-ACRS CONSTRUCTION PERMIT REPORTS I.2.1 Introduction "At its eighty-third meeting, March 9-11, 1967, the Advisory Committee on Reactor Safeguards completed its review of the application of the Tennessee Valley Authority for authorization to construct Browns Ferry Nuclear Power Station Units No. 1 and No. 2. This project was previously considered at the eight-first and eighty-second meetings of the Committee, January 12-14, 1967, and February 9-11, 1967, respectively, at a special meeting on February 28, 1967, and at subcommittee meetings on November 26, 1966, January 4-5, and January 28, 1967. Representatives of the Committee visited the site on February 27, 1967.
During its review, the Committee had the benefit of discussions with representatives of the Tennessee Valley Authority, General Electric Company, and the AEC Regulatory Staff." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260) "At its ninety-seventh meeting, May 9-11, 1968, the Advisory Committee on Reactor Safeguards completed its review of the application by the Tennessee Valley Authority for authorization to construct Browns Ferry Nuclear Power Station Unit 3. The project was previously considered at an ACRS Subcommittee meeting on May 7, 1968. During its review, the Committee had the benefit of discussions with representatives of the Tennessee Valley Authority, General Electric Company, and the AEC Regulatory Staff and its consultants."
(Browns Ferry Unit 3, ACRS Letter, 5/15/68, AEC Docket No. 50-296)
The ACRS concern findings of these meetings are tabulated below.
I.2.2 Effects of Fuel Failure on CSCS Performance Concern "Analysis indicates that a large fraction of the reactor fuel elements may be expected to fail in certain loss-of-coolant accidents. The applicant states that the principal mode of failure is expected to be by localized perforation of the clad, and that damage within the fuel assembly of such nature or extent as to interfere with heat I.0-2
BFN-16 removal sufficiently to cause clad melting would not occur. The Committee believes that additional evidence, both analytical and experimental, is needed and should be obtained to demonstrate that this model is adequately conservative for this power density and fuel burnup proposed." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket No. 50-529 and 50-260)
Resolution The proposed experimental investigation program of fuel failure mode is presented in GE Topical Report submitted to the AEC April 1968. The objective of this test program is to demonstrate the ability of the CSCS to prevent fuel cladding melting as a result of perforation and swelling in the cladding under the combination of temperature and internal pressure which prevail from the preaccident fuel performance. The general plan of action is to simulate as closely as possible all of the significant aspects of the problem in out-of-pile tests, starting with single-rod tests, expanding to multirod Zircaloy-clad simulated fuel assembly tests in air and under emergency core cooling conditions, and culminating with fullsize assembly tests. This general plan is supplemented by individual phenomenon tests as might be required to corroborate specific points of the experiment or related analysis work.
Fuel clad perforation will occur when the gas pressure within the fuel rod exceeds the pressure the clad can withstand for that particular clad temperature. The mode of this failure is known. The perforation will be local in that a given fuel rod will perforate at a particular location, the extent of which will be random in that it will occur at a particular, even a very slight, weak point along the fuel rod length--probably at a point of clad flaw, pellet oversize or pellet chip, or point of slightly increased clad oxidation. Such weak points will be randomly distributed.
However, the location of failures will be clustered about the point where peak heat flux is located, probably in a two- or three-foot region.
The position that the perforation will be random and local has been supported by experiments observed on failed irradiated fuel.2 It has also been demonstrated in test loops by placing single Zircaloy tubes containing UO2 pellets with internal pressurization in an electric induction heating facility and observing the failure mode.
The observed failures in this single rod test were always localized, of the order of one inch in the axial direction and random along the length of the heated rod.
Furthermore, the analysis of the perforation test results showed good agreement of clad stress at failure with ultimate stress at failure temperature. Additional research and development testing has been performed with a nine-rod section consisting of nine Zircaloy tubes with internal pressurization. These rods were heated internally by electrical means. The observed failures were again localized and did not block the flow passage enough to preclude effective cooling.
I.0-3
BFN-16 Since the fuel perforation will have the characteristics identified above, the overall geometry of the 49 rod fuel bundles which are 12-feet long will essentially remain the same and analytical investigation based upon the preceding experimental observations indicate that the emergency core cooling function by either reactor core spray cooling or core flooding would not be adversely affected. A full-length, internally-pressurized, nine-rod Zircaloy clad heater assembly was tested under postulated design basis loss-of-coolant conditions with core spray cooling. A full-scale Zircaloy clad heater bundle with collars welded to the cladding to simulate actual perforations has been tested in both spray and flooding cooling modes. Also, a single full-scale test was conducted with internally-pressurized Zircaloy clad heater rods to approximate as closely as possible a postulated design basis loss-of-coolant accident in terms of heatup perforations and spray cooling.
The test program results have been submitted to the AEC as a GE Topical Report.2 I.2.3 Effects of Fuel Bundle Flow Blockage Concern "The applicant considers the possibility of melting and subsequent disintegration of a portion of fuel assembly, by inlet coolant orifice blockage or by other means, to be remote. However, the resulting effects in terms of fission product release, local high pressure production, and possible initiation of failure in adjacent fuel elements are not well known. Information should be developed to show that such an incident will not lead to unacceptable conditions." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)
Resolution The outline for the resolution of the above concern item is presented in a GE Topical Report1 submitted to the AEC in April 1968.
Experience with fuel performance in operating reactors similar in design to this station, together with appropriate core mechanical analysis, has indicated that flow blockage during normal operation could only be local in nature and could not propagate to the extent that the remainder of the reactor core would be affected.
Calculation of hydraulic forces under flow blockage condition had indicated that the fuel channels would remain intact.
Analytical study of data derived from experimental work with induced melting of UO2 at Argonne National Laboratory and Oak Ridge National Laboratory has indicated that melting of a portion of fuel assembly would not lead to unacceptable results in I.0-4
BFN-16 terms of fission product release, local high pressure production or initiation of failure in adjacent assemblies.
The nature of potential flow blockages is being examined and analyses are being performed to determine possible sequence of events and consequences. From these analyses an experimental program will proceed with test conditions approximating those from analysis as closely as possible. The experimental measurements will be used in conjunction with an analytical model to apply the results to the reactor situation or the results will be used directly to show that a safety concern does not exist.
The test program results have been submitted to the AEC as a GE Topical Report NEDO-10174, "Consequences of Postulated Flow Blockage Incident in a Boiling Water Reactor," July 1970.
I.2.4 Verification of Fuel Damage Limit Criterion Concern "A linear heat generation rate of 28 kW/ft is used by the applicant as a fuel element damage limit. Experimental verification of this criterion is incomplete, and the applicant plans to conduct additional tests. The Committee recommends that such tests include heat generation rates in excess of those calculated for the worst anticipated transient and fuel burnups comparable to the maximum expected in the reactor." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)
Resolution The resolution of the above concern item is presented in a GE Topical Report submitted to the AEC in April 1968.
General Electric believes that the available data are adequate to support the validity of the 28 kW/ft damage limit for the 1965 (low power density) and 1967 (high power density) product lines BWR fuel. The fuel design and the associated linear heat generation rate have been selected as a result of development programs and experience over the past six to seven years. These programs, combined with extensive, large boiling-water-reactor operating experience, have demonstrated with a high degree of confidence that fuel integrity can be maintained in 1965 and 1967 product line BWR cores even for worst anticipated transients.
General Electric has conducted fuel rod tests over a range of conditions to obtain data applicable to the design of this plant. Test fuel rods have been operated at I.0-5
BFN-16 various levels, including 17.5 kW/ft, and higher ranges of 18.5 kW/ft, 21 to 22 kW/ft, and 28 kW/ft. These tests have verified that the calculational methods adequately predict the clad strain associated with a particular linear heat generation rate. In addition to tests performed by General Electric, tests in the range of 12 to 24 kW/ft have been performed by others.
Additional fuel tests are in progress as a development effort primarily to provide a basis for possible extensions in fuel technology. These data, as well as the operational history of BWRs placed in service prior to the operation of 1965 and 1967 product-line plants, will provide additional confirmation of the present design bases and will demonstrate operation at heat generation rates comparable to the worst anticipated transients for both the 1965 and 1967 product lines.
A summary of the fuel test programs and their results is given in Amendment 14/15 of Dresden Nuclear Power Station, Units 2 and 3 (AEC Docket Nos. 50-237 and 50-249).
Since the Dresden 2 and 3 reactor core design is a GE low power density Millstone-type, the maximum linear heat flux generation rate is 17.5 kW/ft. That is, it is less than the 18.5 kW/ft design for the GE high power density Browns Ferry-type core.
A GE Topical Report has been submitted to the AEC on the final results of the test programs.3 I.2.5 Quality Assurance and Inspection of the Reactor Primary System Concern "The Committee continues to emphasize the importance of quality assurance in fabrication of the primary system and of inspection during service life. Because of the higher power level and advanced thermal conditions in the Browns Ferry Units, these matters assume even greater importance. The Committee recommends that the applicant implement those improvements in primary system quality which are practical with current technology." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)
Resolution Design and fabrication of the reactor primary system is of the highest quality practicable with current technology. The reactor vessels are designed, fabricated, and inspected in accordance with the ASME Boiler and Pressure Vessel Code,Section III Class A for nuclear vessels as follows:
I.0-6
BFN-16 Vessel ASME Code Applicable Unit-1 1965+Summer '65 Addenda Unit-2 1965+Summer '65 Addenda Unit-3 1965+Summer '66 Addenda The following is a list of a number of specific requirements which have been applied to these vessels which exceed the applicable ASME Code requirements. Inclusion of these features means that these vessels will meet many important technical requirements of the Summer 1968 Addenda to Sections I and III of the ASME Code.
- a. 100 percent volumetric UT inspection of plates after forming and heat treating and acceptance standards equal to the ASME 1968 edition of Section III, para N321.1. These requirements first appeared in the Winter 1967 Addenda.
- b. 100 percent UT testing of main closure stud, bushing, nut, and washer material following heat treatment and rough machining, acceptance standards prescribed are at least equal to N325.1 as specified in Winter 1967 Addenda and subsequently.
- c. 100 percent liquid penetrant inspection of all cladding to acceptance standards at least equal to Winter 1967 Addenda and subsequently. The B&W liquid penetrant test procedure approved by GE fulfills the technical requirements of Appendix IX, Section 360.
- d. Plate Material conforms to SA-533 Grade B Class 1 per ASME Code Case 1339, para 1. This material specification first appears in Table N421 of the Summer 1967 Addenda and subsequently.
- e. Low alloy steel forgings to ASTM A-508 in accord with ASME Code Case 1332-2, para 5. This material first appears in Table N421 of the Winter 1967 Addenda and subsequently.
- f. Studs, nuts, bushings and washers to ASTM A540 Grade B23 or 24 and per ASME Code Case 1335-2, para 4. This specification appears in the Summer 1968 Addenda, Table N422.
- g. Control rod drive stub tubes of nickel-chromium-iron SB166 per Code Case 1336. This material first appears in Table N423 of the Summer 1967 Addenda and subsequently.
I.0-7
BFN-16
- h. Complete records so that each component can be related to the original material certification and the fabrication history including the heat numbers, chemical composition and mechanical properties. See Section III, Appendix IX, para 226, which first appeared in the Winter 1967 Addenda and subsequently.
- i. Submission of nondestructive testing procedures for purchaser approval. See Section III, Appendix IX, para 321.
- j. Submission of detailed fabrication procedures for purchaser approval. See Appendix IX, para 222.
- k. Maintenance of quality control records in at least the same detail as Appendix IX, para 225 and provides for continued maintenance as specified in the Summer 1968 Addenda to para 225.
- l. Nozzle safe ends are considered to be a part of the reactor vessel; this exceeds the requirements of Section III, para N150 of the 1968 edition.
- m. The essential requirements listed in Appendix X, para 2, such as listing of reference sources, identification and description of computer programs and provision of a summary report have been incorporated.
- n. Paragraph N141 of the Winter 1967 Addenda includes a requirement to provide the authorized inspection at the manufacturing site, with a copy of the design specification, before fabrication begins. This requirement has been fulfilled on the subject vessels.
- o. Paragraph N143 of the Winter 1967 Addenda has likewise been fulfilled on the subject vessels by application of the GE Quality Control Plan No. 209, Rev. 4, which is incorporated in the purchase requirements. It should also be noted that this quality control plan closely parallels the administrative requirements of Appendix IX, Section 220, which first appeared in the Winter 1967 Addenda.
The design basis for other primary systems components incorporate a quality level equal to that of the reactor vessel. This is accomplished by specifying these components to meet applicable codes (ASME Section III Class C or USAS B31.1.0) and imposing addition special requirements, as applicable.
The inservice inspection program for the primary systems is given in FSAR Subsection 4.12.
I.0-8
BFN-16 Refer to Appendix D for further details of the General Electric and TVA Quality Assurance Programs.
I.2.6 Effects of Cladding Temperatures and Materials on CSCS Performance Concern "In a loss-of-coolant accident, the core spray systems are required to function effectively under circumstances in which some areas of fuel clad may have attained temperatures considerably higher than the maximum at which such sprays have been tested experimentally to date. The Committee understands that the applicant is conducting additional experiments, and urges that these be extended to temperatures as high as practicable. Use of stainless steel in these tests for simulation of the Zircaloy clad appears suitable, but some corroboration tests employing Zircaloy should be included." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)
Resolution The resolution of the above concern item is presented in a GE Topical Report submitted to the AEC in April 1968.
The General Electric Company experimental program on reactor core spray cooling effectiveness is currently in progress and extensive data and analysis of its results have been reported in a GE Topical Report4 submitted to the AEC August 1968.
Experimental full-scale fuel assemblies exactly like the ones being used in this plant, as well as in all the current General Electric 1965 and 1967 product-line boiling water reactors, are being employed in this test program. These simulated fuel assemblies contain Calrod units inside the fuel rod cladding instead of nuclear fuel, and complete simulation of the hardware (nose piece, spacers, handle, channel box, etc.) is incorporated. The power in the assembly is also simulated (axial cosine heated Calrods, corner fuel rod peaking, decay heat variation in time).
Tests already conducted as of this date have encompassed fuel assembly powers in excess of those which will occur in Browns Ferry, and flows which are lower than those being provided for this plant. The results of those experiments confirm that the design basis of the reactor core spray cooling system is firmly established as adequate.
The general approach being followed is to develop high-temperature Zircaloy-clad electrically heated fuel rod simulators and to use these to conduct full-size Zircaloy-clad assembly tests. Testing conditions will be selected (1) to duplicate cooling modes, initial temperatures, coolant flow rate, power transients, subcooling I.0-9
BFN-16 temperatures, and time of cooling initiation representative of the multitude of tests performed with stainless steel clad heaters, and (2) to investigate emergency core cooling effectiveness at peak temperatures in excess of 2500°F, to the highest temperatures the heaters will permit. The first area of testing will be to corroborate use of models based on the wealth of stainless steel data obtained in the past while the latter area of testing will be to extend the knowledge to higher temperatures as closely approaching the cladding melting temperature as possible.
A series of "low-temperature" spray tests are being conducted to provide information on the correlation between stainless steel and Zircaloy assemblies. "High-temperature" effects will also be investigated in the spray mode. In a manner similar to the spray tests, flooding-only tests will be conducted to provide correlation information with "low-temperature" tests and to investigate high-temperature effects.
A single test was conducted early in this program to obtain scoping results under realistic, high-temperature conditions with combined spray flooding models of cooling.
Several core spray distribution tests have recently been performed using simulated reactor core spray cooling system spargers and "top-of-reactors" fuel assembly geometry which would be exposed to the spray action. These tests, which measure the water entering each fuel assembly, show that the design flow distribution can be attained. Tests also included experiments with air updraft to simulate potential steam upflow. The data obtained to date and the forthcoming data will make it possible to further refine the understanding of the core spray and core flood phenomena as well as increase the wealth of information now available to confirm that core spray is an effective means of accomplishing core cooling.
A GE Topical Report5 on the heated rod-core cooling aspects of this test program has been submitted to the AEC.
I.2.7 Control Rod Block Monitor Design Concern "The Rod Block Monitor system should be designed so that, if bypassing is employed for purposes other than brief testing, no single failure will impair the safety function." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
Resolution The rod block monitor (RBM) system was incorporated as an operational system for the purpose of backing up the reactor operator to prevent a single operator error or a I.0-10
BFN-16 single equipment malfunction, from causing fuel damage. It is felt that the level of reliability provided by the system is consistent with this application. The applicant and General Electric do not consider this a safety system.
The control rod block action of the RBM system is not to be confused with the Neutron Monitoring System APRM rod block function. The APRM rod block is a bulk power control system. The RBM is a local power control system.
Refer to Section 7 for further details and description of this system.
An operational analysis performed on this system demonstrated that an improbable event (a worst case rod pattern) plus five to seven operator and equipment malfunctions concurrently would only lead to an improbable failure of approximately 150 fuel rods. This would not constitute a 10 CFR 20 dose event. The details of this analysis are presented in Dresden Units 2 and 3 FSAR Amendment 19/20 (AEC Docket No. 50-237 and 50-245).
Subsections 1.3, 1.4 and Appendix G justify the nonsafety status of this system.
I.2.8 Station Startup Program Concern "Considerable information should be available from operation of previously reviewed large boiling water reactors prior to operation of the Browns Ferry reactors.
However, because the Browns Ferry Units are to operate at substantially higher power level and power density than those on which such experience will be obtained, an especially extensive and careful startup program will be required. If the startup program or the additional information on fuel behavior referred to earlier should fail to confirm adequately the designer's expectations, system modifications or restrictions on operation may be appropriate." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)
Resolution The extent and scope of the startup program for this station will reflect considerations appropriate for the size of the reactor and the thermal characteristics, service or transient conditions which might affect fuel integrity, reactor control and response characteristics, and functional performance of safeguard features contained in the design.
A step-by-step power level approach to 3293 MWt is planned.
I.0-11
BFN-16 In particular, extensive surveys of reactor core power distribution will be performed during the initial approach to rated power. The startup test program is expected to demonstrate that power distributions, as good or better than predicted, will be realized. Appropriate steps will be taken to ensure that safety margins are maintained under operational conditions.
A GE Topical Report6 was submitted to the AEC on a summary of results obtained from a typical startup and power test program for a GE-BWR in February 1969.
Refer to Section 13 for further details of the startup test program.
I.2.9 Main Steamline Isolation Valve Testing Under Simulated Accident Conditions Concern "Steamline isolation valves are provided which constitute an important safeguard in the event of failure of a steamline external to the containment. One or more valves identical to these will be tested under simulated accident conditions prior to a request for an operating license." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
Resolution General Electric implemented a program to test a full-size main steamline isolation valve under simulated accident conditions. It was anticipated that this research and development program, as applicable to this plant, would involve: (1) testing of valves on a small scale to permit evaluation of hydrodynamics of the blowdown under prototypical conditions, (2) testing of a valve essentially identical in design to those to be used in this plant simulating as closely as feasible the accident conditions, and (3) testing the main steamline isolation valves of this plant during the preoperational test phase to verify that the valves as installed will meet functional requirements.
The detailed description of the program was presented in a General Electric Topical Report1 submitted to the AEC in April 1968. The testing programs have been successfully completed and reported in a GE Topical Report7 submitted to the AEC in March 1969. Analysis of the accident event is discussed in a GE Topical Report submitted to the AEC in October 1969.
Refer also to Subsection 4.6 for further details of the isolation valves.
I.0-12
BFN-16 I.2.10 Performance Testing of the Station Standby Diesel Generator System Concern "The diesel generator sets for emergency power appear to be fully loaded with little or no margin (on the design basis of one of three failing to start). They are required to start, synchronize, and carry load within less than 30 seconds. The applicant stated that tests will be conducted by the diesel manufacturer to demonstrate capability of meeting these requirements. Any previously untried features, such as the method of synchronization, will be included in the tests. The results should be evaluated carefully by the AEC Regulatory Staff. In addition, the installed emergency generating system should be tested thoroughly under simulated emergency conditions prior to a request for an operating license." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
"The emergency power system originally provided for Units 1 and 2 has been redesigned and expanded to serve all three units. Four diesel generators are now incorporated instead of three. The design as proposed appears marginally acceptable. Questions arise regarding the capacity of the diesel generators and regarding the necessity for paralleling of generators at some time after an accident.
Consideration should be given to improvement of the system. The Committee believes that these improvements should be resolved between the applicant and the Regulatory Staff." (Browns Ferry, ACRS Letter, 5/15/68, AEC Docket No. 50-296)
Resolution Loading logic no longer requires paralleling of generators. Tests have been conducted at the diesel generator manufacturers plant to further confirm the adequacy of the diesel generator unit design for this facility (Browns Ferry-General Motors)9 with respect to starting times on simulated loading sequences. Part of the preoperation and startup programs for other facilities (Dresden Unit 2) has demonstrated the ability of the diesel generators to assume their necessary emergency loads in the prescribed time interval in a sequential manner. Refer to Sections 8 and 13 for further details including results of motor starting tests and system load margins.
I.2.11 Formulation of an Inservice Inspection Program Concern "The Committee will wish to review the detailed inservice inspection program at the time of request for an operating license." (Browns Ferry, ACRS Report, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
I.0-13
BFN-16 Resolution The inservice inspection program planned for the facility is described in Appendix B, Technical Specifications and Subsection 4.12.
I.2.12 Diversification of the CSCS Initiation Signals Concern "Also, he will explore further possibilities for improvement, particularly by diversification, of the instrumentation that initiates emergency core cooling, to provide additional assurance against delay of this vital function." (Browns Ferry, ACRS Report, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
Resolution The primary design of sensors for the core standby cooling system (CSCS) equipment consisted of a reactor vessel low water signal from either of two independent instrumentation sources to activate the pumping equipment. Further studies were conducted to ascertain whether reliability could be improved by utilizing alternate or improved sensors. As a result of these studies, instrumentation which detects high pressure in the drywell has been incorporated in addition to the reactor low water level instruments to actuate reactor core spray cooling, HPCI, and LPCI and the standby diesel generator systems.
Diversity of the sensing mechanisms which provide signals that permit the opening of the RHR and core spray injection valves and the actuation of the cooling pumps has also been incorporated into the design. Two different types of pressure interlock sensors--bellows type and bourbon-tube type--are used in parallel to circumvent any unknown phenomenological uncertainties associated with pressure measurements.
I.2.13 Control Systems for Emergency Power Concern "The applicant stated that the control systems for emergency power will be designed and tested in accordance with standards for reactor protection systems." (Browns Ferry, ACRS Report, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
I.0-14
BFN-16 Resolution In common with all reactor protection features, the plant standby diesel generator system will be designed and tested in accordance with the intent of the proposed IEEE Standards for Nuclear Power Plant Protection Systems (IEEE-279). The design basis includes the requirements that no single component failure shall prevent the system from operating with sufficient capacity to supply required emergency loads.
Additional information is contained in Section 8.
I.2.14 Misorientation of Fuel Assemblies Concern Operation with a fuel assembly having an improper angular orientation could result in local thermal conditions that exceed by a substantial margin the design thermal operating limits. The applicant stated that he is continuing to investigate more positive means for precluding possible misorientation of fuel assemblies. (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
Resolution Operation with a misoriented fuel assembly would be an economic rather than a safety concern for this plant. Analyses have shown that less than 10 fuel rods in a misoriented assembly would experience a MCHFR less than 1.9. Under normal operating conditions, these 10 fuel rods would, even in the peak power position, remain at a MCHFR greater than 1.0 and peak linear heat generation rate less than 28 kW/ft.
Studies into means of precluding possible fuel misorientation have been completed.
It is concluded that the present method of procedural controls is the most desirable of the alternates. Fuel-handling operations at operating GE BWRs have shown this to be an efficient, effective method.
Various mechanical devices to prevent inserting a misoriented fuel assembly were also studied and eventually discarded. These devices tended to provide greater potentials for fuel damage during loading and storage operations than the misorientation they were designed to prevent.
Visual identification has been successfully used in all BWRs operated to date to provide assurance of fuel location and orientation. Photos taken of the KRB core after the initial fuel loading clearly showed four different means of identifying a I.0-15
BFN-16 misoriented fuel assembly: (1) the assembly numbers point towards the center of the cell, (2) the spring- clip assemblies all face the control rod, (3) the lugs on the handles point towards the control rods, and (4) cell to cell symmetry. Experience has shown that the distinguishing features will be visible during the design lifetime of the fuel. In all cases, fueling procedures require that the fuel assembly number be verified. As a result of this study and the accumulated fuel-handling experience, no further work with respect to providing an alternate means of preventing fuel assembly misorientation is planned. All changes in fuel assembly design will be evaluated to insure that they do not degrade the present visual confirmation signals.
Refer to Section 3 for further details.
I.2.15 Concern of Dr. Stephen H. Hanauer-Emergency Power and Core Standby Cooling Systems Concern The following are additional remarks by Dr. Stephen H. Hanauer: "It is my belief that the substantial increase in power and power density of the Browns Ferry reactors over boiling water reactors previously approved should be accompanied by increased safeguard system margins for the unexpected. The emergency core cooling system proposed should, in my opinion, be redesigned to provide additional time margin and to reduce the severe requirements for starting of large equipment in a few seconds. The dependence on immediate availability of a large amount of emergency electrical power, using diesel generators operating fully loaded in a previously untried starting mode, is of special concern, as are the high temperatures and numerous fuel-element failures predicted even for successful operation of the emergency core cooling system in a large loss-of-coolant accident." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket Nos. 50-259 and 50-260)
Resolution Even though the Browns Ferry Nuclear Plant uses boiling water reactors of increased power level and power density over past boiling water reactors, the design criteria for the design of core standby cooling equipment remains unchanged, thus requiring major increases in the size of core standby cooling equipment provided.
For any potential breach of the primary cooling system, from a small leak up to the instantaneous complete rupture of the largest coolant line, the recirculation line, sufficient core standby cooling equipment is provided to prevent any clad temperatures in excess of 2700°F. This is accomplished by either one of two independent cooling systems. These core standby cooling systems are capable of operating at full capacity without any dependence on the "offsite" power source.
I.0-16
BFN-16 The core standby cooling equipment incorporates cooling mechanisms which are known to be effective by experience. All systems are capable of being tested.
The complete satisfaction of the above criteria demands the provision of an extensive core standby cooling network which has considerably more cooling capability than that required for any expected coolant loss situations which might occur at the Browns Ferry plant.
As discussed in paragraph I.2.2, fuel perforation due to high temperature might occur, but this would not lead to failure of the cooling mechanism. Perforation has been observed in reactors and in test-facilities; it is a local phenomena and in no way would preclude core standby cooling functions.
In summary, it might be stated that, although there is no disciplined manner for designing for various unknown events which might also occur, the spectrum of accidental events designed for, the severity of the criteria employed, as well as the conservatism of the performance evaluations all combine to result in a core standby cooling system which has sufficient capacity and capability to adequately cool the core for a vast spectrum of emergency events far greater than any expected to occur. Additional information is available in Sections 6 and 14 and paragraph I.2.16.
The capability of the diesel generators and test results are presented in Section 8 and paragraph I.2.10.
I.2.16 Fuel Clad Disintegration Limitations Concern "In connection with postulated loss-of-coolant accidents, the applicant stated that, using conservative assumptions and allowing appropriately for fuel element distortion from the original core geometry, the emergency core cooling systems will be designed to keep fuel-clad temperatures below the point at which the clad may disintegrate upon subsequent cooling." (Browns Ferry, ACRS Letter, 5/15/68, AEC Docket No. 50-296)
Resolution With respect to this overall concern of core standby cooling systems (CSCS) effectiveness to cool overheated fuel rods, GE has selected a maximum allowable temperature criterion of 2700°F. This selection was based on a desire to keep the fuel bundle geometry intact. (Refer to a GE Topical Report1 submitted to the AEC.)
I.0-17
BFN-16 Even though this criterion has been adopted for core standby cooling system (CSCS) equipment design, experimental effort continues at both General Electric Company and elsewhere to further refine knowledge with respect to a proper tolerable maximum fuel temperature during loss-of-coolant accidents.
Some preliminary data from Argonne tend to indicate that possible clad shattering rather than clad melting might be a more conservative criteria for loss of geometry intactness. This shattering might occur at temperatures as much as 400°F below the Zircaloy melt temperature. Current testing programs at GE for out specific fuel bundle designs are fully investigating this possibility.
The current conservative core cooling evaluation techniques used on this plant indicate that the maximum predicted clad temperatures for the BWR reactor core postulated design basis loss-of-coolant accidents (less than 2000°F) are sufficiently below any temperatures of clad shattering that there is no concern that a potential modification in the maximum allowable temperature criteria would adversely influence the present sizes of the core standby cooling systems equipment.
General Electric is developing high-temperature Zircaloy-clad electrically heated fuel rod simulators for use in full-size Zircaloy-clad bundle tests. Testing conditions have been selected (1) to duplicate cooling modes, initial temperatures, coolant initiation representative of the multitude of tests performed with stainless steel-clad heaters, and (2) to investigate CSCS effectiveness at peak temperatures in excess of 2500°F, to the highest temperatures the heaters will permit. The results of this program have been filed with the AEC as the answer to questions 5.1 of Dresden Units 2 and 3 FSAR Amendment 7/8, Docket Nos. 50-237 and 50-249. Refer to Section 6 for further details.
I.2.17 General Concern with Regard to Reactors of High Power Density and All Large Water-Cooled Power Reactor Concern "The Committee continues to call attention to matters that warrant careful consideration with regard to reactors of high power density and other matters of significance for all large water-cooled power reactors. If developments in any of these areas, particularly fuel behavior, should fail to confirm adequately the designer's expectations, system modification or restrictions on operation of Unit 3 may be appropriate." (Browns Ferry, ACRS Letter, 5/15/68, AEC Docket No. 50-296)
I.0-18
BFN-16 Resolution The resolution for all ACRS concerns for this and all other large water-cooled power reactors is covered in Appendix I, Subsections 2 and 4.
I.2.18 Summary "The Advisory Committee on Reactor Safeguards believes that the items mentioned above can be resolved during construction of the reactors. On the basis of the foregoing comments, and in view of the favorable characteristics of the proposed site, the Committee believes that the proposed reactors can be constructed at the Browns Ferry site with reasonable assurance that they can be operated without undue risk to the health and safety of the public." (Browns Ferry, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260) "The Advisory Committee on Reactor Safeguards believes that the items mentioned above can be resolved during construction of the reactor. On the basis of the foregoing comments, and in view of the favorable characteristics of the site, the Committee believes that the proposed Unit 3 can be constructed at the Browns Ferry site with reasonable assurance that it can be operated without undue risk to the health and safety of the public." (Browns Ferry, ACRS Letter, 5/15/68, AEC Docket No. 50-296)
The above 17 concern items have been or will be resolved prior to the initial operation of this facility and have or will have demonstrated the necessary assurance that they will have no adverse effect on the health and safety of the public.
I.3 AREAS SPECIFIED IN THE AEC-STAFF CONSTRUCTION PERMIT-SAFETY EVALUATION REPORTS I.3.1 General The AEC-STAFF-Construction Permit-Safety Evaluation Reports of 3/31/67 and 6/6/68 identified areas of specific concerns. The concerns are discussed below.
I.3.2 Unit 1 and 2 AEC-STAFF-Construction Permit Concerns I.3.2.1 Unit 1 and 2 ACRS Concerns Statement (Page 15)
"The ACRS, in its March 14, 1967, report on the Browns Ferry Nuclear Power Station, has indicated that further analytical and experimental verification of predicted fuel damage character and thresholds should be developed. The areas of I.0-19
BFN-16 concern include fuel element misorientation, the mode of fuel failure under loss of coolant accident conditions, the effects of local fuel melting in a fuel assembly, and fuel damage limits. It was noted, however, and we concur, that these items are of concern for all large water-cooled power reactors. The General Electric Company has stated that it plans to continue its investigation in these areas on both an analytical and experimental basis. It is currently engaged in these programs on a general basis and, in our opinion, will obtain the necessary information."
Resolution All Unit 1 and 2 ACRS concerns are discussed in Section I.2 of this appendix.
I.3.2.2 Core Spray Cooling Effectiveness Statement (Page 20)
"The power ratings for the Dresden 2 class reactor plants resulted in modeling parameters under assumed accident conditions that were within the envelope of test conditions used to size the Core Spray System. During our review of the effects of the higher power density, it was apparent that some extrapolation between core spray test and design conditions was required. General Electric has performed additional evaluation to indicate that even with the increased power density, no threshold for a phenomenon that would preclude core cooling by spray is evident. In any case, additional tests are to be performed to confirm that the design bases for the Core Spray System are applicable to the higher power density core."
Resolution The design and final test program of the effectiveness of the core spray cooling system has been completed and presented in a GE Topical Report1 submitted to the AEC.
I.3.2.3 Items That Will Be Given Close Attention Statement (Page 22)
"The ACRS and we have, however, noted several items which will be given close attention during the final design stage prior to completion of the operating license review. These are:
- a. the results of reliability studies which support the design decision to provide single closed valves which must open to allow system operation (HPCIS and LPCIS),
I.0-20
BFN-16
- b. further study for possible improvement of the instrumentation provided for sensing loss of coolant and of the means for taking appropriate action to provide core cooling,
- c. the automatic controller which sequences the ECCS subsystems,
- d. core spray test data which confirms the efficacy of spray cooling for the higher power density core,
- e. the performance capability of the diesel generator emergency power system to accommodate the ECCS loads in the required time,
- f. the mode of fuel failure under assumed loss-of-coolant accident conditions."
Resolution
- a. The injection path for the CSCS, which consists of a testable check valve inside the containment and two motor-operated valves outside the containment (one open and one closed) has been designed to meet the requirements of the proposed AEC 70 General Design Criteria numbers 38 through 48. The primary considerations are (1) testability, (2) positive containment capability, and (3) a single failure proof core cooling capability. These systems meet all of the AEC criteria for core standby cooling systems with adequate reliability.
See Section 4, 6, and 7 for system details.
- b. See paragraph I.2.12.
- c. The core standby cooling system uses timers only for start sequencing of the motor operated pumps. See Section 6 and 8 for system details.
- d. See paragraph I.3.2.2.
- e. See paragraph I.2.10.
- f. See paragraphs I.2.2, I.2.3, and I.2.6.
I.3.2.4 Control Rod Block Monitor Design Statement (Page 25)
"We believe that the RBM system will be made to conform to current criteria relating to functional adequacy, redundancy, and inservice testability, and that it will provide I.0-21
BFN-16 adequate protection capability for the Browns Ferry plant. GE has indicated that it would also evaluate the design in regard to immunity from "single failure" during nontest bypass conditions."
Resolution See paragraph I.2.7.
I.3.2.5 Core Cooling Statement (Page 30)
"a. Core Cooling-This development effort is directed toward the determination of core cooling requirements for the coolant loss accident. GE has indicated that further testing of core spray effectiveness is to be performed using both stainless steel and Zircaloy clad elements."
Resolution The performance of the core standby cooling systems (CSCS) used for core cooling following a postulated design basis loss-of-coolant accident in the 1967 GE Product-Line BWR is described and analyzed as a function of break size.4 The test programs that have been conducted to obtain significant design parameters related to these systems are also discussed. It is concluded the CSCS network provides an effective means in depth of terminating the core heatup transient over the complete spectrum of loss-of-coolant accidents. Refer to Section 6 for further details.
I.3.2.6 Control Rod Worth Minimizer Statement (Page 31)
"b. Control Rod Worth Minimizer-This effort is directed toward developing an operational computer to assist the operator in preventing excessive control rod worth patterns."
Resolution The design of the Control Rod Worth Minimizer (CRWM) is complete as reported in the GE Topical Report12 submitted to the AEC in March 1967. Refer to Section 7 for further details.
I.0-22
BFN-16 I.3.2.7 Control Rod Velocity Limiter Statement (Page 31)
"c. Rod Velocity Limiter-Testing is in progress to evaluate the effectiveness of a device which is designed to limit the free-fall velocity of a control rod. The device is to be an integral part of the control rod drive shaft."
Resolution The design and final test program of the Control Rod Velocity Limiter (CRVL) is complete as reported in a GE Topical Report13 submitted to the AEC in March 1967.
Refer to Section 3 for further details.
I.3.2.8 Incore Nuclear Instrumentation Statement (Page 31)
"d. Incore Neutron Monitoring System-These development efforts are directed to evaluating the operational performance of incore neutron detectors. The tests are being conducted at existing reactor facilities."
Resolution The design and adequate performance demonstration of the Incore Nuclear Instrumentation System is complete and is reported in a set of GE Topical Reports14,15 submitted to the AEC in August 1968 and November 1968, respectively.
Refer to Section 7 for further details.
I.3.2.9 Jet Pump Development Statement (Page 31)
"e. Jet Pumps-Development programs are in progress to determine the overall performance of the jet pump for the proposed design application including system stability analyses. Tests are being conducted on single and multiple assemblies to evaluate hydraulic characteristics."
Resolution The design and test program of the Jet Pump Assemblies is complete and is reported in a GE Topical Report16 submitted to the AEC in September 1968.
I.0-23
BFN-16 I.3.2.10 Other Concerns Statement (Page 31)
"f. Others-The applicant and its designer, GE, have indicated that other areas exist in which further analytical and experimental efforts are to be made to improve features of system design. These include core analytical models, fuel failure modes, load control using variable speed recirculation pumps, improvement in the ECCS instrumentation sensing system including consideration for diversification, main steamline isolation valve testing under simulated accident conditions, and performance testing of the emergency diesel generating system to power the ECCS in the time required for adequate core cooling."
Resolution I.3.2.10.1 Core Analytical Models During accident analysis discussions on Dresden, Millstone, Quad Cities, etc., the AEC staff identified Core Analytical Models as an area requiring additional technical information. This requirement has been carried through to Browns Ferry and others.
The requirement pertains to the models used in describing the thermal and nuclear behavior of the core under accident conditions leading to the release of fission products.
Several GE Topical Reports17,18,19,20,21 have been written to resolve this concern, and covers the area of nuclear transients as well as core heatup under loss-of-coolant accidents.22 Refer to Sections 6, 7, and 14 for further details.
I.3.2.10.2 Fuel Failure Modes See paragraph I.3.2.3f.
I.0-24
BFN-16 I.3.2.10.3 Load Control by Variable Speed Recirculation Pumps The objective of this program is to accurately model the performance of the reactor coolant recirculation system pumps and the reactor response for this system. The modeling program is complete, with appropriate parameters modified as particular equipment is designed or purchased. The adequacy of the model will be demonstrated by comparison of the prediction with the results of the . . .
- a. Jersey Central Power Company Oyster Creek Nuclear Power Plant, Unit 1 AEC Docket No. 50-219 Nonjet pump design
- b. Niagara-Mohawk Power Corporation Nine Mile Point Nuclear Station, Unit 1 AEC Docket No. 50-220
- c. Commonwealth Edison Company of Chicago Dresden Nuclear Power Station, Unit 2 AEC Docket No. 50-237 Jet pump design
- d. Millstone Point Company Millstone Nuclear Power Station, Unit 1 AEC Docket No. 50-245
. . . . . startup tests, which have been completed for Oyster Creek, Nine Mile and Dresden-2, and will be completed on Millstone late in 1970.
I.3.2.10.4 Improvement in ECCS Instrumentation Sensing System See paragraph I.3.2.3b.
I.3.2.10.5 Main Steamline Isolation Valve Testing Under Simulated Accident Conditions See paragraph I.2.9.
I.0-25
BFN-16 I.3.2.10.6 Performance Testing of the Station Standby Diesel Generator System See paragraph I.3.2.3e.
I.3.3 Unit 3 AEC-STAFF-Construction Permit Concerns I.3.3.1 Performance Testing of the Standby Diesel Generator System Statement (Pages 9 & 10)
"The applicant has stated in his summary description for Units 1 and 2 that the diesel generator will be tested to demonstrate acceptable performance for starting and operating the ECCS loads. We conclude that this commitment is also necessary for Unit 3 and that the program will include suitable testing to demonstrate the capability of the system to satisfy the starting and load requirements for the equipment."
Resolution See paragraph I.3.2.3e.
I.3.3.2 Reactor Building Basement Corner Room Flooding Statement (Page 11)
"The applicant will revise his present design of the reactor building so that possible flooding of the basement area will not affect emergency core cooling capability.
Although the details of the design change have not been developed as yet, the applicant has stated in Amendment No. 4 that it will either seal the compartments enclosing the emergency core cooling equipment or design another means for preventing the flooding of the ECCS equipment. We conclude that this approach is acceptable at this time. We will review the details of the revised design at the operating license stage."
Resolution Standby coolant supply connections and RHR crossties have been provided in Subsection 4.8. These connections and crossties can provide long-term reactor core and primary containment cooling capability irrespective of the RHR system associated with the given unit. With these provisions, possible flooding of the basement area will not affect emergency core cooling capability.
I.0-26
BFN-16 I.3.3.3 Automatic Pressure Relief System-Initiation Interlock Statement (Page 14)
"In the course of our discussions with the applicant and subsequent discussions during the ACRS meeting, the applicant indicated that it would install an interlock to prevent actuation of the autorelief valves unless power is available to operate the ECCS pumps. The addition of this interlock provides a greater margin (hours) to melt for the small breaks in the event of actuation of the autorelief valves if operation of the core spray or LPCI systems is delayed. We conclude that this approach is acceptable."
Resolution A system has been installed to sense pressure downstream from the core spray and the LPCIS pumps and prevent autodepressurization unless the pressure is above a value assuring the capability of low pressure core cooling.
Refer to Sections 6 and 7 for further details.
I.3.3.4 AEC General Design Criterion 35 Intent Statement (Page 15 and 16)
"The capability of satisfying Criterion 35, which relates to the prevention of brittle fracture in the pressure vessel and the other parts of the primary coolant pressure boundary, has been discussed with the applicant. The Browns Ferry pressure vessels meet the requirements of Criterion 35 as presently phrased, however, the remainder of the primary system does not meet a literal interpretation of the present phrasing of the criterion. The applicant has stated, however, that the Browns Ferry Station units will meet the requirement of brittle fracture prevention in all parts of the reactor coolant pressure boundary. Details of the design and analytical techniques by which the applicant will assure prevention of brittle fracture in the primary system will be resolved between the applicant and staff."
Resolution The agreed upon interpretation of the proposed Criterion 35 with the AEC-Staff23 and the design conformance objective for Unit 3 is stated below.
The piping and pressure containing parts of the reactor coolant pressure boundary will conform to the NDT requirements of Criterion 35 as follows:
I.0-27
BFN-16
- a. Piping and pressure containing parts with a wall thickness of one inch and greater will have a nil-ductility transition temperature, by test, 60°F below anticipated minimum operating temperature when the system has a potential for being pressurized to above 20 percent of the reactor design pressure.
- b. Those pipes and pressure containing parts with a wall thickness less than one inch need not have material property tests (i.e., Charphy V-notch) if: (1) fabricated from austenitic stainless steel, (2) the material has been normalized (heat treated), (3) the material has been fabricated to "fine-grain practice."
Protection against the brittle fracture or other failure modes of the reactor coolant pressure boundary system components is provided for all potential service loading temperatures. Control is exercised in the selection of materials and fabrication and design of equipment and components to meet the above criteria. Refer to Section 4.
Units 1 and 2 conform to the intent of Criterion 35 as discussed in Appendix A.
I.3.3.5 RPV-Stub Tube Design Statement (Pages 16 and 17)
"In order to facilitate our review of this potential problem at the earliest time, the applicant has informed us that it will provide us with the additional information on the stub tubes and an evaluation of the potential stub tube problems for the Browns Ferry vessels. As indicated in the applicant's Summary of Application, he will incorporate any necessary corrective action, resulting from the stub tube problem evaluation in its vessels on a reasonable and practical basis prior to completion of fabrication. The applicant has indicated that the design and evaluation will be submitted to the staff as soon as information is available. This course of action with respect to the reactor pressure vessel design is acceptable to us."
Resolution A GE Topical Report24 was submitted to the AEC on the stub-tube design. The report describes the design, analysis, fabrication and test of the control rod drive penetration typically used in current General Electric reactor vessels. The penetration described consists of an Inconel internal stub nozzle welded inside the reactor vessel bottom head and an austenitic stainless steel control rod drive housing penetrating the reactor vessel head and welded to the top on the Inconel stub nozzle. This penetration is typical of the Dresden II and III, Millstone, Monticello, Browns Ferry, Vermont Yankee, Peach Bottom and Pilgrim nuclear power station plants now well along in construction and on other plants to follow in the immediate future. Although details of design and fabrication vary slightly in this I.0-28
BFN-16 series of plants, principally to accommodate the fabricator's manufacturing preferences and methods, these differences are not significant and the resulting penetrations are equivalent. Refer to Section 4 for further details.
I.3.3.6 Requirements for Further Technical Information Statement (Pages 18 and 19)
"A number of areas have been identified during the previous review of Units 1 and 2 that require further technical information. The areas were identified in our safety analysis for Units 1 and 2 (Appendix A,Section VI) and also are applicable to Unit 3.
They include the following:
- a. core cooling,
- c. rod velocity limiter,
- d. incore neutron monitoring system,
- e. jet pumps,
- f. core analytical models,
- g. fuel failure modes,
- h. load control using variable speed recirculation pumps,
- i. main steamline isolation valve testing, and
- j. diesel generating testing."
Resolution See Sections I.2 and I.3 for resolution of all the above items.
I.3.3.7 CSCS Thermal Effects on the Reactor Vessel and Internals Statement (Page 19)
"The effect of thermal shock on the reactor vessel and its appurtenances induced by injection of emergency core cooling water into the higher temperature reactor I.0-29
BFN-16 system has not yet been fully analyzed. General Electric will perform a detailed stress analysis in connection with the Millstone Point provisional operating license review. At this stage of the Browns Ferry review, we are satisfied with the applicant's awareness of the requirement for a detailed thermal shock analysis at the operating license stage and of its intentions to provide one."
Resolution A detailed reactor vessel thermal shock analysis was performed on a representative GE-BWR reactor vessel. The thermal shock analysis simulating CSCS-LOCA operation was performed on a reactor vessel similar in design to the Browns Ferry vessels and is reported in a GE Topical Report25 submitted to the AEC in July 1969.
The thermal shock analysis simulating CSCS-LOCA conditions was made on the reactor internals, including the core spray sparger and the reactor vessel shroud and is described in Sections 3 and 4.
I.3.3.8 Depressurization Performance of HPCIS Statement (Page 20)
"As a result of the continuing interest in the area of depressurization model and peak clad temperatures, the General Electric Company has formulated an experimental test program to determine HPCI mixing efficiencies. It is planned that the proposed tests will be completed in 1968. After the depressurization model is evaluated by comparison with experiments, the analytical model can be refined to establish the calculated peak clad temperatures. We believe that the HPCI depressurization principle is feasible and that the experimental program can be expected to test its applicability. The results from this program will be available for review prior to the proposed operating data for Unit 3."
Resolution The resolution of the above concern item is presented in the GE Topical Report1 submitted to the AEC in April 1968.
The primary function of the high-pressure coolant injection system (HPCIS) is to provide coolant makeup to the reactor vessel to keep the reactor core covered and cooled for small system breaks. The secondary function is to depressurize the reactor so that the low-pressure coolant injection system or the reactor core spray cooling system in the CSCS network can become effective for somewhat larger breaks than can be handled entirely by HPCIS inventory makeup. An analytical model based upon solution to the mass and energy balances for the system I.0-30
BFN-16 assuming thermodynamic equilibrium is used to predict the depressurization characteristics due to HPCIS operation. Because equilibrium does not actually exist, a calculated "mixing efficiency" is used to represent how nearly the injected subcooled water is raised to the temperature of the reactor vessel fluids.
Engineering tests were conducted in which subcooled water was injected into a constant-volume, high-pressure steam-water system designed to simulate reactor conditions and geometry.
Depressurization rate, inlet and fluid temperature were measured. An overall mixing efficiency was evaluated. A sufficient range of variables were included in the tests such as to determine a mixing efficiency for each reactor primary system. Refer to Section 6 for further details.
The results and successful completion of this test program were submitted to the AEC in a GE Topical Report in June 1969.
I.3.3.9 Electrical Equipment Inside Containment Test Program Statement (Page 21)
"Electrical Equipment Inside Containment-Electrical equipment that must operate inside primary containment in an accident environment is limited to cables and operators for isolation valves. Where practical, the valves are designed to fail "as is" or closed (safe failure). A circuit failure after the valve has closed will be a safe failure. In addition to designing the equipment to withstand the accident environment long enough to operate the valves, the applicant has agreed to test the performance of this equipment. In Amendment No. 2, the applicant outlines the components and subsequent tests of the materials to be installed in the primary containment. The tests will demonstrate that the material and equipment will survive the accident conditions of simultaneous pressure, temperature, and humidity for a period of time essential for their operation. Successful demonstration by these tests will satisfy our requirements."
Resolution Type tests of typical valves have been performed and are reported in Millstone FSAR Amendment 18, Question A-9, Docket No. 50-245. The quality control plan will ensure that components identical to those which successfully passed the tests will be installed at Browns Ferry.
I.0-31
BFN-16 I.3.3.10 Primary System Leak Detection Statement (Pages 21 and 22)
Detection of leaks in the primary system will be accomplished by monitoring the sump level in the containment vessel and by monitoring the containment temperature and pressure. Leaks as low as 1 gpm can be detected by these methods. Selected areas in the reactor building in the vicinity of the RCIC and RHR equipment will also be monitored.
We will continue to review leak detection techniques to ascertain that the proposed methods are sufficiently sensitive. We conclude that there is reasonable assurance that this matter will be satisfactorily resolved prior to the date proposed for initial operation of the Browns Ferry Station.
Resolution The primary containment leakage detection system as described in Section 4.10 is both sensitive and reliable for its intended safety conditions. This system is based on the sump-pump technique approach to leakage detection phenomena. Other supplemental techniques as described in the FSAR are useful alternates and are considered as supplemental offline specialty approaches versus the operational primary online process approach, the automatic sump-pump system.
The proposed technical specifications justify the leakage rate sensitivity and operational readiness requirements of the system.
The results of studies committed by others (Jersey Central Power and Light Company, refer to ACRS Letter-Oyster Creek Nuclear Plant, Unit 1-12/12/68-AEC Docket No. 50-218) will be examined for appropriate disposition in regards to this facility when such data are made available.
I.3.4 Summary The above cited concerns all that have been resolved or shortly will be resolved prior to initial operation of the facility.
I.0-32
BFN-16 I.4 AREAS SPECIFIED IN OTHER RELATED AEC-ACRS CONSTRUCTION PERMIT AND OPERATING LICENSE REPORTS I.4.1 General Development, testing, and analysis programs are continuing in several other areas of related interest.1 Other study programs which are related directly not only to the high power density reactor core design such as Browns Ferry, and indirectly to other low power density reactor core boiling water reactors now near completion, but also to reactor designs which have been reviewed since the Browns Ferry Construction Permit issuance are being pursued and results will be issued soon. The information developed in these programs will be addressed to several of the technical concerns which have been voiced by the AEC-Advisory Committee on Reactor Safeguards (ACRS) recently with respect to the General Electric BWR product lines.
The ACRS issues on the following facilities are identified and the Browns Ferry design capabilities relative to them are discussed in this section.
50-271.
50-277 and 50-278.
50-324 and 50-325.
I.0-33
BFN-16
Additional, water-cooled, reactor design ACRS concern items were documented in the PG&E-Diablo Canyon, Unit 1 (AEC Docket No. 50-275), ACRS letter of 12/20/67. These items are also identified, and the Browns Ferry design capability is discussed.
Thus, although these items have not been addressed as requirements to this plant, a detailed comprehensive review of each item and the Browns Ferry design conformance to it is analyzed in the following subsections.
I.4.2 Ring Header Leakage Design Concern "The present design of the units includes a ring header to supply water from the torus to the emergency core cooling systems. The applicant discussed a possible modification intended to simplify the piping and reduce susceptibility to single point failure. The Committee believes that this matter should be resolved between the applicant and the Regulatory Staff." (Peach Bottom-ACRS Letter, October 12, 1967, AEC Docket Nos. 50-278 and 50-279)
Resolution The design of this facility does include a ring header to supply water from the primary containment system-torus to the CSCS. However, this facility is provided with an RHRS-Service Water Intertie System capability to assure an unlimited (alternate) supply of cooling water to the CSCS. The service water pumps are energized by the Standby Diesel Generator System, if required and they are capable of delivering their cooling water directly to the reactor vessel, if desired. Refer to Sections 4, 5, 6, and 8 for further details.
I.4.3 CSCS Thermal Effects on the Reactor Vessel and Internals Concern "The Regulatory Staff should review analyses of possible effects upon pressure vessel integrity, arising from thermal shock induced by ECCS operation." (Diablo Canyon, ACRS Letter, 12/20/67, AEC Docket No. 50-275)
I.0-34
BFN-16 Resolution See paragraph I.3.3.7.
I.4.4 Effects of Blowdown Forces on Reactor Primary System Components Concern "The effects of blowdown forces on core and other primary system components should be analyzed more fully as detailed design proceeds." (Diablo Canyon ACRS Letter, 12/20/67, AEC Docket No. 50-275)
Resolution The reactor core structural components are designed to accommodate the loadings applied during normal operation and maneuvering transients. Deflections are limited so that the normal functioning of the components under these conditions are not impaired. Where deflection is not the limiting factor, the ASME Boiler and Pressure Vessel Code,Section III, was used as a guide to determine limiting stress intensities and cyclic loadings for the core internal structure.
The loading conditions that occur during excursions or design basis loss-of-coolant accidents were examined. The reactor core shroud, shroud support, and jet pump body, which comprise the inner vessel around the core within the reactor vessel, are designed to maintain a reflooding capability following a design basis loss-of-coolant accident. Reflooding the reactor core to the top of the jet pump inlets provides adequate cooling of the fuel.
The design of the jet pump parts takes into account the pressure loading both in normal and accident conditions and the reactions at the supporting brackets due to differential thermal expansion of the pump and reactor vessel.
The reactor internals were designed to preclude failure that would result in any part being discharged through the main steamline, in the event of a steamline break, which might block a main steamline isolation valve.
The structural components that guide the control rods were analyzed to determine the loadings that would occur in a design basis loss-of-coolant accident. The reactor core structural components are designed so that deformations produced by accident loadings do not prevent insertion of control rods.
Further details on this analysis are described in Sections 3, 4, and Appendix C.
I.0-35
BFN-16 I.4.5 Separation of Control and Protection System Functions Concern "The applicant has proposed using signals from protection instruments for control purposes. The Committee believes that control and protection instrumentation should be separated to the fullest extent practicable. The Committee believes that the present design is unsatisfactory in this respect but that a satisfactory protection system can be designed during the construction of this reactor. The Committee wishes to review an improved design prior to installation of the protection System."
(Diablo Canyon, ACRS Report, 12/20/67, AEC Docket No. 50-275)
Resolution The reactor protection system, independent from the station process control and indication systems, overrides all other controls to initiate any required safety action.
The reactor protection system automatically and independently initiates appropriate action whenever the station conditions approach preestablished operational limits.
All redundant instrumentation provided for safe reactor shutdown are powered from separate sources. The connections to this redundant instrumentation and controls are routed in separate wireways (conduit, trays, etc.) via independent paths to reduce the possibility of loss of both cables in the event of an accident condition or fire.
Refer to Sections 6, 7, and Appendix A for further details.
I.4.6 Instrumentation for Prompt Detection of Gross Fuel Failure Concern "Considerations should also be given to the development and utilization of instrumentation for prompt detection of gross failure of a fuel element." (Diablo Canyon, AEC Letter, 12/20/67, AEC Docket No. 50-275)
Resolution Refer to Responses 7.5 and 9.4.2 of Supplement No. 3 and to Response 7.5 of Supplement No. 4 of the Brunswick Steam Electric Plant, Units 1 and 2 (AEC Docket Nos. 50-324 and 50-235). It is shown that the GE-BWR failed fuel element detection capability for gross failure is conservatively responsive and well within the design requirements of the concern.
I.0-36
BFN-16 The Brunswick submittal (referenced) discusses the design criteria for the instrumentation for prompt detection of gross failure of a fuel element that is also applicable for this facility as well as all other GE-BWR projects.
In essence, the GE-BWR detection system instantaneously detects and takes the necessary corrective action for not only gross, immediate but also local minor, long-term fuel failures.
Refer to Section 7 for further details.
I.4.7 Design of Piping Systems to Withstand Earthquake Forces Concern "The Committee recommends that the applicant give special attention to the design of the critical elements of the plant piping, including the drywell torus connections, to ensure that these elements are not overstressed under maximum earthquake forces." (Vermont Yankee-ACRS Letter, June 15, 1967, AEC Docket No. 50-271)
Resolution Critical elements of the station piping, including the connections of that piping to the drywell and torus of the primary containment, are designed to withstand, without exceeding the requirements of the ASME Code Section III, 1968 edition, the maximum forces resulting from the Design Basis Earthquake which is approximately two times the Operating Basis Earthquake. This was accomplished by the performance of an appropriate static or dynamic analysis of the important piping in systems critical to reactor safety or to safe shutdown of the station. The stresses resulting from these earthquake forces have been calculated and are within the limits for the piping materials and other associated components involved, according to appropriate ASA and ASME Codes. Refer to Subsection 12.2 and Appendix C for further information. A detailed analysis of a typical GE-BWR, Primary Containment Construction was given in Dresden 2/3, Amendments 13/14, (AEC Docket No.
50-237 and 50-245).
I.4.8 LPCIS-Logic Control System Design Concern "The applicant proposes to use sensing devices in the recirculation loops of the reactor to detect the location of a pipe break. Signals from these devices would be used automatically to select various valve actions that are essential to the proper operation of the emergency core cooling systems. In view of the importance of the I.0-37
BFN-16 proper valve actions in the unlikely event of a major pipe break, the Committee recommends that the sensing instrumentation and valve control system be designed to full reactor protection system standards, and that consideration be given to providing more than one type of sensing device in the system." (Vermont Yankee-ACRS Letter, June 15, 1967, AEC Docket No. 50-271)
Resolution The engineered safeguards with respect to core standby cooling systems (CSCS) includes a low pressure coolant injection system (LPCIS) which is capable of reflooding the reactor core following a design basis loss-of-coolant accident (LOCA).
The system is equipped with sensing and initiating equipment that is capable of reliably detecting which of the two reactor coolant recirculation system loop lines is not associated with the reactor primary system rupture so that the coolant injection can occur in the proper loop line. The current technique for sensing this information by means of pressure differential sensing devices and a logic control system has been found to have sufficient reliability and sensitivity to be an acceptable system.
Refer to such a system description in Section 6.
I.4.9 Reevaluation of Main Steamline Break Accident Concern "Fuel clad temperatures following a steamline break should be further evaluated during detailed design, with due attention to using conservative assumptions and methods in calculating these temperatures. Steamline isolation valve closure time as short as 3 seconds may be required to maintain acceptably low fuel clad temperatures in this accident. This applicant has stated that isolation valves with closure times adjustable from 3 to 10 seconds will be obtained for the plant."
(Vermont Yankee, ACRS Letter, June 15, 1967, AEC Docket No.59-271)
Resolution The resolution plan for the above concern item is presented in a GE Topical Report1 submitted to the AEC in April 1968. Section 14 justifies a 10-second closure time both thermal-hydraulic-wise and radiologically.
A more extensive study of this phenomena was undertaken. The program has been completed and a GE Topical Report27 was submitted to the AEC in October 1969.
I.0-38
BFN-16 I.4.10 Depressurization Performance of HPCIS Concern "The film condensation coefficient used to predict the depressurization performance of the High Pressure Coolant Injection (HPCI) system is based on extrapolation of available heat transfer data. Additional experiments or other supporting studies are needed to confirm the effectiveness of the HPCI system, and the results should be reviewed by the Regulatory Staff." (Peach Bottom, ACRS Letter, October 12, 1967, AEC Docket Nos. 50-278 and 50-279)
Resolution See paragraph I.3.3.8.
I.4.11 AEC General Design Criterion No. 35-Design Intent and Conformance Concern "The applicant and the Staff should resolve the manner in which the intent of General Design Criterion Number 35 (10 CFR 50.34 proposed) will be met for the Pilgrim plant." (Pilgrim, ACRS Letter, 4/12/68, AEC Docket No. 50-293)
"Discussion of General Design Criterion Number 35 (10 CFR 50.34 proposed) has occurred in connection with this review. The manner in which the "intent of this criterion" will be met for the Copper Nuclear Station should be resolved between the applicant and the AEC Regulatory Staff." (Cooper, ACRS Letter, March 12, 1968, AEC Docket No. 50-298)
Resolution See paragraph I.3.3.4.
I.4.12 Automatic Pressure Relief System-Initiation Interlock Concern "The applicant stated that he would give further consideration to a suitable interlock to ensure that low-pressure cooling capability would be available before the auto-relief depressurization could be initiated." (Pilgrim, ACRS Letter, April 12, 1968, AEC Docket No. 50-293)
I.0-39
BFN-16 Resolution See paragraph I.3.3.3.
I.4.13 Scram Reliability Study Concern "The Committee believes that, for transients having a high probability of occurrence, and for which action of a protective system or other engineered safety feature is vital to the public health and safety, an exceedingly high probability of successful action is needed. Common failure modes must be considered in ascertaining an acceptable level of protection. In the event of a turbine trip, reliance is placed on prompt control-rod scram to prevent large rises in primary system pressure. The applicant and his contractors have devoted considerable effort to providing a reliable protective system. However, systematic failures due to improper design, operation, or maintenance could obviate the scram reliability. The Committee recommends that a study be made of further means of preventing common failure modes from negating scram action, and of design features to make tolerable the consequences of failure to scram during anticipated transients." (Brunswick, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)
Resolution Studies are being performed by General Electric Company (a) to evaluate common mode failures that could negate scram action, and (b) of design features to make tolerable the consequences of failure to scram during anticipated transients.
Complete failure of the scram system (redundant reactor protection system and the 185 individual control rods) is considered an impossibility nevertheless, the studies will be performed. Upon completion of the studies, the applicant plans to consider the results, assess their appropriateness for Browns Ferry, and examine the provisions necessary to their implementation, if required, into the Browns Ferry facility.
A description of the intended study program is described in Brunswick Steam Electric Plant, Units 1 and 2,-Supplement 6, C/R 8.0, (AEC Docket Nos. 50-324 and 50-325). Refer to Sections 3 and 7 for further details on the scram system.
The above mentioned studies have been completed and it is anticipated that the results will be submitted on the Hatch or Vermont Yankee dockets in 1970.
I.0-40
BFN-16 I.4.14 Design Basis of Engineered Safety Features Concern "For purposes of design of the engineered safety features, the applicant has proposed using a fission-product source term smaller than that suggested in TID-14844, and a treatment of this source within the containment different from that recommended in the same document. The Committee believes that the assumptions of TID-14844 should be used as a design basis for the engineered safety features of the Brunswick plant, unless and until the use of a different set of assumptions has been justified to the satisfaction of the Regulatory Staff and the ACRS." (Brunswick, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)
Resolution General Design Basis Philosophy The engineered safety features for this facility are designed to perform preventive and mitigative functions when called upon during the course of any credible design basis accident. These functions are related to two general objectives: (1) protect the fuel barrier (i.e., maintenance of fuel cladding integrity, prevention of clad melt, minimization of extent of fuel rod perforation, etc.), and (2) minimize potential offsite doses (i.e., mitigate the cause and consequences of accidents, containment, filter, control elevated release, etc.). The design philosophy is that these functions must be maintained under all credible design basis accident conditions.
The radiological consequences-accident analysis employed in meeting the above two objectives was based upon the following criteria:
- a. liberal definitions and conservative assumptions for the initial accident event,
- b. appropriate conservative proven engineering calculational methods, and
- c. conservative actual or predicted system/equipment performance.
The design philosophy is to have and assure that substantial margins exist in the overall system, component, or equipment design. This is achieved from a thorough consideration of all factors, such as the fission product source terms, plateout, partition, etc., that may be reasonably expected to occur. Margin is applied to each assumption and calculational method consistent with the confidence level one has in the data and its uncertainties to achieve an overall margin.
I.0-41
BFN-16 Specific Design Basis Criteria In the spirit of the above general design basis philosophy, the radiological consequences-accident analysis methods and models employed in the design of this facility are those cited in the GE Topical Report28 submitted to the AEC in March 1969. This document reflected the approved design described in the construction permit D and AR documentation and the "as built" station conformance to 10 CFR 100 limits which are described in the FSAR.
TID-14844 Capability The TID-14844 sources are not considered possible, but in order to demonstrate the additional margin in the design, the engineered safety features were analyzed using the TID-14844 source terms. An assessment of the capability of the CSCS equipment to perform their intended functions is given in Section 14 along with the offsite radiological effects of such postulated source assumptions.
Summary All the necessary safety-related core cooling, containment, and/or design basis accident mitigating systems or components are capable of operating and performing their intended function while subject to the conservative design basis radiation sources or the postulated ultraconservative TID-14844 (AEC) sources without exceeding 10 CFR 100 guideline limits at the site boundaries.
I.4.15 Hydrogen Generation Study Concern "Studies are continuing on the possible effects of radiolysis of water in the unlikely event of a loss-of-coolant accident. The Committee believes the applicant should evaluate all problems which may arise from hydrogen generation, including various levels of Zircaloy-water reactions which could occur if the effectiveness of the emergency core cooling system were significantly less than that predicted. The matter should be resolved between the applicant and the AEC Regulatory Staff."
(Brunswick, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)
Resolution GE studies are continuing on the possible effects of radiolysis of water in the unlikely event of a loss-of-coolant accident. The studies will evaluate all problems that may arise from credible hydrogen generation. The study is also intended to show possible methods of handling postulated quantities of hydrogen generated by I.0-42
BFN-16 radiolysis. Details on the studies have been documented and submitted on Supplement 4, Brunswick Steam Electric Plant, Units 1 and 2. (AEC Docket Nos.
50-324 and 50-325)
Two General Electric topic reports were submitted to the AEC, in which it is clearly established that very little hydrogen is evolved as the result of the design basis LOCA event with the design minimum CSCS equipment being available for operation under all required failure modes. Even with further CSCS degradations, the modeled design clad temperatures (of approximately 2000°F) would not increase to levels (2800°F) where clad shattering or 1 percent metal water reactions could take place. The containment-metal/water reaction capability is 50 to 100 times greater than the maximum hydrogen level predicted based on CSCS performance.
I.4.16 Primary Containment Inerting Concern "The Committee believes that, with the present state of knowledge of the ECCS and the course of a postulated loss-of-coolant accident, the containment should be inerted during operation of the reactor. However, it is recognized that inerting increases problems of inspecting for and repairing leaks in the primary system. It is recommended that the requirement for inerting be periodically reviewed as operating experience and further knowledge from development work currently underway are obtained, and as other means of eliminating the hazards from accident generated hydrogen are found." (Dresden 2, ACRS Letter, 9/10/69, AEC Docket No. 50-237)
Resolution Although a primary containment atmospheric control system incorporation capability was originally described in the D and AR at the construction permit stage, subsequent design information indicated that such a system was neither necessary nor desirable. Before final development of the Core Standby Cooling Systems (CSCS), accidents were postulated which could result in a significant water-metal chemical reaction. Drywell inerting was originally proposed to prevent possible combustion of the hydrogen formed by the water-metal reaction. The CSCS provides completely redundant and independent methods of core cooling over the entire spectrum of reactor coolant piping breaks up to the complete severance of the largest recirculation pipe. Therefore, because any credible rupture of the reactor coolant boundary does not result in any core melting, only a negligible volume of hydrogen could be formed as a result of any water-metal reaction.
Two GE Topical Reports29,30 on file with the AEC contain additional supporting information on the deletion of the primary containment inerting system.
I.0-43
BFN-16 A review of another station (Dresden 2) is reported in an ACRS report to the chairman of the AEC in which it appears that the Dresden Unit 2 will be required to install inerting equipment. Neither TVA nor General Electric considers primary containment inerting to be desirable or necessary for the following reasons:
- a. The several accident prevention and limiting systems (CSCS) being provided are more than adequate to protect the health and safety of the public.
- b. An inert atmosphere will discourage the operating crew from entering the containment at the first opportunity in order to positively identify leaks or other abnormal phenomena detected by remote means and would inhibit the motivation to perform routine inspections within the containment.
- c. The inerting gas is a real and present danger to anyone entering the containment even after purging is thought to have been accomplished.
However, to avoid a potential delay if inerting is required prior to plant startup, a Containment Inerting System will be installed and available for use at that time. It is not intended to operate the containments with inerted atmosphere, though, unless review of operating experience and further knowledge from development work currently underway indicate that inerting is required.
Refer to Sections 5 and 6 for further details of the Containment System and the Core Standby Cooling Systems.
I.4.17 Seismic Design and Analysis Models Concern "The applicant is reviewing the seismic design of Class I structural and mechanical components of the plant and will complete his analysis before the reactor goes into operation. In the event that changes to the plant should be found necessary, such changes will be made on a time scale to be agreed upon between the applicant and the Regulatory Staff." (Dresden 2, ACRS Letter, 9/10/69, AEC Docket 50-237)
Resolution The method used to do the seismic (earthquake) analysis on the reactor coolant recirculation system piping of the Dresden 2/3 Plants was the same as used on other GE-BWR reactor coolant recirculation piping on other plants. The components of the Dresden 2/3 recirculation lines are very similar to the Browns Ferry Nuclear I.0-44
BFN-16 Plant. The size of the pump suction, risers, head and pump discharge are smaller; however, the length and shape of the components are nearly identical.
A reevaluation of the results (Method II) of the Dresden 2/3 recirculation lines was made by expanding the analysis to include the following alteration to the GE standard method referenced and described in the Monticello FSAR (Method I),
docket 50-263.
In the expanded analysis, the inertia forces for each mode were used to determine each mode's contribution to the total internal forces, moments and stresses in the pipe. The total combined results were obtained by taking the square root of the sum of the squares of each parameter, i.e., forces, moments, and stresses. This new analysis is identified and called Method II.
A summary of the three, highest stresses for Method I in each of the four components in the Dresden 2/3 recirculation lines and the corresponding stresses as calculated by Method II were submitted to the AEC31 for purposes of comparison in order to eliminate the subject concern above.
The comparison of the stresses of corresponding points as calculated by Method I were substantially in agreement with the stresses calculated by Method II.
From the above comparison, it may be concluded for the reactor coolant recirculation system loop lines on Dresden 2/3 that either Method I or II gives results reasonably close to one another. Since the Monticello recirculation lines are similar in shape and size to the Dresden 2/3 recirculation lines, it can be concluded that applying Method II analysis to Monticello would result in stress differences similar to those obtained on Dresden 2/3 Plants. Therefore, continued use of the seismic results and techniques as given in the "Report on Dynamic Earthquake Analysis of the Recirculation Lines-Appendix A" of the Monticello FSAR, Volume IV gives a conservative design of the recirculation piping lines and their supports and is in basic agreement with other methods suggested by others in reviewing the station seismic design.
The Dresden 2/3 reconfirmation of seismic design justification and conservation was submitted to the AEC-STAFF in October 1969. The same seismic techniques used on the above GE-BWRs have been used on this facility. Thus, the above resolution is applicable to the Browns Ferry Nuclear Plant.
TVA is making seismic analyses of critical piping systems using Method II described above. Refer to Appendix C for details of this analysis.
I.0-45
BFN-16 I.4.18 Automatic Pressure Relief System-Single Component Failure Capability-Manual Operation Concern "The automatic pressure relief subsystem should be modified so that at least the manual actuation of the subsystem would not be prevented by any single failure in the subsystem." (Dresden 2, ACRS Letter, 9/10/69, AEC Docket No. 50-23)
Resolution In order to provide an additional level of single component failure capability, the automatic pressure relief subsystem of the CSCS is designed to provide the subsystem with the ability to sustain a DC power failure in any of its DC battery feeds. The subsystem is designed and installed such that any of the redundant, independent 250-V DC battery system networks is available, automatically, for the required subsystem action. This modification will provide the subsystem (when manually operated) with the single component failure criteria application capability.
Sections 6 and 8 contain design description of the details of this additional functional capability.
I.4.19 Matters of Current Regulatory Staff-Applicant Discussion Concern "Several matters are still under discussion between the applicant and the Regulatory Staff. These include review of the need for separation of redundant components of the standby gas treatment system, and final revisions to the technical specifications.
The ACRS believes these matters can be resolved by the applicant and the Regulatory Staff." (Dresden 2, ACRS Letter, 9/10/69, AEC Docket 50-237)
Resolution Standby Gas Treatment System The standby gas treatment system design provides both electrical and physical isolation capability to each of the two treatment trains. This design provides a high degree of independence, isolation, and redundancy between the two full capacity treatment trains. This design provides for the need for separation of redundant components of the SGTS. The power supplies for the Standby Gas Treatment System meet single-failure criteria. Fan motors and heaters on each train are I.0-46
BFN-16 powered from separate 480-V Diesel Auxiliary Boards. Dampers fail to the safe position. Refer to Sections 5, 7, and 8 for further details.
Technical Specifications The technical specifications proposed in Appendix B reflect current AEC operational requirements for similar facilities (Monticello, Dresden, and Pilgrim facilities). The technical specifications to be incorporated into the facility licenses will be resolved with the regulatory staff.
I.4.20 Flow Reference Scram Concern "In the area of reactor instrumentation, the Committee believes that the flux scram point should be automatically reduced to an appropriate level as the reactor recirculation flow is reduced below the normal full-power flow." (Brunswick, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)
Resolution Although it is felt that a flow reference scram is not required for safety purposes, the flow reference scram system is being designed and installed such that the flux scram point will be automatically reduced to an appropriate level as the reactor coolant recirculation flow is reduced below the normal full-power flow.
The flow reference scram system will sum the flow sensed in each of the reactor coolant recirculation loops and provide a flow reference signal to vary the neutron flux scram setpoint. Flow will be sensed from one flow measurement venturi in each of the two reactor coolant recirculation loops.
The station transient analyses (Section 14) demonstrate that, for all transient considered, the core is adequately protected with a fixed APRM scram trip setting at 120 percent of rated neutron flux and the high-pressure scram setting of 1070 psig.
Therefore, it is intended to ultimately replace the automatic flow referenced scram with a fixed 120 percent scram setting, providing that initial power operation confirms the nuclear behavior characteristics used in these transient analyses.
Refer to Section 7 for further details.
I.0-47
BFN-16 I.4.21 Future Items of Considerations for Incorporation Concern "Continuing research is expected to enhance safety of water-cooled reactors in other areas than those mentioned, for example, by the determination of the extent of radiolytic decomposition of cooling water in the unlikely event of a loss-of-coolant accident, development of instrumentation for in-service monitoring of the pressure vessel and other parts of the primary system for vibration and detection of loose parts in the system, and evaluation of the consequences of water contamination by structural materials and coatings in a loss-of-coolant accident. As solutions to the problems develop and are evaluated by the Regulatory Staff, appropriate action should be taken by the applicant on a reasonable time scale." (Dresden 2, ACRS Letter, 9/10/69, AEC Docket No. 50-237)
Resolution Radiolytic Decomposition of Cooling Water Refer to Appendix I, Subsection I.4.15.
Development of Instrumentation-Vibration and Loose Parts Detection Studies Refer to Appendix I, Subsection I.4.24.
Consequences of Water Containment-Structural Materials-LOCA Coatings and materials of insulation in the primary containments have been selected to minimize the possibility of contaminating cooling water circulated during the design basis loss-of-coolant accident. In addition, the sizing of the strainers in the torus and the pipes connecting the torus and suction header was conservatively based on the assumption that at least one of the four strainers was completely plugged during the postulated accident.
I.4.22 Diesel Generator Synchronization Considerations Concern "The Committee recommends that the applicant give further consideration to the design of the emergency onsite power system to avoid the need for synchronization of the diesel-driven generators." (Cooper, ACRS Letter, 3/12/68, AEC Docket No.
50-298)
I.0-48
BFN-16 Resolution The plant standby diesel generator system, although composed of four diesel generator units, is designed so that each unit is completely separated both physically and electrically from the other unit. Each unit feeds sufficient and diverse CSCS loads (components) that the necessary core cooling function is completely satisfied by each unit without any synchronization or transfer of loads between units.
The design is such as to conform with the total CSCS requirement of not negating the required CSCS action even when subjected to the single component failure analysis.
Therefore, for normal operation and safety (CSCS) action the synchronization of diesel generators is not required.
Refer to Sections 6, 7, and 8 for further design details.
I.4.23 Development of Instrumentation-Primary Containment Leakage Detection System-Increased Sensitivity Studies Concerns "It is recommended that supplemental and potentially more sensitive methods of primary system leak detection be studied, evaluated, and implemented if they provide significant improvements in measurement of leak rate, in the time needed to measure leak rate, or in distinguishing the nature of the leak. The study and evaluation should be completed within a year." (Oyster Creek, ACRS Letter, 12/12/68, AEC Docket No. 50-218)
Resolution See paragraph I.3.3.10.
I.4.24 Development of Instrumentation-Vibration and Loose Parts Detection Studies Concern "The applicant has stated that he plans to study possible means of instrumenting and monitoring for vibration or for the presence of loose parts in the reactor pressure vessel as well as in other portions of the primary system and, by the time of the first refueling outage, to implement such means as are found practical and appropriate."
(Nine Mile Point, ACRS Letter, 4/17/69, AEC Docket No. 50-219)
I.0-49
BFN-16 Resolution It is not planned to provide instrumentation for monitoring for vibration or for the presence of loose parts in the reactor primary system. The results of studies committed by others (Niagara-Mohawk Power Corporation-Refer to ACRS Letter-Nine Mile Point Nuclear Station, Unit 1, 4/17/69, AEC Docket No. 50-219) will be examined for appropriate disposition in regards to this facility when such data are made available. Refer to Sections 3, 4, and Appendix C for further details.
I.4.25 CSCS Leakage Detection, Protection, and Isolation Capability Concern Engineered safety systems that are required to recirculate water after a loss-of-coolant accident should be designed so that a gross system leak will not result in critical loss of recirculation or in loss of isolation capability. The Committee believes that exception to this general rule may be made in respect to a very short pipe from the torus to the first valve, if extremely conservative design of the pipe (and its connection to the torus) is used and suitably remote operability of the valve is provided. The design of these systems also should provide adequate leak detection and surveillance capability. (Brunswick, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)
Resolution The design of the Browns Ferry Nuclear Plant conforms to the intent of the recently proposed AEC 70 General Design Criteria (refer to FSAR, Appendix A). As shown in Appendix A (Group Discussion-Criterion 37 through 65), the plant design meets the intent of all AEC Design Criteria with regards to CSCS and the station containment systems. Examination of each of the AEC Design Criterion requirements individually establish that
- a. No AEC Design Criterion requires a Class I passive component failure(s) protection. That is, failure of pipes, valve bodies, pump casings, etc., is not required.
- b. It does require the design (1) to provide safety function assuming a failure of a single active component (Criterion 41),
(2) to provide safety systems that shall not share active components and shall not share other features or components unless it can be I.0-50
BFN-16 demonstrated that (a) the capability of the shared feature or component to perform its required function can be readily ascertained during reactor operation, (b) failure of the shared feature or component does not initiate a LOCA, and (c) capability of the shared feature or component to perform its required function is not impaired by the effects of a LOCA and is not lost during the entire period this function is required following the accident (Criterion 44),
(3) to perform its required function and not be impaired by the effects of a LOCA (Criterion 42), and finally (4) to provide heat removal systems which prevent the containment from exceeding its design pressure (Criterion 52).
The Browns Ferry design meets all the above (b.1 through b.4), but only under the single active component failure criteria. Attention to failures of Class I passive components is not necessary by requirement. Although provisions for mitigating the consequences on non-Class I structure, system, component, etc., equipment from having any adverse effect on the Class I equipment required for safety function.
With this in mind, the ACRS concern is interpreted to require the following:
"Provide the capability to mitigate the consequences (in terms of radiological dose and core cooling continuity effects) of normal or credible accident induced equipment leakage."
In response to this concern, the Browns Ferry design includes a nuclear system leakage detection, isolation, processing, and makeup system. This system (comprising many normal station operational subsystems) provides for leakage control capability. This capability includes:
- a. identifying the reactor building (or reactor primary system) leakage sources,
- b. efficiently isolating and controlling the sources,
- c. effectively removing the residual leakage water (before and after isolation), and
- d. conveniently replacing the leakage liquid and/or restoring the source system function.
The above is done under normal operation or postaccident conditions in a manner in which normal (10 CFR 20) or accident (10 CFR 100) offsite reference values are not I.0-51
BFN-16 exceeded and in a manner in which the core and the containment cooling continuity is not impaired or negated.
Refer to Sections 4, 9, and 10 for additional details on this system. The normal or credible accident induced leakage cited above is the leakage from active components in the CSCS. These sources represent a maximum value of from 10 to 50 gpm in leakage rates.
The thorough examination of the AEC 70 General Design Criteria referenced and cited above appears in Brunswick Steam Electric Plan, Units 1 and 2-Supplement 4, C/R 6.4 (AEC Docket Nos. 50-324 and 50-325). The analysis of the events applied to the Browns Ferry facility provide similar results.
I.4.26 Main Steamlines-Standards for Fabrication, QC, and Inspection Concern The Committee has reviewed the applicant's proposal concerning standards of design, fabrication, and inspection of the steamlines downstream of the second isolation valve. The Committee concurs with the approach used in analyzing the stresses in the piping during an Operating Basis Earthquake. The Committee recommends that a program of spot radiography of the field butt welds be employed by the applicant as a quality control measure. Consideration should be given to an appropriate program of inservice inspection. (Brunswick, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)
Resolution The main steamlines downstream of the second isolation valve to the turbine stop valve are designed, fabricated, and inspected in accordance with USAS B31.1.0 with the following supplementary examinations:
- a. All shop and field butt welds are 100 percent examined by radiography and accessible surfaces of the weld and adjacent base metal are examined by either liquid penetrant or magnetic particle methods.
- b. Special steamline headers made from plate are 100 percent ultrasonic tested and all welds are examined as in (a) above.
- c. Special fittings made from forgings are examined on all accessible surfaces by either liquid penetrant or magnetic particle methods.
I.0-52
BFN-16 I.4.27 Summary The Browns Ferry facility has been designed with sufficient flexibility and capability to accommodate the ACRS concern items above, as stated and resolved, although the original construction permit approvals did not include or identify them as being required for safe operation.
I.5 AREAS SPECIFIED IN OTHER RELATED AEC-STAFF CONSTRUCTION PERMIT OR OPERATING LICENSE SAFETY EVALUATION REPORTS I.5.1 General The following areas of concern, attention, or further study have been noted in AEC-Staff Safety evaluation reports on recent GE-BWR construction and operating permit applications. Although these have not been addressed to this facility directly as required, a detailed, comprehensive review of each item and the Browns Ferry design conformance to it is analyzed.
I.5.2 Tornado and Missile Protection-GE-BWR-Spent Fuel Storage Pool Resolution The objective of a GE Topical Report was to investigate the potential effects of a tornado striking the fuel storage pool of a Boiling Water Reactor (BWR). A brief discussion of the tornado phenomena is provided and two key concerns were examined to determine (a) whether sufficient water could be removed from the pool to prevent cooling of the fuel, and (b) whether missiles could potentially enter the pool and damage the stored fuel.
The fuel pool in a General Electric BWR reactor building is designed with substantial capability for withstanding the effects of a tornado, as this document shows. The design of the fuel pool makes the removal of more than 5 feet of water due to tornado action highly improbable. With 25 feet of water covering the fuel racks, the removal of 5 feet of water is of no concern. Protection against a wide spectrum of tornado-generated missiles is provided by the water which covers the fuel racks. It is shown that protection is provided against all tornado-generated missiles having a probability of hitting the pool greater than 1 per 1.4 billion reactor lifetimes. Typical potential missiles in this category include a spectrum ranging up to a 3-inch-diameter steel cylinder 7-feet long or a 14-inch-diameter wooden pole 12-feet long.
I.0-53
BFN-16 The General Electric Company concludes, therefore, that adequate protection for the fuel pool against the effects of a tornado has been provided for and no additional protection is required.
Refer to Sections 2, 10, and 12 for further details.
I.5.3 BWR System Stability Analysis Resolution The development of a BWR Stability Model which would predict the onset of instabilities in the reactor core in this station has been completed and the excellent agreement between model predictions and experimental data that has been reported in the following GE Topical Reports 33,34 submitted to the AEC and in GE Memorandum,35 submitted on Peach Bottom Atomic Power Station, Units 2 and 3, AEC Docket Nos. 50-277 and 50-278. Refer to Section 7 for further details.
I.5.4 Summary The Browns Ferry facility has been designed with sufficient flexibility and capability to accommodate the AEC-STAFF concern items above although the original construction permit approvals did not include or identify them as being required for safe operation.
I.6
SUMMARY
CONCLUSIONS The necessary research and development programs, additional information, or special analysis to support the application for a provisional operating permit for this station is discussed and justified in the above sections. Resolution of Browns Ferry AEC-ACRS and AEC-Staff concern items at the construction permit phases have been examined and ample support for their complete satisfaction is presented.
Thus, it is concluded that no further research and development or related activities are necessary for this facility in order to comply with the construction permit cited concerns and requirements.
I.0-54
BFN-16 APPENDIX I I.7 REFERENCES
- 1. Bray, A. P. et al., "The General Electric Company, Analytical and Experimental Programs for Resolution of ACRS Safety Concerns," APED-5608, April 1968.
- 2. NEDO-10208, "Effects of Fuel Rod Failure on ECCS Performance," August 1970.
- 3. NEDO-10173, "Current State of Knowledge High Performance BWR Zircalloy-Clad Uo Fuel," May 1970.
- 4. Ianni, P. W., "Effectiveness of Core Standby Cooling Systems for General Electric BWR," APEO-5458, March 1968.
- 5. NEDO-10179, "Effects of Cladding Temperature and Material on ECCS Performance," June 1970.
- 6. "Summary of Results Obtained From a Typical Startup and Power Test Program for a GE-BWR," APED-5698, February 1969.
- 7. Rockwell, D. A. and Van Zylstra, E. H., "Design and Performance of GE-BWR Main Steamline Isolation Valves," APED-5750, March 1969.
- 8. Rockwell, D. A., "Consequences of a Steamline Break for a GE-BWR,"
NEDO-10045, October 1969.
- 9. Gusfarson, H. P., General Motors Electro Motive Div., "Development of Diesel Standby Generators for Emergency Use in Nuclear Power Plants," January 1968, IEEE Winter Power Meeting, New York, N.Y.
- 10. ANL 7438, Progress Report, March 1968.
- 11. "Effectiveness of Core Standby Cooling Systems for GE-BWRs," GE APED-5458, March 1968.
- 12. Stanley, L., Starr, J. D., and Thompson, O. A., "Control Rod Worth Minimizer,"
APED-5449, March 1967.
- 13. "Control Rod Velocity Limiter," APED-5446, March 1967.
I.0-55
BFN-16
- 14. Morgan, W., "In-Core Nuclear Instrumentation Systems for Oyster Creek, Unit 1 and Nine Mile Point, Unit 1 Reactors," APED-5456, August 1968.
- 15. Morgan, W., "In-Core Neutron Monitoring System for GE-BWR," APED-5706, November 1968, revised April 1969.
- 16. Holland, K., "Design and Performance of GE-BWR Jet Pumps," APED-5460, September 1968.
- 17. "Stability and Dynamic Performance of the GE-BWR," GE APED-5652, (April 1969).
- 18. "Analytical Methods for Evaluating the Radiological Aspects of GE APED-5756," (March 1969).
- 19. "Analysis Methods of Hypothetical Super-Prompt Critical Reactivity Transients in Large Power Reactors," GE APED-5448, (April 1968).
- 20. "Nuclear Excursion Technology," GE APED-5528, (August 1967).
- 21. "The Mechanical Effect of Reactivity Transients," GE APED-5455, (January 1968).
- 23. Hatch Nuclear Plant, Unit 1 - Amendment No. 6 - Item No. 2 - AEC Docket No.
50-321.
- 24. "Design and Analysis of the Control Rod Drive Reactor Vessel Penetrations,"
GE APED-5703, November 1968.
- 25. "An Analytical Study on Brittle Fracture of GE-BWR Vessel Subject to the Design Basis Accident (LOCA)," by L. C. Hsui, NEDO-10029, July 1969.
- 26. Rogers, A. E. and Torbeck, V. E., "Depressurization Performance of the GE-BWR-HPCIS," APED-5447, June 1969.
- 27. Rockwell, D. A., "Consequences of a Steamline Break for a GE-BWR,"
NEDO-10045, October 1969.
- 28. "Analytical Methods for Evaluation of the Radiological Aspects of the GE-BWR," GE APED-5756, March 1969.
I.0-56
BFN-16
- 29. "Metal-Water Reactions-Effects on Core Cooling and Containment,"
GE APED-5454, March 1968.
- 30. "Considerations Pertaining to Containment Inerting," GE APED-5654, August 1968.
- 31. Monticello Nuclear Generating Plant - Amendments 20 and 23, AEC Docket No. 50-263.
- 32. "Tornado Protection for the Spent Fuel Storage Pool," GE APED-5696, November 1968.
- 33. Holland, K. and Ianni, P. W., "Stability and Dynamic Performance of the GE BWR," APED-5652, April 1969.
I.0-57