ML21081A025: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot insert)
 
(StriderTol Bot change)
Line 17: Line 17:


=Text=
=Text=
{{#Wiki_filter:DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Enclosure 1 Supplemental Information to Support the AP1000 Design Certification Extension (Non-Proprietary)
{{#Wiki_filter:}}
                          © 2021 Westinghouse Electric Company LLC All Rights Reserved
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Summary Description (Non-Proprietary)
                    © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                            2
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
 
==Purpose:==
By {{letter dated|date=June 26, 2020|text=letter dated June 26, 2020}} (ML20178A640), Westinghouse requested the NRC extend the duration of the AP1000 design certification (DC). In order to enable the NRC staff to make the necessary safety findings under 10 CFR 52.54, Westinghouse is submitting information that documents five previously resolved technical issues related to the AP1000 design certification. These technical issues were resolved as part of the Levy, Lee, and Turkey Point AP1000 combined license (COL) applications, as well as the Vogtle 3&4 COL. The purpose of the submittal is to update the certified design with the same design information that NRC previously approved as part of the COL process.
Details of the five previously identified & resolved technical issues can be found in the Vogtle 3&4 documentation shown in the table below. Site specific Vogtle UFSAR sections impacted by these five changes are not incorporated into the generic DCD markups provided in the attachments. The DCD table of contents and page numbers are not updated, as this submittal is not a renewal application. The revised DCD content is replacement information, not replacement pages.


LAR Number          Amendment Request    Amendment            NRC SER Approval Passive Core Cooling        SNC LAR-16-026      ML16319A120          ML17024A317          ML17024A307 System (PXS) Condensate      (WEC LAR-053)        ML16321A416 Return                                            (Supplement 1)
Main Control Room            SNC LAR-17-001      ML17129A608          ML18011A885          ML18011A894 Emergency Habitability      (WEC LAR-082)        ML17258B211 System (VES) Changes to                          (Supplement 1)
Satisfy Post-Actuation Performance Requirements Improvements to Main        SNC LAR-17-023      ML17243A352,        ML18085A620          ML18085A628 Control Room (MCR)          (WEC LAR-099)        ML18040A489 Post-Accident                                    (Supplement 1)
Radiological                                      ML18067A648 Consequences                                      (Supplement 2)
Hydrogen Venting from        SNC LAR-17-003      ML17053A425          ML17213A217          ML17213A224 Passive Core Cooling        (WEC LAR-093)        ML17153A362 System (PXS)                                      (Supplement 1)
Compartments PMS Logic Changes for        SNC LAR-16-006      ML16168A399          ML16320A097          ML16320A174 Source Range Flux            (WEC LAR-Doubling                    0103)

                              © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                                      3
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Passive Core Cooling System (PXS) Condensate Return (Ext-01)
The DCD changes for the following sections are consistent with the licensing basis markups in the Southern Nuclear LAR-16-026 [ML16319A120 and ML16321A416].
x Tier 1, Table 2.2.3-1                                    x Tier 2, Figure 6.3-1 (Sheet 1) x Tier 1, Table 2.2.3-2                                    x Tier 2, Figure 6.3-1 (Sheet 2) x Tier 2, Subsection 1.9.4.2.2                            x Tier 2, Figure 6.3-1 (Sheet 3) x Tier 2, Subsection 1.9.5.1.5                            x Tier 2, Subsection 7.4 x Tier 2, Table 3.2-3                                      x Tier 2, Subsection 7.4.1.1 x Tier 2, Subsection 5.4.5.2.1                            x Tier 2, Table 9.5.1-1 x Tier 2, Subsection 5.4.11.2                              x Tier 2, Table 14.3-2 x Tier 2, Subsection 5.4.14.1                              x Tier 2, Subsection 15.0.13 x Tier 2, Subsection 6.3.1.1.1                            x Tier 2, Subsection 15.2 x Tier 2, Subsection 6.3.1.1.4                            x Tier 2, Subsection 15.2.6.1 x Tier 2, Subsection 6.3.1.1.6                            x Tier 2, Ch.16 Tech Spec 3.5.4 x Tier 2, Subsection 6.3.1.2                              x Tier 2, Ch.16 Tech Spec Bases B3.5.4 x Tier 2, Subsection 6.3.1.2.1                            x Tier 2, Table 19.59-18 x Tier 2, Subsection 6.3.2.1                              x Tier 2, Subsection 19E.2.3.2.6 x Tier 2, Subsection 6.3.2.1.1                            x Tier 2, Subsection 19E.4.10.2 x Tier 2, Subsection 6.3.2.2.7                            x Tier 2, Subsection 19E.9 x Tier 2, Subsection 6.3.2.2.7.1                          x Tier 2, Table 19E.4.10-1 x Tier 2, Subsection 6.3.2.2.7.2                          x Tier 2, Figure 19E.4.10-1 x Tier 2, Subsection 6.3.2.8                              x Tier 2, Figure 19E.4.10-2 x Tier 2, Subsection 6.3.3                                x Tier 2, Figure 19E.4.10-3 x Tier 2, Subsection 6.3.3.2.1.1                          x Tier 2, Figure 19E.4.10-4 x Tier 2, Subsection 6.3.3.4.1 The DCD changes for the following Tech Spec sections are consistent with the licensing basis markups in the Turkey Point Units 6 & 7 Tech Specs [ML16250A350]. (Note: The Turkey Point Tech Spec changes are referenced since the Southern Tech Specs for these sections were reformatted prior to implementing SNC Vogtle 3&4 LAR-16-026.)
x Tier 2, Ch. 16, Tech Spec Bases B3.3.3
                              © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                                            4
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Main Control Room Emergency Habitability System (VES) Changes to Satisfy Post-Actuation Performance Requirements (Ext-02)
The proposed DCD changes for the following sections are consistent with the licensing basis markups in the Southern Nuclear LAR-17-001 [ML17129A608 and ML17258B211].
x Tier 1, Section 2.2.5                                        x Tier 2, Subsection 6.4.5.1 x Tier 1, Table 2.2.5-1                                        x Tier 2, Subsection 6.4.5.3 x Tier 1, Table 2.2.5-4                                        x Tier 2, Subsection 6.4.5.4 x Tier 1, Table 2.2.5-5                                        x Tier 2, Subsection 6.4.8 x Tier 1, Table 2.5.2-3                                        x Tier 2, Table 6.4-3 x Tier 1, Table 2.5.2-4                                        x Tier 2, Figure 7.2-1 (Sheet 13) x Tier 2, Table 1.1-1                                          x Tier 2, Subsection 7.3.1.2.17 x Tier 2, Table 1.6 (See Note 1)                              x Tier 2, Table 7.3-1 x Tier 2, Table 3.7.3-1                                        x Tier 2, Table 7.3-3 x Tier 2, Table 3.9-12                                        x Tier 2, Table 7.5-1 x Tier 2, Table 3.9-16                                        x Tier 2, Table 7.5-7 x Tier 2, Table 3.9-17                                        x Tier 2, Subsection 7A.4 x Tier 2, Table 3.11-1                                        x Tier 2, Subsection 7A.8 x Tier 2, Table 3D.5-4                                        x Tier 2, Subsection 9.3.1.1.2 x Tier 2, Figure 3D.5-1                                        x Tier 2, Subsection 9.4.1.1.2 x Tier 2, Table 3I.6-2                                        x Tier 2, Subsection 9.4.1.2.3.1 x Tier 2, Table 3I.6-3                                        x Tier 2, Subsection 14.2.9.1.6 x Tier 2, Subsection 6.4.2.2                                  x Tier 2, Table 14.3-7 x Tier 2, Subsection 6.4.2.3                                  x Tier 2, Ch.16 Tech Spec 3.7.6 x Tier 2, Subsection 6.4.3.2                                  x Tier 2, Ch.16 Tech Spec Bases B3.7.6 x Tier 2, Subsection 6.4.4 The DCD changes for the following Tech Spec sections are consistent with the licensing basis markups in the Turkey Point Units 6 & 7 Tech Specs [ML16250A350]. (Note: The Turkey Point Tech Spec changes are referenced since the Southern Tech Specs for these sections were reformatted prior to implementing SNC Vogtle 3&4 LAR-17-001.)
x Tier 2, Ch.16 Tech Spec 3.3.2 x Tier 2, Ch.16 Tech Spec Bases B3.3.2 Note:
: 1. The DCD Tier 2, Subsection 1.6-1 is revised to note that the Topical Reports listed in Tier 2, Subsection 7A have been modified. This change was previously reviewed and approved as part of SNC LAR          020S2 and SNC LAR-15-017 [ML14251A301 and ML16046A009].
                              © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                                              5
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Improvements to Main Control Room (MCR) Post-Accident Radiological Consequences (Ext-03)
The proposed DCD changes for the following sections are consistent with the licensing basis markups in the Southern Nuclear LAR-17-023 [ML17243A352, ML18040A489, and ML18067A648].
x Tier 1, Section 2.2.5                                      x Tier 2, Subsection 12.2.1.3.1 x Tier 1, Table 2.2.5-1                                      x Tier 2, Subsection 12.2.1.3.2 x Tier 1, Table 2.2.5-5                                      x Tier 2, Table 12.2-28 x Tier 1, Section 2.7.1                                      x Tier 2, Table 12.2-29 x Tier 1, Table 5.0-1                                        x Tier 2, Subsection 12.3.2.2.7 x Tier 2, Section 1.9.4.2.3                                  x Tier 2, Figure 12.3-1 (Sheet 6) x Tier 2, Appendix 1A                                        x Tier 2, Figure 12.3-2 (Sheet 7) x Tier 2, Table 2-1                                          x Tier 2, Figure 12.3-2 (Sheet 8) x Tier 2, Subsection 3.1.2 (See Note 1)                      x Tier 2, Subsection 12.4.1.8 x Tier 2, Subsection 6.4                                    x Tier 2, Table 14.3-7 x Tier 2, Subsection 6.4.2.6                                x Tier 2, Subsection 15.1.5.4.1 x Tier 2, Subsection 6.4.3.2                                x Tier 2, Subsection 15.1.5.4.6 x Tier 2, Subsection 6.4.4                                  x Tier 2, Table 15.1.5-1 x Tier 2, Table 6.4-2                                        x Tier 2, Subsection 15.3.3.3.1 x Tier 2, Figure 6.4-1                                      x Tier 2, Table 15.3-3 x Tier 2, Figure 6.4-2 (Sheet 2)                            x Tier 2, Subsection 15.4.8.3.1 x Tier 2, Figure 7.2-1 (Sheet 13)                            x Tier 2, Table 15.4-4 x Tier 2, Subsection 7.3.1.2.17                              x Tier 2, Subsection 15.6.2 x Tier 2, Subsection 7.3.1.5.2                              x Tier 2, Subsection 15.6.3.3.1 x Tier 2, Table 7.3-1                                        x Tier 2, Subsection 15.6.3.3.6 x Tier 2, Table 7.3-4                                        x Tier 2, Subsection 15.6.5.3.2 x Tier 2, Subsection 9.2.6.1.1                              x Tier 2, Subsection 15.6.5.3.5 x Tier 2, Subsection 9.4.1.1.1                              x Tier 2, Subsection 15.6.5.3.8.2 x Tier 2, Subsection 9.4.1.1.2                              x Tier 2, Subsection 15.6.6 x Tier 2, Subsection 9.4.1.2.1.1                            x Tier 2, Table 15.6.3-3 x Tier 2, Subsection 9.4.1.2.3.1                            x Tier 2, Table 15.6.5-2 x Tier 2, Subsection 9.4.1.2.3.2                            x Tier 2, Table 15.6.5-3 x Tier 2, Subsection 9.4.2.2.3.1                            x Tier 2, Subsection 15.7.4.2 x Tier 2, Subsection 9.4.2.2.3.2                            x Tier 2, Subsection 15A.3.1.2 x Tier 2, Subsection 9.4.2.2.3.3                            x Tier 2, Table 15A-6 x Tier 2, Table 9.4-1                                        x Tier 2, Table 15A-7 x Tier 2, Table 9.4.1-1                                      x Tier 2, Figure 15A-1 x Tier 2, Figure 9.4.1-1 (Sheet 5)                          x Tier 2, Subsection 15B.1 x Tier 2, Table 11.1-4                                      x Tier 2, Ch.16 TS 3.7.4 x Tier 2, Table 11.1-5                                      x Tier 2, Ch.16 TS Bases B3.4.10 x Tier 2, Table 11.1-6                                      x Tier 2, Ch.16 TS Bases B3.7.4 x Tier 2, Subsection 11.5.1.1                                x Tier 2, Ch.16 TS Bases B3.7.6 x Tier 2, Subsection 11.5.2.3.1                              x Tier 2, Ch.16 TS Bases B3.9.4 x Tier 2, Figure 11.5-6 (See Note 2)
The following DCD sections contain additional changes consistent with licensing basis markups found in NRC approved Topical Report WCAP-17524-P-A, Revision 1, AP1000 Core Reference Report [ML15180A187].
These Chapter 15 markups were an input to the Duke William States Lee COLA departure request [ML16049A411]
and Vogtle LAR-16-001 [ML16201A435]. (Note: The markup pages identify these changes as Ext-03 (CRR))
x Tier 2, Table 1.6-1                                    x Tier 2, Subsection 15.0.11.1
                            © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                                      6
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 x  Tier 2, Subsection 15.0.11.6                            x  Tier 2, Subsection 15.4.8.3.5 x  Tier 2, Table 15.0-2                                    x  Tier 2, Subsection 15.4.8.3.6 x  Tier 2, Subsection 15.1.5.4.1                          x  Tier 2, Subsection 15.4.10 x  Tier 2, Table 15.1.5-1                                  x  Tier 2, Table 15.4-1 x  Tier 2, Table 15.3-3                                    x  Tier 2, Table 15.4-3 x  Tier 2, Subsection 15.4.8.1.1.3                        x  Tier 2, Table 15.4-4 x  Tier 2, Subsection 15.4.8.1.2                          x  Tier 2, Figure 15.4.8-1 x  Tier 2, Subsection 15.4.8.2                            x  Tier 2, Figure 15.4.8-2 x  Tier 2, Subsection 15.4.8.2.1                          x  Tier 2, Figure 15.4.8-3 x  Tier 2, Subsection 15.4.8.2.1.1                        x  Tier 2, Figure 15.4.8-4 x  Tier 2, Subsection 15.4.8.2.1.2                        x  Tier 2, Subsection 15.6.2.6 x  Tier 2, Subsection 15.4.8.2.1.3                        x  Tier 2, Subsection 15.6.3.3.6 x  Tier 2, Subsection 15.4.8.2.1.4                        x  Tier 2, Subsection 15.6.5.3.8.1 x  Tier 2, Subsection 15.4.8.2.1.5 x  Tier 2, Table 15.6.2-1 x  Tier 2, Subsection 15.4.8.2.1.7 x  Tier 2, Table 15.6.3-3 x  Tier 2, Subsection 15.4.8.2.1.8 x  Tier 2, Table 15.6.5-2 x  Tier 2, Subsection 15.4.8.2.1.9 x  Tier 2, Subsection 15.7.4.5 x  Tier 2, Subsection 15.4.8.3 x  Tier 2, Table 15.7-1 x  Tier 2, Subsection 15.4.8.3.1 Note:
: 1. The DCD Tier 2, Subsection 3.1.2 markup is consistent with the Tier 2, Subsection 3.2.1 UFSAR markup provided in the Southern Nuclear LAR-17-023. The DCD markup removes discussion of automatic isolation of VES on low pressurizer pressure. This change was implemented within the Vogtle 3&4 UFSAR under 10 CFR 52 Appendix D B.5.b criteria prior to submittal of LAR-17-023. Therefore, since the discussion was removed in the LAR-17-023 markups, it is also being removed as part of the generic DCD markups.
: 2. The DCD Tier 2, Figure 11.5-6 markup provided in is consistent with the Tier 2, Figure 11.5-6 UFSAR markup provided in the Southern Nuclear LAR-17-023. The DCD markup matches the UFSAR markup by removing the control signal arrow sent to PMS and adding the control signal received by PMS. This change was implemented within the Vogtle 3&4 UFSAR under 10 CFR 52 Appendix D B.5.b criteria prior to submittal of LAR-17-023. Therefore, since the control signal indication was shown in the LAR-17-023 markups, it is also being modified as part of the generic DCD markups.
                              © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                                          7
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Hydrogen Venting from Passive Core Cooling System (PXS) Compartments (Ext-04)
The proposed DCD changes for the following sections are consistent with the licensing basis markups in the Southern Nuclear LAR-17-003 [ML17053A425 and ML17153A362].
x Tier 1, Table 2.3.9-3 x Tier 2, Subsection 6.2.4.5.1 x Tier 2, Subsection 19.41.7 x Tier 2, Subsection 19.59.9.5.6 x Tier 2, Table 19.59-18 x Tier 2, Table 19D-7 PMS Logic Changes for Source Range Flux Doubling (Ext-05)
The proposed DCD changes for the following sections are consistent with the licensing basis markups in the Southern Nuclear Vogtle 3&4 LAR-16-006 [ML16168A399].
x Tier 2, Figure 7.2-1 (Sheet 3) (See note 1) x Tier 2, Subsection 7.3.1.2.14 x Tier 2, Subsection 7.3.1.2.15 (See note 2) x Tier 2, Table 7.3-1 x Tier 2, Table 7.3-2 x Tier 2, Subsection 9.3.6.3.7 x Tier 2, Subsection 9.3.6.4.5.1 x Tier 2, Subsection 9.3.6.7 x Tier 2, Subsection 19E.2.7.2 The DCD changes for the following Tech Spec sections are consistent with the licensing basis markups in the Turkey Point Units 6 & 7 Tech Specs [ML16250A350]. (Note: The Turkey Point Tech Spec changes are referenced since the Southern Tech Specs for these sections were reformatted prior to implementing SNC Vogtle 3&4 LAR-16-006.)
x Tier 2, Ch.16 Tech Spec 3.3.2 x Tier 2, Ch.16 Tech Spec Bases B3.3.2 Note:
: 1. The DCD Tier 2, Figure 7.2-1 Sheet 3 markup provided is consistent with the Tier 2, Figure 7.2-1 Sheet 3 UFSAR markup provided in the Southern Nuclear LAR-17-003. The DCD markup includes a time delay in the functional logic for the actuation of the demineralized water system (DWS) isolation valves. This time delay was implemented within the Vogtle 3&4 UFSAR under 10 CFR 52 Appendix D B.5.b criteria prior to submittal of LAR-17-003. Therefore, since it was included in LAR-17-003, it is also being included as part of the generic DCD markups.
: 2. The DCD Tier 2, Subsection 7.3.1.2.15 markup provided is consistent with the Tier 2 7.3.1.2.15 UFSAR markup provided in the Southern Nuclear LAR-17-003. The DCD markup includes the new paragraph for Source Range flux doubling. This paragraph was implemented within the Vogtle 3&4 UFSAR under 10 CFR 52 Appendix D B.5.b criteria prior to submittal of LAR-17-003. Therefore, since it was included in LAR-17-003, it is also being included as part of the generic DCD markups.
                                © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                                              8
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Design Control Document Markup Pages Passive Core Cooling System (PXS) Condensate Return (Ext-01)
(Non-Proprietary)
                          © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                              9
 
DCP_NRC_003343                                                    Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                    AP1000 Design Control Document Table 2.2.3-1                                                          Commented [HZS1]: Ext-01 ASME                          Class 1E/                                Loss of Code              Remotely    Qual.      Safety-    Control          Motive Section Seismic    Operated    Harsh    Related      PMS/    Active  Power Equipment Name                Tag No. III    Cat. I      Valve      Envir. Display      DAS    Function Position Passive Residual Heat            PXS-ME-01  Yes    Yes          -        -/-        -          -/-      -        -
Removal Heat Exchanger (PRHR HX)
Accumulator Tank A              PXS-MT-01A  Yes    Yes          -        -/-        -          -/-      -        -
Accumulator Tank B              PXS-MT-01B  Yes    Yes          -        -/-        -          -/-      -        -
Core Makeup Tank                PXS-MT-02A  Yes    Yes          -        -/-        -          -/-      -        -
(CMT) A CMT B                          PXS-MT-02B  Yes    Yes          -        -/-        -          -/-      -        -
IRWST                            PXS-MT-03  No      Yes          -        -/-        -          -/-      -        -
IRWST Screen A                PXS-MY-Y01A  No      Yes          -        -/-        -          -/-      -        -
IRWST Screen B                PXS-MY-Y01B  No      Yes          -        -/-        -          -/-      -        -
IRWST Screen C                PXS-MY-Y01C  No      Yes          -        -/-        -          -/-      -        -
Containment Recirculation      PXS-MY-Y02A  No      Yes          -        -/-        -          -/-      -        -
Screen A Containment Recirculation      PXS-MY-Y02B  No      Yes          -        -/-        -          -/-      -        -
Screen B pH Adjustment Basket 3A        PXS-MY-Y03A  No      Yes          -        -/-        -          -/-      -        -
pH Adjustment Basket 3B        PXS-MY-Y03B  No      Yes          -        -/-        -          -/-      -        -
pH Adjustment Basket 4A        PXS-MY-Y04A  No      Yes                    -/-                    -/-
pH Adjustment Basket 4B        PXS-MY-Y04B  No      Yes                    -/-                    -/-
Downspout Screen 1A            PXS-MY-Y81  No      Yes          -        -/-        -          -/-      -        -
Downspout Screen 1B            PXS-MY-Y82  No      Yes          -        -/-        -          -/-      -        -
Note: Dash (-) indicates not applicable.
Tier 1 Material                                                2.2.3-3                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                      10
 
DCP_NRC_003343                                                    Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                      AP1000 Design Control Document Table 2.2.3-1 (cont.)
ASME                            Class 1E/                                Loss of Code              Remotely      Qual. Safety-    Control          Motive Section Seismic    Operated      Harsh    Related      PMS/    Active  Power Equipment Name                Tag No. III    Cat. I      Valve      Envir. Display      DAS  Function Position Downspout Screen 1C            PXS-MY-Y83    No      Yes          -          -/-        -          -/-      -      -
Downspout Screen 1D            PXS-MY-Y84    No      Yes          -          -/-        -          -/-      -      -
Downspout Screen 2A            PXS-MY-Y85    No      Yes          -          -/-        -          -/-      -      -
Downspout Screen 2B            PXS-MY-Y86    No      Yes          -          -/-        -          -/-      -      -
Downspout Screen 2C            PXS-MY-Y87    No      Yes          -          -/-        -          -/-      -      -
Downspout Screen 2D            PXS-MY-Y88    No      Yes          -          -/-        -          -/-      -      -
CMT A Inlet Isolation        PXS-PL-V002A  Yes    Yes        Yes        Yes/Yes    Yes        Yes/No  None      As Is Motor-operated Valve                                                                (Position)
CMT B Inlet Isolation        PXS-PL-V002B  Yes    Yes        Yes        Yes/Yes    Yes        Yes/No  None      As Is Motor-operated Valve                                                                (Position)
CMT A Discharge              PXS-PL-V014A  Yes    Yes        Yes        Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                      (Position)            Open CMT B Discharge              PXS-PL-V014B  Yes    Yes        Yes        Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                      (Position)            Open CMT A Discharge              PXS-PL-V015A  Yes    Yes        Yes        Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                      (Position)            Open CMT B Discharge              PXS-PL-V015B  Yes    Yes        Yes        Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                      (Position)            Open CMT A Discharge Check        PXS-PL-V016A  Yes    Yes          No          -/-      No          -/-  Transfer    -
Valve                                                                                                      Open/
Transfer Closed Note: Dash (-) indicates not applicable.
Tier 1 Material                                                2.2.3-4                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            11
 
DCP_NRC_003343                                                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                          AP1000 Design Control Document Table 2.2.3-2 (cont.)                                                      Commented [HZS2]: Ext-01 ASME          Leak      Functional Code        Before    Capability Line Name                            Line Number                  Section III    Break      Required IRWST screen cross-connect line        PXS-L180A, PXS-L180B                        Yes          No          Yes Containment recirculation line A      PXS-L113A, PXS-L131A, PXS-L132A              Yes          No          Yes Containment recirculation line B      PXS-L113B, PXS-L131B, PXS-L132B              Yes          No          Yes IRWST gutter drain line                PXS-L142A, PXS-L142B                        Yes          No          Yes PXS-L141A, PXS-L141B                        Yes          No          No Downspout drain lines from polar      PXS-L301A, PXS-L302A, PXS-L303A,            Yes          No          Yes crane girder and internal stiffener to PXS-L304A, PXS-L305A, PXS-L306A, collection box A                      PXS-L307A, PXS-L308A, PXS-L309A, PXS-L310A Downspout drain lines from polar      PXS-L301B, PXS-L302B, PXS-L303B,            Yes          No          Yes crane girder and internal stiffener to PXS-L304B, PXS-L305B, PXS-L306B, collection box B                      PXS-L307B, PXS-L308B, PXS-L309B, PXS-L310B Tier 1 Material                                                      2.2.3-13                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                            12
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                    AP1000 Design Control Document 1.9.4.2.2  Task Action Plan Items A-1        Water Hammer Discussion:
Generic Safety Issue A-1 was raised after the occurrence of various incidents of water hammer that involved steam generator feedrings and piping, emergency core cooling systems, residual heat removal systems, containment spray, service water, feedwater, and steam lines. The incidents have been attributed to such causes as rapid condensation of steam pockets, steam-driven slugs of water, pump startup with partially empty lines, and rapid valve motion.
Most of the damage has been relatively minor and involved pipe hangers and restraints.
However, several incidents have resulted in piping and valve damage. This item was originally identified in NUREG-0371, (Reference 4) and was later determined to be an Unresolved Safety Issue.
AP1000 Response:
Specific sections of the Standard Review Plan (NUREG-0800) address criteria for mitigation of water hammer concerns. The applicable Standard Review Plan sections as well as information provided in NUREG-0927 (Reference 5) were reviewed. The AP1000 meets the water hammer provisions as specified. The discussion that follows provides a brief description of selected systems identified as being subject to water hammer occurrences and special design features that mitigate or prevent water hammer damage.
Design features are incorporated as appropriate to prevent water hammer damage in applicable systems including steam generator feedrings and piping, passive core cooling system, passive residual heat removal system, service water system, feedwater system, and steam lines.
Water hammer issues are considered in the design of the AP1000 passive core cooling system.
The passive core cooling system design includes a number of design features specifically to prevent or mitigate water hammer.
The automatic depressurization system operation uses multiple, sequenced valve stages to provide a relatively slow, controlled depressurization of the reactor coolant system, which helps to reduce the potential for water hammer.
Once the depressurization is complete, gravity injection from the in-containment refueling water storage tank is initiated by opening squib valves and then check valves, which reposition slowly.
Gravity injection flow actuates slowly, without water hammer, as the pressure differential across the gravity injection check valves equalizes, and the valves open and initiate flow.
The passive residual heat removal heat exchanger is normally aligned with an open inlet valve and closed discharge valves. This alignment keeps the system piping at reactor coolant system pressure, preventing water hammer upon initiation of flow through the heat exchanger.
Instrumentation is provided at the system high point to detect a void in the system.
Tier 2 Material                                    1.9-32                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                    13
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                    AP1000 Design Control Document AP1000 Response:
The AP1000 incorporates the NRC criteria. The heat load is evaluated for the spent fuel storage capacity.
A-29        Nuclear Power Plant Design for the Reduction of Vulnerability to Industrial Sabotage Description This item addresses potential methods to reduce vulnerability to sabotage. The NRC staff concluded that existing requirements dealing with plant physical security, controlled access to vital areas, screening for reliable personnel appear to be effective. This item was resolved with no new requirements.
AP1000 Response:
The passive systems in the AP1000 provided to mitigate the effects of potential accidents may have an inherent advantage when considering potential acts of sabotage compared to the active systems in operating plants. The AP1000 includes provisions for access control to the vital area.
The provisions for security are discussed in the AP1000 Security Design Report and outlined in Section 13.6.
A-31        Residual Heat Removal Requirements                                                                Commented [HZS1]: Ext-01 Discussion:
Generic Issue A-31 addresses the desire for plants to be able to go from hot-standby to cold-shutdown conditions (when this is determined to be the safest course of action) under an accident condition. The safe shutdown of a nuclear power plant following an accident not related to a loss-of-coolant accident has been typically interpreted as achieving a hot standby condition (the reactor is shut down, but system temperature and pressure are at or near normal operating values). There are events that require eventual cooldown and long-term cooling to perform inspection and repairs.
AP1000 Response:
The AP1000 employs safety-related core decay heat removal systems that establish and maintain the plant in a safe, stable shutdown condition following design basis events. It is not necessary that these passive systems achieve cold shutdown as defined by Regulatory Guide 1.139.
The AP1000 complies with General Design Criteria 34 by using a more reliable and simplified system design. The passive core cooling system is employed for both hot-standby and long-term cooling modes. Hot-standby conditions are achieved immediately and a temperature of 420°F is reached within 36 hours as discussed in Subsection 19E.4.10.2. Reactor pressure is controlled and can be reduced to about 250 psig. The passive residual heat removal system provides a closed cooling system to maintain long-term core cooling. Passive feed and bleed cooling, using the passive injection features for the feed and the automatic depressurization system for bleed, provides another closed-loop safety-related cooling capability. This capability eliminates Tier 2 Material                                      1.9-38                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              14
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                    AP1000 Design Control Document dependency on open-loop cooling systems, which have limited ability to remain in hot standby for long-term core cooling. See Section 7.4 for a discussion of safe shutdown and Section 6.3 for a description of the passive core cooling system.
Since the passive core cooling system maintains safe conditions indefinitely, cold shutdown is necessary only to gain access to the reactor coolant system for inspection or repair. On the AP1000, cold shutdown is accomplished by using non-safety-related systems. These systems are highly reliable. They have similar redundancy as current generation safety-related systems and are supplied with ac power from either onsite or offsite sources. See subsection 5.4.7 for a description of the normal residual heat removal system and subsection 7.4.1.3 for a discussion of cold shutdown achieved by use of non-safety-related systems.
A-35        Adequacy of Offsite Power Systems Discussion:
Generic Issue A-35 addresses the susceptibility of safety-related electric equipment to offsite power source degradation. The NRC considers this issue as technically resolved with the issuance of the Standard Review Plan, Section 8.3.1 criteria specified in Appendix A, Branch Technical Position BTP PSB 1, "Adequacy of Station Electric Distribution System Voltages."
AP1000 Response:
The AP1000 ac power system is discussed in subsections 8.1 through 8.3. The AP1000 does not require any ac power source to achieve and maintain safe shutdown.
A-36        Control of Heavy Loads Near Spent Fuel Discussion:
Generic Issue A-36 addresses the need to review requirements, facility designs, and Technical Specifications regarding the movement of heavy loads near spent fuel. The NRC has documented its technical position on this issue in NUREG-0612 (Reference 10) and that issued Standard Review Plan, Section 9.1.5, which includes NUREG-0612 as a part of the review plan.
AP1000 Response:
The AP1000 design conforms to NUREG-0612 and Standard Review Plan, Section 9.1.5. Light load handling systems are described in subsection 9.1.4, and overhead heavy-load handling systems are described in subsection 9.1.5.
A-39        Determination of Safety Relief Valve Pool Dynamic Loads and Temperature Limits for BWR Containments Discussion:
Generic Issue A-39 addresses operation of BWR primary system pressure relief valves whose operation can result in hydrodynamic loads on the suppression pool retaining structures or those Tier 2 Material                                    1.9-39                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                    15
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                    AP1000 Design Control Document Administrative controls require containment closure capability in modes 5 and 6, during reduced inventory operations, and when the upper internals are in place. Containment closure capability is defined as the capability to close the containment prior to core uncovery following a loss of the normal decay heat removal system (that is, normal residual heat removal system). The containment design also includes penetrations for temporary cables and hoses needed for shutdown operations. These penetrations are isolated in an emergency.
In addition to these design features, appropriate procedures are defined to guide and direct the operator in the proper conduct of midloop operation and to aid in identifying and correcting abnormal conditions that might occur during shutdown operations.
1.9.5.1.5  Station Blackout                                                                                    Commented [HZS3]: Ext-01 NRC Position:
The NRC has issued NUREG-0649 (Reference 34), NUREG-1032 (Reference 35), and NUREG-1109 (Reference 36) to address the unresolved safety issue of station blackout (USI-44).
See subsection 1.9.4 for a discussion of USI-44.
To resolve this issue, the NRC published 10 CFR 50.63 and Regulatory Guide 1.155, which establish new requirements so that an operating plant can safely shut down following a loss of all ac power. SECY-94-084 (Reference 67), discusses station blackout for passive plants.
AP1000 Response:
The AP1000 is in conformance with the NRC guidelines for station blackout.
The AP1000 design minimizes the potential risk contribution of station blackout by not requiring ac power sources for design basis events. Safety-related systems do not need nonsafety-related ac power sources to perform safety-related functions.
The AP1000 safety-related passive systems automatically establish and maintain safe, stable shutdown conditions for the plant following design basis events, including an extended loss of ac power sources. The passive systems can maintain these safe, stable shutdown conditions after design basis events for at least 72 hours, without operator action, following a loss of both onsite and offsite ac power sources. Subsection 1.9.5.4 provides additional information on long-term actions following an extended station blackout beyond 72 hours.
The AP1000 also includes redundant nonsafety-related onsite ac power sources (diesel-generators) to provide electrical power for the nonsafety-related active systems which provide defense in depth.
AP1000 design features that mitigate the consequences of a station blackout are as follows:
x    A full-load rejection capability to reduce the probability of loss of onsite power x    Safety-related passive residual heat removal heat exchanger Tier 2 Material                                    1.9-76                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                16
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                            AP1000 Design Control Document Table 3.2-3 (Sheet 16 of 75)                                        Commented [HZS1]: Ext-01 AP1000 CLASSIFICATION OF MECHANICAL AND FLUID SYSTEMS, COMPONENTS, AND EQUIPMENT AP1000    Seismic    Principal Con-Tag Number          Description                Class      Category  struction Code    Comments Passive Core Cooling System (Continued)
PXS-MY-Y01C        IRWST Screen C              C          I          Manufacturer Std. Structural frame and attachment use ASME III, Subsection NF criteria. Screen modules use manufacturer std.
PXS-MY-Y02A        Containment Recirculation  C          I          Manufacturer Std. Structural frame Screen A                                                            and attachment use ASME III, Subsection NF criteria. Screen modules use manufacturer std.
PXS-MY-Y02B        Containment Recirculation  C          I          Manufacturer Std. Structural frame Screen B                                                            and attachment use ASME III, Subsection NF criteria. Screen modules use manufacturer std.
PXS-MY-Y03A        pH Adjustment Basket A      C          I          Manufacturer Std.
PXS-MY-Y03B        pH Adjustment Basket B      C          I          Manufacturer Std.
PXS-MY-Y03C        pH Adjustment Basket C      C          I          Manufacturer Std.
PXS-MY-Y03D        pH Adjustment Basket D      C          I          Manufacturer Std.
PXS-MY-Y81          Downspout Screen 1A        C          I          Manufacturer Std.
PXS-MY-Y82          Downspout Screen 1B        C          I          Manufacturer Std.
PXS-MY-Y83          Downspout Screen 1C        C          I          Manufacturer Std.
PXS-MY-Y84          Downspout Screen 1D        C          I          Manufacturer Std.
PXS-MY-Y85          Downspout Screen 2A        C          I          Manufacturer Std.
PXS-MY-Y86          Downspout Screen 2B        C          I          Manufacturer Std.
PXS-MY-Y87          Downspout Screen 2C        C          I          Manufacturer Std.
PXS-MY-Y88          Downspout Screen 2D        C          I          Manufacturer Std.
PXS-PL-V002A        CMT A CL Inlet Isolation    A          I          ASME III-1 PXS-PL-V002B        CMT B CL Inlet Isolation    A          I          ASME III-1 PXS-PL-V010A        CMT A Upper Sample          B          I          ASME III-2 PXS-PL-V010B        CMT B Upper Sample          B          I          ASME III-2 PXS-PL-V011A        CMT A Lower Sample          B          I          ASME III-2 PXS-PL-V011B        CMT B Lower Sample          B          I          ASME III-2 Tier 2 Material                                  3.2-35                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            17
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                      AP1000 Design Control Document 5.4.5.2    Design Description 5.4.5.2.1  Pressurizer                                                                                          Commented [HZS1]: Ext-01 The pressurizer is a vertical, cylindrical vessel having hemispherical top and bottom heads constructed of low alloy steel. Internal surfaces exposed to the reactor coolant are clad austenitic stainless steel. Material specifications are provided in Table 5.2-1 for the pressurizer.
The general configuration of the pressurizer is shown in Figure 5.4-5. The design data for the pressurizer are given in Table 5.4-9. Codes and material requirements are provided in Section 5.2. Nickel-chromium-iron alloys are not used for heater wells or instrument nozzles.
The spray line nozzles and the automatic depressurization and safety valve connections are located in the top head of the pressurizer vessel. Spray flow is modulated by automatically controlled air-operated valves. The spray valves can also be operated manually from the control room. In the bottom head at the connection of the surge line to the surge nozzle a thermal sleeve protects the nozzle from thermal transients.
A retaining screen above the surge nozzle prevents passage of any foreign matter from the pressurizer to the reactor coolant system. Baffles in the lower section of the pressurizer prevent an in-surge of cold water from flowing directly to the steam/water interface. The baffles also assist in mixing the incoming water with the water in the pressurizer. The retaining screen and baffles also act as a diffuser. The baffles also support the heaters to limit vibration.
Electric direct-immersion heaters are installed in vertically oriented heater wells located in the pressurizer bottom head. The heater wells are welded to the bottom head and form part of the pressure boundary. The heaters can be removed for maintenance or replacement.
The heaters are grouped into a control group and backup groups. The heaters in the control group are proportional heaters which are supplied with continuously variable power to match heating needs. The heaters in the backup group are either off or at full power. The power supply to the heaters is a 480-volt 60 Hz. three-phase circuit. Each heater is connected to one leg of a delta-connected circuit and is rated at 480 volts with one-phase current. The capacity of the control and backup groups is defined in Table 5.4-10.
A manway in the upper shell provides access to the internal space of the pressurizer in order to inspect or maintain the spray nozzle. The manway closure is a gasketed cover held in place with threaded fasteners. Periodic planned inspections of the pressurizer interior are not required.
Brackets on the upper shell attach the structure (a ring girder) of the pressurizer safety and relief valve (PSARV) module. The pressurizer safety and relief valve module includes the safety valves and the first three stages of automatic depressurization system valves. The support brackets on the pressurizer represent the primary vertical load path to the building structure. Sway struts between the ring girder and pressurizer compartment walls also provide lateral support to the upper portion of the pressurizer. See subsection 5.4.10 for additional details.
Tier 2 Material                                      5.4-29                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  18
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                      AP1000 Design Control Document Four steel columns attach to pads on the lower head to provide vertical support for the vessel.
The columns are based at elevation 107'-2". Lateral support for the lower portion of the vessel is provided by sway struts between the columns and compartment walls.
The AP1000 pressurizer has metallic reflective insulation (MRI) installed on the external surfaces; the insulation is designed to minimize heat losses from the pressurizer, to reduce heat load on the containment cooling system, and to limit temperatures in nearby concrete or components. During normal operating conditions, the insulation has an average maximum heat transfer rate of 65 Btu/hr-ft2 at a containment design temperature of 120°F.
5.4.5.2.2  Instrumentation Instrument connections are provided in the pressurizer shell to measure important parameters.
Eight level taps are provided for four channels of level measurement. Level taps are also used for connection to the pressure measurement instrumentation. Two temperature taps monitor water/steam temperature. A sample tap connection is provided for connection to the sampling system to monitor coolant chemistry. The instrument and sample taps are constructed of stainless steel and designed for a socket weld of the connecting lines to the taps. The sample and instrument taps incorporate an integral flow restrictor with a diameter of 0.38 inch or smaller.
See Chapter 7 for details of the instrumentation associated with pressurizer pressure, level, and temperature.
5.4.5.2.3  Operation During steady-state operation at 100 percent power, approximately 50 percent of the pressurizer volume is water and 50 percent is steam. Electric immersion heaters in the bottom of the vessel keep the water at saturation temperature. The heaters also maintain a constant operating pressure.
A small continuous spray flow is provided through a manual bypass valve around each power-operated spray valve to minimize the boron concentration difference between the pressurizer liquid and the reactor coolant. This continuous flow also prevents excessive cooling of the spray piping. Proportional heaters in the control group are continuously on during normal operation to compensate for the continuous introduction of cooler spray water and for losses to ambient.
These conditions result in a continuous outsurge in most cases during normal operation and anticipated transients. The outsurge minimizes the potential for thermal stratification in the surge line.
During an outsurge of water from the pressurizer, flashing of water to steam and generation of steam by automatic actuation of the heaters keep the pressure above the low-pressure engineered safety features actuation setpoint. During an in-surge from the reactor coolant system, the spray system (which is fed from two cold legs) condenses steam in the pressurizer. This prevents the pressurizer pressure from reaching the high-pressure reactor trip setpoint. The heaters are energized on high water level during in-surge to heat the subcooled surge water entering the pressurizer from the reactor coolant loop.
Tier 2 Material                                      5.4-30                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      19
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                      AP1000 Design Control Document 5.4.11.2    System Description                                                                                  Commented [HZS2]: Ext-01 Each safety valve discharge is directed to a rupture disk at the end of the discharge piping. A small pipe is connected to the discharge piping to drain away condensed steam leaking past the safety valve. The discharge is directed away from any safety related equipment, structures, or supports that could be damaged to the extent that emergency plant shutdown is prevented by such a discharge.
The discharge from each of two groups of automatic depressurization system valves is connected to a separate sparger below the water level in the in-containment refueling water storage tank.
The piping and instrumentation diagram for the connection between the automatic depressurization system valves and the in-containment refueling water storage tank is shown in Figure 6.3-26.3-1. The in-containment refueling water storage tank is a stainless steel lined compartment integrated into the containment interior structure. The discharge of water, steam, and gases from the first-stage automatic depressurization system valves when used to vent noncondensable gases does not result in pressure in excess of the in-containment refueling water storage tank design pressure. Additionally, vents on the top of the tank protect the tank from overpressure, as described in subsection 6.3.2.
Overflow provisions prevent overfilling of the tank. The overflow is directed into the refueling cavity. The in-containment refueling water storage tank does not have a cover gas and does not require a connection to the waste gas processing system. The normal residual heat removal system provides nonsafety-related cooling of the in-containment refueling water storage tank.
5.4.11.3    Safety Evaluation The design of the control for the reactor coolant system and the volume of the pressurizer is such that a discharge from the safety valves is not expected. The containment design pressure, which is based on loss of coolant accident considerations, is greatly in excess of the pressure that would result from the discharge of a pressurizer safety valve. The heat load resulting from a discharge of a pressurizer safety valve is considerably less than the capacity of the passive containment cooling system or the fan coolers. See Section 6.2.
Venting of noncondensable gases, including entrained steam and water from the loop seals in the lines to the automatic depressurizations system valves, from the pressurizer into spargers below the water line in the in-containment refueling water storage tank does not result in a significant increase in the pressure or water temperature. The in-containment refueling water storage tank is not susceptible to vacuum conditions resulting from the cooling of hot water in the tank, as described in subsection 6.3.2. The in-containment refueling water storage tank has capacity in excess of that required for venting of noncondensable gases from the pressurizer following an accident.
5.4.11.4    Instrumentation Requirements The instrumentation for the safety valve discharge pipe, containment, and in-containment refueling water storage tank are discussed in subsections 5.2.5, 5.4.9, and in Sections 6.2 and 6.3, respectively. Separate instrumentation for the monitoring of the discharge of noncondensable gases is not required.
Tier 2 Material                                    5.4-66                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                20
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                      AP1000 Design Control Document In addition, materials and welds are inspected according to the requirements of the ASME Code, Section III Class 1.
5.4.14      Passive Residual Heat Removal Heat Exchanger The passive residual heat removal heat exchanger (PRHR HX) is the component of the passive core cooling system that removes core decay heat for any postulated non-loss of coolant accident event where a loss of cooling capability via the steam generators occurs. Section 6.3 discusses the operation of the passive residual heat removal heat exchanger in the passive core cooling system.
5.4.14.1    Design Bases                                                                                        Commented [HZS3]: Ext-01 The passive residual heat removal heat exchangers automatically actuates to removes core decay heat for 72 hours as discussed in Section 6.3an unlimited period of time, assuming the condensate from steam generated in the in-containment refueling water storage tank (IRWST) is returned to the tank. The passive residual heat removal heat exchanger is designed to withstand the design environment of 2500 psia and 650qF.
The passive residual heat removal heat exchanger and the in-containment refueling water storage tank are designed to delay significant steam release to the containment for at least one hour. The passive residual heat removal heat exchanger will keep the reactor coolant subcooled and prevent water relief from the pressurizer and remove sufficient decay heat from the reactor coolant system to satisfy the applicable post-accident safety evaluation criteria detailed in Chapter 15 for at least 72 hours.
The passive residual heat removal heat exchanger in conjunction with the passive containment cooling system can remove heat for an indefinite time in a closed-loop (that is, no pipe break) mode of operation. In addition, the passive residual heat removal heat exchanger will cool the reactor coolant system, with reactor coolant pumps operating or in the natural circulation mode, so that the reactor coolant system pressure can be lowered depressurized to reduce stress levels in the system if required. See Section 6.3 for a discussion of the capability of the passive core cooling system.
The passive residual heat removal heat exchanger is designed and fabricated according to the ASME Code, Section III, as a Class 1 component. Those portions of the passive residual heat exchanger that support the primary-side pressure boundary and falls under the jurisdiction of ASME Code, Section III, Subsection NF are AP1000 equipment Class A (ANS Safety Class 1, Quality Group A). Stresses for ASME Code, Section III equipment and supports are maintained within the limits of Section III of the Code. Section 5.2 provides ASME Code, Section III and material requirements. Subsection 5.2.4 discusses inservice inspection.
Materials of construction are specified to minimize corrosion/erosion and to provide compatibility with the operating environment, including the expected radiation level. Subsection 5.2.3 discusses the welding, cutting, heat treating and other processes used to minimize sensitization of stainless steel.
Tier 2 Material                                    5.4-73                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                21
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document x  Components are designed and fabricated according to industry standard quality groups commensurate with its intended safety-related functions.
x  It is tested and inspected at appropriate intervals, as defined by the ASME Code, Section XI, and by technical specifications.
x  It performs its intended safety-related functions following events such as fire, internal missiles or pipe breaks.
x  It is protected from the effects of external events such as earthquakes, tornadoes, and floods.
x  It is designed to be sufficiently reliable, considering redundancy and diversity, to support the plant core melt frequency and significant release frequency goals.
6.3.1.1    Safety Design Basis The passive core cooling system is designed to provide emergency core cooling during events involving increases and decreases in secondary side heat removal and decreases in reactor coolant system inventory. Subsection 6.3.3 provides a description of the design basis events. The performance criteria are provided in subsection 6.3.1 and also described in Chapter 15, under the respective event sections.
6.3.1.1.1  Emergency Core Decay Heat Removal                                                                    Commented [HZS1]: Ext-01 For postulated non-LOCA events, where a loss of capability to remove core decay heat via the steam generators occurs, the passive core cooling system is designed to perform the following functions for at least 72 hours:
x    The passive residual heat removal heat exchanger automatically actuates to provide reactor coolant system cooling and to prevent water relief through the pressurizer safety valves.
x    The passive residual heat removal heat exchanger, in conjunction with the in-containment refueling water storage tank, the condensate collection features, and the passive containment cooling system, is designed to remove decay heat following a design basis event. Automatic depressurization actuation is not expected, but may occur depending on the amount of reactor coolant system leakage and when normal systems are recovered (refer to Subsection 6.3.1.1.4).
x    The passive residual heat removal heat exchanger is designed to maintain acceptable reactor coolant system conditions following a non-LOCA event. The applicable post-accident safety evaluation criteria are discussed in Chapter 15.
x    The passive residual heat removal heat exchanger is capable of performing its post-accident safety functions automatically removing core decay heat following such an event, assuming the steam generated in the in-containment refueling water storage tank is condensed on the containment vessel and returned by gravity via the in-containment refueling water storage tank condensate return gutter and downspouts.
Tier 2 Material                                        6.3-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                22
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document x    The passive residual heat removal heat exchanger, in conjunction with the passive containment cooling system, is designed to remove decay heat for an indefinite time in a closed-loop mode of operation. The passive residual heat removal heat exchanger is designed to cool the reactor coolant system to 420qF in 36 hours, with or without reactor coolant pumps operating. This allows the reactor coolant system to be depressurized and the stress in the reactor coolant system and connecting pipe to be reduced to low levels. This also allows plant conditions to be established for initiation of normal residual heat removal system operation.
x    During a steam generator tube rupture event, the passive residual heat removal heat exchanger removes core decay heat and reduces reactor coolant system temperature and pressure, equalizing with steam generator pressure and terminating break flow, without overfilling the steam generator.
System operation beyond 72 hours is described in Subsection 6.3.1.2.1.
6.3.1.1.2  Reactor Coolant System Emergency Makeup and Boration For postulated non-LOCA events, sufficient core makeup water inventory is automatically provided to keep the core covered and to allow for decay heat removal. In addition, this makeup prevents actuation of the automatic depressurization system for a significant time.
For postulated events resulting in an inadvertent cooldown of the reactor coolant system, such as a steam line break, sufficient borated water is automatically provided to makeup for reactor coolant system shrinkage. The borated water also counteracts the reactivity increase caused by the resulting system cooldown.
For a Condition II steam line break described in Chapter 15, return to power is acceptable if there is no core damage. For this event, the automatic depressurization system is not actuated.
For a large steam line break, the peak return to power is limited so that the offsite dose limits are satisfied. Following either of these events, the reactor is automatically brought to a subcritical condition.
For safe shutdown, the passive core cooling system is designed to supply sufficient boron to the reactor coolant system to maintain the technical specification shutdown margin for cold, post-depressurization conditions, with the most reactive rod fully withdrawn from the core. The automatic depressurization system is not expected to actuate for these events.
6.3.1.1.3  Safety Injection The passive core cooling system provides sufficient water to the reactor coolant system to mitigate the effects of a loss of coolant accident. In the event of a large loss of coolant accident, up to and including the rupture of a hot or cold leg pipe, where essentially all of the reactor coolant volume is initially displaced, the passive core cooling system rapidly refills the reactor vessel, refloods the core, and continuously removes the core decay heat. A large break is a Tier 2 Material                                      6.3-3                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        23
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document rupture with a total cross-sectional area equal to or greater than one square foot. Although the criteria for mechanistic pipe break are used to limit the size of pipe rupture considered in the design and evaluation of piping systems, as described in subsection 3.6.3, such criteria are not used in the design of the passive core cooling system.
Sufficient water is provided to the reactor vessel following a postulated loss of coolant accident so that the performance criteria for emergency core cooling systems, described in Chapter 15, are satisfied.
The automatic depressurization system valves, provided as part of the reactor coolant system, are designed so that together with the passive core cooling system they:
x    Satisfy the small loss of coolant accident performance requirements x    Provide effective core cooling for loss of coolant accidents from when the passive core cooling system is actuated through the long-term cooling mode.
6.3.1.1.4  Safe Shutdown                                                                                      Commented [HZS2]: Ext-01 The functional requirements for the passive core cooling system specify that the plant be brought to a safe, stable condition using the passive residual heat removal heat exchanger for events not involving a loss of coolant. As stated in Subsection 6.3.1.1.1, the passive residual heat removal heat exchanger in conjunction with the passive containment cooling system provides sufficient heat removal to satisfy the post-accident safety evaluation criteria for at least 72 hours.
Additionally For these events, the passive core cooling system, in conjunction with the passive containment cooling system and the automatic depressurization system, has the capability to establish long-term safe shutdown conditions, cooling in the reactor coolant system as identified in Subsection 7.4.1.1to about 420qF in 36 hours, with or without the reactor coolant pumps operating.
The core makeup tanks automatically provide injection to the reactor coolant system after they are actuated on low reactor coolant temperature or low pressurizer pressure or levelas the temperature decreases and pressurizer level decreases, actuating the core makeup tanks. The passive core cooling system can maintain stable plant conditions for a long time in this mode of operation, depending on the reactor coolant leakage and the availability of normal systemsac power sources. For example, with a technical specification leak rate of 10 gpm, stable plant conditions can be maintained for at least 10 hours. With a smaller leak a longer time is available.
However in scenarios when ac power sources are unavailable for as long as 24 hours, the automatic depressurization system will automatically actuate.
In scenarios when ac power sources are unavailable for approximately 22 hours, the automatic depressurization system automatically actuates. However, after the initial plant cooldown following a non-LOCA event, operators assess plant conditions and have the option to perform recovery actions to further cool and depressurize the reactor coolant system in a closed-loop mode of operation, i.e., without actuation of the automatic depressurization system. After verifying the reactor coolant system is in an acceptable, stable condition such that automatic depressurization is not needed, the operators may take action to extend the passive residual heat Tier 2 Material                                      6.3-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                24
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document removal heat exchanger operation by deenergizing the loads on the 24-hour Class 1E dc batteries powering the protection and monitoring system actuation cabinets. After operators have taken action to extend its operation, the passive residual heat removal heat exchanger, in conjunction with the passive containment cooling system, has the capability to maintain safe, stable conditions for at least 72 hours. The automatic depressurization system remains available to maintain safe shutdown conditions at a later time.
In most sequences, the operators would return the plant to normal system operations and terminate passive system operation within several hours in accordance with the plant emergency operating procedures. For loss of coolant accidents, when the core makeup tank level reaches the automatic depressurization system actuation setpoint and other postulated events where ac power sources are lost the passive residual heat removal heat exchanger operation is not extended or is exhausted, or when the core makeup tank levels reach the automatic depressurization system actuation setpoint, the automatic depressurization system initiates may be initiated. This results in injection from the accumulators and subsequently from the in-containment refueling water storage tank, once the reactor coolant system is nearly depressurized. For these conditions, the reactor coolant system depressurizes to saturated conditions at about 250°F within 24 hours. The passive core cooling system can maintain this safe shutdown condition indefinitely for the plant as identified in Subsection 7.4.1.1.
The basis used to define the passive core cooling system functional requirements are derived from Section 7.4 of the Standard Review Plan. The functional requirements are met over the range of anticipated events and single failure assumptions. The primary function of the passive core cooling system during a safe shutdown using only safety-related equipment is to provide a means for boration, injection, and core cooling. Details of the safe shutdown design bases are presented in subsection 5.4.7 and Section 7.4. The performance of the passive residual heat removal heat exchanger to bring the plant to 420°F in 36 hours is summarized in Subsection 19E.4.10.2.
6.3.1.1.5  Containment pH Control The passive core cooling system is capable of maintaining the desired post-accident pH conditions in the recirculation water after containment floodup. The pH adjustment is capable of maintaining containment pH within a range of 7.0 to 9.5, to enhance radionuclide retention in the containment and to prevent stress corrosion cracking of containment components during long-term containment floodup.
6.3.1.1.6  Reliability Requirements                                                                              Commented [HZS3]: Ext-01 The passive core cooling system satisfies a variety of reliability requirements, including redundancy (such as for components, power supplies, actuation signals, and instrumentation),
equipment testing to confirm operability, procurement of qualified components, and provisions for periodic maintenance. In addition, the system provides protection in a number of areas including:
x    Single active and passive component failures x    Spurious failures Tier 2 Material                                      6.3-5                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  25
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document x    Physical damage from fires, flooding, missiles, pipe whip, and accident loads x    Environmental conditions such as high-temperature steam and containment floodup Subsection 6.3.1.32 includes specific nonsafety-related design requirements that help to confirm satisfactory system reliability.
6.3.1.2    Nonsafety Design Basis                                                                              Commented [HZS4]: Ext-01 6.3.1.2.1  Post Accident Core Decay Heat Removal The passive residual heat removal heat exchanger is designed to cool the reactor coolant system to 420°F in 36 hours, with or without reactor coolant pumps operating. This allows the reactor coolant system to be depressurized and the stress in the reactor coolant system and connecting pipe to be reduced to low levels. This non-bounding, conservative evaluation is discussed in Subsection 19E.4.10.2.
The passive residual heat removal heat exchanger, in conjunction with the in-containment refueling water storage tank, the condensate return features, and the passive containment cooling system, has the capability to maintain the reactor coolant system in the specified, long-term safe shutdown condition of 420°F for greater than 14 days in a closed-loop mode of operation. The automatic depressurization system can be manually actuated by the operators during the extended passive residual heat removal heat exchanger operation to initiate open-loop cooling. The operator actions necessary to achieve safe shutdown using the passive residual heat removal heat exchanger in a closed-loop mode of operation involve preventing unnecessary actuation of the automatic depressurization system as detailed in Subsection 7.4.1.
Eventually, if pressurizer heaters are not available, the pressurizer subcools due to ambient heat loss. When this happens, the steam void within the pressurizer is transferred to the reactor coolant system. It has been determined that this condition is safe as long as the passive residual heat removal performance is not affected.
If passive residual heat removal performance is affected by subcooling (or other plant conditions) and non-safety systems to control core cooling are not reestablished, then the final, long-term safe shutdown conditions may be achieved and maintained using the automatic depressurization system as discussed in Subsection 7.4.1.1.
6.3.1.3    Power Generation Design Basis The passive core cooling system is designed to be sufficiently reliable to support the probabilistic risk analysis goals for core damage frequency and severe release frequency. In assessing the reliability for probabilistic risk analysis purposes, more realistic analysis is used for both the passive core cooling system performance and for plant response.
In the event of a small loss of coolant accident, the passive core cooling system limits the increase in peak clad temperature and core uncovery with design basis assumptions. For pipe ruptures of less than eight-inch nominal diameter size, the passive core cooling system is designed to prevent core uncovery with best estimate assumptions.
Tier 2 Material                                      6.3-6                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                26
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document The passive residual heat removal heat exchanger and the in-containment refueling water storage tank are designed to delay significant steam release to the containment for at least one hour.
The frequency of automatic depressurization system actuation is limited to a low probability to reduce safety risks and to minimize plant outages. Equipment is located so that it is not flooded or it is designed so that it is not damaged by the flooding. Major plant equipment is designed for multiple occurrences without damage.
The pH control equipment is designed to minimize the potential for and the impact of inadvertent actuation.
The passive core cooling system is capable of supporting the required testing and maintenance, including capabilities to isolate and drain equipment.
6.3.2      System Design The passive core cooling system is a seismic Category I, safety-related system. It consists of two core makeup tanks, two accumulators, the in-containment refueling water storage tank, the passive residual heat removal heat exchanger, pH adjustment baskets, and associated piping, valves, instrumentation, and other related equipment. The automatic depressurization system valves and spargers, which are part of the reactor coolant system, also provide important passive core cooling functions.
The passive core cooling system is designed to provide adequate core cooling in the event of design basis events. The redundant onsite safety-related class 1E dc and UPS system provides power such that protection is provided for a loss of ac power sources, coincident with an event, assuming a single failure has occurred.
6.3.2.1    Schematic Piping and Instrumentation Diagrams                                                      Commented [HZS5]: Ext-01 Figures 6.3-1 and 6.3-2 shows the piping and instrumentation drawings of the passive core cooling system. Simplified flow diagrams are shown in Figures 6.3-3 and 6.3-4. The accident analysis results of events analyzed in Chapter 15 provide a summary of the expected fluid conditions in the passive core cooling system for the various locations shown on the simplified flow diagrams, for the specific plant conditions identified -- safety injection and decay heat removal.
The passive core cooling system is designed to supply the core cooling flow rates to the reactor coolant system specified in Chapter 15 for the accident analyses. The accident analyses flow rates and heat removal rates are calculated by assuming a range of component parameters, including best estimate and conservatively high and low values.
The passive core cooling system design is based on the six major components, listed in subsection 6.3.2.2, that function together in various combinations to support the four passive core cooling system functions:
x      Emergency decay heat removal x      Emergency reactor makeup/boration Tier 2 Material                                      6.3-7                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              27
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document x    Safety injection x    Containment pH control 6.3.2.1.1  Emergency Core Decay Heat Removal at High Pressure and Temperature Conditions                      Commented [HZS6]: Ext-01 For events not involving a loss of coolant, the emergency core decay heat removal is provided by the passive core cooling system via the passive residual heat removal heat exchanger. The heat exchanger consists of a bank of C-tubes, connected to a tubesheet and channel head arrangement at the top (inlet) and bottom (outlet). The passive residual heat removal heat exchanger connects to the reactor coolant system through an inlet line from one reactor coolant system hot leg (through a tee from one of the fourth stage automatic depressurization lines) and an outlet line to the associated steam generator cold leg plenum (reactor coolant pump suction).
The inlet line is normally open and connects to the upper passive residual heat removal heat exchanger channel head. The inlet line is connected to the top of the hot leg and is routed continuously upward to the high point near the heat exchanger inlet. The normal water temperature in the inlet line will be hotter than the discharge line.
The outlet line contains normally closed air-operated valves that open on loss of air pressure or on control signal actuation. The alignment of the passive residual heat removal heat exchanger (with a normally open inlet motor-operated valve and normally closed outlet air-operated valves) maintains the heat exchanger full of reactor coolant at reactor coolant system pressure. The water temperature in the heat exchanger is about the same as the water in the in-containment refueling water storage tank, so that a thermal driving head is established and maintained during plant operation.
The heat exchanger is elevated above the reactor coolant system loops to induce natural circulation flow through the heat exchanger when the reactor coolant pumps are not available.
The passive residual heat removal heat exchanger piping arrangement also allows actuation of the heat exchanger with reactor coolant pumps operating. When the reactor coolant pumps are operating, they provide forced flow in the same direction as natural circulation flow through the heat exchanger. If the pumps are operating and subsequently trip, then natural circulation continues to provide the driving head for heat exchanger flow.
The heat exchanger is located in the in-containment refueling water storage tank, which provides the heat sink for the heat exchanger.
Although gas accumulation is not expected, there is a vertical pipe stub on the top of the inlet piping high point that serves as a gas collection chamber. Level detectors indicate when gases have collected in this area. There are provisions to allow the operators to open manual valves to locally vent these gases to the in-containment refueling water storage tank.
The passive residual heat removal heat exchanger, in conjunction with the in-containment refueling water storage tank, the condensate return features, and the passive containment cooling system, can provide core cooling for at least 72 hoursan indefinite period of time. After the in-containment refueling water storage tank water reaches its saturation temperature (in severalabout 2 hours), the process of steaming to the containment initiates. Containment Tier 2 Material                                      6.3-8                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                28
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document pressure increases as steam is released from the in-containment refueling water storage tank. As containment temperature increases, condensation begins to form on the subcooled metal and concrete surfaces inside containment. Condensation on these heat sink surfaces transfers energy to the bulk metal and concrete until they come into equilibrium with the containment atmosphere.
Condensation that is not returned to the incontainment refueling water storage tank drains to the containment sump.
Condensation occurs on the steel containment vessel, which is cooled by the passive containment cooling system. The Most of the condensate formed on the containment vessel wall is collected in a safety-related gutter arrangement. A gutter is located near at the operating deck level which returns the elevation, and a downspout piping system is connected at the polar crane girder and internal stiffener, to collect steam condensate to the inside the containment during passive containment cooling system operation and return it to the in-containment refueling water storage tank. The gutter normally drains to the containment sump, but when the passive residual heat removal heat exchanger actuates, safety-related isolation valves in the gutter drain line shut and the gutter overflow returns directly to the in-containment refueling water storage tank. Recovery of the condensate maintains the passive residual heat removal heat exchanger heat sink for greater than 14 daysan indefinite period of time.
The passive residual heat removal heat exchanger is used to maintain an acceptable, stable reactor coolant system a safe shutdown condition. It transfers removes decay heat and sensible heat from the reactor coolant system to the in-containment refueling water storage tank, the containment atmosphere, the containment vessel, and finally to the ultimate heat sink-the atmosphere outside of containment. This occurs after in-containment refueling water storage tank saturation is reached and steaming to containment initiates.
The duration the passive residual heat removal heat exchanger can continue to remove decay heat is affected by the efficiency of the return of condensate to the in-containment refueling water storage tank. The in-containment refueling water storage tank water level is affected by the amount of steam that leaves the tank and does not return. Resources are typically recovered within 72 hours, which allows the operators to place active, defense-in-depth systems into service and to terminate passive system operation. If resources are not recovered within this time frame, cooling can be extended as described in Subsection 7.4.1.1 to maintain a safe, stable condition after a design basis event.
6.3.2.1.2  Reactor Coolant System Emergency Makeup and Boration The core makeup tanks provide reactor coolant system makeup and boration during events not involving loss of coolant when the normal makeup system is unavailable or insufficient. There are two core makeup tanks located inside the containment at an elevation slightly above the reactor coolant loops. During normal operation, the core makeup tanks are completely full of cold, borated water. The boration capability of these tanks provides adequate core shutdown margin following a steam line break.
The core makeup tanks are connected to the reactor coolant system through a discharge injection line and an inlet pressure balance line connected to a cold leg. The discharge line is blocked by two normally closed, parallel air-operated isolation valves that open on a loss of air pressure or Tier 2 Material                                      6.3-9                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      29
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document spargers prevents undesirable and/or excessive dynamic loads on the in-containment refueling water storage tank and other structures.
Each sparger is sized to discharge at a flow rate that supports automatic depressurization system performance, which in turn, allows adequate passive core cooling system injection.
6.3.2.2.7  IRWST and Containment Recirculation Screens                                                      Commented [HZS7]: Ext-01 The passive core cooling systems has two different sets of screens that are used following a LOCA; IRWST screens and containment recirculation screens. These screens to prevent debris from entering the reactor and blocking core cooling passages during a LOCA: IRWST screens and containment recirculation screens. The screens are AP1000 Equipment Class C and are designed to meet seismic Category I requirements. The structural frames, attachment to the building structure, and attachment of the screen modules use the criteria of ASME Code, Section III Subsection NF. The screen modules are fabricated of sheet metal and are designed and fabricated to a manufacturers standard. These IRWST screens and containment recirculation screens are designed to comply with applicable licensing regulations including:
x    GDC 35 of 10 CFR 50 Appendix A x    Regulatory Guide 1.82 x    NUREG-0897 The operation of the passive core cooling system following a LOCA is described in subsection 6.3.2.1.3. Proper screen design, plant layout, and other factors prevent clogging of these screens by debris during accident operations.
6.3.2.2.7.1 General Screen Design Criteria                                                                    Commented [HZS8]: Ext-01 The IRWST screens and containment recirculation screens are designed with the following criteria.
: 1. Screens are designed to Regulatory Guide 1.82, including:
x  Separate, large screens are provided for each function.
x  Screens are located well below containment floodup level. Each screen provides the function of a trash rack and a fine screen. A debris curb is provided to prevent high density debris from being swept along the floor to the screen face.
x  Floors slope away from screens (not required for AP1000).
x  Drains do not impinge on screens.
x  Screens can withstand accident loads and credible missiles.
Tier 2 Material                                      6.3-18                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              30
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document 6.3.2.2.7.2 IRWST Screens                                                                                        Commented [HZS9]: Ext-01 The IRWST screens are located inside the IRWST at the bottom of the tank. Figure 6.3-6 shows a plan view and Figure 6.3-7 shows a section view of these screens. Three separate screens are provided in the IRWST, one at either end of the tank and one in the center. A cross-connect pipe connects all three IRWST screens to distribute flow. The IRWST is closed off from the containment; its vents and overflows are normally closed by louvers. The potential for introducing debris inadvertently during plant operations is limited. A cleanliness program (refer to subsection 6.3.8.1) controls foreign debris from being introduced into the tank during maintenance and inspection operations. The Technical Specifications require visual inspections of the screens during every refueling outage.
The IRWST design eliminates sources of debris from inside the tank. Insulation is not used in the tank. Air filters are not used in the IRWST vents or overflows. Wetted surfaces in the IRWST are corrosion resistant such as stainless steel or nickel alloys; the use of these materials prevents the formation of significant amounts of corrosion products. In addition, the water is required to be clean because it is used to fill the refueling cavity for refueling; filtering and demineralizing by the spent fuel pit cooling system is provided during and after refueling.
During a LOCA, steam vented from the reactor coolant system condenses on the containment shell, and drains down the shell to the operating deck elevation polar crane girder or internal stiffener where it is drained via downspouts to the IRWST. Steam that condenses below the internal stiffener drains down the shell and is collected in a gutter near the operating deck elevation. It is very unlikely that debris generated by a LOCA can reach the downspouts or the gutter because of its their locations. Each downspout inlet is covered with a coarse screen that prevents larger debris from entering the downspout. The gutter is covered with a trash rack which prevents larger debris from clogging the gutter or entering the IRWST through the two 4-inch drain pipes. The inorganic zinc coating applied to the inside surface of the containment shell is safety - Service Level I, and will stay in place and will not detach.
The design of the IRWST screens reduces the chance of debris reaching the screens. The screens are oriented vertically such that debris that settles out of the water does not fall on the screens.
The lowest screening surface of the IRWST screens is located 6 inches above the IRWST floor to prevent high density debris from being swept along the floor by water flow to the IRWST screens. The screen design provides the trash rack function. This is accomplished by the screens having a large surface area to prevent a single object from blocking a large portion of the screen and by the screens having a robust design to preclude an object from damaging the screen and causing by-pass. The screen prevents debris larger than 0.0625 inch from being injected into the reactor coolant system and blocking fuel cooling passages. The screen is a type that has sufficient surface area to accommodate debris that could be trapped on the screen. The design of the IRWST screens is described further in APP-GW-GLN-147 (Reference 4).
The screen flow area is conservatively designed considering the operation of the nonsafety-related normal residual heat removal system pumps which produce a higher flow than the safety-related gravity driven IRWST injection/recirculation flows. As a result, when the normal residual heat removal system pumps are not operating, there is a large margin to screen clogging.
Tier 2 Material                                      6.3-24                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  31
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document It is acceptable for the core makeup tank injection to be delayed several minutes following actuation due to high initial steam condensation rates in the tank.
6.3.2.5.4  Potential Boron Precipitation Boron precipitation in the reactor vessel is prevented by sufficient flow of passive core cooling system water through the core to limit the increase in boron concentration of the water remaining in the reactor vessel. Water along with steam leaves the core and exits the RCS through the fourth stage ADS lines. These valves connect to the hot leg and open in about 20 minutes after a loss of coolant accident or an automatic depressurization system actuation.
6.3.2.5.5  Safe Shutdown During a safe shutdown, the passive core cooling system provides redundancy for boration, makeup, and heat removal functions. Section 7.4 provides additional information about safe shutdown.
6.3.2.6    Protection Provisions The measures taken to protect the system from damage that might result from various events are described in other sections, as listed below.
x    Protection from dynamic effects is presented in Section 3.6.
x    Protection from missiles is presented in Section 3.5.
x    Protection from seismic damage is presented in Sections 3.7, 3.8, 3.9, and 3.10.
x    Protection from fire is presented subsection 9.5.1.
x    Environmental qualification of equipment is presented in Section 3.11.
x    Thermal stresses on the reactor coolant system are presented in Section 5.2.
6.3.2.7    Provisions for Performance Testing The passive core cooling system includes the capability for determination of the integrity of the pressure boundary formed by series passive core cooling system check valves. Additional information on testing can be found in subsection 6.3.6.
6.3.2.8    Manual Actions The passive core cooling system is automatically actuated for those events as presented in subsection 6.3.3. Following actuation, the passive core cooling system continues to operate in the injection mode until the transition to recirculation initiates automatically following containment floodup.
Although the passive core cooling system operates automatically, operator actions would be beneficial, in some cases, in reducing the consequences of an event. For example, in a steam generator tube rupture with no operator action, the protection and safety monitoring system automatically terminates the leak, prevents steam generator overfill, and limits the offsite doses.
However, the operator can initiate actions, similar to those taken in current plants, to identify and Tier 2 Material                                      6.3-35                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        32
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document isolate the faulted steam generator, cool down and depressurize the reactor coolant system to terminate the break flow to the steam generator, and stabilize plant conditions.
The operator can take action to avoid actuation of the automatic depressurization system when it is not needed. For non-LOCA events during which ac power has been lost for more than 22 hours, the protection and safety monitoring system will automatically open the automatic depressurization system valves to begin a controlled depressurization of the reactor coolant system and, eventually, containment floodup and recirculation prior to depletion of the 24-hour Class 1E actuation batteries. However, the operators can take action to block actuation of the automatic depressurization system should actuation be deemed unnecessary based on reactor coolant system conditions. This action allows closed loop passive residual heat removal heat exchanger operation to continue as long as acceptable reactor coolant system conditions are maintained.
Section 7.4 describes the anticipated operator actions to block the unnecessary automatic depressurization system actuation and to achieve recovery using available systems to remove decay heat. Section 7.5 describes the post-accident monitoring instrumentation available to the operator in the main control room following an event.
6.3.3      Performance Evaluation                                                                          Commented [HZS10]: Ext-01 The events described in subsection 6.3.1 result in passive core cooling system actuation and are mitigated within the performance criteria. For the purpose of evaluation in Chapters 15 and 19, the events that result in passive core cooling system actuation are categorized as follows:
A. Increase in heat removal by the secondary system
: 1. Inadvertent opening of a steam generator power-operated atmospheric steam relief or safety valve
: 2. Steam system piping failure B. Decrease in heat removal by the secondary system
: 1. Loss of Main Feedwater Flow
: 2. Feedwater system piping failure C. Decrease in reactor coolant system inventory
: 1. Steam generator tube rupture
: 2. Loss of coolant accident from a spectrum of postulated reactor coolant system piping failures
: 3. Loss of coolant due to a rod cluster control assembly ejection accident (This event is enveloped by the reactor coolant system piping failures.)
Tier 2 Material                                    6.3-36                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            33
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document The core makeup tanks and passive residual heat removal heat exchangers are also actuated by the Diverse Actuation System as described in subsection 7.7.1.11.
Upon receipt of an actuation signal, the actions described in subsection 6.3.2.1 are automatically initiated to align the appropriate features of the passive core cooling system.
For non-LOCA events, the passive residual heat removal heat exchanger is actuated so that it can remove core decay heat. The passive residual heat removal heat exchanger can operate for at least 72 hours after initiation of a design basis event to satisfy Condition I, II, III, and IV safety evaluation criteria described in the relevant safety analyses. Subsection 6.3.3.2.1.1 provides an evaluation of the duration of the passive residual heat removal heat exchanger operation using the LOFTRAN code described in Subsection 15.0.11.2. In this evaluation, it is assumed that the operators power down the protection and safety monitoring actuation cabinets in the 22-hour time frame prior to the automatic timer actuating the automatic depressurization system.
In addition to mitigating the initiating events, the passive residual heat removal heat exchanger is capable of cooling the reactor coolant system to the specified safe shutdown condition of 420°F within 36 hours as described in Subsection 19E.4.10.2. A non-bounding, conservative analysis of the plant response during operator-initiated, extended operation of the passive residual heat removal heat exchanger is demonstrated in the shutdown temperature evaluation of Subsection 19E.4.10.2. The closed-loop cooling mode allows the reactor coolant system pressure to decrease and reduces the stress in the reactor coolant system and connecting pipe.
For loss of coolant accidents, the core makeup tanks deliver borated water to the reactor coolant system via the direct vessel injection nozzles. The accumulators deliver flow to the direct vessel injection line whenever reactor coolant system pressure drops below the tank static pressure. The in-containment refueling water storage tank provides gravity injection once the reactor coolant system pressure is reduced to below the injection head from the in-containment refueling water storage tank. The passive core cooling system flow rates vary depending upon the type of event and its characteristic pressure transient.
As the core makeup tanks drain down, the automatic depressurization system valves are sequentially actuated. The depressurization sequence establishes reactor coolant pressure conditions that allow injection from the accumulators, and then from the in-containment refueling water storage tank and the containment recirculation path. Therefore, an injection source is continually available. If onsite or offsite ac power has not been restored after 72 hours, the post-72 hour support actions described in Subsection 1.9.5.4 maintain this mode of core cooling and provide adequate decay heat removal for an unlimited time.
The transient analyses summarized in Chapter 15 are extended long enough to demonstrate the applicable safety evaluation criteria are met. It is expected that normal systems would be available such that operators could terminate the passive safety systems and proceed with an orderly shutdown. However, as discussed in Subsection 6.3.1.1.4, the passive systems are capable of bringing the plant to a safe, stable condition for at least 72 hours in closed loop cooling mode and for longer in an open loop mode.
The events listed in group D occur during shutdown conditions that are characterized by slow plant responses and mild thermal-hydraulic transients. In addition, some of the passive core Tier 2 Material                                      6.3-38                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          34
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document For this event, the passive residual heat removal heat exchanger is actuated. If the core makeup tanks are not initially actuated, they actuate later when passive residual heat exchanger cooling sufficiently reduces pressurizer level. The passive residual heat removal heat exchanger serves to remove core decay heat and the core makeup tanks inject a borated water solution directly into the reactor vessel downcomer annulus. Since the reactor coolant pumps are tripped on actuation of the core makeup tanks, the passive residual heat removal heat exchanger operates under natural circulation conditions. The core makeup tanks operate via water recirculation, without draining, to maintain reactor coolant system inventory. Therefore, the automatic depressurization system is not actuated on the lowering of the core makeup tank level. Since the event is characterized by a heat-up transient, the injection of negative reactivity is not required and is not taken credit for in the analysis to control core reactivity.
The reactor coolant system does not depressurize to permit the accumulators to deliver makeup water to the reactor coolant system. Subsequent to stabilizing plant conditions and satisfying passive core cooling system termination criteria, the operator terminates passive core cooling system operation and initiates a normal plant shutdown.
6.3.3.2.1.1 Loss of AC Power to Plant Auxiliaries                                                                Commented [HZS11]: Ext-01 The most severe conditions resulting from a loss of ac power to the plant auxiliaries are associated with loss of offsite power with a loss of main feedwater system flow at full power. A loss of main feedwater with a loss of ac power lasting longer than a few hours presents the highest demand on passive residual heat removal heat exchanger operation. Subsection 15.2.6 provides a description of this short-term event, including criteria and analytical results.
During most events, the passive systems would be terminated in hours. When an ac power source is restored and passive core cooling system termination criteria are satisfied, the operator terminates passive core cooling system operation and initiates normal plant shutdown operations (as discussed in Subsection 6.3.1.2.1).
However, if normal systems are not recovered as expected, the passive residual heat removal heat exchanger removes core decay heat and maintains acceptable reactor coolant system conditions for at least 72 hours. For a non-LOCA event where ac power is lost, the automatic depressurization system will actuate in approximately 22 hours if operators do not act to avoid actuation when it is not needed. For this long-term transient, it is assumed operators extend passive residual heat exchanger operation as described in the Subsection 7.4.1.1.
The loss of main feedwater with loss of ac power event is analyzed for a 72-hour period, assuming operators extend closed-loop cooling beyond the time the automatic depressurization system would be actuated by the protection and safety monitoring system. This event mirrors the loss of ac power to the plant auxiliaries as described in Subsection 15.2.6, but the loss of ac power extends to 72 hours. In this event, operation of the passive residual heat removal heat exchanger continues for 72 hours and maintains acceptable reactor coolant system conditions such that the applicable Condition II safety evaluation criteria are met. If non-safety systems capable of removing decay heat are not recovered, operator action to actuate automatic depressurization system is eventually required. This condition would then be bounded by the Condition III event of inadvertent automatic depressurization system actuation.
Tier 2 Material                                      6.3-41                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  35
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document Reactor coolant system leakage could limit closed-loop capacity. A reactor coolant system leak could produce conditions that would preclude the operators from de-energizing the loads on the 24-hour Class 1E batteries, or could require the operators to re-energize the buses powered by the Class 1E batteries before 72 hours so that the automatic depressurization system valves could be actuated.
6.3.3.2.2  Feedwater System Pipe Failure The most severe core conditions resulting from a feedwater system piping failure are associated with a double-ended rupture of a feed line at full power. Depending on break size and power level, a feedwater system pipe failure could cause either a reactor coolant system cooldown transient or a reactor coolant system heat-up transient. Only the reactor coolant system heat-up transient is evaluated as a feedwater system pipe failure, since the spectrum of cooldown transients is bounded by the steam system pipe failure analyses. The heat-up transient effects of smaller piping failures at reduced power levels are bounded by the double-ended feed line rupture at full power. Subsection 15.2.8 provides a description of this event, including criteria and analytical results.
For this event, the passive residual heat removal heat exchanger and the core makeup tanks are actuated. The passive residual heat removal heat exchanger serves to remove core decay heat, and the core makeup tanks inject a borated water solution directly into the reactor vessel downcomer. Since the reactor coolant pumps are tripped on actuation of the core makeup tanks, the passive residual heat removal heat exchanger operates under natural circulation conditions.
The core makeup tanks operate via water recirculation to maintain reactor coolant system inventory. Since the event is characterized by a heat-up transient, the injection of negative reactivity is not required and is not taken credit for in the analysis to control core reactivity.
The reactor coolant system does not depressurize to permit the accumulators to deliver makeup water to the reactor coolant system. Subsequent to stabilizing plant conditions and satisfying passive core cooling system termination criteria, the operator terminates passive core cooling system operation and initiates normal plant shutdown operations.
6.3.3.3    Decrease in Reactor Coolant System Inventory A number of events have been postulated that could result in a decrease in reactor coolant system inventory. For each event, consideration has been given to operation of nonsafety-related systems that could affect the consequences of the event. The operation of the startup feedwater system and the chemical and volume control system makeup pumps can affect these events. Analyses of these events, both with and without these nonsafety-related systems operating, are presented in Section 15.6. For those events which result in passive core cooling system actuation, the following summarizes passive core cooling system performance.
6.3.3.3.1  Steam Generator Tube Rupture Although a steam generator tube rupture is an event that results in a decrease in reactor coolant system inventory, severe core conditions do not result from a steam generator tube rupture. The event analyzed is a complete severance of a single steam generator tube that occurs at power with the reactor coolant contaminated with fission products, corresponding to continuous operation Tier 2 Material                                      6.3-42                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        36
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document During shutdown conditions, some of the passive core cooling system equipment is isolated. In addition, since the normal residual heat removal system is not a safety-related system, its loss is considered.
As a result, gravity injection is automatically actuated when required during shutdown conditions prior to refueling cavity floodup, as discussed in subsection 6.3.3.3.2. The operator can also manually actuate other passive core cooling system equipment, such as the passive residual heat removal heat exchanger, if required for accident mitigation during shutdown conditions when the equipment does not automatically actuate.
6.3.3.4.1  Loss of Startup Feedwater During Hot Standby, Cooldowns, and Heat-ups                              Commented [HZS12]: Ext-01 During normal cooldowns, the steam generators are supplied by the startup feedwater pumps and steam from the steam generator is directed to either the main condenser or to the atmosphere.
There are two nonsafety-related startup feedwater pumps, each of which is capable of providing sufficient feedwater flow to both steam generators to remove decay heat. These pumps are also automatically loaded on the nonsafety-related diesel-generators in the event offsite power is lost.
Since these pumps are nonsafety-related, their failure is considered.
In the event of a loss of startup feedwater, the passive residual heat removal heat exchanger is automatically actuated on low steam generator water level and provides safety-related heat removal. The passive residual heat removal heat exchanger can maintain the reactor coolant system temperature, as well as provide for reactor coolant system cooldown to conditions where the normal residual heat removal system can be operated.
Since the chemical and volume control system makeup pumps are nonsafety-related, they may not be available. In this case, the core makeup tanks automatically actuate as the cooldown continues and the pressurizer level decreases. The core makeup tanks operate in a water recirculation mode to maintain reactor coolant system inventory while the passive residual heat removal heat exchanger is operating.
The in-containment refueling water storage tank provides the heat sink for the passive residual heat removal heat exchanger. Initially, the heat addition increases the water temperature. Within one to two hours, the water reaches saturation temperature and begins to boil. The steam generated in the in-containment refueling water storage tank discharges to containment. Because the containment integrity is maintained during cooldown Modes 3 and 4, the passive containment cooling system provides the safety-related ultimate heat sink. Therefore, most of the steam generated in the in-containment refueling water storage tank is condensed on the inside of the containment vessel and drains back into the in-containment refueling water storage tank via the condensate return gutter arrangement. This allows it to indefinitely function as a heat sink for greater than 14 days, as discussed in Subsection 6.3.1.2.1.
6.3.3.4.2  Loss of Normal Residual Heat Removal Cooling With The Reactor Coolant System Pressure Boundary Intact During normal shutdown conditions, the normal residual heat removal system is placed into service at about 350qF to accomplish reactor coolant system cooldown to refueling temperatures.
The normal residual heat removal system piping is safety-related and meets seismic Category I Tier 2 Material                                      6.3-46                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                37
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                              AP1000 Design Control Document Figure 6.3-1 (Sheet 1 of 3) Commented [HZS13]: Ext-01 Passive Core Cooling System Piping and Instrumentation Diagram (Sheet 1)
Tier 2 Material                                                    6.3-69                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                          38
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                              AP1000 Design Control Document Figure 6.3-21 (Sheet 2 of 3) Commented [HZS14]: Ext-01 Passive Core Cooling System Piping and Instrumentation Diagram (Sheet 2)
Tier 2 Material                                                    6.3-71                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                          39
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document Figure 6.3-1 (Sheet 3 of 3) Commented [HZS15]: Ext-01 Passive Core Cooling System Piping and Instrumentation Diagram Tier 2 Material                                                    6.3-72                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        40
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                                      AP1000 Design Control Document Figure 6.3-2 Not Used                                                                  Commented [HZS16]: Ext-01 Tier 2 Material                                                                    6.3-73                Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                          41
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document 7.4        Systems Required for Safe Shutdown                                                                    Commented [HZS1]: Ext-01 Systems to establish safe shutdown conditions perform two basic functions. First, they provide the necessary reactivity control to maintain the core in a subcritical condition. Boration capability is provided to compensate for xenon decay and to maintain the required core shutdown margin.
Second, these systems must provide residual heat removal capability to maintain adequate core cooling.
The designation of systems required for safe shutdown depends on identifying those systems that provide the following capabilities for maintaining a safe shutdown:
x    Decay heat removal x    Reactor coolant system inventory control x    Reactor coolant system pressure control x    Reactivity control There are two different safe shutdown conditions that are expected following a transient or accident condition. Short-term safe shutdown refers to the plant conditions from the start of an event until about 36 hours later. Long-term safe shutdown refers to the plant conditions after this 36-hour period.
The short-term safe shutdown conditions include maintaining the reactor subcritical, the reactor coolant average temperature less than or equal to no load temperature, and adequate coolant inventory and core cooling. These shutdown conditions shall be achieved following any of the design basis events using safety-related equipment. The specific safe shutdown condition achieved is a function of the particular accident sequence.
The long-term safe shutdown conditions are the same as the short-term conditions except that the core average coolant temperature shall be less than 420°F. This long-term condition must be achieved within 36 hours and following a non-LOCA event using the passive residual heat removal heat exchanger as shown in Appendix 19E. These safe shutdown conditions can be maintained by the passive residual heat removal heat exchanger for greater than 14 days based on a non-bounding, conservative analysis that only credits using safety-related equipment. In addition, these safe shutdown conditions can be maintained indefinitely using the automatic depressurization system and passive injection/recirculation as discussed in Subsection 7.4.1.1safety-related equipment.
There are no systems specifically and solely dedicated as safe shutdown systems. However, there are a number of plant systems that are available to establish and maintain safe shutdown conditions. Normally, in the event of a turbine or reactor trip, nonsafety-related plant systems automatically function to place the plant in short-term safe shutdown, as described in subsection 7.4.1.2. During the short-term safe shutdown condition, an adequate heat sink is provided to remove reactor core residual heat and boration control is available. Redundancy of systems and components is provided to enable continued maintenance of the short-term safe shutdown condition. Additional redundant nonsafety-related systems are normally available to manually perform a plant depressurization and cooldown.
Tier 2 Material                                      7.4-1                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  42
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document x    Support of engineered safety systems actuation is provided by safety-related onsite dc power.
7.4.1      Safe Shutdown 7.4.1.1    Safe Shutdown Using Safety-Related Systems                                                              Commented [HZS2]: Ext-01 The following describes the process that establishes safe shutdown conditions for the plant, based on a conservative, non-bounding analysis using the safety-related systems, and no operator action. The reactor coolant system is assumed to be intact for this discussion of safe shutdown.
Since this discussion only considers the use of safety-related systems, offsite electrical power sources are assumed to be lost at the start of the event. This results in a loss of the reactor coolant pumps. Even though the reactor coolant pumps are tripped during the initiation of certain engineered safety system actuation, it is assumed that no engineered safety system actuation signal is generated for this initiating event. With loss of the reactor coolant pumps, reactor coolant system natural circulation flow initiates and transfers core heat to the steam generators.
Since feedwater flow is lost, the existing steam generator water inventory provides initial decay heat removal capability.
The initial loss of main ac power results in the Class 1E dc batteries automatically supplying power to the Class 1E dc power distribution network and the four Class 1E 120 Vac instrumentation divisions via the inverters.
The initial response of the passive safety systems is to actuate the passive residual heat removal heat exchanger due to low steam generator water level. The passive residual heat removal heat exchanger removes decay heat from the core by transferring this heat to the in-containment refueling water storage tank.
The passive residual heat removal heat exchanger removes core decay heat, cooling the reactor coolant system. As reactor coolant system cooldown continues, the reactor coolant system pressure decreases due to contraction of the reactor coolant system inventory since the pressurizer heaters are de-energized. An engineered safety system actuation signal occurs when reactor coolant system pressure decreases below a setpoint. This actuates the core makeup tanks, if they had not been previously actuated due to low pressurizer level. The core makeup tanks provide borated water injection to the reactor coolant system.
The engineered safety system actuation signal generated on low pressurizer pressure also actuates containment isolation. This prevents loss of water inventory from containment and permits indefinite operation of the passive residual heat removal heat exchanger and the in-containment refueling water storage tank for greater than 14 days.
The in-containment refueling water storage tank starts to boil about one to two hours after passive residual heat removal operation is initiated. Once boiling occurs, the in-containment refueling water storage tank begins steaming to containment, transferring heat to the air flowing on the outside of the containment shell. As steaming to containment continues, containment pressure slowly increases. As containment pressure slowly increases, an engineered safety system actuation signal is generated on containment high pressure, resulting in the initiation of Tier 2 Material                                      7.4-3                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  43
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document passive containment cooling. This provides water flow on the outside of the containment shell to improve the heat removal performance from containment through evaporative cooling to the outside air.
A gutter located at the operating deck elevation collects condensate from the inside of the containment shell. Valves located in drain lines from the gutter to the containment waste sump close on a passive residual heat removal heat exchanger actuation signal. This action diverts the condensate to the in-containment refueling water storage tank. The system indefinitely provides core decay heat removal in this configuration for greater than 14 days without a limited significant increase in the containment water level.
Once the reactor coolant system and the safety systems are in this configuration, the plant is in a safe, stable shutdown condition. The reactor coolant system temperatures and pressures continue to slowly decrease. The passive residual heat removal heat exchanger has the capacity to maintain a safe, stable reactor coolant system condition during a design basis event for at least 72 hours in a closed-loop mode of operation. A non-bounding, conservative analysis of extended operation in this mode shows the The passive residual heat removal heat exchanger cools the reactor coolant system to 420°F in 36 hours.
Operation in this configuration may be limited in time duration by reactor coolant system leakage. The core makeup tanks can only supply a limited amount of makeup in the event there is reactor coolant system leakage. Eventually the volume of the water in the core makeup tanks will decrease to the first stage automatic depressurization setpoint. The time to reach this setpoint depends upon the reactor coolant system leak rate and the reactor coolant cooldown.
The 24-hour Class 1E dc batteries that power the automatic depressurization system valves provide power for at least 24 hours. There is a timer that measures the time that ac power sources are unavailable. This timer provides for automatic actuation of the automatic depressurization system before the 24-hour Class 1E dc batteries are discharged. The emergency response guidelines direct the operator to assess the need for automatic depressurization before the timer completes its count (approximately 22 hours). The operator assessment considers includes consideration for a visible refueling water storage tank level, full core makeup tanks levels, and a high and stable in-containment refueling water storage tank level reactor coolant system hot leg level, temperature, and pressure. If automatic depressurization is not needed, the operator is directed to de-energize all loads on the 24-hour Class 1E dc batteries. This action preserves the capability for the operator to initiate automatic depressurization at a later time based on assessment of the same parameters.
The automatic depressurization system can be manually initiated by the operator at any time, but no operator action is needed to provide safe shutdown conditions. Once the automatic depressurization system sequence initiates, the plant automatically transitions to lower pressure and temperature conditions that establish and maintain long-term safe shutdown of the plant.
When the automatic depressurization system is actuated, the first stage depressurization valves open and the reactor coolant system depressurization starts. The second and third stage depressurization valves open in sequence, based on automatic timers that are started upon the actuation of the first stage depressurization valves. As reactor coolant inventory continues to be lost, the core makeup tanks continue to inject. If the volume of the water in the core makeup Tier 2 Material                                      7.4-4                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        44
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document Table 9.5.1-1 (Sheet 11 of 33)                                        Commented [HZS1]: Ext-01 AP1000 FIRE PROTECTION PROGRAM COMPLIANCE WITH BTP CMEB 9.5-1 BTP CMEB 9.5-1 Guideline                    Paragraph      Comp(1)            Remarks Safe Shutdown Capability
: 72. Fire damage should be limited so that one train        C.5.b(1)          C of systems necessary to achieve and maintain hot shutdown conditions from either the main control room or emergency control station is free of fire damage.
: 73. Fire damage should be limited so that systems          C.5.b (1)        AC    Safe shutdown following a necessary to achieve and maintain cold                                        fire is defined for the AP1000 shutdown from either the control room or                                      plant as the ability to achieve emergency control station can be repaired within                              and maintain the reactor 72 hours.                                                                    coolant system (RCS) core average temperature below 215.6°C (420°F) without uncontrolled venting of the primary coolant from the RCS. This is a departure from the criteria applied to the evolutionary plant designs, and the existing plants where safe shutdown for fires applies to both hot and cold shutdown capability.
With expected RCS leakage, the AP1000 plant can maintain safe shutdown conditions indefinitely for greater than 14 days.
Therefore, repairs to systems necessary to reach cold shutdown need not be completed within 72 hours.
: 74. Separation requirements for verifying that one        C.5.b (2)        C train of systems necessary to achieve and maintain hot shutdown is free of fire damage.
Tier 2 Material                                        9.5-42                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  45
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-2 (Sheet 7 of 17)                                      Commented [HZS1]: Ext-01 DESIGN BASIS ACCIDENT ANALYSIS Reference                              Design Feature                            Value Section    6.3.6.1.3    The bottom of the in-containment refueling water storage    3.4 tank is located above the direct vessel injection nozzle centerline (ft).
Section    6.3.6.1.3    The pH baskets are located below plant elevation 107 2.
Figure    6.3-1        The passive core cooling system has two direct vessel injection lines.
Table      6.3-2        The passive core cooling system has two core makeup tanks, 2500 each with a minimum required volume (ft3).
Table      6.3-2        The passive core cooling system has two accumulators, each 2,000 with a minimum required volume (ft3)
Table      6.3-2        The passive core cooling system has an in-containment      73,900 refueling water storage tank with a minimum required water volume (ft3)
Section    6.3.2.2.3    The containment floodup volume for a LOCA in PXS          73,500 room B has a maximum volume (ft3) (excluding the IRWST) below a containment elevation of 108 feet.
Table      6.3-2        Each sparger has a minimum discharge flow area (in2).      274 Table      6.3-2        The passive core cooling system has two pH adjustment      280 baskets each with a minimum required volume (ft3).
Section    14.2.9.1.3f  The passive residual heat removal heat exchanger minimum natural circulation heat transfer rate (Btu/hr)
                        - With 520°F hot leg and 80°F IRWST                        1.78 E+08
                        - With 420°F hot leg and 80°F IRWST                        1.11 E+08 Section    6.3.6.1.3    The centerline of the HXs upper channel head is located    26.3 above the HL centerline (ft).
Figure    6.3-1        The CMT level sensors (PXS-11A/B/C/D, -12A/B/C/D,          1 +/- 1
                        -13A/B/C/D, and -14A/B/C/D) upper level tap centerlines are located below the centerline of the upper level tap connection to the CMTs (in).
Figure    6.3-1        The CMT inlet lines (cold leg to high point) have no downward sloping sections.
Figure    6.3-1        The maximum elevation of the CMT injection lines between the connection to the CMT and the reactor vessel is the connection to the CMTs.
Figure    6.3-12      The PRHR inlet line (hot leg to high point) has no downward sloping sections.
Tier 2 Material                                  14.3-23                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                        46
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-2 (Sheet 8 of 17)
DESIGN BASIS ACCIDENT ANALYSIS Reference                              Design Feature                          Value Figure    6.3-12      The maximum elevation of the IRWST injection lines (from the connection to the IRWST to the reactor vessel) and the containment recirculation lines (from the containment to the IRWST injection lines) is less than the bottom inside surface of the IRWST.
Figure    6.3-12      The maximum elevation of the PRHR outlet line (from the PRHR to the SG) is less than the PRHR lower channel head top inside surface.
Section    7.1.2.10    Isolation devices are used to maintain the electrical independence of divisions and to see that no interaction occurs between nonsafety-related systems and the safety-related system. Isolation devices serve to prevent credible faults in circuit from propagating to another circuit.
Section    7.1.4.2      The ability of the protection and safety monitoring system to initiate and accomplish protective functions is maintained despite degraded conditions caused by internal events such as fire, flooding, explosions, missiles, electrical faults and pipe whip.
Section    7.1.2        The flexibility of the protection and safety monitoring system enables physical separation of redundant divisions.
Section    7.2.2.2.1    The protection and safety monitoring system initiates a reactor trip whenever a condition monitored by the system reaches a preset level.
Section    7.2.2.2.8    The reactor is tripped by actuating one of two manual reactor trip controls from the main control room.
Section    7.3.1.2.2    The in-containment refueling water storage tank is aligned for injection upon actuation of the fourth stage automatic depressurization system via the protection and safety monitoring system.
Section    7.3.1.2.3    The core makeup tanks are aligned for operation on a safeguards actuation signal or on a low-2 pressurizer level signal via the protection and safety monitoring system.
Section    7.3.1.2.4    The fourth stage valves of the automatic depressurization system receive a signal to open upon the coincidence of a low-2 core makeup tank water level in either core makeup tank and low reactor coolant system pressure following a preset time delay after the third stage depressurization valves receive a signal to open via the protection and safety monitoring system.
Tier 2 Material                                  14.3-24                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                              47
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document A single incorrect or omitted operator action in response to an initiating event is also considered as an active failure; the error is limited to manipulation of safety-related equipment and does not include thought-process errors or similar errors that could potentially lead to common cause or multiple errors.
15.0.12.2  Passive Failures SECY-77-439 also provides a description of passive failures. A passive failure is the structural failure of a static component that limits the effectiveness of the component in carrying out its design function. A passive failure is applied to fluid systems and consists of a breach in the fluid system boundary. Examples include cracking of pipes, sprung flanges, or valve packing leaks.
Passive failures are not assumed to occur until 24 hours after the start of the event. Consequential effects of a pipe leak - such as flooding, jet impingement, and failure of a valve with a packing leak - must be considered.
Where piping is significantly overdesigned or installed in a system where the pressure and temperature conditions are relatively low, passive leakage is not considered a credible failure mechanism. Line blockage is also not considered as a passive failure mechanism.
15.0.12.3  Limiting Single Failures The most limiting single active failure (where one exists), as described in Section 3.1, of safety-related equipment, is identified in each analysis description. The consequences of this failure are described therein. In some instances, because of redundancy in protection equipment, no single failure that could adversely affect the consequences of the transient is identified. The failure assumed in each analysis is listed in Table 15.0-7.
15.0.13    Operator Actions                                                                                    Commented [HZS1]: Ext-01 For events where the PRHR heat exchanger is actuated, the plant automatically cools down to the a safe, stable shutdown condition. Where a stabilized condition is reached automatically following a reactor trip, it is expected that the operator may, following event recognition, take manual control and proceed with orderly shutdown of the reactor in accordance with the normal, abnormal, or emergency operating procedures. The exact actions taken and the time at which these actions occur depend on what systems are available and the plans for further plant operation.
However, for these events, operator actions are not required to maintain the plant in a safe and stable condition for at least 72 hours. Operator actions typical of normal operation are credited for the inadvertent actuations of equipment in response to a Condition II event.
15.0.14    Loss of Offsite ac Power As required in GDC 17 of 10 CFR Part 50, Appendix A, anticipated operational occurrences and postulated accidents are analyzed assuming a loss of offsite ac power. The loss of offsite power is not considered as a single failure, and the analysis is performed without changing the event Tier 2 Material                                      15.0-13                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                48
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.2        Decrease in Heat Removal by the Secondary System                                                    Commented [HZS1]: Ext-01 A number of transients and accidents that could result in a reduction of the capacity of the secondary system to remove heat generated in the reactor coolant system are postulated.
Analyses are presented in this section for the following events that are identified as more limiting than the others:
x    Steam pressure regulator malfunction or failure that results in decreasing steam flow x    Loss of external electrical load x    Turbine trip x    Inadvertent closure of main steam isolation valves x    Loss of condenser vacuum and other events resulting in turbine trip x    Loss of ac power to the station auxiliaries x    Loss of normal feedwater flow x    Feedwater system pipe break The above items are considered to be Condition II events, with the exception of a feedwater system pipe break, which is considered to be a Condition IV event.
For events in this section where PRHR heat exchanger actuation occurs, transients are presented until the PRHR heat exchanger heat removal matches decay heat generation. After that point in time, PRHR heat exchanger performance is driven by the performance of the passive containment cooling systems to control containment pressure and the ability of the condensate collection features to return condensate to the in-containment refueling water storage tank. The performance of these systems, for extended decay heat removal, is described in Subsection 6.3.1.1.1.
The radiological consequences of the accidents in this section are bounded by the radiological consequences of a main steam line break (see subsection 15.1.5).
15.2.1      Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow There are no steam pressure regulators in the AP1000 whose failure or malfunction causes a steam flow transient.
15.2.2      Loss of External Electrical Load 15.2.2.1    Identification of Causes and Accident Description A major load loss on the plant can result from loss of electrical load due to an electrical system disturbance. The ac power remains available to operate plant components such as the reactor coolant pumps; as a result, the standby onsite diesel generators do not function for this event.
Following the loss of generator load, an immediate fast closure of the turbine control valves occurs. The automatic turbine bypass system accommodates the excess steam generation.
Reactor coolant temperatures and pressure do not significantly increase if the turbine bypass system and pressurizer pressure control system function properly. If the condenser is not available, the excess steam generation is relieved to the atmosphere. Additionally, main Tier 2 Material                                    15.2-1                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                49
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.2.4      Inadvertent Closure of Main Steam Isolation Valves Inadvertent closure of the main steam isolation valves results in a turbine trip with no credit taken for the turbine bypass system. Turbine trips are discussed in subsection 15.2.3.
15.2.5      Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in subsection 15.2.3. A loss of condenser vacuum prevents the use of steam dump to the condenser. Because steam dump is assumed to be unavailable in the turbine trip analysis, no additional adverse effects result if the turbine trip is caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in subsection 15.2.3 apply to the loss of the condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, listed in subsection 15.2.3.1, are covered by subsection 15.2.3. Possible overfrequency effects, due to a turbine overspeed condition, are discussed in subsection 15.2.2.1 and are not a concern for this type of event.
15.2.6      Loss of ac Power to the Plant Auxiliaries 15.2.6.1    Identification of Causes and Accident Description                                                    Commented [HZS2]: Ext-01 The loss of power to the plant auxiliaries is caused by a complete loss of the offsite grid accompanied by a turbine-generator trip. The onsite standby ac power system remains available but is not credited to mitigate the accident.
From the decay heat removal point of view, in the long term this transient is more severe than the turbine trip event analyzed in subsection 15.2.3 because, for this case, the decrease in heat removal by the secondary system is accompanied by a reactor coolant flow coastdown, which further reduces the capacity of the primary coolant to remove heat from the core. The reactor will trip:
x    Upon reaching one of the trip setpoints in the primary or secondary systems as a result of the flow coastdown and decrease in secondary heat removal.
x    Due to the loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.
Following a loss of ac power with turbine and reactor trips, the sequence described below occurs:
x    Plant vital instruments are supplied from the Class 1E and uninterruptable power supply.
x    As the steam system pressure rises following the trip, the steam generator power-operated relief valves may be automatically opened to the atmosphere. The condenser is assumed not to be available for turbine bypass. If the steam flow rate through the power-operated relief valves is not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
Tier 2 Material                                    15.2-9                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  50
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document x    The onsite standby power system, if available, supplies ac power to the selected plant non-safety loads.
x    As the no-load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition if the startup feedwater is available to supply water to the steam generators.
x    If startup feedwater is not available, the PRHR heat exchanger is actuated.
During a plant transient, core decay heat removal is normally accomplished by the startup feedwater system if available, which is started automatically when low levels occur in either steam generator. If that system is not available, emergency core decay heat removal is provided by the PRHR heat exchanger. The PRHR heat exchanger is a C-tube heat exchanger connected, through inlet and outlet headers, to the reactor coolant system. The inlet to the heat exchanger is from the reactor coolant system hot leg, and the return is to the steam generator outlet plenum.
The heat exchanger is located above the core to provide natural circulation flow when the reactor coolant pumps are not operating. The IRWST provides the heat sink for the heat exchanger. The PRHR heat exchanger, in conjunction with the passive containment cooling system, keeps the provides core cooling and maintains reactor coolant subcooled indefinitely system conditions to satisfy the evaluation criteria. After the IRWST water reaches saturation (in about two and half hours), steam starts to vent to the containment atmosphere. The condensation that collects on the containment steel shell (cooled by the passive containment cooling system) returns to the IRWST, maintaining fluid level for the PRHR heat exchanger heat sink. The analysis shows that the natural circulation flow in the reactor coolant system following a loss of ac power event is sufficient to remove residual heat from the core.
Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant and PRHR loops.
A loss of ac power to the plant auxiliaries is a Condition II event, a fault of moderate frequency.
This event is more limiting with respect to long-term heat removal than the turbine trip initiated decrease in secondary heat removal without loss of ac power, which is discussed in subsection 15.2.3. A loss of offsite power to the plant auxiliaries will also result in a loss of normal feedwater.
The plant systems and equipment available to mitigate the consequences of a loss of ac power event are discussed in subsection 15.0.8 and listed in Table 15.0-6.
15.2.6.2    Analysis of Effects and Consequences 15.2.6.2.1 Method of Analysis The analysis is performed to demonstrate the adequacy of the protection and safety monitoring system, the PRHR heat exchanger, and the reactor coolant system natural circulation capability in removing long-term (approximately 36,000 seconds) decay heat. This analysis also demonstrates Tier 2 Material                                      15.2-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        51
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 PRHR HX - Operating 3.5.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE                                      FREQUENCY SR 3.5.4.1  Verify the outlet manual isolation valve is fully open. 12 hours SR 3.5.4.2  Verify the inlet motor operated isolation valve is open. 12 hours SR 3.5.4.3  Verify the volume of noncondensible gases in the          24 hours PRHR HX inlet line has not caused the high-point water level to drop below the sensor.
SR 3.5.4.4  Verify that power is removed from the inlet motor        31 days operated isolation valve.
SR 3.5.4.5  Verify both PRHR air operated outlet isolation valves    In accordance with and both IRWST gutter isolation valves are                the Inservice OPERABLE by stroking open the valves.                    Testing Program SR 3.5.4.6  Verify PRHR HX heat transfer performance in              10 years accordance with the System Level OPERABILITY Testing Program.
SR 3.5.4.7  Verify by visual inspection that the IRWST gutters and    24 months            Commented [HZS1]: Ext-01 downspout screens are not restricted by debris.
AP1000                                  3.5.4 - 3                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                52
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 PAM Instrumentation B 3.3.3 BASES LCO (continued)                                                                                Commented [HZS1]: Ext-01
: 10. Pressurizer Level and Associated Reference Leg Temperature Pressurizer level is provided to monitor the RCS coolant inventory.
During an accident, operation of the safeguards systems can be verified based on coolant inventory indicators.
The reference leg temperature is included in the Technical Specification since it is used to compensate the level signal.
: 11. In-Containment Refueling Water Storage Tank (IRWST) Water Level The IRWST provides a long term heat sink for non-LOCA events and is a source of injection flow for LOCA events. When the IRWST is a heat sink, the level will change due to increased volume associated with the temperature increase. When saturation temperature is reached, the IRWST will begin steaming and initially lose mass to the containment atmosphere until condensation occurs on the steel containment shell which is cooled by the passive containment cooling system. The condensate is returned to the IRWST via a gutter and downspouts.
During a LOCA, the IRWST is available for injection. Depending on the severity of the event, when a fully depressurized RCS has been achieved, the IRWST will inject by gravity flow.
: 12. Passive Residual Heat Removal (PRHR) Flow and PRHR Outlet Temperature PRHR Flow is provided to monitor primary system heat removal during accident conditions when the steam generators are not available. PRHR provides primary protection for non-LOCA events when the normal heat sink is lost.
PRHR outlet temperature is provided to monitor primary system heat removal during accident conditions when the steam generators are not available. PRHR provides primary protection for non-LOCA events when the normal heat sink is lost.
13, 14, 15, 16. Core Exit Temperature Core Exit Temperature is provided for verification and long term surveillance of core cooling.
AP1000                                    B 3.3.3 - 4                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  53
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 PRHR HX - Operating B 3.5.4 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)                                                            Commented [HZS1]: Ext-01 B 3.5.4 Passive Residual Heat Removal Heat Exchanger (PRHR HX) - Operating BASES BACKGROUND          The normal heat removal mechanism is the steam generators, which are supplied by the startup feedwater system. However, this path utilizes non-safety related components and systems, so its failure must be considered. In the event the steam generators are not available to remove decay heat for any reason, including loss of startup feedwater, the heat removal path is the PRHR HX (Ref. 1).
The principle component of the PRHR HX is a 100% capacity heat exchanger mounted in the In-containment Refueling Water Storage Tank (IRWST). The heat exchanger is connected to the Reactor Coolant System (RCS) by a inlet line from one RCS hot leg, and an outlet line to the associated steam generator cold leg channel head. The inlet line to the passive heat exchanger contains a normally open, motor operated isolation valve. The outlet line is isolated by two parallel, normally closed air operated valves, which fail open on loss of air pressure or control signal. There is a vertical collection point at the top of the common inlet piping high point which serves as a gas collector. It is provided with level detectors that indicate when noncondensible gases have collected in this area. There are provisions to manually vent these gases to the IRWST.
In order to preserve the IRWST water for long term PRHR HX operation, downspouts and a gutter is are provided to collect and return water to the IRWST that has condensed on the inside surface of the containment shell. During normal plant operation, any water collected by the downspouts or gutter is directed to the normal containment sump. During PRHR HX operation, redundant series air operated valves are actuated to block the draining of condensate to the normal sump and to force the condensate into the IRWST. These valves fail closed on loss of air pressure or control signal.
The PRHR HX size and heat removal capability is selected to provide adequate core cooling for the limiting non-LOCA heatup Design Basis Accidents (DBAs) (Ref. 2). The Probability Risk Assessment (PRA)
(Ref. 3) shows that PRHR HX is not required assuming that passive feed and bleed is available. Passive feed and bleed uses the Automatic Depressurization System (ADS) for bleed and the CMTs/accumulators/
IRWST for feed.
AP1000                                    B 3.5.4 - 1                                Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    54
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3 PRHR HX - Operating B 3.5.4 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.5.4.7 This surveillance requires visual inspection of the IRWST gutters and downspout screens to verify that the return flow to the IRWST will not be restricted by debris. A Frequency of 24 months is adequate, since there are no known sources of debris with which the gutters or downspout screens could become restricted.
REFERENCES      1. Section 6.3, Passive Core Cooling System.
: 2. Chapter 15, Safety Analysis.
: 3. AP1000 PRA.
AP1000                                B 3.5.4 - 7                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      55
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                          AP1000 Design Control Document Table 19.59-18 (Sheet 6 of 25)                                          Commented [HZS1]: Ext-01 AP1000 PRA-BASED INSIGHTS Insight                                                Disposition 1e. (cont.)
Long-term cooling of PRHR will result in steaming to the containment. The            6.3.1 & system steam will normally condense on the containment shell and return to the IRWST        drawings by safety-related features. Connections are provided to IRWST from the spent fuel system (SFS) and chemical and volume control system (CVS) to extend PRHR operation. A safety-related makeup connection is also provided from outside the containment through the normal residual heat removal system (RNS) to the IRWST.
Capability exists and guidance is provided for the control room operator to          6.3.3 & 16.1 identify a leak in the PRHR HX of 500 gpd. This limit is based on the assumption that a single crack leaking this amount would not lead to a PRHR HX tube rupture under the stress conditions involving the pressure and temperature gradients expected during design basis accidents, which the PRHR HX is designed to mitigate.
The positions of the inlet and outlet PRHR valves are indicated and alarmed in      6.3.7 the control room.
PRHR air-operated valves are stroke-tested quarterly. The PRHR HX is tested to      3.9.6 detect system performance degradation every 10 years.
PRHR is required by Technical Specifications to be available from Modes 1            16.1 through 5 with RCS pressure boundary intact.
The PRHR HX, in conjunction with the IRWST, the condensate return features,          6.3.2.1.1 & 6.3.7.6 and the PCS, can provide core cooling for an indefinite period of time greater than 14 days. After the IRWST water reaches its saturation temperature, the process of steaming to the containment initiates. Condensation occurs on the steel containment vessel, and the condensate is collected in a safety-related gutter arrangement, which returns the condensate to the IRWST. The gutter normally drains to the containment sump, but when the PRHR HX actuates, safety-related isolation valves in the gutter drain line shut and the gutter overflow returns directly to the IRWST. The following design features provide proper re-alignment for the gutter system valves to direct water to the IRWST:
          -    IRWST gutter and its drain isolation valves are safety-related
          -    These isolation valves are designed to fail closed on loss of compressed air, loss of Class 1E dc power, or loss of the PMS signal
          -    These isolation valves are actuated automatically by PMS and DAS.              7.3.1.2.7 The PRHR subsystem provides a safety-related means of removing decay heat            16.1 following loss of RNS cooling during shutdown conditions with the RCS intact.
Tier 2 Material                                        19.59-80                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    56
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document 19E.2.3.2.2 Accumulators The PXS accumulators provide safety injection following a LOCA. In Mode 3, the accumulators must be isolated to prevent their operation when the RCS pressure is reduced to below their set pressure. The accumulator isolation valves are closed when the RCS pressure is reduced to 1000 psig to block their injection when the RCS pressure is reduced to below the normal accumulator pressure.
19E.2.3.2.3 In-containment Refueling Water Storage Tank The IRWST provides long-term RCS makeup. During shutdown, the IRWST is available until Mode 6, when the reactor vessel upper internals are removed and the refueling cavity flooded. At that time, the IRWST is not required, due to the large heat capacity of the water in the refueling cavity.
The IRWST injection paths are actuated on a low-2 CMT water level. This signal is available in shutdown Modes 3, 4, and 5, with the RCS intact. When the RCS is open to transition to reduced inventory operations, the CMT actuation logic on low pressurizer level is removed, and the CMTs can be taken out of service. For these modes, automatic actuation of the IRWST can be initiated (on a two-out-of-two basis) on low hot leg level.
19E.2.3.2.4 Passive Residual Heat Removal Heat Exchanger The PRHR HX provides decay heat removal during power operation and is required to be available in shutdown Modes 3, 4, and 5, until the RCS is open. In these modes, the PRHR HX provides a passive decay heat removal path. It is automatically actuated on a CMT actuation signal, which would eventually be generated on a loss of shutdown decay heat removal, as shown in the analysis provided in Section 19E.4 of this appendix. In modes with the RCS open (portions of Mode 5 and Mode 6), decay heat removal is provided by feeding water from the IRWST and bleeding steam from the ADS.
19E.2.3.2.5 Reduced Challenges to Low-Temperature Overpressure Events Another design feature of the PXS that reduces challenges to shutdown safety is the elimination of high-head safety injection pumps in causing low temperature overpressure events. In current plants, during water solid operations that may be necessary to perform shutdown maintenance, the high-head safety injection pumps are a major source of cold overpressure events. To address this, plants are required to lock out safety injection pumps to prevent them from inadvertently causing a cold overpressure event. This eliminates a potential source of safety injection for a loss of inventory event that could occur at shutdown. With the AP1000 PXS, the CMTs are not pressurized above RCS pressure and are, therefore, not capable of causing a cold overpressure event. Therefore, they are not isolated until the pressurizer is drained for mid-loop.
Low-temperature overpressure events are discussed in subsection 19E.4.10.1.
19E.2.3.2.6 Discussion of Safe Shutdown for AP1000                                                              Commented [HZS1]: Ext-01 The functional requirements for the PXS specify that the plant be brought to a safe, stable condition using the PRHR HX for events not involving a loss of coolant. As stated in Subsection Tier 2 Material                                      19E-9                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                57
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document 6.3.1.1.1, the PRHR HX, in conjunction with the passive containment cooling system (PCS),
provides sufficient heat removal to satisfy the post-accident safety evaluation criteria for at least 72 hours. For these eventsAdditionally, the PXS, in conjunction with the passive containment cooling system (PCS), and the ADS, has the capability to establish long-term safe shutdown conditions in the RCS as identified in Subsection 7.4.1.1, cooling the RCS to less than 420°F within 36 hours, with or without the RCPs operating.
The CMTs automatically provide injection to the RCS after they are actuated on low reactor coolant temperature or low pressurizer pressure or levelas the temperature decreases and the pressurizer level decreases, actuating the CMTs. The PXS can maintain stable plant conditions for a long time in this mode of operation, depending on the reactor coolant leakage and the availability of ac power sources. For example, with a technical specification leak rate of 10 gpm, stable plant conditions can be maintained for at least 10 hours. With a smaller leak, a longer time is available. However, in scenarios when ac power sources are unavailable for as long as 24 hours, the ADS will automatically actuate.
In scenarios when ac power sources are unavailable for approximately 22 hours, the ADS automatically actuates. However, after the initial plant cooldown following a non-LOCA event, operators assess plant conditions and have the option to perform recovery actions to further cool and depressurize the RCS in a closed-loop mode of operation, i.e., without actuation of the ADS.
After verifying the RCS is in an acceptable, stable condition, such that automatic depressurization is not needed, the operators may take action to extend PRHR HX operation by de-energizing the loads on the Class 1E dc batteries powering the protection and safety monitoring system actuation cabinets. After operators have taken action to extend its operation, the PRHR HX, in conjunction with the PCS, has the capability to maintain safe, stable conditions. The ADS remains available to maintain safe shutdown conditions at a later time.
In most sequences, the operators would return the plant to normal system operations and terminate passive system operation within several hours in accordance with the plant emergency operating procedures. For LOCAs and other postulated events, when the core makeup tank level reaches the automatic depressurization actuation setpoint, and other postulated events where ac power sources are lost, or when the CMT levels reach the ADS actuation setpoint, the PRHR HX operation is not extended or exhausted, ADS initiates may be initiated. This results in injection from the accumulators and subsequently from the in-containment refueling water storage tank, once the RCS is nearly depressurized. For these conditions, the RCS depressurizes to saturated conditions at about 240250°F within 24 hours. The PXS can maintain this safe shutdown condition indefinitely as identified in Subsection 7.4.1.1.
The primary function of the PXS during a safe shutdown using only safety-related equipment is to provide a means for boration, injection, and core cooling. Analysis is provided in subsection 19E.4.10.2 of this appendix that verifies the ability of the AP1000 passive safety systems to meet the safe shutdown requirements.
19E.2.3.2.7 Containment Recirculation Screens The PXS containment recirculation screens may have to function in the longer-term during a shutdown accident that results in ADS operation. Effective screen design, plant layout, and other factors prevent clogging of these screens by debris during such accident operations.
Tier 2 Material                                    19E-10                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        58
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document plant shutdown and startup operations. The RNS relief valve is sized to provide LTOP by limiting the RCS and RNS pressure to less than the 10 CFR 50 Appendix G (Reference 13) steady-state pressure limit. Subsection 5.2.2 provides a discussion of the AP1000 low temperature overpressure protection design bases.
19E.4.10.2 Shutdown Temperature Evaluation                                                                      Commented [HZS3]: Ext-01 In SECY-94-084, Item C, Safe Shutdown (Reference 14), the NRC staff recommended the Commissions approval of 420°F or below, rather than cold shutdown condition as a safe stable condition, which the PRHR HX must be capable of achieving and maintaining following non-LOCA events, predicated on acceptable passive safety system performance and an acceptable resolution of the regulatory treatment of nonsafety systems (RTNSS) issue. The NRC requested a safety As discussed in Subsection 6.3.1.1.4, the PRHR HX is required to be able to cool the RCS to a safe, stable condition after shutdown following a non-LOCA event. The following summarizes a non-bounding, conservative analysis, which demonstrates the PRHR HX can meet this criterion and cool the RCS to the specified, safe shutdown condition of 420°F within 36 hours. This analysis to demonstrates that the passive systems can bring the plant to a stable safe, stable condition and maintain this condition so that no transients will result in the specified acceptable fuel design limit and pressure boundary design limit being violated and that no high-energy piping failure being initiated from this condition results in 10 CFR 50.46 (Reference 15) criteria.
As discussed in subsections 6.3.3 and 7.4.1.1, the PRHR HX operates to reduce the RCS core average temperature to the safe shutdown condition following an a non- LOCA event. An analysis of the loss of main feedwater with a loss of ac power event demonstrates that the passive systems can bring the plant to a stable safe, stable condition following postulated transients. The results of this A non-bounding, conservative analysis are is represented in Figures 19E.4.10-1 through 19E.4.10-4. The progression of this event is outlined in Table 19E.4.10-1. Though some of the assumptions of this evaluation are based on nominal conditions, many of the analysis assumptions are bounding.
The performance of the PRHR HX is affected by the containment pressure. Containment pressure determines the PRHR HX heat sink (the IRWST water) temperature. The WGOTHIC containment response model described in Subsection 6.2.1.1.3 was used to determine the containment pressure response to this transient, which was used as an input to the plant cooldown analysis performed with LOFTRAN. Some changes were made to the WGOTHIC model to provide conservative results for the long-term safe shutdown analysis.
The PRHR HX performance is also affected by the IRWST water level when the level drops below the top of the PRHR HX tubes. The IRWST water level is affected by the heat input from the PRHR HX and by the amount of steam that leaves the IRWST and does not return to the IRWST through the IRWST gutter arrangement. The principal steam condensate losses include steam that stays in the containment atmosphere, steam that condenses on heat sinks inside containment other than the containment vessel, and dripping or splashing losses due to obstructions on the inner containment vessel wall. The WGOTHIC containment response model also provided the mass balance with respect to the steam lost to the containment atmosphere and to condensation on passive heat sinks other than the containment vessel. The WGOTHIC analysis inputs (including the mass of the heat sinks and heat transfer rates) were biased to increase steam Tier 2 Material                                    19E-43                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                59
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document condensate losses. The WGOTHIC model provides the time-dependent condensate return rate, which was incorporated into the LOFTRAN computer code described in Subsection 15.0.11.2 to demonstrate that the RCS core average temperature could be cooled to 420°F within 36 hours.
Summarizing this transient, the loss of normal ac power occurs (offsite and onsite), followed by the reactor trip. The PRHR HX heat exchanger is actuated on the low steam generator narrow range level coincident with low startup feed water flow rate signal. Eventually a safeguards actuation signal is actuated on Low cold leg temperature and the CMTs are actuated.
Once actuated, at about 600 2,700 seconds, the CMTs operate in recirculation mode, injecting cold borated water into the RCS. In the first part of their operation, due to the injection of cold flow rate water, the CMTs operate in conjunction with the PRHR HX to reduce RCS temperature. Due to the primary system cooldown, the PRHR heat transfer capability drops below the decay heat and the RCS cooldown is essentially driven by the CMT cold injection flow. However, at about 3,500 6,000 seconds, the CMT cooling effect decreases and the RCS starts heating up again (Figure 19.E.4.10-1). The RCS temperature increases until the PRHR HX can match decay heat. At about 31,000 46,700 seconds, the PRHR heat transfer matches decay heat and it continues to operate to reduce the RCS temperature to below 420°F within 36 hours.
As seen from Figure 19E.4.10-1 the cold leg temperature in the loop with the PRHR is reduced to 420°F at 82,600 about 52,900 seconds, while the core average temperature reaches 420°F in 123,600 at about 120,900 seconds (approximately 34 hours).
As discussed in subsection 7.4.1.1, this mode of operation can last for up to 72 hours. However, in about 22 hours after the event, if no ac power is available, or if condensate return is not available, then the operator is instructed to actuate the ADS. a timer is used to automatically actuate the ADS if offsite and onsite power are lost for about 24 hours. This timer automates putting the open loop cooling features into service prior to draining the Class 1E dc 24-hour batteries that operate the ADS valves. Before 22 hours, if the plant conditions indicate that the ADS would not be needed until well after 24 hours, the operators are directed to de-energize all loads on the 24-hour batteries. This action will block actuation of the ADS and preserves the ability to align open loop cooling at a later time. Operation of the ADS in conjunction with the CMTs, accumulators, and IRWST reduces the RCS pressure and temperature to below 420°F.
The ability to actuate ADS and IRWST injection provides a safety-related, backup mode of decay heat removal that is diverse to extended PRHR HX operation.
As discussed in Subsection 6.3.3.2.1.1, the PRHR HX can operate in this mode for at least 72 hours to maintain RCS conditions within the applicable Chapter 15 safety evaluation criteria. In addition, the analysis supporting this section shows the PRHR HX is expected to maintain safe shutdown conditions for greater than 14 days. One important consideration with regard to the duration closed-loop cooling can be maintained is the RCS leak rate. This duration of closed-loop cooling can be achieved with expected RCS leak rates. For abnormal leak rates, it may become necessary to initiate open-loop cooling earlier than 14 days.
19E.5      Technical Specifications While the Technical Specification guidance provided in NUREG-1449 (Reference 2) relates to existing plant shutdown operation concerns, the underlying concerns relating to causes of events and recovery from those events during shutdown operations are applicable to the AP1000.
Tier 2 Material                                    19E-44                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      60
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                  AP1000 Design Control Document 19E.8      Conclusion This AP1000 Shutdown Evaluation provides a systematic evaluation of the AP1000 during shutdown operations. As demonstrated in this appendix, the AP1000 is designed to mitigate events that can occur during shutdown modes. In addition, the risk of core damage as a result of an accident that may occur during shutdown has been demonstrated to be acceptably low.
19E.9      References                                                                                      Commented [HZS4]: Ext-01
: 1. Letter, Westinghouse to NRC, DCP/NRC1385, AP600 Emergency Response Guidelines.
: 2. NUREG-1449, Shutdown and Low Power Operations at Commercial Nuclear Power Plants in the United States, September 1993.
: 3. NRC Information Notice 92-54, Level Instrumentation Inaccuracies Caused by Rapid Depressurization, July 24, 1992.
: 4. Letter, Westinghouse to NRC, DCP/NRC0124, APWR-0452, AP600 Vortex Mitigator Development Test for RCS Mid-loop Operation, July 6, 1994.
: 5. NUREG-0897, Rev. 1, Containment Emergency Sump Performance, October 1985.
: 6. Title 10, Code of Federal Regulations, Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Processing Plants.
: 7. NRC Regulatory Guide 1.26, Quality Group Classifications and Standards for Water-,
Steam-, and Radioactive-Waste-Containing Components of Nuclear Power Plants, Revision 3, February 1976.
: 8. American Society of Mechanical Engineers Boiler and Pressure Vessel Code, Section III, 1988 with 1989 Addenda.
: 9. Lewis, R. N., Huang, P., Behnke, D. H., Fittante, R. L., and Gelman, A., WCAP-10698-P-A (Proprietary) and WCAP-10750-A (Non-Proprietary), SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill, August 1987.
: 10. WCAP-14171, Revision 2 (Proprietary) and WCAP-14172, Revision 2 (Non-Proprietary),
WCOBRA/TRAC Applicability to AP600 Large-Break Loss-of-Coolant Accident, March 1998.
: 11. Title 10, Code of Federal Regulations, Part 50, Appendix K, ECCS Evaluation Model.
: 12. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, Revision 1, July 1981.
: 13. Title 10, Code of Federal Regulations, Part 50, Appendix G, Fracture Toughness Requirements.
Tier 2 Material                                  19E-46                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            61
 
DCP_NRC_003343                                  Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                AP1000 Design Control Document
: 14. Not used. SECY-94-084, Policy and Technical Issues Associated with the Regulatory Treatment of Non-Safety Systems in Passive Plant Designs, March 28, 1994.
: 15. Title 10, Code of Federal Regulations, Part 50, (10 CFR 50.46).
: 16. NRC letter, SECY-93-190, Regulatory Approach to Shutdown and Low-Power Operations, July 12, 1993.
: 17. Title 10, Code of Federal Regulations, Part 50.36, Technical Specifications.
: 18. NUREG-1431, Standard Technical Specifications - Westinghouse Plants, April 1995.
Tier 2 Material                                19E-47                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                  62
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                AP1000 Design Control Document Table 19E.4.10-1                                        Commented [HZS5]: Ext-01 SEQUENCE OF EVENTS FOLLOWING A LOSS OF AC POWER FLOW WITH CONDENSATE FROM THE CONTAINMENT SHELL BEING RETURNED TO THE IRWST Time Event                                        (seconds)
Feedwater is Lost                                                                        10.0 Low Steam Generator Water Level (Narrow-Range) Reactor Trip Setpoint Reached          60.672.4 Rods Begin to Drop                                                                    62.674.4 Low Steam Generator Water Level (Wide-Range) Reached                                    209.5 PRHR HX Actuation on Low Steam Generator Water Level (WideNarrow-Range              221.5129.4 Coincident with Low Startup Feedwater Flow)
Low Tcold Setpoint Reached                                                          2,752599.0 Steam Line Isolation on Low Tcold Signal                                            2,764611.0 CMTs Actuated on Low Tcold Signal                                                    2,764617.0 IRWST Reaches Saturation Temperature                                                15,90017,600 Heat Extracted by PRHR HX Matches Core Decay Heat                                  46,70031,000 CMTs Stop Recirculating                                                                43,500 Cold Leg Temperature Reaches 420°F (loop with PRHR)                                52,90082,600 Hot Leg Core Average Temperature Reaches 420°F (loop with PRHR)                    120,900123,600 Tier 2 Material                                    19E-54                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      63
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                AP1000 Design Control Document Figure 19E.4.10-1 Commented [HZS6]: Ext-01 Shutdown Temperature Evaluation, RCS Temperature Tier 2 Material                    19E-93                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                      64
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                  AP1000 Design Control Document Figure 19E.4.10-2 Commented [HZS7]: Ext-01 Shutdown Temperature Evaluation, PRHR Heat Transfer Tier 2 Material                      19E-94                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                          65
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                AP1000 Design Control Document Figure 19E.4.10-3 Commented [HZS8]: Ext-01 Shutdown Temperature Evaluation, PRHR Flow Rate Tier 2 Material                    19E-95                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                      66
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment              AP1000 Design Control Document Figure 19E.4.10-4 Commented [HZS9]: Ext-01 Shutdown Temperature Evaluation, IRWST Heatup Tier 2 Material                  19E-96                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                      67
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Design Control Document Markup Pages Main Control Room Emergency Habitability System (VES) Changes to Satisfy Post-Actuation Performance Requirements (Ext-02)
(Non-Proprietary)
                        © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                              68
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                        AP1000 Design Control Document a) The VES provides a 72-hour supply of breathable quality air for the occupants of the MCR.
b) The VES maintains the MCR pressure boundary at a positive pressure with respect to the surrounding areas. There is a discharge of air through the MCR vestibule.
c) The heat loads within the MCR, the I&C equipment rooms, and the Class 1E dc equipment rooms are within design basis assumptions to limit the heatup of the rooms identified in Table 2.2.5-4.
d) The system provides a passive recirculation flow of MCR air to maintain main control room dose rates below an acceptable level during VES operation.
e) The system provides shielding below the VES filter that is sufficient to ensure main control room doses are below an acceptable level during VES operation.                                              Commented [HZS4]: Ext-03
: 8. Safety-related displays identified in Table 2.2.5-1 can be retrieved in the MCR.
: 9. a) Controls exist in the MCR to cause those remotely operated valves identified in Table 2.2.5-1 to perform their active functions.
b) The valves identified in Table 2.2.5-1 as having protection and safety monitoring system (PMS) control perform their active safety function after receiving a signal from the PMS.
c) The MCR Load Shed Panels identified in Table 2.2.5-1 perform their active safety function after receiving a signal from the PMS.                                                                      Commented [HZS5]: Ext-02
: 10. After loss of motive power, the remotely operated valves identified in Table 2.2.5-1 assume the indicated loss of motive power position.
: 11. Displays of the parameters identified in Table 2.2.5-3 can be retrieved in the MCR.
: 12. The background noise level in the MCR does not exceed 65 dB(A) at the operator workstations when the VES is operating.
Inspections, Tests, Analyses, and Acceptance Criteria Table 2.2.5-5 specifies the inspections, tests, analyses, and associated acceptance criteria for the VES.
Tier 1 Material                                    2.2.5-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              69
 
DCP_NRC_003343                                                      Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                      AP1000 Design Control Document Table 2.2.5-1 ASME                            Class 1E/                              Loss of Code              Remotely      Qual. for  Safety-                      Motive Section Seismic    Operated      Harsh    Related    Control  Active  Power Equipment Name                Tag No. III    Cat. I      Valve      Envir. Display      PMS    Function Position MCR Load Shed Panel 1          VES-EP-01  No      Yes            -        Yes/No      Yes        Yes    De-      -          Commented [HZS6]: Ext-02 energize MCR Loads MCR Load Shed Panel 2          VES-EP-02  No      Yes            -        Yes/No      Yes        Yes    De-      -          Commented [HZS7]: Ext-02 energize MCR Loads Emergency Air Storage          VES-MT-01  No      Yes            -          -/-        -          -      -        -
Tank 01 Emergency Air Storage          VES-MT-02  No      Yes            -          -/-        -          -      -        -
Tank 02 Emergency Air Storage          VES-MT-03  No      Yes            -          -/-        -          -      -        -
Tank 03 Emergency Air Storage          VES-MT-04  No      Yes            -          -/-        -          -      -        -
Tank 04 Emergency Air Storage          VES-MT-05  No      Yes            -          -/-        -          -      -        -
Tank 05 Emergency Air Storage          VES-MT-06  No      Yes            -          -/-        -          -      -        -
Tank 06 Note: Dash (-) indicates not applicable.
Tier 1 Material                                                2.2.5-3                                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                        70
 
DCP_NRC_003343                                                      Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                      AP1000 Design Control Document Table 2.2.5-1 (cont.)
ASME                              Class 1E/                              Loss of Code              Remotely      Qual. for Safety-                      Motive Section Seismic    Operated        Harsh    Related    Control  Active    Power Equipment Name              Tag No. III    Cat. I      Valve        Envir. Display    PMS    Function  Position Emergency Air Storage        VES-MT-31    No      Yes          -            -/-      -          -        -        -
Tank 31 Emergency Air Storage        VES-MT-32    No      Yes          -            -/-      -          -        -        -
Tank 32 Air Delivery Alternate      VES-PL-V001  Yes    Yes          No            -/-      No          -    Transfer    -
Isolation Valve                                                                                          Open Eductor Flow Path            VES-PL-V045  Yes    Yes          No            -/-      No          -    Transfer    -
Isolation Valve                                                                                          Close Eductor Bypass Isolation    VES-PL-V046  Yes    Yes          No            -/-      No          -    Transfer    -
Valve                                                                                                    Open Pressure Regulating        VES-PL-V002A  Yes    Yes          No            -/-      No          -    Throttle    -
Valve A                                                                                                  Flow Pressure Regulating        VES-PL-V002B  Yes    Yes          No            -/-      No          -    Throttle    -
Valve B                                                                                                  Flow MCR Air Delivery            VES-PL-V005A  Yes    Yes        Yes          Yes/No    No        Yes  Transfer  Open Isolation Valve A                                                                                        Open MCR Air Delivery            VES-PL-V005B  Yes    Yes        Yes          Yes/No    No        Yes  Transfer  Open Isolation Valve B                                                                                        Open Temporary Instrument        VES-PL-V018  Yes    Yes          No            -/-      No        No    Transfer    -          Commented [HZS8]: Ext-02 Isolation Valve A                                                                                        Open Temporary Instrument        VES-PL-V019  Yes    Yes          No            -/-      No        No    Transfer    -          Commented [HZS9]: Ext-02 Isolation Valve B                                                                                        Open Note: Dash (-) indicates not applicable.
Tier 1 Material                                                  2.2.5-7                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                        71
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                  AP1000 Design Control Document Table 2.2.5-2 ASME Code            Functional Capability Line Name            Line Number              Section III              Required MCR Relief Line            VES-PL-022A                Yes                      Yes MCR Relief Line            VES-PL-022B                Yes                      Yes Table 2.2.5-3 Equipment                        Tag No.                      Display Air Storage Tank Pressure                    VES-001A                          Yes Air Storage Tank Pressure                    VES-001B                          Yes Table 2.2.5-4 Heat Load 0 to 24 Hours    Heat Load 24 to 72 Hours Room Name          Room Numbers                (Btu/s)                  (Btu/s)
MCR Envelope                  12401          12.8 (hour 0 through 3)            3.93.95            Commented [HZS11]: Ext-02 5.1 (hour 4 through 24) 23.5 (hour 0 to 0.5) 14.5 (hour 0.5 to 3.5) 4.75 (hour 3.5 through 24)
I&C Rooms                  12301, 12305                8.8                        0 I&C Rooms                  12302, 12304                13.0                      4.2 dc Equipment Rooms        12201, 12205      3.7 (hour 0 through 1)                0 2.4 (hour 2 through 24) dc Equipment Rooms        12203, 12207      5.8 (hour 0 through 1)              2.0 4.5 (hour 2 through 24)
Tier 1 Material                            2.2.5-11                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    72
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                              AP1000 Design Control Document Table 2.2.5-5 (cont.)
Inspections, Tests, Analyses, and Acceptance Criteria Design Commitment                  Inspections, Tests, Analyses                Acceptance Criteria 7d) The system provides a passive      Testing will be performed to          The air flow rate at the outlet of the recirculation flow of MCR air to        confirm that the required amount      MCR passive filtration system is at maintain main control room dose        of air flow circulates through the    least 600 cfm greater than the flow rates below an acceptable level        MCR passive filtration system,        measured by VES-003A/B.
during VES operation.
7e) Shielding below the VES filter      Inspection will be performed for      A report exists and concludes that the is capable of providing attenuation    the existence of a report verifying  as-built shielding identified in Table that is sufficient to ensure main      that the as-built shielding meets    2.2.5-1 meets the functional control room doses are below an        the requirements for functional      requirements and exists below the acceptable level during VES            capability.                          filtration and exists below the operation.                                                                    filtration unit, and within its vertical projection.                              Commented [HZS12]: Ext-03
: 8. Safety-related displays identified  Inspection will be performed for      Safety-related displays identified in in Table 2.2.5-1 can be retrieved in    retrievability of the safety-related  Table 2.2.5-1 can be retrieved in the the MCR.                                displays in the MCR.                  MCR.
9.a) Controls exist in the MCR to      Stroke testing will be performed      Controls in the MCR operate to cause cause remotely operated valves          on remotely operated valves          remotely operated valves identified identified in Table 2.2.5-1 to          identified in Table 2.2.5-1 using    in Table 2.2.5-1 to perform their perform their active functions.        the controls in the MCR.              active safety functions.
9.b) The valves identified in          Testing will be performed on          The remotely operated valves Table 2.2.5-1 as having PMS            remotely operated valves listed in    identified in Table 2.2.5-1 as having control perform their active safety    Table 2.2.5-1 using real or          PMS control perform the active function after receiving a signal      simulated signals into the PMS.      safety function identified in the table from the PMS.                                                                after receiving a signal from the PMS.
9.c) The MCR Load Shed Panels          Testing will be performed on the      The MCR Load Shed Panels identified in Table 2.2.5-1 perform    MCR Load Shed Panels listed in        identified in Table 2.2.5-1 perform their active safety function after      Table 2.2.5-1 using real or          their active safety function identified receiving a signal from the PMS.        simulated signals into the PMS.      in the table after receiving a signal from the PMS.                            Commented [HZS13]: Ext-02
: 10. After loss of motive power, the    Testing of the remotely operated      After loss of motive power, each remotely operated valves identified    valves will be performed under        remotely operated valve identified in in Table 2.2.5-1 assume the            the conditions of loss of motive      Table 2.2.5-1 assumes the indicated indicated loss of motive power          power.                                loss of motive power position.
position.
: 11. Displays of the parameters          Inspection will be performed for      The displays identified in identified in Table 2.2.5-3 can be      retrievability of the parameters in  Table 2.2.5-3 can be retrieved in the retrieved in the MCR.                  the MCR.                              MCR.
Tier 1 Material                                        2.2.5-15                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        73
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                        AP1000 Design Control Document Table 2.5.2-3 PMS Automatically Actuated Engineered Safety Features Safeguards Actuation Containment Isolation Automatic Depressurization System (ADS) Actuation Main Feedwater Isolation Reactor Coolant Pump Trip CMT Injection Turbine Trip (Isolated signal to nonsafety equipment)
Steam Line Isolation Steam Generator Relief Isolation Steam Generator Blowdown Isolation Passive Containment Cooling Actuation Startup Feedwater Isolation Passive Residual Heat Removal (PRHR) Heat Exchanger Alignment Block of Boron Dilution Chemical and Volume Control System (CVS) Makeup Line Isolation Steam Dump Block (Isolated signal to nonsafety equipment)
MCR Isolation and Air Supply InitiationMain Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization                                                                                                  Commented [HZS1]: Ext-02 Auxiliary Spray and Letdown Purification Line Isolation Containment Air Filtration System Isolation Normal Residual Heat Removal Isolation Refueling Cavity Isolation In-Containment Refueling Water Storage Tank (IRWST) Injection IRWST Containment Recirculation CVS Letdown Isolation Pressurizer Heater Block (Isolated signal to nonsafety equipment)
Containment Vacuum Relief Tier 1 Material                                        2.5.2-6                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  74
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                        AP1000 Design Control Document Table 2.5.2-4 PMS Manually Actuated Functions Reactor Trip Safeguards Actuation Containment Isolation Depressurization System Stages 1, 2, and 3 Actuation Depressurization System Stage 4 Actuation Feedwater Isolation Core Makeup Tank Injection Actuation Steam Line Isolation Passive Containment Cooling Actuation Passive Residual Heat Removal Heat Exchanger Alignment IRWST Injection Containment Recirculation Actuation Control Room Isolation and Air Supply InitiationMain Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization                                                                                  Commented [HZS2]: Ext-02 Steam Generator Relief Isolation Chemical and Volume Control System Isolation Normal Residual Heat Removal System Isolation Containment Vacuum Relief Tier 1 Material                                      2.5.2-7                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  75
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of the Plant                    AP1000 Design Control Document Table 1.1-1 (Sheet 4 of 4)                                    Commented [HZS1]: Ext-02 AP1000 DCD ACRONYMS ORE            Occupation Radiation Exposure PCS            Passive Containment Cooling System P&ID          Piping and Instrumentation Diagram PRA            Probabilistic Risk Assessment PRHR          Passive Residual Heat Removal PRHR HX        Passive Residual Heat Removal Heat Exchanger PWR            Pressurized Water Reactor PXS            Passive Core Cooling System QA            Quality Assurance RAM            Reliability, Availability, Maintainability RAP            Reliability Assurance Program RCS            Reactor Coolant System RCDT          Reactor Coolant Drain Tank RFI            Radio Frequency Interference R.G.          Regulatory Guide RNS            Normal Residual Heat Removal RSW            Remote Shutdown Workstation RV            Reactor Vessel SECY          Secretary of the Commission Letter SER            Safety Evaluation Report SMACNA        Sheet Metal and Air Conditioning Contractors National Association SRP            Standard Review Plan SSAR          Standard Safety Analysis Report SSD            System Specification Document SSE            Safe Shutdown Earthquake SSI            Soil Structure Interaction SUFCV          Startup Feedwater Control Valve SUFIV          Startup Feedwater Isolation Valve TID            Total Integrated Dose TMI            Three Mile Island TSC            Technical Support Center UBC            Uniform Building Code UL            Underwriters Laboratories UPS            Uninterruptible Power Supply URD            Utility Requirements Document USI            Unresolved Safety Issue USPHS          United States Public Health Service WBGT          Wet Bulb Globe Temperature Tier 2 Material                                          1.1-6                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            76
 
DCP_NRC_003343                                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                                        AP1000 Design Control Document Table 1.6-1 (Sheet 12 of 21)
MATERIAL REFERENCED DCD Section          Westinghouse Topical Number                Report Number                                                          Title 6.2        WCAP-15644-P (P)                        AP1000 Code Applicability Report, Revision 2, March 2004 WCAP-15644-NP 6.3        WCAP-8966 (P)                          Evaluation of Mispositioned ECCS Valves, September 1977 WCAP-13594 (P)                          FMEA of Advanced Passive Plant Protection System, Revision 1, WCAP-13662 (NP)                        June 1998 6A          WCAP-15846 (P)                          WGOTHIC Application to AP600 and AP1000, Revision 1, WCAP-15862                              March 2004 WCAP-14135 (P)                          Final Data Report for Passive Containment Cooling System Large WCAP-14138                              Scale Test, Phase 2 and Phase 3, Revision 3, November 1998 WCAP-15613 (P)                          AP1000 PIRT and Scaling Assessment Report, March 2001 WCAP-15706 7.1        WCAP-14605 (P)                          Westinghouse Setpoint Methodology for Protection Systems -
WCAP-14606 (NP)                        AP600, April 1996 WCAP-16361-P                            Westinghouse Setpoint Methodology for Protection Systems -
WCAP-16361-NP                          AP1000, February 2011 WCAP-15775                              AP1000 Instrumentation and Control Defense-in-Depth and Diversity Report
[WCAP-16096-NP-A                        Software Program Manual for Common Q Systems, Revision 01A, December 2004]*
[WCAP-16097-P-A                        Common Qualified Platform, Revision 01, May 2003]*
WCAP-16097-NP-A WCAP-15776                              Safety Criteria for the AP1000 Instrumentation and Control Systems, April 2002 WCAP-16674-P                            AP1000 I&C Data Communication and Manual Control of Safety WCAP-16674-NP                          Systems and Components, Revision 4 WCAP-16675-P                            AP1000 Protection and Safety Monitoring System Architecture WCAP-16675-NP                          Technical Report, Revision 5 (as modified by changes provided in Appendix 7A)                                                            Commented [HZS1]: Ext-02 APP-GW-GLR-017                          AP1000 Standard Combined License Technical Report, Resolution of Common Q NRC Items (P) Denotes Document is Proprietary
*NRC Staff approval is required prior to implementing a change in this information; see DCD Introduction Section 3.5.
Tier 2 Material                                                    1.6-13                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                77
 
DCP_NRC_003343                                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                                        AP1000 Design Control Document Table 1.6-1 (Sheet 13 of 21)
MATERIAL REFERENCED DCD Section          Westinghouse Topical Number                Report Number                                                          Title 7.1        [WCAP-17179-P                          AP1000 Component Interface Module Technical Report]*
WCAP-17179-NP
[WCAP-15927 (NP)                        Design Process for AP1000 Common Q Safety Systems, Revision 2, November 2008]*
Westinghouse Electric Company Quality Management System (QMS), (Non-Proprietary), Revision 5, October 2002 APP-GW-J0R-012                          AP1000 Protection and Safety Monitoring System Computer Security Plan, Revision 1
[WCAP-17201-P                          AC160 High Speed Link Communication Compliance to DI&C-ISG-04 Staff Positions 9, 12, 13 and 15, Revision 0, February 2010]*
WCAP-17184-P (P)                        AP1000' Diverse Actuation System Planning and Functional Design Summary Technical Report 7.2        WCAP-16438-P                            FMEA of AP1000 Protection and Safety Monitoring System, WCAP-16438-NP                          Revision 3 (as modified by changes provided in Appendix 7A)            Commented [HZS2]: Ext-02 WCAP-16592-P                            Software Hazards Analysis of AP1000 Protection and Safety WCAP-16592-NP                          Monitoring System, Revision 2 WCAP-15776                              Safety Criteria for the AP1000 Instrumentation and Control Systems, April 2002 WCAP-16097-P-A                          Common Qualified Platform, Digital Plant Protection System, WCAP-16097-NP-A                        Appendix 3, May 2003 7.3        WCAP-15776                              Safety Criteria for the AP1000 Instrumentation and Control Systems, April 2002 7.7        WCAP-17184-P                            AP1000' Diverse Actuation System Planning and Functional Design Summary Technical Report 9.5        WCAP-15871                              AP1000 Assessment Against NFPA 804, Revision 1, December 2002 10.2        WCAP-16650-P (P)                        Analysis of the Probability of the Generation of Missiles for AP1000 WCAP-16650-NP                          Fully Integral Low Pressure Turbines, Revision 0, February 2007 WCAP-16651-P (P)                        Probabilistic Evaluation of Turbine Valve Test Frequency, WCAP-16651-NP                          Revision 1, May 2009 13          WCAP-14690                              Designers Input to Procedure Development for the AP600, Revision 1, June 1997 (P) Denotes Document is Proprietary
*NRC Staff approval is required prior to implementing a change in this information; see DCD Introduction Section 3.5.
Tier 2 Material                                                    1.6-14                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                78
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                AP1000 Design Control Document Table 3.7.3-1 (Sheet 1 of 3)                                          Commented [HZS1]: Ext-02 SEISMIC CATEGORY I EQUIPMENT OUTSIDE CONTAINMENT BY ROOM NUMBER Room No.                      Room Name                                    Equipment Description 12101      Division A battery room                          Batteries 12102      Division C battery room 1                        Batteries 12103      Spare battery room                                Spare batteries 12104      Division B battery room 1                        Batteries 12105      Division D battery room                          Batteries 12113      Spare battery charger room 12162      RNS pump room A                                  RNS pressure boundary 12163      RNS pump room B                                  RNS pressure boundary 12201      Division A dc equipment room                      dc equipment 12202      Division C battery room 2                        Batteries 12203      Division C dc equipment room                      dc equipment 12204      Division B battery room 2                        Batteries 12205      Division D dc equipment room                      dc equipment 12207      Division B dc equipment room                      dc equipment 12211      Corridor                                          Divisional cables 12212      Division B RCP trip switchgear room              RCP trip switchgear 12244      Lower annulus valve area                          CVS/WLS containment isolation valves 12251      Demineralizer/filter access area                  CVS/DWS isolation valves 12254      SFS penetration room                              SFS containment isolation valve 12256      Containment isolation valve room                  RNS containment isolation valves 12259      Pipe chase                                        RNS piping 12262      Piping/Valve room                                RNS pressure boundary, SFS piping 12265      Waste monitor tank room C                        SFS piping 12269      Pipe chase                                        RNS pressure boundary 12300      Corridor                                          Divisional cable, MCR load shed panel 12301      Division A I&C room                              Divisional I&C 12302      Division C I&C room                              Divisional I&C Tier 2 Material                                        3.7-63                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                79
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                AP1000 Design Control Document Table 3.7.3-1 (Sheet 2 of 3)                                            Commented [HZS2]: Ext-02 SEISMIC CATEGORY I EQUIPMENT OUTSIDE CONTAINMENT BY ROOM NUMBER Room No.                      Room Name                                    Equipment Description 12303    Remote shutdown room                              Divisional cabling 12304    Division B I&C/penetration room                  Divisional I&C/electrical penetrations 12305    Division D I&C/penetration room                  Divisional I&C/electrical penetrations 12306    Valve/piping penetration room                    CCS/CVS/DWS/FPS/SGS containment isolation valves 12311    Corridor                                          Divisional cabling 12312    Division C RCP trip switchgear room              RCP trip switchgear 12313    Division C I&C/penetration room                  Divisional I&C/electrical penetrations 12321    Non-1E equipment/penetration room                Divisional cabling 12341    Middle annulus                                    Class 1E electrical penetrations Various mechanical piping penetrations 12351    Maintenance floor staging area                    Divisional cabling (ceiling) 12352    Personnel hatch                                  Personnel airlock (interlocks) 12354    Middle annulus access room                        PSS/SFS containment isolation valves 12362    RNS HX room                                      RNS pressure boundary 12365    Waste monitor tank room B                        SFS piping 12400    Control room vestibule                            Control room access 12401    Main control room                                Dedicated safety panel VBS HVAC dampers VES isolation valves Lighting circuits Mounting for lighting fixtures 12404    Lower MSIV compartment B                          SGS containment isolation valves, instrumentation and controls 12405    Lower VBS B and D equipment room                  VWS/PXS/CAS containment isolation valves 12406    Lower MSIV compartment A                          SGS containment isolation valves, instrumentation and controls 12412    Electrical penetration room Division A            Divisional electrical penetrations, MCR load shed panel Tier 2 Material                                      3.7-64                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  80
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                            AP1000 Design Control Document Table 3.9-12 (Sheet 6 of 7)                                    Commented [HZS1]: Ext-02 LIST OF ASME CLASS 1, 2, AND 3 ACTIVE VALVES Valve No.          Description                                                        Function(a)
Steam Generator System (Cont.)
SGS-PL-V040A        Main Steam Line Isolation                                          2,3,4 SGS-PL-V040B        Main Steam Line Isolation                                          2,3,4 SGS-PL-V057A        Main Feedwater Isolation                                            2,3,4 SGS-PL-V057B        Main Feedwater Isolation                                            2,3,4 SGS-PL-V067A        Startup Feedwater Isolation                                        2,3,4 SGS-PL-V067B        Startup Feedwater Isolation                                        2,3,4 SGS-PL-V074A        Steam Generator Blowdown Isolation                                  2,3,4 SGS-PL-V074B        Steam Generator Blowdown Isolation                                  2,3,4 SGS-PL-V075A        Steam Generator Series Blowdown Isolation                          3,4 SGS-PL-V075B        Steam Generator Series Blowdown Isolation                          3,4 SGS-PL-V086A        Steam Line Condensate Drain Control                                3,4 SGS-PL-V086B        Steam Line Condensate Drain Control                                3,4 SGS-PL-V233A        Power Operated Relief Valve                                        3,4 SGS-PL-V233B        Power Operated Relief Valve                                        3,4 SGS-PL-V240A        Main Steam Isolation Valve Bypass Isolation                        2,3,4 SGS-PL-V240B        Main Steam Isolation Valve Bypass Isolation                        2,3,4 SGS-PL-V250A        Main Feedwater Control                                              3,4 SGS-PL-V250B        Main Feedwater Control                                              3,4 SGS-PL-V255A        Startup Feedwater Control                                          3,4 SGS-PL-V255B        Startup Feedwater Control                                          3,4 Nuclear Island Nonradioactive Ventilation System VBS-PL-V186        MCR Supply Air Isolation Valve                                      3 VBS-PL-V187        MCR Supply Air Isolation Valve                                      3 VBS-PL-V188        MCR Return Air Isolation Valve                                      3 VBS-PL-V189        MCR Return Air Isolation Valve                                      3 VBS-PL-V190        MCR Exhaust Air Isolation Valve                                    3 VBS-PL-V191        MCR Exhaust Air Isolation Valve                                    3 Main Control Room Habitability System VES-PL-V001        Air Delivery Alternate Isolation Valve                              3 VES-PL-V002A        Pressure Regulating Valve A                                        3 VES-PL-V002B        Pressure Regulating Valve B                                        3 VES-PL-V005A        Air Delivery Isolation Valve A                                      3 VES-PL-V005B        Air Delivery Isolation Valve B                                      3 VES-PL-V018        Temporary Instrument Isolation Valve A                              3 VES-PL-V019        Temporary Instrument Isolation Valve B                              3 VES-PL-V022A        Pressure Relief Isolation Valve A                                  3 VES-PL-V022B        Pressure Relief Isolation Valve B                                  3 Tier 2 Material                                    3.9-126                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                        81
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                                                                                                                              AP1000 Design Control Document Table 3.9-16 (Sheet 23 of 26)                                                                                                        Commented [HZS2]: Ext-02 VALVE INSERVICE TEST REQUIREMENTS Valve Tag                                            Valve/Actuator  Safety-Related                                ASME Class/
Number                                Description(1)      Type          Missions            Safety Functions(2)    IST Category                    Inservice Testing Type and Frequency            IST Notes VES-PL-V001    Air Delivery Isolation Valve                  Manual      Maintain Close      Active                        Class 3      Exercise Full Stroke/2 Years                                        37 Transfer Open                                    Category B Maintain Open VES-PL-V002A    Pressure Regulating Valve A                Press. Reg. Throttle Flow        Active                        Class 3      Exercise Stroke/Quarterly                                          31, 38 Augmented      Operability Test VES-PL-V002B    Pressure Regulating Valve B                Press. Reg. Throttle Flow        Active                        Class 3      Exercise Stroke/Quarterly                                          31, 38 Augmented      Operability Test VES-PL-V005A    Air Delivery Isolation Valve A              Remote SO    Maintain Open        Active-to-Failed              Class 3      Remote Position Indication, Exercise/2 Years                        31 GLOBE        Transfer Open                                    Category B    Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V005B    Air Delivery Isolation Valve B              Remote SO    Maintain Open        Active-to-Failed              Class 3      Remote Position Indication, Exercise/2 Years                        31 GLOBE        Transfer Open                                    Category B    Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V018    Temporary Instrument Isolation Valve A        Manual      Maintain Close      Active                        Class 3      Exercise Full Stroke/2 Years Transfer Open                                    Category B Maintain Open VES-PL-V019    Temporary Instrument Isolation Valve B        Manual      Maintain Close      Active                        Class 3      Exercise Full Stroke/2 Years Transfer Open                                    Category B Maintain Open VES-PL-V022A    Pressure Relief Isolation Valve A          Remote AO      Maintain Open        Active-to-Failed              Class 3      Remote Position Indication, Exercise/2 Years                        31 Butterfly    Transfer Open                                    Category B    Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V022B    Pressure Relief Isolation Valve B          Remote AO      Maintain Open        Active-to-Failed              Class 3      Remote Position Indication, Exercise/2 Years                        31 Butterfly    Transfer Open                                    Category B    Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V040A    Air Tank Safety Relief Valve A                Relief      Maintain Close      Active                        Class 3      Class 2/3 Relief Valve Tests/10 Years and 20% in 4 Years Transfer Open                                    Category BC VES-PL-V040B    Air Tank Safety Relief Valve B                Relief      Maintain Close      Active                        Class 3      Class 2/3 Relief Valve Tests/10 Years and 20% in 4 Years Transfer Open                                    Category BC VES-PL-V041A    Air Tank Safety Relief Valve A                Relief      Maintain Close      Active                        Class 3      Class 2/3 Relief Valve Tests/10 Years and 20% in 4 Years Transfer Open                                    Category BC Tier 2 Material                                                                                                                                                              3.9-177                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                                                                                          82
 
DCP_NRC_003343                                              Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                      AP1000 Design Control Document Table 3.9-17 SYSTEM LEVEL OPERABILITY TEST REQUIREMENTS System/Feature                                Test Purpose                Test Method        Tech Speca PCS PCCWST drain lines                        Flow capability and water coverage      Note 1            SR 3.6.6.6 PXS Accumulator injection lines                Flow capability                        Note 2            SR 3.5.1.6 CMT injection lines                        Flow capability                        Note 3            SR 3.5.2.7 PRHR HX                                    Heat transfer capability                Note 4            SR 3.5.4.6 IRWST injection lines                      Flow capability                        Note 5            SR 3.5.6.10 Containment recirculation lines            Flow capability                        Note 6            SR 3.5.6.10 VES MCR isolation/makeup                      MCR pressurization capability          Note 7            SR 3.7.6.10        Commented [HZS3]: Ext-02 Alpha Note:
: a. Refer to the Technical Specification surveillance identified in this column for the test frequency.
Notes:
: 1. The flow capability of each PCS water drain line is demonstrated by conducting a test where water is drained from the PCS water storage tank onto the containment shell by opening two of the three parallel isolation valves. During this flow test the water coverage is also demonstrated. The test is terminated when the flow measurement is obtained and the water coverage is observed. The minimum allowable flowrate is 469.1 gpm with the passive containment cooling water storage tank level 27.3 feet above the lowest standpipe. The test may be run with a higher water level and the test results adjusted for the increased level. Water coverage is demonstrated by visual inspection that there is unobstructed flow from the lower weirs. In addition, at least four air baffle panels will be removed at the containment vessel spring line, approximately 90 degrees apart, to permit visual inspection of the water coverage and the vessel coating. The water coverage observed at these locations will be compared against the coverage measured at the same locations during pre-operational testing (see item 7.(b)(i) of ITAAC Table 2.2.2-6).
: 2. The flow capability of each accumulator is demonstrated by conducting a test during cold shutdown conditions. The initial conditions of the test include reduced accumulator pressure. Flow from the accumulator to the RCS is initiated by opening the accumulator isolation valve. Sufficient flow is provided to fully open the check valves. The test is terminated when the flow measurement is obtained. The allowable calculated flow resistance between each accumulator and the reactor vessel is  1.47 x 10-5 ft/gpm2 and  1.83 x 10-5 ft/gpm2.
: 3. The flow capability of each CMT is demonstrated by conducting a test during cold shutdown conditions. The initial conditions of the test include the RCS loops drained to a level below the top of the RCS hot leg. Flow from the CMT to the RCS is initiated by opening one CMT isolation valve. The test is terminated when the flow measurement is obtained. The allowable calculated flow resistance between each CMT and the reactor vessel is 1.83 x 10-5 ft/gpm2 and  2.25 x 10-5 ft/gpm2.
Tier 2 Material                                            3.9-191                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                            83
 
DCP_NRC_003343                                              Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                    AP1000 Design Control Document
: 4. The heat transfer capability of the passive residual heat exchanger is demonstrated by conducting a test during cold shutdown conditions. The test is conducted with the RCPs in operation and the RCS at a reduced temperature. Flow through the heat exchanger is initiated by opening one outlet isolation valve. The test is terminated when the flow and temperature measurements are obtained. The allowable calculated heat transfer is t 1.04E8 Btu/hr with an inlet temperature of 250qF and an IRWST temperature of 120qF and the design basis number of tubes plugged.
: 5. The flow capability of each IRWST injection line is demonstrated by conducting flow tests and inspections. A flow test is conducted to demonstrate the flow capability of the injection line from the IRWST through the IRWST injection check valves. Water flow from the IRWST through the IRWST injection check valve demonstrates the flow capability of this portion of the line. Sufficient flow is provided to fully open the check valves. The test is terminated when the flow measurement is obtained. The allowable calculated flow resistance from the IRWST to each injection line check is: Line A:  5.53 x 10-6 ft/gpm2 and  9.20 x 10-6 ft/gpm2 and Line B:  6.21 x 10-6 ft/gpm2                                                                                                          and 1.03 x 10-5 ft/gpm2.
The flow capability of the portion of the line from the IRWST check valves to the DVI line is demonstrated by conducting an inspection of the inside of the line. The inspection shows that the lines are not obstructed. It is not necessary to operate the IRWST injection squib valves for this inspection.
: 6. The flow capability of each containment recirculation line is demonstrated by conducting an inspection. The line from the containment to the containment recirculation squib valve is inspected from the containment side. The line from the squib valve to the IRWST injection line is inspected from the IRWST side. The inspection shows that the lines are not obstructed. It is not necessary to operate the containment recirculation squib valves for this inspection.
: 7. The MCR pressurization capability is demonstrated by conducting a test. The test is conducted with the normal HVAC lines connected to the MCR isolated using the dampers in VBS designated for this purpose in subsection 9.4.1. Pressurization of the MCR is initiated by opening one of the emergency MCR habitability air supply lines. The test is performed on a staggered test basis and, therefore, the air supply lines are alternated for subsequent tests. The test is a limited duration test and is terminated when the MCR pressurization is measured. The minimum allowable MCR pressurization is 1/8 inch gauge pressure relative to the surrounding areas, with 65 +/- 5 scfm air flow supplied by the emergency MCR habitability air supply line.
Control room envelope inleakage is evaluated by tracer gas testing performed as part of initial plant preoperational testing, as discussed in subsection 6.4.5.1, and periodically thereafter, as discussed in subsection 6.4.5.4. Where possible, inleakage testing is performed in conjunction with the VES system level operational testing since the VES must be in operation to perform the inleakage testing.                                                                  Commented [HZS4]: Ext-02 Tier 2 Material                                            3.9-192                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                            84
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                        AP1000 Design Control Document Table 3.11-1 (Sheet 17 of 51)                                    Commented [HZS1]: Ext-02 ENVIRONMENTALLY QUALIFIED ELECTRICAL AND MECHANICAL EQUIPMENT Operating Envir.                Time  Qualification AP1000              Zone    Function  Required    Program Description              Tag No.          (Note 2)    (Note 1)  (Note 5)  (Note 6)
Power Range Neutron Flux        PMS-JW-007C            2          RT        5 min      E High Voltage Distribution Box C Power Range Neutron Flux        PMS-JW-007D            2          RT        5 min      E High Voltage Distribution Box D MAIN CONTROL ROOM Operator Workstation A          N/A                    3          RT        5 min      E ESF      24 hr PAMS      2 wks Operator Workstation B          N/A                    3          RT        5 min      E ESF      24 hr PAMS      2 wks Supervisor Workstation          N/A                    3          RT        5 min      E ESF      24 hr PAMS      2 wks Switch Station                  N/A                    3          RT        5 min      E (Including Switches)                                              ESF      24 hr QDPS MCR Display Unit            PMS-JY-001B            3          PAMS      2 wks      E QDPS MCR Display Unit            PMS-JY-001C            3          PAMS      2 wks      E MCR Load Shed Panel 1            VES-EP-01              2          ESF      24 hr      ES PAMS      2 wks MCR Load Shed Panel 2            VES-EP-02              2          ESF      24 hr      E PAMS      2 wks PENETRATIONS Penetrations (Mechanical)        See Table 6.2.3-1                                      M*
Penetrations (Electrical)        See Figure 3.8.2-4                                    E*
ACTIVE VALVES Containment Isolation - Air Out  CAS-PL-V014            2          ESF      5 min      MS Solenoid Valve                  CAS-PL-V014-S          2          ESF      5 min      E Limit Switch                    CAS-PL-V014-L          2          PAMS      2 wks      E Containment Isolation - Air In  CAS-PL-V015            1          ESF      5 min      M*
Containment Isolation - Inlet    CCS-PL-V200            2          ESF      5 min      MS Limit Switch                    CCS-PL-V200-L          2          PAMS      2 wks      E Motor Operator                  CCS-PL-V200-M          2          ESF      5 min      E Service Air Supply Inside        CAS-PL-V205            1          PB        1 yr      M*
Containment Isolation Containment Isolation - Inlet    CCS-PL-V201            1          ESF      5 min      M*
Tier 2 Material                                  3.11-22                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      85
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Table 3.11-1 (Sheet 30 of 51)                                    Commented [HZS2]: Ext-02 ENVIRONMENTALLY QUALIFIED ELECTRICAL AND MECHANICAL EQUIPMENT Operating Envir.                  Time  Qualification AP1000            Zone      Function  Required    Program Description                Tag No.          (Note 2)    (Note 1)  (Note 5)  (Note 6)
MCR Isolation Valve                  VBS-PL-V191          3          ESF      24 hr      M Limit Switch                        VBS-PL-V191-L        3          PAMS      2 wks      E Motor Operator                      VBS-PL-V191-M        3          ESF      24 hr      E Air Delivery Isolation Valve          VES-PL-V001          3          ESF      2 wks      M Pressure Regulator Valve A            VES-PL-V002A        7          ESF      2 wks      M Pressure Regulator Valve B            VES-PL-V002B        7          ESF      2 wks      M Actuation Valve A                    VES-PL-V005A        3          ESF      2 wks      M Limit Switch                        VES-PL-V005A-L      3          PAMS      2 wks      E Solenoid Operator                    VES-PL-V005A-S      3          ESF      2 wks      E Actuation Valve B                    VES-PL-V005B        3          ESF      2 wks      M Limit Switch                        VES-PL-V005B-L      3          PAMS      2 wks      E Solenoid Operator                    VES-PL-V005B-S      3          ESF      2 wks      E Temporary Instrument Isolation Valve  VES-PL-V018          7          ESF      2 wks      M A
Temporary Instrument Isolation Valve  VES-PL-V019          7          ESF      2 wks      M B
Relief Isolation Valve A              VES-PL-V022A        3          ESF      2 wks      M Limit Switch                        VES-PL-V022A-L      3          PAMS      2 wks      E Solenoid Valve                      VES-PL-V022A-S      3          ESF      2 wks      E Relief Isolation Valve B              VES-PL-V022B        3          ESF      2 wks      M Limit Switch                        VES-PL-V022B-L      3          PAMS      2 wks      E Solenoid Valve                      VES-PL-V022B-S      3          ESF      2 wks      E Air Tank Relief A                    VES-PL-V040A        7          ESF      2 wks      M Air Tank Relief B                    VES-PL-V040B        7          ESF      2 wks      M Air Tank Relief C                    VES-PL-V040C        7          ESF      2 wks      M Air Tank Relief D                    VES-PL-V040D        7          ESF      2 wks      M Main Air Flow Path Isolation Valve    VES-PL-V044          3          ESF      2 wks      M Eductor Flow Path Isolation Valve    VES-PL-V045          3          ESF      2 wks      M Eductor Bypass Isolation Valve        VES-PL-V046          3          ESF      2 wks      M Containment Purge Inlet Isolation    VFS-PL-V003          7          ESF      5 min      MS Limit Switch                        VFS-PL-V003-L        7          PAMS      2 wks      E Solenoid Valve                      VFS-PL-V003-S1      7          ESF      5 min      E Containment Purge Inlet Isolation    VFS-PL-V004          1          ESF      5 min      M*
Limit Switch                        VFS-PL-V004-L        1          PAMS      1 yr      E*
Solenoid Valve                      VFS-PL-V004-S1      1          ESF      5 min      E*
Containment Purge Discharge Isolation VFS-PL-V009          1          ESF      5 min      M*
Limit Switch                        VFS-PL-V009-L        1          PAMS      1 yr      E*
Tier 2 Material                                    3.11-35                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          86
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Table 3.11-1 (Sheet 47 of 51)                                    Commented [HZS3]: Ext-02 ENVIRONMENTALLY QUALIFIED ELECTRICAL AND MECHANICAL EQUIPMENT Operating Envir.                  Time  Qualification AP1000            Zone      Function  Required    Program Description                  Tag No.          (Note 2)    (Note 1)  (Note 5)  (Note 6)
Steam Line Condensate Drain Level      SGS-PL-V096B        5          PB        1 yr      M*
Isolation Valve Steam Line Condensate Drain Level      SGS-PL-V097A        5          PB        1 yr      M*
Isolation Valve Steam Line Condensate Drain Level      SGS-PL-V097B        5          PB        1 yr      M*
Isolation Valve Startup Feedwater Check Valve          SGS-PL-V256A        5          PB        1 yr      M*
Startup Feedwater Check Valve          SGS-PL-V256B        5          PB        1 yr      M*
Air Delivery Line Pressure Instrument  VES-PL-V006A        7          PB        1 yr      M Isolation Valve A Air Delivery Line Pressure Instrument  VES-PL-V006B        7          PB        1 yr      M Isolation Valve B Air Delivery Line Maintenance          VES-PL-V010A        7          PB        1 yr      M Isolation Valve A Air Delivery Line Maintenance          VES-PL-V010B        7          PB        1 yr      M Isolation Valve B Air Delivery Line Maintenance          VES-PL-V011A        7          PB        1 yr      M Isolation Valve A Air Delivery Line Maintenance          VES-PL-V011B        7          PB        1 yr      M Isolation Valve B Temporary Instrument                  VES-PL-V016          7          PB        1 yr      M Isolation Valve A Temporary Instrument                  VES-PL-V018          7          PB        1 yr      M Isolation Valve A Temporary Instrument                  VES-PL-V019          7          PB        1 yr      M Isolation Valve B Temporary Instrument                  VES-PL-V020          7          PB        1 yr      M Isolation Valve B Air Bank 1 Isolation Valve A          VES-PL-V024A        7          PB        1 yr      M Air Bank 2 Isolation Valve B          VES-PL-V024B        7          PB        1 yr      M Air Bank 3 Isolation Valve C          VES-PL-V024C        7          PB        1 yr      M Air Bank 4 Isolation Valve D          VES-PL-V024D        7          PB        1 yr      M Air Bank 1 Isolation Valve A          VES-PL-V025A        7          PB        1 yr      M Air Bank 2 Isolation Valve B          VES-PL-V025B        7          PB        1 yr      M Air Bank 3 Isolation Valve C          VES-PL-V025C        7          PB        1 yr      M Air Bank 4 Isolation Valve D          VES-PL-V025D        7          PB        1 yr      M Air Bank 1 Fill/Vent Isolation Valve A VES-PL-V026A        7          PB        1 yr      M Tier 2 Material                                      3.11-53                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          87
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                        AP1000 Design Control Document Table 3D.5-4 (Sheet 1 of 2)
ABNORMAL OPERATING ENVIRONMENTS OUTSIDE CONTAINMENT Conditions/Parameter            Abnormal Extreme                  Duration        Notes Zone 2 - Loss of AC Power Temperature              Figure 3D.5-1 (Sheet 2)            7 days            Note 3 Pressure                  Atmospheric Humidity                  40 - 95%                                            Note 2 Radiation                Same as normal Chemistry/Submergence    None Zone 3 - Loss of HVAC Temperature              Figure 3D.5-1 (Sheet 1)            7 days Pressure                  Atmospheric                                          Note 1 Humidity                  60 - 95%5 - 95%                                      Note 2        Commented [HZS1]: Ext-02 Radiation                Same as normal Chemistry/Submergence    None Zone 4 - Loss of AC Power Temperature              120°F max                          10x4 hrs Pressure                  Atmospheric Humidity                  Same as normal Radiation                Same as normal Chemistry/Submergence    None Zone 5 - Loss of AC Power Temperature              150°F max                          10x4 hrs Pressure                  Atmospheric Humidity                  Same as normal Radiation                Same as normal Chemistry/Submergence    None Zone 6 - Loss of AC Power Temperature              140°F max                          10x4 hrs Pressure                  Atmospheric Humidity                  Same as normal Radiation                Same as normal Chemistry/Submergence    None Tier 2 Material                                3D-45                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  88
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Figure 3D.5-1 (Sheet 1 of 3) Commented [HZS2]: Ext-02 Typical Abnormal Environmental Test Profile:
Main Control Room Tier 2 Material                      3D-49                                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              89
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Table 3I.6-2 (Sheet 11 of 28)                                  Commented [HZS1]: Ext-02 LIST OF POTENTIAL HIGH FREQUENCY SENSITIVE AP1000 SAFETY-RELATED ELECTRICAL AND ELECTRO-MECHANICAL EQUIPMENT AP1000 Description                                        Tag Number Intermediate Range Neutron Flux Preamplifier Panel D                        PMS-JW-006D Power Range Neutron Flux High Voltage Distribution Box A                    PMS-JW-007A Power Range Neutron Flux High Voltage Distribution Box B                    PMS-JW-007B Power Range Neutron Flux High Voltage Distribution Box C                    PMS-JW-007C Power Range Neutron Flux High Voltage Distribution Box D                    PMS-JW-007D Main Control Room Operator Workstation A                                                      N/A Operator Workstation B                                                      N/A Supervisor Workstation                                                      N/A Switch Station (Including Switches)                                        N/A QDPS MCR Display Unit                                                      PMS-JY-001B QDPS MCR Display Unit                                                      PMS-JY-001C MCR Load Shed Panel 1                                                      VES-EP-01 MCR Load Shed Panel 2                                                      VES-EP-02 Active Valves Containment Isolation - Air Out Solenoid Valve                                                        CAS-PL-V014-S Limit Switch                                                          CAS-PL-V014-L Containment Isolation - Inlet Limit Switch                                                          CCS-PL-V200-L Motor Operator                                                        CCS-PL-V200-M Containment Isolation - Outlet Limit Switch                                                          CCS-PL-V207-L Motor Operator                                                        CCS-PL-V207-M Containment Isolation - Outlet Tier 2 Material                                      3I-22                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                        90
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                AP1000 Design Control Document Table 3I.6-3 (Sheet 28 of 32)                                  Commented [HZS2]: Ext-02 LIST OF AP1000 SAFETY-RELATED ELECTRICAL AND MECHANICAL EQUIPMENT NOT HIGH FREQUENCY SENSITIVE AP1000 Description                                  Tag Number      Comment Startup Feedwater Check Valve                                          SGS-PL-V256B            2 Air Delivery Line Pressure Instrument Isolation Valve A                VES-PL-V006A            2 Air Delivery Line Pressure Instrument Isolation Valve B                VES-PL-V006B            2 Temporary Instrument Isolation Valve A                                  VES-PL-V016            2 Temporary Instrument Isolation Valve A                                  VES-PL-V018            2 Temporary Instrument Isolation Valve B                                  VES-PL-V019            2 Temporary Instrument Isolation Valve B                                  VES-PL-V020            2 Air Tank Isolation Valve A                                              VES-PL-V024A            2 Air Tank Isolation Valve B                                              VES-PL-V024B            2 Air Tank Isolation Valve A                                              VES-PL-V025A            2 Air Tank Isolation Valve B                                              VES-PL-V025B            2 Refill Line Isolation Valve                                            VES-PL-V038            2 DP Instrument Line Isolation Valve A                                    VES-PL-V043A            2 DP Instrument Line Isolation Valve B                                    VES-PL-V043B            2 Containment Isolation Test Connection                                  VFS-PL-V008            2 Containment Isolation Test Connection                                  VFS-PL-V012            2 Containment Isolation Test Connection                                  VFS-PL-V015            2 Main Equipment Hatch Test Connection                                    VUS-PL-V015            2 Maintenance Equipment Hatch Test Connection                            VUS-PL-V016            2 Personnel Hatch Test Connection                                        VUS-PL-V017            2 Personnel Hatch Test Connection                                        VUS-PL-V018            2 Personnel Hatch Test Connection                                        VUS-PL-V019            2 Personnel Hatch Test Connection                                        VUS-PL-V020            2 Personnel Hatch Test Connection                                        VUS-PL-V021            2 Personnel Hatch Test Connection                                        VUS-PL-V022            2 Fuel Transfer Tube Test Connection                                      VUS-PL-V023            2 Tier 2 Material                                        3I-68                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          91
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document main control area, operations work area, operations break room, shift supervisors office, kitchen, and toilet facilities. The pressure boundary is represented by the line around the periphery of the boundary in the figure. The stairwell leading down to elevation 100 and the area within the vestibule are specifically excluded from the boundary.
The areas, equipment, and materials to which the main control room operator requires access during a postulated accident are shown in Figure 6.4-1. This figure is a subset of Figure 1.2-8.
Areas adjacent to the main control room are shown in Figures 1.2-25 and 1.2-31. The layout, size, and ergonomics of the operator workstations and wall panel information system depicted in Figure 6.4-1 do not reflect the results of the design process described in Chapter 18. The actual size, shape, ergonomics, and layout of the operator workstations and wall panel information system is an output of the design process in Chapter 18.
6.4.2.2    General Description The main control room emergency habitability system air storage tanks are sized to deliver the required air flow to the main control room and induce sufficient air flow through the passive filtration line to meet the ventilation and pressurization requirements for 72 hours based on the performance requirements of subsection 6.4.1.1. Normal system makeup is provided by a connection to the breathable quality air compressor in the compressed and instrument air system (CAS). See subsection 9.3.1 for a description of the CAS. A connection for refilling operation is provided in the CAS.
Flow from the air storage tanks induces a filtration flow of at least 600 cfm. Testing was conducted to validate that the passive filtration line is capable of inducing a filtration flow of at least 600 cfm greater than the design flow rate from the VES emergency air storage tanks. The testing is documented in TR-SEE-III-09-03 (Reference 12). The filtration flow passes through a series of silencers to maintain acceptable main control room noise levels. The passive filtration portion of the system includes a HEPA filter, a charcoal adsorber, and a downstream postfilter.
The filters are configured to satisfy the guidelines of Regulatory Guide 1.52 (Reference 10). The air intake to the passive filtration ductwork is located near the operations work area. The ductwork is routed behind the main control area through the operations break room to reduce the overall noise level in the main control area. The filtered air supply is then distributed to three supply locations that are sufficiently separated from the air intake to avoid short circuiting of the air flow. Two of the supply locations are located inside the main control area. Flow dampers ensure the filtered air is properly distributed throughout the main control room envelope.
The function of providing passive heat sinks for the main control room, instrumentation and control rooms, and dc equipment rooms is part of the main control room emergency habitability system. The heat sinks for each room are designed to limit the temperature rise inside each room during the 72-hour period following a loss of nuclear island nonradioactive ventilation system operation. The heat sinks consist primarily of the thermal mass of the concrete that makes up the ceilings and walls of these rooms.
To enhance the heat-absorbing capability of the ceilings, a metal form is attached to the interior surface of the concrete at selected locations. Metallic plates are attached perpendicular to the form. These plates extend into the room and act as thermal fins to enhance the heat transfer from Tier 2 Material                                      6.4-3                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        92
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document the room air to the concrete. The specifics of the fin construction for the main control room and I&C room ceilings are described in subsection 3.8.4.1.2.
The normal operating temperatures in the main control room, instrumentation and control rooms, dc equipment rooms, and adjacent rooms are kept within a specified range by the nuclear island nonradioactive ventilation system in order to maintain a design basis initial heat sink capacity of each room. See subsection 9.4.1 for a description of the nuclear island nonradioactive ventilation system.
In the unlikely event that power to the nuclear island nonradioactive ventilation system is unavailable for more than 72 hours, MCR habitability is maintained by operating one of the two MCR ancillary fans to supply outside air to the MCR such that the maximum average Wet Bulb Globe temperature (WBGT) Index for the MCR is less than 90ºF. See subsection 9.4.1 for a        Commented [HZS2]: Ext-02 description of this cooling mode of operation. Doors and ducts may be opened to provide a supply pathway and an exhaust pathway. Likewise, outside air is supplied to division B and C instrumentation and control rooms in order to maintain the ambient temperature below the qualification temperature of the equipment.
The main control room emergency habitability system piping and instrumentation diagram is shown in Figure 6.4-2.
6.4.2.3    Component Description The main control room emergency habitability system compressed air supply contains a set of storage tanks connected to a main and an alternate air delivery line and equipment to provide electrical load de-energization. Components common to both lines include a manual isolation          Commented [HZS3]: Ext-02 valve and a pressure regulating valve. Single active failure protection is provided by the use of redundant, remotely operated isolation valves, which are located within the MCR pressure boundary. In the event of insufficient or excessive flow in the main delivery line, the main delivery line is isolated and the alternate delivery line is manually actuated. The alternate delivery line contains the same components as the main delivery line with the exception of the remotely operated isolation valves, and thus is capable of supplying compressed air to the MCR pressure boundary at the required air flowrate. The VES piping and penetrations for the MCR envelope are designated as equipment Class C. Additional details on Class C designation are provided in subsection 3.2.2.5. The classification of VES components is provided in Table 3.2-3, as appropriate.
x    Emergency Air Storage Tanks There are a total of 32 air storage tanks. The air storage tanks are constructed of forged, seamless pipe, with no welds, and conform to Section VIII and Appendix 22 of the ASME Code. The design pressure of the air storage tanks is 4000 psi. The storage tanks collectively contain a minimum storage capacity of 327,574 scf.
x    MCR Load Shed Panels The de-energization of the MCR electrical loads is performed using Class 1E equipment.
Equipment within each of the two electrical panels is actuated from the main control room Tier 2 Material                                      6.4-4                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                93
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document isolation, air supply initiation, and electrical load de-energization engineered safety feature. The de-energization is separated into two stages to provide operators with the maximum available nonsafety-related equipment while maintaining the MCR heat load within the requirements of the VES.
Each electrical panel has redundant relays and timers controlled by both protection and safety monitoring system (PMS) Division A and PMS Division C. Either division is capable of actuating the timers and relays associated with each electrical panel independent of one another. This configuration prevents routine maintenance or single failures of a PMS cabinet from creating a spurious loss of MCR electrical loads while still providing for single failure protection. To accomplish the De-energize MCR Electrical Loads function, one set of Stage 1 and Stage 2 timers in each electrical panel must receive the PMS command.
Relays in both electrical panels must be actuated to carry out the overall function. However, overall actuation may occur via different combinations of Division A and Division C commands.                                                                                      Commented [HZS4]: Ext-02 x  Pressure Regulating Valve Each compressed air supply line contains a pressure regulating valve located downstream of the common header. The pressure at the outlet of the valve is controlled via a two-staged self-contained pressure control operator. A failure of either stage of the pressure regulating valve will not cause the valve to fail completely open. A failure of the second stage of the pressure regulating valve will increase flow from the emergency air storage tanks. There is adequate margin in the emergency air storage tanks such that an operator has time to isolate the line and manually actuate the alternate delivery line.
x  Flow Metering Orifice The flow rate of air delivered to the main control room pressure boundary is limited by an orifice located downstream of the pressure regulating valve in the eductor and in the eductor bypass line. The orifice is sized to provide the required air flow rate to the main control room pressure boundary.
x  Air Delivery Main Isolation Valve The pressure boundary of the compressed air storage tanks is maintained by normally closed remotely operated isolation valves in the main supply line. These valves are located within MCR pressure boundary downstream of the pressure regulating valve and automatically initiate air flow upon receipt of a signal to open (see subsection 6.4.3.2).
x  Pressure Relief Isolation Valve To limit the pressure increase within the main control room, isolation valves are provided, one in each of redundant flowpaths, which open on a time delay after receipt of an emergency habitability system actuation signal. The valves provide a leak tight seal to protect the integrity of the main control room pressure boundary during normal operation, Tier 2 Material                                      6.4-5                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                94
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document control room shielding parameters, and evaluation of doses to main control room personnel are presented in Section 15.6.
The main control room and its location in the plant are shown in Figure 12.3-1.
6.4.3      System Operation This subsection discusses the operation of the main control room emergency habitability system.
6.4.3.1    Normal Mode The main control room emergency habitability system is not required to operate during normal conditions. The nuclear island nonradioactive ventilation system maintains the air temperature of a number of rooms within a predetermined temperature range. The rooms with this requirement include the rooms with a main control room emergency habitability system passive heat sink design and their adjacent rooms.
6.4.3.2    Emergency Mode Operation of the main control room emergency habitability system is automatically initiated by either of the following conditions:
x    High-highHigh-2 particulate or iodine radioactivity in the main control room supply air  Commented [HZS6]: Ext-03 duct x    Loss of ac power for more than 10 minutes x    Low main control room differential pressure for more than 10 minutes                      Commented [HZS7]: Ext-03 Operation can also be initiated by manual actuation.
The nuclear island nonradioactive ventilation system is isolated from the main control room pressure boundary by automatic closure of the isolation devices located in the nuclear island nonradioactive ventilation system ductwork if radiation levels in the main control room supply air duct exceed the high-high High-2 setpoint or if ac power is lost for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes.. At the same time, the main control room emergency habitability system begins to          Commented [HZS8]: Ext-03 deliver air from the emergency air storage tanks to the main control room by automatically opening the isolation valves located in the supply line. The relief damper isolation valves also open allowing the pressure relief dampers to function and discharge the damper flow to purge the vestibule.
After the main control room emergency habitability system isolation valves are opened, the air supply pressure is regulated by a self-contained regulating valve. This valve maintains a constant downstream pressure regardless of the upstream pressure. A constant air flow rate is maintained by the flow metering orifice downstream of the pressure regulating valve. This flow rate is sufficient to maintain the main control room pressure boundary at least 1/8-inch water gauge positive differential pressure with respect to the surroundings and induce a flow rate of at least 600 cfm into the passive air filtration line. The main control room emergency habitability system Tier 2 Material                                      6.4-9                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              95
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document air flow rate is also sufficient to maintain the carbon dioxide levels below 0.5 percent concentration for 11 occupants and to maintain air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1.
The emergency air storage tanks are sized to provide the required air flow to the main control room pressure boundary for 72 hours. After 72 hours, the main control room is cooled by drawing in outside air and circulating it through the room, as discussed in subsection 6.4.2.2.
The temperature and humidity in the main control room pressure boundary following a loss of the nuclear island nonradioactive ventilation system remain within limits for reliable human performance (References 2 and 3 14) over a 72-hour period. The bounding initial values of temperature/relative humidity in the MCR are 75°F/60 percent, the relative humidity in the MCR varies between 5% and 95% with a corresponding dry bulb temperature variance between 75°F to under 95°F. At 3 hours, when the non-1E battery heat loads are exhausted, the conditions are 87.2°F/41 percent. At 24 hours, when the 24 hour battery heat loads are terminated, the conditions are 84.4°F/45 percent. At 72 hours, the conditions are 85.8°F/ 39 percent. The temperature/relative humidity values calculated during the 72 hours following a design basis accident equate to a maximum average WBGT Index for the MCR of less than 90°F. The 90°F WBGT Index is the design limit for minimizing performance decrements and potential harm, and preserving well-being and effectiveness of the MCR staff for an unlimited duration (Reference 14). Non-Class 1E MCR heat loads are de-energized by PMS automatic actions, and the 24- hour battery heat loads are terminated or exhausted at 24 hours to maintain the occupied zone of the MCR and the zones containing qualified safety-related equipment within the constraints of the heat loads in Table 6.4-3 (to maintain temperature below the WBGT limit) at 72 hours after VES actuation. The occupied zone is considered to be the area between the raised floor and 7 feet above the floor, which encompasses the reactor operator and the senior reactor operator consoles. Commented [HZS9]: Ext-02 Sufficient thermal mass is provided in the walls and ceiling of the main control room to absorb the heat generated by the equipment, lights, and occupants. The temperature in the instrumentation and control rooms and dc equipment rooms following a loss of the nuclear island nonradioactive ventilation system remains below acceptable limits as discussed in subsection 6.4.4. As in the main control room, sufficient thermal mass is provided surrounding these rooms to absorb the heat generated by the equipment. After 72 hours, the instrumentation and control rooms will be cooled by drawing in outside air and circulating it through the room, as discussed in subsection 6.4.2.2.
In the event of a loss of ac power or Low main control room differential pressure for more than 10 minutes, the nuclear island nonradioactive ventilation system isolation valves automatically close and the main control room emergency habitability system isolation valves automatically open. These actions protect the main control room occupants from a potential radiation release. Commented [HZS10]: Ext-03 In instances in which there is no radiological source term present, the compressed air storage tanks are refilled via a connection to the breathable quality air compressor in the compressed and instrument air system (CAS). The compressed air storage tanks can also be refilled from portable supplies by an installed connection in the CAS.
Tier 2 Material                                      6.4-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                96
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document 6.4.4      System Safety Evaluation In the event of an accident involving the release of radioactivity to the environment, the nuclear island nonradioactive ventilation system (VBS) is expected to switch from the normal operating mode to the supplemental air filtration mode to protect the main control room personnel.
Although the VBS is not a safety-related system, it is expected to be available to provide the necessary protection for realistic events. However, the design basis accident doses reported in Chapter 15 utilize conservative assumptions, and the main control room doses are calculated based on operation of the safety-related emergency habitability system (VES) since this is the system that is relied upon to limit the amount of activity the personnel are exposed to. The analyses assume that the VBS is initially in operation, but fails to enter the supplemental air filtration mode on a High-1 radioactivity indication in the main control room atmosphere. VES operation is then assumed to be initiated once the High-2 level for control room atmosphere activity iodine or particulate radioactivity is reached.                                          Commented [HZS11]: Ext-03 Doses are also calculated assuming that the VBS does operate in the supplemental air filtration mode as designed, but with no switchover to VES operation. This VBS operating case demonstrates the defense-in-depth that is provided by the system and also shows that, in the event of an accident with realistic assumptions, the VBS is adequate to protect the control room operators without depending on VES operation.
Doses were determined for the following design basis:
VES Operating          VBS Operating Large Break LOCA                                  4.414.33 rem TEDE      4.734.84    rem TEDE Fuel Handling Accident                            2.51.5 rem TEDE        1.61.1 rem TEDE Steam Generator Tube Rupture (Pre-existing iodine spike)                  4.33.4 rem TEDE        3.12.8 rem TEDE (Accident-initiated iodine spike)            1.21.0 rem TEDE        1.70.8 rem TEDE Steam Line Break (Pre-existing iodine spike)                  3.91.1 rem TEDE        2.10.6 rem TEDE (Accident-initiated iodine spike)            4.01.3 rem TEDE        4.91.6 rem TEDE Rod Ejection Accident                              1.83.6 rem TEDE        2.22.2 rem TEDE Locked Rotor Accident (Accident without feedwater available)        0.70.4 rem TEDE        0.50.5 rem TEDE (Accident with feedwater available)          0.50.2 rem TEDE        1.50.6 rem TEDE Small Line Break Outside Containment              0.80.4 rem TEDE        0.30.2 rem TEDE  Commented [HZS12]: Ext-03 For all events the doses are within the dose acceptance limit of 5.0 rem TEDE. The details of analysis assumptions for modeling the doses to the main control room personnel are delineated in the LOCA dose analysis discussion in subsection 15.6.5.3 for VES operating cases. The analysis assumptions are provided in subsection 9.4.1.2.3.1 for the VBS operating case.
No radioactive materials are stored or transported near the main control room pressure boundary (this does not apply to installed equipment, such as radiation monitors described in Section 11.5, Tier 2 Material                                    6.4-11                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              97
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document nor to portable equipment that is in use, such as calibration equipment, survey instrumentation, tools, and other such transient items).                                                            Commented [HZS13]: Ext-03 As discussed and evaluated in subsection 9.5.1, the use of noncombustible construction and heat and flame resistant materials throughout the plant reduces the likelihood of fire and consequential impact on the main control room atmosphere. Operation of the nuclear island nonradioactive ventilation system in the event of a fire is discussed in subsection 9.4.1.
The exhaust stacks of the onsite standby power diesel generators are located in excess of 150 feet away from the fresh air intakes of the main control room. The onsite standby power system fuel oil storage tanks are located in excess of 300 feet from the main control room fresh air intakes.
These separation distances reduce the possibility that combustion fumes or smoke from an oil fire would be drawn into the main control room.
The protection of the operators in the main control room from offsite toxic gas releases is discussed in Section 2.2. The sources of onsite chemicals are described in Table 6.4-1, and their locations are shown on Figure 1.2-2. Analysis of these sources is in accordance with Regulatory Guide 1.78 (Reference 5) and the methodology in NUREG-0570, Toxic Vapor Concentrations in the Control Room Following a Postulated Accidental Release (Reference 6), and the analysis shows that these sources do not represent a toxic or flammability hazard to control room personnel.
A supply of protective clothing, respirators, and self-contained breathing apparatus adequate for 11 persons is stored within the main control room pressure boundary.
The main control room emergency habitability system components discussed in subsection 6.4.2.3 are arranged as shown in Figure 6.4-2. The location of components and piping within the main control room pressure boundary provides the required supply of compressed air to the main control room pressure boundary, as shown in Figure 6.4-1.
During emergency operation, the main control room emergency habitability system passive heat sinks are designed to limit the temperature inside the main control room to remain within limits for reliable human performance (References 2 and 3 14) over 72 hours. The passive heat sinks        Commented [HZS14]: Ext-02 limit the air temperature inside the instrumentation and control rooms to 120°F and dc equipment rooms to 120°F. The walls and ceilings that act as the passive heat sinks contain sufficient thermal mass to accommodate the heat sources from equipment, personnel, and lighting for 72 hours.
The main control room emergency habitability system nominally provides 65 scfm of ventilation air to the main control room from the compressed air storage tanks. Sixty scfm of supplied ventilation flow is sufficient to induce a filtration flow of at least 600 cfm into the passive air filtration line located inside the main control room envelope. This ventilation flow is also sufficient to pressurize the control room to at least positive 1/8-inch water gauge differential pressure with respect to the surrounding areas in addition to limiting the carbon dioxide concentration below one-half percent by volume for a maximum occupancy of 11 persons and maintaining air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1.
Tier 2 Material                                      6.4-12                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                98
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document to the main control room envelope for 72 hours during VES operation. An eductor bypass line with a flow control orifice provides the operators with the ability to ensure that the breathable air from the emergency air storage tanks is delivered to the MCR.
6.4.5      Inservice Inspection/Inservice Testing A program of preoperational and inservice testing requirements is implemented to confirm initial and continued system capability. The VES system is tested and inspected at appropriate intervals, as defined by the technical specifications. Emphasis is placed on tests and inspections of the safety-related portions of the habitability systems.
6.4.5.1    Preoperational Inspection and Testing Preoperational testing of the main control room emergency habitability system is performed to verify that the air flow rate of 65 +/- 5 scfm is sufficient to induce a flow rate of at least 600 cfm into the passive air filtration line and maintain pressurization of the main control room envelope of at least 1/8-inch water gauge with respect to the adjacent areas. The positive pressure within the main control room is confirmed via the differential pressure transmitters within the control room. The installed flow meters are utilized to verify the system flow rates. The preoperational testing also verifies that the VES pressure regulating valves are capable of maintaining the VES flow rate of 65 +/- 5 scfm over the operating range of expected valve inlet pressures. The pressurization of the control room limits the ingress of radioactivity, and the recirculation through the passive air filtration line maintains operator dose limits below regulatory limits. Air quality within the MCR environment is confirmed to be within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1 by analyzing air samples taken during the pressurization test.
The storage capacity of the compressed air storage tanks is verified to be in excess of 327,574 scf of compressed air. This amount of compressed air will assure 72 hours of air supply to the main control room.
Temperatures within the MCR are verified by analysis and/or testing to remain within the limits for reliable human performance (Reference 14) for a 72-hour period following a bounding scenario with MCR isolation and nonsafety-related ac power available (see Table 6.4-3 for heat loads) and a station blackout (battery-backed loads only).An inspection will verify that the heat loads within the rooms identified in Table 6.4-3 are less than the specified values.                  Commented [HZS18]: Ext-02 Preoperational testing of the main control room isolation valves in the nuclear island nonradioactive ventilation system is performed to verify the leaktightness of the valves.
Preoperational testing for main control room envelope habitability during VES operation will be conducted in accordance with ASTM E741 (Reference 4). Where possible, inleakage testing is performed in conjunction with the VES system level operability testing since the VES must be in operation to perform the inleakage testing. See Note 7 of Table 3.9-17 for additional information on the VES system level operability test.                                                            Commented [HZS19]: Ext-02 Testing and inspection of the radiation monitors is discussed in Section 11.5. The other tests noted above are discussed in Chapter 14.
Tier 2 Material                                      6.4-14                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  99
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document 6.4.5.2    Inservice Testing Inservice testing of the main control room emergency habitability system and nuclear island nonradioactive ventilation system is conducted in accordance with the surveillance requirements specified in the technical specifications in Chapter 16.
ASTM E741 testing of the main control room pressure boundary is conducted in accordance with the frequency specified in the technical specifications.
6.4.5.3    Air Quality Testing Connections are provided for sampling the air supplied from the compressed and instrument air system and for periodic sampling of the air stored in the storage tanks. Air samples of the compressed air storage tanks are taken quarterly and analyzed for acceptable air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1 with a pressure dew point of 40°F or lower at 3,400 psig or greater.                                                              Commented [HZS20]: Ext-02 6.4.5.4    Main Control Room Envelope Habitability Testing for main control room envelope habitability during VES operation will be conducted in accordance with ASTM E741 (Reference 4).
The main control room envelope must undergo an analysis of inleakage into the control room envelope to determine the integrity of the control room envelope boundary during a design basis accident, hazardous chemical release, or smoke event. Baseline control room envelope habitability testing will be performed as discussed in subsection 6.4.5.1, followed by a self-assessment at three (3) years after successful baseline testing, and a periodic test at six (6) years in conjunction with other ASME inservice testing requirements. The self-assessment of the ability to maintain main control room habitability includes a review of procedures, boundaries, design changes, maintenance activities, safety analyses, and other related determinations.
If periodic testing is successful, then the assessment/testing cycle continues with a self-assessment three (3) years later and periodic testing three (3) years after the self-assessment.
If a periodic testing is unsuccessful, then a periodic test is required three (3) years after repair and successful re-testing, following the unsuccessful periodic testing, to ensure there is no accelerated degradation of the main control room boundary or discrepancies in control of the main control room habitability.
In addition to periodic tests, control room envelope testing will also be performed when changes are made to structures, systems, and components that could impact control room envelope integrity, including systems internal and external to the control room envelope. The tests must be commensurate with the types and degrees of modifications and repairs and the potential impact upon integrity. Additional control room envelope testing will also be performed if a new limiting condition or alignment arises for which no inleakage data is available. Test failure is considered to be inleakage in excess of the licensing basis value for the particular challenge to control room envelope integrity.
Tier 2 Material                                      6.4-15                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      100
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                      AP1000 Design Control Document Where possible, inleakage testing is performed in conjunction with the VES system level operability testing since the VES must be in operation to perform the inleakage testing. See Note 7 of Table 3.9-17 for additional information on the VES system level operability test.        Commented [HZS21]: Ext-02 6.4.6      Instrumentation Requirements The indications in the main control room used to monitor the main control room emergency habitability system and nuclear island nonradioactive ventilation system are listed in Table 6.4-2.
Instrumentation required for actuation of the main control room emergency habitability system and nuclear island nonradioactive ventilation system are discussed in subsection 7.3.1.
Details of the radiation monitors used to provide the main control room indication of actuation of the nuclear island nonradioactive ventilation system supplemental filtration mode of operation and actuation of main control room emergency habitability system operation are given in Section 11.5.
A description of initiating circuits, logic, periodic testing requirements, and redundancy of instrumentation relating to the habitability systems is provided in Section 7.3.
6.4.7      Combined License Information Combined License applicants referencing the AP1000 certified design are responsible for the amount and location of possible sources of hazardous chemicals in or near the plant and for seismic Category I Class 1E hazardous chemical monitoring, as required. Regulatory Guide 1.78 (Reference 5) addresses control room protection for hazardous chemicals and evaluation of offsite hazardous chemical releases (including the potential for hazardous chemical releases beyond 72 hours) in order to meet the requirements of TMI Action Plan Item III.D.3.4 and GDC 19.
Combined License applicants referencing the AP1000 certified design are responsible for verifying that procedures and training for control room envelope habitability are consistent with the intent of Generic Issue 83 (see Section 1.9).
The Combined License applicant testing frequency for the main control room envelope habitability is discussed in subsection 6.4.5.4.
6.4.8      References
: 1. Ventilation for Acceptable Indoor Air Quality, ASHRAE Standard 62 - 1989.
: 2. Human Engineering Design Guidelines, MIL-HDBK-759C, 31 July 1995.
: 3. Human Engineering, MIL-STD-1472E, 31 October 1996.
: 4. Standard Test Methods for Determining Air Change in a Single Zone by Means of a Tracer Gas Dilution, ASTM E741, 2000.
Tier 2 Material                                    6.4-16                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                101
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                    AP1000 Design Control Document
: 5. Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, Regulatory Guide 1.78, Revision 1, December 2001.
: 6. NUREG-0570, Toxic Vapor Concentrations in the Control Room Following a Postulated Accidental Release, June 1979.
: 7. Code on Nuclear Air and Gas Treatment, ASME/ANSI AG-1-1997.
: 8. Loss of Charcoal Adsorber Cells, IE Bulletin 80-03, 1980.
: 9. High-Efficiency, Particular, Air-Filter Units, UL-586, 1996.
: 10. Design, Testing, and Maintenance Criteria for Post Accident Engineered-Safety-Feature Atmosphere Cleanup System Air Filtration and Adsorption Units of Light-Water-Cooled Nuclear Power Plants, Regulatory Guide 1.52, Revision 3, 2001.
: 11. Test Performance of Air-Filter Units, UL-900, 1994.
: 12. AP1000 VES Air Filtration System Test Report, TR-SEE-III-09-03.
: 13. Single Failure Criterion, SECY-77-439.
: 14. NUREG-0700, Human-System Interface Design Review Guidelines, Revision 2, 2002.      Commented [HZS22]: Ext-02 Tier 2 Material                                  6.4-17                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                        102
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                              AP1000 Design Control Document Table 6.4-3 LOSS OF AC POWER HEAT LOAD LIMITS Heat Load                Heat Load 0 to 24 Hours            24 to 72 Hours Room Name        Room Numbers                (Btu/sec)                (Btu/sec)
MCR Envelope              12401                    12.823                  3.9283.95          Commented [HZS24]: Ext-02 (Hour 0 through 3) 5.133 (Hour 4 through 24) 23.5 (Hour 0 to 0.5) 14.5 (Hour 0.5 to 3.5) 4.75 (Hour 3.5 through 24)
I&C Rooms              12301, 12305                8.854                      0 I&C Rooms              12302, 12304                13.07                    4.22 dc Equipment Rooms      12201, 12205                3.792                      0 (Hour 0 through 1) 2.465 (Hour 2 through 24) dc Equipment Rooms      12203, 12207                  5.84                    2.05 (Hour 0 through 1) 4.51 (Hour 2 through 24)
Tier 2 Material                        6.4-20                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                103
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                            AP1000 Design Control Document Figure 7.2-1 (Sheet 13 of 21) Commented [HZS2]: Ext-02, Ext-03 Functional Diagram Containment and Other Protection      Ext-02 in Blue Ext-03 in Green Tier 2 Material                                                      7.2-51                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                              104
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document temperature is above the P-8 setpoint. It is automatically reinstated when reactor power is decreased below the P-6 power level during shutdown or reactor coolant average temperature decreases below the P-8 setpoint. The source range flux doubling function can also be manually blocked during shutdown conditions when below the P-8 setpoint. Prior to manually blocking the source range flux doubling function, the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution.                                                                        Commented [HZS3]: Ext-05 The functional logic relating to chemical and volume control system isolation is illustrated in Figure 7.2-1, sheets 6 and 11.
7.3.1.2.16 Steam Dump Block Signals to block steam dump (turbine bypass) are generated from either of the following conditions:
: 1. Low-2 reactor coolant system average temperature
: 2. Manual initiation Condition 1 results from a coincidence of two of the four divisions of reactor loop average temperature (Tavg) below the Low-2 setpoint. This blocks the opening of the steam dump valves. This signal also becomes an input to the steam dump interlock selector switch for unblocking the steam dump valves used for plant cooldown.
Condition 2 consists of three sets of controls. The first set of two controls selects whether the steam dump system has its normal manual and automatic operating modes available or is turned off. The second set of two controls enables or disables the operations of the Stage 1 cooldown steam dump valves if the reactor coolant average temperature (Tavg) is below the Low-2 setpoint. The third set of two controls enables or disables the operation of the Stage 2 cooldown steam dump valves.
The functional logic relating to the steam dump block is illustrated in Figure 7.2-1, sheet 10.
7.3.1.2.17 Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization                                                                                        Commented [HZS4]: Ext-02 Signals to initiate isolation of the main control room, to initiate the air supply, and to open the main control room pressure relief isolation valves, and to de-energize nonessential main control room electrical loads are generated from either any of the following conditions:            Commented [HZS5]: Ext-02
: 1. High-2 main control room air supply radioactivity level                                        Commented [HZS6]: Ext-02
: 2. Loss of ac power sources (low Class 1E battery charger input voltage)
: 3. Low main control room differential pressure                                                  Commented [HZS7]: Ext-03 3.4. Manual initiation Condition 1 is the occurrence one of two main control room air supply radioactivity monitors        Commented [HZS8]: Ext-02 detecting a the iodine or particulate radioactivity level above the High-2 setpoint.                Commented [HZS9]: Ext-03 Tier 2 Material                                    7.3-17                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                105
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document Condition 2 results from the loss of normal control room ventilation due to a loss of all ac        Commented [HZS9]: Ext-03 power sources. A preset time delay is provided to permit the restoration of ventilation and ac      Commented [HZS10]: Ext-03 power from the offsite sources or from the onsite diesel generators before initiation. The loss of all ac power is detected by undervoltage sensors that are connected to the input of each of the four Class 1E battery chargers. Two sensors are connected to each of the four battery charger inputs. The loss of ac power signal is based on the detection of an undervoltage condition by each of the two sensors connected to two of the four battery chargers. The two-out-of-four logic is based on an undervoltage to the battery chargers for divisions A or C coincident with an undervoltage to the battery chargers for divisions B or D.
Condition 3 results from the loss of main control room differential pressure as detected by the pressure boundary differential sensors. One out of two logic is based on main control room differential pressure below the Low setpoint for greater than 10 minutes.                          Commented [HZS11]: Ext-03 In addition, the loss of all ac power sources coincident with main control room isolation will de-energize the main control room radiation monitors in order to conserve the battery capacity.
Condition 3 4 consists of two momentary controls. Manual actuation of either of the two              Commented [HZS12]: Ext-03 controls will result in main control room isolation, and air supply initiation, and electrical load de-energization.                                                                                Commented [HZS13]: Ext-02 The functional logic relating to main control room isolation, and air supply initiation, and electrical load de-energization is illustrated in Figure 7.2-1, sSheet 13.                          Commented [HZS14]: Ext-02 7.3.1.2.18 Auxiliary Spray and Letdown Purification Line Isolation A signal to isolate the auxiliary spray and letdown purification lines is generated upon the coincidence of pressurizer level below the Low-1 setpoint in any two of four divisions. This helps to maintain reactor coolant system inventory. This function can be manually blocked when the pressurizer water level is below the P-12 setpoint. This function is automatically unblocked when the pressurizer water level is above the P-12 setpoint. The automatic auxiliary spray isolation signal can be reset by the operator, after actuation of the auxiliary spray isolation valve, by using the reset control. This will allow the operators to use the auxiliary spray to rapidly depressurize the reactor coolant system. The operator can also manually initiate auxiliary spray isolation. The functional logic relating to this is illustrated in Figure 7.2-1, sheet 12.
The auxiliary spray and letdown purification line isolation signal is also generated upon manual actuation of chemical and volume control system isolation (subsection 7.3.1.2.15).
7.3.1.2.19 Containment Air Filtration System Isolation A signal to isolate the containment air filtration system is generated from any of the following conditions:
: 1. Automatic or manual safeguards actuation signal (subsection 7.3.1.1)
Tier 2 Material                                      7.3-18                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  106
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document Table 7.3-1 (Sheet 7 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Divisions/        Actuation Actuation Signal          Controls            Logic              Permissives and Interlocks
: b. High-2 steam generator      4/steam          2/4-BYP1 in                      None narrow range level          generator        either steam generator
: c. Automatic or manual                                (See items 1a through 1e) safeguards actuation signal coincident with High-1 pressurizer water        4            2/4-BYP1                        None level
: d. High-2 containment              4            2/4-BYP1                        None radioactivity
: e. Manual initiation          2 controls        1/2 controls                      None
: f. Flux doubling calculation        4            2/4-BYP1          Manual block permitted above P- 8 when critical or intentionally approaching criticality Automatically unblocked below P-6 or below P-8 Manual block permitted below P-8; demineralized water system isolation valves signaled closed when blocked below P-8                Commented [HZS18]: Ext-05
: g. High steam generator        4/steam          2/4-BYP1 in                      None narrow range level          generator        either steam coincident with                                generator Reactor trip (P-4)          1/division            2/4                          None (8)
: 15. Steam Dump Block (Figure 7.2-1, Sheet 10)
: a. Low reactor coolant          2/loop          2/4-BYP1                        None temperature (Low-2 Tavg)
: b. Mode control                2 controls        1/division                      None
: c. Manual stage 1 cooldown    2 controls        1/division                      None control
: d. Manual stage 2 cooldown    2 controls        1/division                      None control
: 16. Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization (Figure 7.2-1, Sheet 13)                                                                                                Commented [HZS19]: Ext-02 Tier 2 Material                                    7.3-33                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  107
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Table 7.3-1 (Sheet 8 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Divisions/          Actuation Actuation Signal              Controls            Logic              Permissives and Interlocks
: a. High-2 main control room          2                1/2                            None                  Commented [HZS19]: Ext-02 supply air iodine or particulate radiation                                                                                    Commented [HZS20]: Ext-03
: b. Extended                      2/charger      2/2 per charger                      None undervoltageUndervoltage                          and 2/4                                                Commented [HZS21]: Ext-03 to Class 1E battery                              chargers5 chargers(8)
: c. Extended Low main control          2                1/2                            None                  Commented [HZS22]: Ext-03 room differential pressure cd. Manual initiation(8)          2 controls        1/2 controls                      None                  Commented [HZS23]: Ext-03
: 17.      Auxiliary Spray and Purification Line Isolation (Figure 7.2-1, Sheet 12)
: a. Low-1 pressurizer level            4              2/4-BYP1          Manual block permitted below P-12 Automatically unblocked above P-12
: b. Manual initiation of                                        (See item 14e) chemical and volume control system isolation
: c. Manual initiation of              1                1/1                            None auxiliary spray isolation
: 18. Containment Air Filtration System Isolation (Figure 7.2-1, Sheets 11 and 13)
: a. Containment isolation                                (See items 2a through 2c)
: b. High-1 containment                4              2/4-BYP1                          None radioactivity
: c. N/A                                2                N/A          For containment vacuum relief valves only - close on inside containment purge isolation valve not closed
: 19. Normal Residual Heat Removal System Isolation (Figure 7.2-1, Sheets 13 and 18)
: a. Automatic or manual                                  (See items 1a through 1e) safeguards actuation signal
: b. High-2 containment                4              2/4-BYP1          Manual block permitted below P-11 radioactivity                                                      Automatically unblocked above P-11
: c. Manual initiation              4 controls      2/4 controls3                      None
: 20. Refueling Cavity Isolation (Figure 7.2-1, Sheet 13)
: a. Low spent fuel pool level          3                2/3                            None Tier 2 Material                                      7.3-34                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    108
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                          AP1000 Design Control Document Table 7.3-3 (Sheet 2 of 2)                                    Commented [HZS25]: Ext-02 SYSTEM-LEVEL MANUAL INPUT TO THE ENGINEERED SAFETY FEATURES ACTUATION SYSTEM To      Figure 7.2-1 Manual Control                                    Divisions      Sheet Manual passive containment cooling actuation #1                              A  B    C  D      13 Manual passive containment cooling actuation #2                              A  B    C  D      13 Manual passive containment isolation actuation #1                            A  B    C  D      13 Manual passive containment isolation actuation #2                            A  B    C  D      13 Manual depressurization system stages 1, 2, and 3 actuation #1 & #2          A  B    C  D      15 Manual depressurization system stages 1, 2, and 3 actuation #3 & #4          A  B    C  D      15 Manual depressurization system stage 4 actuation #1 & #2                      A  B    C  D      15 Manual depressurization system stage 4 actuation #3 & #4                      A  B    C  D      15 Manual IRWST injection actuation #1 & #2                                      A  B    C  D      16 Manual IRWST injection actuation #3 & #4                                      A  B    C  D      16 Manual containment recirculation actuation #1 & #2                            A  B    C  D      16 Manual containment recirculation actuation #3 & #4                            A  B    C  D      16 Manual main control room isolation, and air supply initiation, and electrical A  B    C  D      13 load de-energization #1 Manual main control room isolation, and air supply initiation, and electrical A  B    C  D      13 load de-energization #2 RCS pressure CVS/PRHR block control #1                                        A                  6 RCS pressure CVS/PRHR block control #2                                          B                6 RCS pressure CVS/PRHR block control #3                                                C          6 RCS pressure CVS/PRHR block control #4                                                    D      6 Normal residual heat removal system isolation safeguards block control #1    A                  13 Normal residual heat removal system isolation safeguards block control #2        B              13 Boron dilution block control #1                                              A                  3 Boron dilution block control #2                                                  B                3 Boron dilution block control #3                                                        C          3 Boron dilution block control #4                                                          D      3 Manual RNS isolation #1 & #3                                                  A  B        D      18 Manual RNS isolation #2 & #4                                                  A  B        D      18 CVS letdown isolation block control #1                                        A                  16 CVS letdown isolation block control #2                                                    D      16 Manual containment vacuum relief actuation #1                                A        C        19 Manual containment vacuum relief actuation #2                                A      C          19 Tier 2 Material                                      7.3-43                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            109
 
DCP_NRC_003343                                              Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                                  AP1000 Design Control Document Table 7.5-1 (Sheet 11 of 12)                                        Commented [HZS1]: Ext-02 POST-ACCIDENT MONITORING SYSTEM Qualification          Number of            QDPS Range/      Type/                              Instruments  Power  Indication Variable        Status    Category Environmental      Seismic  Required  Supply  (Note 2)  Remarks MCR air delivery      Open/    D2              Mild            Yes      1/valve    1E      Yes isolation valve status Closed                                            (Note 7)
MCR electrical load    Open/    D2              Mild            Yes    1/contactor  1E      Yes status                Closed Instrument air        0-125    F3            None            None        1      Non-1E    No header pressure        psig Service water flow    0-10,000 F3            None            None      1/pump    Non-1E    No gpm Service water pump    On/Off  F3            None            None      1/pump    Non-1E    No status Service water pump    Open/    F3            None            None      1/valve  Non-1E    No discharge valve        Closed status Service water pump    50-      F3            None            None      1/pump    Non-1E    No discharge              150°F temperature Main control room      Note 5  E3, F3          Mild            Yes        2        1E      No supply air radiation                                                    (Note 9)
Plant vent air flow    0-110%  E2              Mild            None        1      Non-1E    No design flow Turbine island vent    10  C2, E2          Mild            None        1      Non-1E    No discharge radiation    10+5 level                  Ci/cc Steam generator        10  C2              Mild            None        1      Non-1E    No blowdown discharge    10-1 radiation              Ci/cc Steam generator        10  C2              Mild            None        1      Non-1E    No blowdown brine        10-1 radiation level        Ci/cc Tier 2 Material                                              7.5-23                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                110
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                            AP1000 Design Control Document Table 7.5-7 (Sheet 4 of 4)
 
==SUMMARY==
OF TYPE D VARIABLES System                              Variable                  Type/Category Containment Cooling              Containment temperature                            D2 PCS water storage tank series isolation valve      D2 status (MOV)
PCS water storage tank isolation valve status      D2 (non-MOV)
Passive containment cooling water flow            D2 PCS storage tank water level                      D2 HVAC System Status              MCR return air isolation valve status              D2 MCR toilet exhaust isolation valve status          D2 MCR supply air isolation valve status              D2 MCR air delivery isolation valve status            D2 MCR pressure relief isolation valve status        D2 MCR electrical load status                        D2          Commented [HZS2]: Ext-02 MCR air storage bottle pressure                    D2 MCR differential pressure                          D2 MCR air delivery flowrate                          D2 Main Steam                      Turbine stop valve status                          D2 Turbine control valve status                      D2 Condenser steam dump valve status                  D2 Tier 2 Material                          7.5-33                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                111
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document APPENDIX 7A                                                                                                        Commented [HZS1]: Ext-02 INSTRUMENTATION AND CONTROLS LICENSING BASIS DOCUMENT CHANGES Note: Revised text within the licensing basis documents is identified in this appendix with strikethrough font for deleted text, underlined font for new text, and three asterisks ( * * * )
where text is omitted for clarity.
Proprietary Information is bracketed and labeled with lower case alphabetic code letters outside the brackets to indicate the criteria or basis on which the proprietary determination was made.
7A.1- 7A.3 Not Used 7A.4        WCAP-16438-P and WCAP-16438-NP, FMEA of AP1000TM Protection and Safety Monitoring System The UFSAR incorporates by reference Tier 2 document WCAP-16438-P and WCAP-16438-NP, FMEA of AP1000TM Protection and Safety Monitoring System. See Table 1.6-1. The incorporated by reference material is modified to include the following revisions and additions as indicated by strikethroughs and underlines:
x    Revise Appendix A, Failure Impact on Plant, as per the following directions:
a,c Tier 2 Material                                      7A.7-1                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  112
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                  AP1000 Design Control Document 7A.5-7A.7 Not Used 7A.8        WCAP-16675-P and WCAP-16675-NP, AP1000 Protection and Safety Monitoring System Architecture Technical Report The UFSAR incorporates by reference Tier 2 document WCAP-16675-P and WCAP-16675-NP, AP1000 Protection and Safety Monitoring System Architecture Technical Report. See Table 1.6-
: 1. The incorporated by reference material is modified to include the following revisions and additions as indicated by strikethroughs and underlines.
x    Revise Section 1.2 Engineered Safety Features Actuation System Functions bullet 18 to say:
: 18. Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization as described in Reference 9.
Tier 2 Material                                  7A.7-2                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                  113
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document 9.3        Process Auxiliaries 9.3.1      Compressed and Instrument Air System The compressed and instrument air system (CAS) consists of three subsystems; instrument air, service air, and high-pressure air. Instrument air supplies compressed air for air-operated valves and dampers. Service air is supplied at outlets throughout the plant to power air-operated tools and is used as a motive force for air-powered pumps. The service air subsystem is also utilized as a supply source for breathing air. Individually packaged air purification equipment is used to produce breathing quality air for protection against airborne contamination. The high-pressure air subsystem supplies air to the main control room emergency habitability system (VES), the generator breaker package, and fire fighting apparatus recharge station. The high-pressure air subsystem also provides a connection for refilling the VES storage tanks from an offsite source.
Major components of the compressed and instrument air system are located in the turbine building.
9.3.1.1    Design Basis 9.3.1.1.1  Safety Design Basis The compressed and instrument air system serves no safety-related function other than containment isolation and therefore has no nuclear safety design basis except for containment isolation. See subsection 6.2.3 for the containment isolation system.
9.3.1.1.2  Power Generation Design Basis The instrument air subsystem provides filtered, dried, and oil-free air for air-operated valves and dampers. The instrument air subsystem consists of two compressors and associated support equipment and controls that are powered from switchgear backed by the nonsafety-related onsite standby diesel generators as an investment protection category load. The subsystem provides high quality instrument air as specified in the ANSI/ISA S7.3 standard (Reference 9.3.8.1).
The service air subsystem provides filtered, dried, and oil-free compressed air for service outlets located throughout the plant. The service air subsystem consists of two compressors and their associated support equipment and controls. Plant breathing air requirements are satisfied by using the service air subsystem as a supply source. Individually packaged air purification equipment is used to improve the service air to Quality Verification Level D breathing air as defined in ANSI/CGA G-7.1.
The high-pressure air subsystem consists of one compressor, its associated air purification system and controls, and a high-pressure receiver. It provides clean, oil-free, high-pressure air to recharge the main control room emergency habitability system cylinders, refill the individual fire fighting breathing air bottles, and recharge the generator breaker reservoir. Quality Verification Level E air as defined in ANSI/CGA G-7.1 , with a pressure dew point of 40°F or lower at 3,400 psig or greater, is produced by this subsystem. See Section 6.4 for a description of the main control room habitability system.                                              Commented [HZS1]: Ext-02 Tier 2 Material                                      9.3-1                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  114
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document system is nonsafety-related and nonseismic. The equipment is procured to meet the environmental qualifications used in standard building practice.
The nuclear island nonradioactive ventilation system is designed to control the radiological habitability in the main control room within the guidelines presented in Standard Review Plan (SRP) 6.4 and NUREG 0696 (Reference 1), if the system is operable and ac power is available.
Portions of the system that provide the defense-in-depth function of filtration of main control room/control support area air during conditions of abnormal airborne radioactivity are designed, constructed, and tested to conform with Generic Issue B-36, as described in Section 1.9 and Regulatory Guide 1.140 (Reference 30), as described in Appendix 1A, and the applicable portions of ASME AG-1 (Reference 36), ASME N509 (Reference 2), and ASME N510 (Reference 3).
Power to the ancillary fans to provide post-72-hour ventilation of the control room and I&C rooms is supplied from divisions B and C regulating transformers through two series fuses for isolation. The fuses protect the regulating transformers from failures of the non-1E fan circuits.
When normal ventilation is available the ancillary fan circuits are disconnected from the supply with manual normally-open switches.
The nuclear island nonradioactive ventilation system is designed to provide a reliable source of heating, ventilation, and cooling to the areas served when ac power is available. The system equipment and component functional capabilities are to minimize the potential for actuation of the main control room emergency habitability system or the potential reliance on passive equipment cooling. This is achieved through the use of redundant equipment and components that are connected to standby onsite ac power sources.
9.4.1.1.2  Power Generation Design Basis Main Control Room/Control Support Area (CSA) Areas The nuclear island nonradioactive ventilation system provides the following specific functions:
x    Controls the main control room and control support area relative humidity between 25 to 60 percent x    Maintains the main control room and CSA areas at a slightly positive pressure with respect to the adjacent rooms and outside environment during normal operations to prevent infiltration of unmonitored air into the main control room and CSA areas x    Isolates the main control room and/or CSA area from the normal outdoor air intake and provides filtered outdoor air to pressurize the main control room and CSA areas to a positive pressure of at least 1/8 inch wg when a high gaseous High-1 radioactivity concentration (gaseous, particulate, or iodine) is detected in the main control room supply air duct        Commented [HZS2]: Ext-03 x    Isolates the main control room and/or CSA area from the normal outdoor air intake and provides 100 percent recirculation air to the main control room and CSA areas when a high concentration of smoke is detected in the outside air intake Tier 2 Material                                      9.4-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              115
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                              AP1000 Design Control Document The system maintains the following room temperatures based on the maximum and minimum outside air safety temperature conditions shown in Chapter 2, Table 2-1:
Temperature Area                                                                                    (qF)
Class 1E battery rooms                                                                67 - 73 Class 1E dc equipment rooms                                                          67 - 73 Class 1E electrical penetration rooms                                                67 - 73 Class 1E instrumentation and control rooms                                            67 - 73 Corridors                                                                            67 - 73 Remote shutdown room                                                                  67 - 73 Reactor coolant pump trip switchgear rooms                                            67 - 73 HVAC equipment rooms                                                                  50 - 85 Passive Containment Cooling System Valve Room The subsystem maintains the following room temperatures based on the maximum and minimum outside air safety temperature conditions shown in Chapter 2, Table 2-1:
Temperature Area                                                                                    (qF)
Passive containment cooling system valve room                                        50 - 120 Post-72-Hour Design Basis Main Control Room The specific function of the nuclear island nonradioactive ventilation system is to maintain the main control room below a temperature approximately 4.5qF above the average outdoor air temperature a maximum average WBGT Index of 90°F based on operation at the site maximum normal temperature.                                                                              Commented [HZS3]: Ext-02 Divisions B and C Instrumentation and Control Rooms Design Basis The specific function of the nuclear island nonradioactive ventilation system is to maintain the I&C rooms below the qualification temperature of the I&C equipment.
9.4.1.2    System Description The nuclear island nonradioactive ventilation system is shown in Figure 9.4.1-1. The system consists of the following independent subsystems:
x    Main control room/control support area HVAC subsystem x    Class 1E electrical room HVAC subsystem x    Passive containment cooling system valve room heating and ventilation subsystem Tier 2 Material                                    9.4-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            116
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document supplemental air filtration subsystem dampers are constructed, qualified, and tested in accordance with ANSI/AMCA 500 or ASME AG-1 (Reference 36), Section DA.
Combination Fire/Smoke Dampers Combination fire/smoke dampers are provided at duct penetrations through fire barriers to maintain the fire resistance ratings of the barriers. The combination fire/smoke dampers meet the design, leakage testing, and installation requirements of UL-555S (Reference 25).
Ductwork and Accessories Ductwork, duct supports, and accessories are constructed of galvanized steel. Ductwork subject to fan shutoff pressures is structurally designed to accommodate fan shutoff pressures. Ductwork, supports, and accessories meet the design and construction requirements of SMACNA Industrial Rectangular and Round Duct Construction Standards (References 16 and 34) and SMACNA HVAC Duct Construction Standards - Metal and Flexible (Reference 17). The supplemental air filtration and main control room/control support area HVAC subsystem's ductwork, including the air filtration units and the portion of the ductwork located outside of the main control room envelope, that maintains integrity of the main control room/control support area pressure boundary during conditions of abnormal airborne radioactivity are designed in accordance with ASME AG-1 (Reference 36), Article SA-4500, to provide low leakage components necessary to maintain main control room/control support area habitability.
9.4.1.2.3  System Operation 9.4.1.2.3.1 Main Control Room/Control Support Area HVAC Subsystem Normal Plant Operation During normal plant operation, one of the two 100 percent capacity supply air handling units and return/exhaust air fans operates continuously. Outside makeup air supply to the supply air handling units is provided through an outside air intake duct. The outside airflow rate is automatically controlled to maintain the main control room and CSA areas at a slightly positive pressure with respect to the surrounding areas and the outside environment.
The main control room/control support area supply air handling units are sized to provide cooling air for personnel comfort, equipment cooling, and to maintain the main control room emergency habitability passive heat sink below its initial ambient air design temperature. The temperature of the air supplied by each air handling unit is controlled by temperature sensors located in the main control room return air duct and in the computer room B return air duct to maintain the ambient air design temperature within its normal design temperature range by modulating the electric heat or chilled water cooling. Some spaces have convection heaters for temperature control.
The outside air is continuously monitored by smoke monitors located at the outside air intake plenum and the return air is monitored for smoke upstream of the supply air handling units. The supply air to the main control room is continuously monitored for airborne radioactivity while the supplemental air filtration units remain in a standby operating mode.
Tier 2 Material                                      9.4-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      117
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document The main control room and CSA areas ventilation supply and return/exhaust ducts can be remotely or manually isolated from the main control room.
If a high concentration of smoke is detected in the outside air intake, an alarm is initiated in the main control room and the main control room/control support area HVAC subsystem is manually realigned to the recirculation mode by closing the outside air and toilet exhaust duct isolation valves. The main control room and control support area toilet exhaust fans are tripped upon closure of the isolation valves. The main control room/CSA areas are not pressurized when operating in the recirculation mode. The main control room/control support area HVAC supply air subsystem continues to provide cooling, ventilation, and temperature control to maintain the emergency habitability passive heat sink below its initial ambient air design temperature and maintains the main control room and CSA areas within their design temperatures.
In the event of a fire in the main control room or control support area, in response to heat from the fire or upon receipt of a smoke signal from an area smoke detector, the combination fire/smoke dampers close automatically to isolate the fire area. The subsystem continues to provide ventilation/cooling to the unaffected area and maintains the unaffected areas at a slightly positive pressure. The main control room/control support area HVAC subsystem can be manually realigned to the once-through ventilation mode to supply 100 percent outside air to the unaffected area. Realignment to the once-through ventilation mode minimizes the potential for migration of smoke or hot gas from the fire area to the unaffected area. Smoke and hot gases can be removed from the affected area by reopening the closed combination fire/smoke damper(s) from outside of the affected fire area during the once-through ventilation mode. In the once-through ventilation mode, the outside air intake damper to the air handling unit mixing plenum opens and the return air damper to the air handling unit closes to provide 100 percent outside air to the supply air handling unit. In this mode, the subsystem exhaust air isolation damper opens to exhaust the return air directly to the turbine building vent.
Power is supplied to the main control room/control support area HVAC subsystem by the plant ac electrical system. In the event of a loss of the plant ac electrical system, the main control room/control support area ventilation subsystem can be transferred to the onsite standby diesel generators. The convection heaters and duct heaters are not transferred to the onsite standby diesel generator.
When complete ac power is lost and the outside air is acceptable radiologically and chemically, MCR habitability is maintained by operating one of the two MCR ancillary fans to supply outside air to the MCR. It is expected that outside air will be acceptable within 72 hours following a radiological release. See subsection 6.4.2.2 for details. The outside air pathway to the ancillary fans is provided through the nonradioactive ventilation system air intake opening located on the roof, the mechanical room at floor elevation 135-3, and nonradioactive ventilation system supply duct. Warm air from the MCR is vented to the annex building through stairway S05, into the remote shutdown room and the clean access corridor at elevation 100-0.
The ancillary fan capacity and air flow rate maintain the MCR environment near the daily average outdoor air temperature below a maximum average WBGT Index of 90°F based on operation at the site maximum normal temperature. The ancillary fans and flow path are located      Commented [HZS9]: Ext-02 within the auxiliary building which is a Seismic Category I structure.
Tier 2 Material                                      9.4-12                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                118
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                              AP1000 Design Control Document 14.2.9.1.6 Main Control Room Emergency Habitability System Testing Purpose The purpose of the main control room emergency habitability system testing is to verify that the as-installed components properly perform the safety-related functions described in Section 6.4, including the following:
x    Provide sufficient breathable quality air to the main control room x    Maintain the main control room at positive pressure x    Provide passive cooling of designated equipment In addition, the following safety-related functions performed by the nuclear island nonradioactive ventilation system described in subsection 9.4.1 are tested:
x    Provide isolation of the main control room from the surrounding areas and outside environment during a design basis accident if the nuclear island nonradioactive ventilation system becomes inoperable.
x    Monitor the radioactivity in the main control room normal air supply and provide signals to isolate the incoming air and actuate the main control room emergency habitability system.
In addition, the following safety-related functions performed by the potable water system, described in subsection 9.2.5; the sanitary drainage system, described in subsection 9.2.6; and the waste water system, described in subsection 9.2.9, are tested:
x    Provide isolation of the main control room from the surrounding areas and outside environment during a design basis accident.
Prerequisites The construction testing of the main control room habitability system has been successfully completed. The required preoperational testing of the compressed and instrument air system, Class 1E electrical power and uninterruptible power supply systems, normal control room ventilation system, and other interfacing systems required for operation of the above systems is available as needed to support the specified testing and system configurations. The main control room air supply tanks are filled with air acceptable for breathing. The main control room construction is complete and its leak-tight barriers are in place.
General Test Acceptance Criteria and Methods Performance of the main control room habitability system is observed and recorded during a series of individual component and integrated system testing. The following testing demonstrates that the habitability system operates as specified in Section 6.4 and as specified in the appropriate design specifications:
a)    Proper operation of safety-related valves is verified by the performance of baseline in-service tests as described in subsection 3.9.6.
Tier 2 Material                                    14.2-27                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        119
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                              AP1000 Design Control Document b)  Proper calibration and operation of safety-related and system readiness instrumentation, controls, actuation signals and interlocks is verified. This testing includes the following:
x    Air storage tank pressure x    Refill line connection pressure x    Main control room differential pressure x    Air supply line flow rate x    Controls for the main control room pressure relief valves x    Controls for the air supply isolation valves x    Controls for the main control room air inlet isolation valves x    Air intake radiation x    Passive filtration line flow rate x    Filter performance x    Sanitary drainage system vent isolation valves c)  The proper flow rate of emergency air to the main control room is verified, demonstrating proper sizing of each air flow limiting orifice, proper operation of each air supply pressure regulator, and the ability to maintain proper control room air quality. The MCR passive filtration system flow rate and filter performance will also be verified at this time to ensure a filtration flow rate of at least 600 cfm. This testing demonstrates the control room pollutant concentrations during the first 6 hours of operation. To determine the control room air quality at 72 hours, the CO2 concentrations can be predicted based on calculations. The other pollutants described in Table 1 and Appendix C, Table 1 of ASHRAE Standard 62-1989 can be predicted by extrapolating their concentrations for the entire 72-hour period.
d)  The ability of the emergency air supply to maintain the main control room at the proper positive pressure is demonstrated, verifying proper operation of the main control room pressure relief dampers.
e)  The ability of the emergency air supply to limit air inleakage to the main control room is verified by inleakage testing as specified in subsection 6.4.5.4.
f)  The ability to maintain the main control room environment within specified limits for 72 hours (Reference subsection 6.4.3.2) is verified with a test simulating a loss of the nuclear island nonradioactive ventilation system. This testing demonstrates the control room heatup from 0 to 6 hours with the actual heat loads from the battery powered equipment and personnel specified for this time period (for the MCR [room 12401], there is automatic de-energization of specific nonsafety-related MCR heat loads). This testing period includes the high 0 to 3 hour heat load and subsequent control room temperature changes versus time that occur when the equipment heat load is decreased when the 2 hour batteries are expended, for the 3 to 6 hour testing time period. The control room temperature versus time      Commented [HZS1]: Ext-02 versus heat load data are used to verify the analysis basis used to assure that the control room conditions remain within specified limits for the 72 hour time period. Periodic grab samples will be taken of the control room air environment to support analyses to confirm that specified limits would not be exceeded for 72 hours.
Tier 2 Material                                      14.2-28                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  120
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-7 (Sheet 1 of 3)
RADIOLOGICAL ANALYSIS Reference                              Design Feature                              Value Table      2-1          Plant elevation for maximum flood level (ft)                  100 3
Section    2.3.4        Atmospheric dispersion factors - X/Q (sec/m )
                        - Site Boundary X/Q 0 - 2 hour time interval                                  5.1 x 10-4
                        - Low Population Zone Boundary X/Q 0 - 8 hours                                              2.2 x 10-4 8 - 24 hours                                            1.6 x 10-4 24 - 96 hours                                              1.0 x 10-4 96 - 720 hours                                            8.0 x 10-5 Table      6.2.3-1      Containment penetration isolation features are configured as in Table 6.2.3-1 Table      6.2.3-1      Maximum closure time for remotely operated containment        10 purge valves (seconds)
Table      6.2.3-1      Maximum closure time for all other remotely operated          60 containment isolation valves (seconds)
Section    6.4.2.3      The minimum storage capacity of all storage tanks in the      327,574 VES (scf)
Section    6.4.3.2      The maximum temperature rise in the main control room        + 10.8              Commented [HZS2]: Ext-02 pressure boundary following a loss on the nuclear island nonradioactive ventilation system over a 72-hour period (°F)
Section    6.4.4        The maximum temperature in the instrumentation and            120 control rooms and dc equipment rooms following a loss of the nuclear island nonradioactive ventilation system remains over a 72-hour period (°F).
Section    6.4.4        The main control emergency habitability system nominally    65 +/- 5 provides 65 scfm of ventilation air to the main control room from the compressed air storage tanks.
Section    6.4.4        Sixty-five +/- five scfm of ventilation flow is sufficient to  1/8th pressurize the control room to 1/8th inch water gauge differential pressure (WIC).
Section    6.4.5.1      The maximum temperature in the main control room            95                  Commented [HZS3]: Ext-02 pressure boundary following a loss of the nuclear island nonradioactive ventilation system over a 72-hour period (°F)
(dry bulb temperature).
Tier 2 Material                                  14.3-49                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          121
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 ACTIONS (continued)
CONDITION                    REQUIRED ACTION                COMPLETION TIME D. One required division    D.1      Restore required division    6 hours inoperable.                      to OPERABLE status.
E. One switch or switch set E.1      Restore switch and switch    48 hours inoperable.                      set to OPERABLE status.
F. One channel              F.1      Restore channel to          72 hours inoperable.                      OPERABLE status.
OR F.2.1    Verify alternate radiation  72 hours monitors are OPERABLE.
AND F.2.2    Verify main control room    72 hours isolation, and air supply initiation, and load de-energization manual controls are OPERABLE.                                Commented [HZS1]: Ext-02 G. One switch, switch set,  G.1      Restore switch, switch set,  72 hours channel, or division              channel, and division to inoperable.                      OPERABLE status.
H. One channel              H.1      Place channel in trip.      6 hours inoperable.
I. One or two channels      I.1      Place one inoperable        6 hours inoperable.                      channel in bypass or trip.
AND I.2      With two inoperable          6 hours channels, place one channel in bypass and one channel in trip.
J. One or two interlock    J.1      Verify the interlocks are in 1 hour channels inoperable.              the required state for the existing plant conditions.
OR AP1000                                  3.3.2 - 2                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                              122
 
DCP_NRC_003343                                                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 11 of 13)
Engineered Safeguards Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED              REQUIRED                                  SURVEILLANCE FUNCTION                      CONDITIONS                CHANNELS            CONDITIONS            REQUIREMENTS
: 20. Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization                                                                                                Commented [HZS8]: Ext-02
: a. Control Room Air Supply                1,2,3,4                      2                  F,O                SR  3.3.2.1 Radiation - High 2                                                                                          SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 Note (o)                    2                  G,K                SR  3.3.2.1 SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: 21. Auxiliary Spray and Purification Line Isolation
: a. Pressurizer Water Level -                  1,2                      4                  B,L                SR  3.3.2.1 Low 1                                                                                                      SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Manual Initiation                          1,2              Refer to Function 16.e (Manual Chemical Volume Control System (Makeup Isolation) for requirements.
: 22. In-Containment Refueling Water Storage Tank (IRWST) Injection Line Valve Actuation
: a. Manual Initiation                      1,2,3,4(b)            2 switch sets              E,N                SR 3.3.2.3 4(c),5,6              2 switch sets              G,Y                SR 3.3.2.3
: b. ADS 4th Stage Actuation        Refer to Function 10 (ADS 4th Stage Actuation) for initiating functions and requirements.
: 23. IRWST Containment Recirculation Valve Actuation
: a. Manual Initiation                      1,2,3,4(b)            2 switch sets              E,N                SR 3.3.2.3 4(c),5,6              2 switch sets              G,Y                SR 3.3.2.3
: b. ADS Stage 4 Actuation          Refer to Function 10 (ADS Stage 4 Actuation) for all initiating functions and requirements.
Coincident with IRWST                1,2,3,4(b)                    4                  B,N                SR  3.3.2.1 Level - Low 3                                                                                              SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 4(c),5(j),6(j)                4                    I,Y                SR  3.3.2.1 SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 (b) With the RCS not being cooled by the Normal Residual Heat Removal System (RNS).
(c) With the RCS being cooled by the RNS.
(j) Not applicable when the required ADS valves are open. See LCO 3.4.12 and LCO 3.4.13 for ADS valve and equivalent relief area requirements.
(o) During movement of irradiated fuel assemblies.
AP1000                                                        3.3.2 - 25                                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                  123
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3 VES 3.7.6 3.7 PLANT SYSTEMS 3.7.6  Main Control Room Emergency Habitability System (VES)                                                              Commented [HZS8]: Ext-02 LCO 3.7.6              The VES shall be OPERABLE.
                                                                  - NOTE -
The main control room envelope (MCRE) boundary may be opened intermittently under administrative control.
APPLICABILITY:          MODES 1, 2, 3, and 4, During movement of irradiated fuel assemblies.
ACTIONS
                                                    - NOTE -
LCO 3.0.8 is not applicable.
CONDITION                              REQUIRED ACTION                            COMPLETION TIME A. One valve or damper            A.1          Restore valve or damper to            7 days inoperable.                                  OPERABLE status.
Restore PMS division in B. One PMS Division                B.1                                                7 days both MCR load shed inoperable in one or panels to OPERABLE more in MCR load shed status.
panel(s).
Thermal mass of one or                      Restore required heat sink C.                                  C.1                                                24 hours more required heat                          air temperatures to within sink(s) not within                          limit(s).
limit(s).                      AND Restore thermal mass of C.2                                                5 days required heat sink(s) to within limit(s).
B. MCRE air temperature            B.1          Restore MCRE air                      24 hours not within limit.                            temperature to within limit.
AP1000                                                3.7.6 - 1                                        Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                          124
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3 VES 3.7.6 ACTIONS (continued)
CONDITION              REQUIRED ACTION                COMPLETION TIME C  VES inoperable due to  CD.1  Initiate action to implement Immediately D. inoperable MCRE              mitigating actions.
boundary in MODE 1, 2, 3, or 4.              AND CD.2  Verify mitigating actions    24 hours ensure MCRE occupant exposures to radiological, chemical, and smoke hazards will not exceed limits.
AND CD.3  Restore MCRE boundary        90 days to OPERABLE status.
D  One bank of VES air    DE.1  Verify that the OPERABLE    2 hours E. tanks (8 tanks)              tanks contain greater than inoperable.                  245,680 scf of compressed    AND air.
Once per 12 hours thereafter AND DE.2  Verify VBS MCRE ancillary    24 hours fans and supporting equipment are available.
AND DE.3  Restore VES to              7 days OPERABLE status.
EF                        EF.1  Be in MODE 3.                6 hours Required Action and associated AND Completion Time of Conditions A, B, C, D, EF.2  Be in MODE 5.                36 hours or D E not met in MODE 1, 2, 3, or 4.
OR VES inoperable for reasons other than AP1000                              3.7.6 - 2                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                125
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 VES 3.7.6 ACTIONS (continued)
CONDITION                      REQUIRED ACTION                COMPLETION TIME Conditions A, B, C, D, or D E in MODE 1, 2, 3, or 4.
F  Required Action            FG.1    Suspend movement of          Immediately G. and associated                      irradiated fuel assemblies.
Completion Time of Conditions A, B, C, D, or D E not met during movement of irradiated fuel.
OR VES inoperable for reasons other than Conditions A, B, C, D, or D E during movement of irradiated fuel.
OR VES inoperable due to inoperable MCRE boundary during movement of irradiated fuel.
SURVEILLANCE REQUIREMENTS SURVEILLANCE                                    FREQUENCY SR 3.7.6.1      Verify MCRE air temperature is  75°F.                  24 hours SR 3.7.6.21      Verify that the compressed air storage tanks contain    24 hours greater than 327,574 scf of compressed air.
SR 3.7.6.3      Verify that each VES air delivery isolation valve is    In accordance with OPERABLE.                                              the Inservice Testing Program AP1000                                    3.7.6 - 3                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                        126
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 VES 3.7.6 Verify thermal mass for the following heat sink SR 3.7.6.2                                                              24 hours locations is within limit:
: a. MCRE;
: b. Each required individual room adjacent to and below MCRE;
: c. Each required room-pair adjacent to and below MCRE; and
: d. Room above MCRE.
SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE                                                              FREQUENCY Operate VES for  15 minutes.
SR 3.7.6.43                                                              31 days SR 3.7.6.54    Verify that each VES air header manual isolation          31 days valve is in an open position.
SR 3.7.6.65    Verify that the air quality of the air storage tanks      92 days meets the requirements of Appendix C, Table C-1 of ASHRAE Standard 62 with a pressure dew point of 40°F at  3400 psig.
SR 3.7.6.76    Verify that all MCRE isolation valves are OPERABLE        24 months and will close upon receipt of an actual or simulated actuation signal.
SR 3.7.6.87    Verify that each VES pressure relief isolation valve      In accordance with within the MCRE pressure boundary is OPERABLE.            the Inservice Testing Program SR 3.7.6.98    Verify that each VES pressure relief damper is            24 months OPERABLE.
SR 3.7.6.109  Verify that the self-contained pressure regulating valve  In accordance with in each VES air delivery flow path is OPERABLE.            the Inservice Testing Program SR 3.7.6.1110  Perform required MCRE unfiltered air inleakage            In accordance with testing in accordance with the Main Control Room          the Main Control Envelope Habitability Program.                            Room Envelope Habitability Program SR 3.7.6.1211  Perform required VES Passive Filtration system filter      In accordance with testing in accordance with the Ventilation Filter Testing  the VFTP Program (VFTP).
AP1000                                    3.7.6 - 4                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      127
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES 3.7.6 Verify the MCR load shed function actuates upon SR 3.7.6.12                                                            24 months receipt of an actual or simulated actuation signal.
Verify each VES main air delivery isolation valve SR 3.7.6.13                                                            24 months actuates to the correct position upon receipt of an actual or simulated actuation signal.
AP1000                                  3.7.6 - 5                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                    128
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued)
Isolation, is referenced for initiating Functions and requirements.
: 20. Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization Isolation of the main control room and initiation of the VES air supply provides a breathable air supply for the protected environment from which operators can control the plant following an uncontrolled release of radioactivityradiation. De-energizing non-essential main control room electrical loads maintains the room temperature within habitable limits. This Function is required to be OPERABLE in MODES 1, 2, 3, and 4, and during movement of irradiated fuel because of the potential for a fission product release following a fuel handling accident, or other DBA.                                            Commented [HZS10]: Ext-02 20.a. Main Control Room Air Supply Radiation - High 2                      Commented [HZS11]: Ext-02 Two radiation monitors are provided on the main control room air intake. If either monitor exceeds the High 2 setpoint, control room isolation is actuated.
: 21. Auxiliary Spray and Purification Line Isolation The CVS maintains the RCS fluid purity and activity level within acceptable limits. The CVS purification line receives flow from the discharge of the RCPs. The CVS also provides auxiliary spray to the pressurizer. To preserve the reactor coolant pressure in the event of a break in the CVS loop piping, the purification line and the auxiliary spray line are isolated on a pressurizer water level Low 1 setpoint.
This helps maintain reactor coolant system inventory.
21.a. Pressurizer Water Level - Low 1 A signal to isolate the purification line and the auxiliary spray line is generated upon the coincidence of pressurizer level below the Low 1 setpoint in any two-out-of-four divisions. This Function is required to be OPERABLE in MODES 1 and 2 to help maintain RCS inventory. In MODES 3, 4, 5, and 6, this Function is not needed for accident detection and mitigation.
21.b. Manual Chemical Volume Control System Makeup Isolation (Function 16.e)
The Auxiliary Spray and Purification Line Isolation is also initiated by the Manual Chemical Volume Control System Makeup Isolation Function. The requirements for this Function AP1000                                B 3.3.2 - 46                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    129
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (Continued) x    Steam Line Isolation; x    Main Feedwater Control Valve Isolation; x    Main Feedwater Pump Trip and Valve Isolation; x    ADS Stages 1, 2, & 3 Actuation; x    ADS Stage 4 Actuation; x    Passive Containment Cooling Actuation; x    PRHR Heat Exchanger Actuation; x    CVS Makeup Line Isolation; x    IRWST Injection Line Valve Actuation; x    IRWST Containment Recirculation Valve Actuation; x    Steam Generator PORV Flow Path Isolation.
This Action addresses the inoperability of the system level manual initiation capability for the ESF Functions listed above. With one switch or switch set inoperable for one or more Functions, the system level manual initiation capability is reduced below that required to meet single failure criterion. Required Action E.1 requires the switch or switch set for system level manual initiation to be restored to OPERABLE status within 48 hours. The specified Completion Time is reasonable considering that the remaining switch or switch set is capable of performing the safety function.
F.1, F.2.1, and F.2.2 Condition F is applicable to the Main main Control control Room room (MCR) isolation, and air supply initiation and electrical load de-energization function which has only two channels of the initiating process variable. With one channel inoperable, the logic becomes one-out-of-one and is unable to meet single failure criterion. Restoring all channels to OPERABLE status ensures that a single failure will not prevent the protective Function.                                                          Commented [HZS12]: Ext-02 Alternatively, radiation monitor(s) which provide equivalent information and main control room isolation, and air supply initiation and electrical load de-energization manual controls may be verified to be OPERABLE.
These provisions for operator action can replace one channel of radiation detection and system actuation. The                                          Commented [HZS13]: Ext-02 AP1000                                    B 3.3.2 - 56                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    130
 
DCP_NRC_003343                                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (Continued)
J.1 and J.2 Condition J applies to the P-6, P-8, P-11, P-12, and P-19 interlocks. With      Commented [HZS14]: Ext-05 one or two required channel(s) inoperable, the associated interlock must be verified to be in its required state for the existing plant condition within 1 hour, or any Function channel associated with the inoperable interlock(s) placed in a bypassed condition within 7 hours. Verifying the interlock state manually accomplishes the interlock role.
If one interlock channel is inoperable, the associated Function(s) must be placed in a bypass or trip condition within 7 hours. If one channel is bypassed, the logic becomes two-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent the protective function.) If one channel is tripped, the logic becomes one-out-of-three, while still meeting the single failure criterion.
(A failure in one of the three remaining channels will not prevent the protective function.)
If two interlock channels are inoperable, one channel of the associated Function(s) must be bypassed and one channel of the associated Function(s) must be tripped. In this state, the logic becomes one-out-of-two, while still meeting the single failure criterion. The 7 hours allowed to place the inoperable channel(s) in the bypassed or tripped condition is justified in Reference 6.
K.1 LCO 3.0.8 is applicable while in MODE 5 or 6. Since irradiated fuel assembly movement can occur in MODE 5 or 6, the ACTIONS have been modified by a Note stating that LCO 3.0.8 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, the fuel movement is independent of shutdown reactor operations. Entering LCO 3.0.8 while in MODE 5 or 6 would require the optimization of plant safety, unnecessarily.
Condition K is applicable to the Main Control Room IsolationMCR Isolation, and Air Supply Initiation and Electrical Load De-energization        Commented [HZS15]: Ext-02 (Function 20), during movement of irradiated fuel assemblies. If the Required Action and associated Completion Time of the first Condition listed in Table 3.3.2-1 is not met, the plant must suspend movement of the irradiated fuel assemblies immediately. The required action suspends activities with potential for releasing radioactivity that might enter the MCR. This action does not preclude the movement of fuel to a safe position.
AP1000                                    B 3.3.2 - 58                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      131
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Main Control Room Emergency Habitability System (VES)
BASES BACKGROUND          The Main Control Room Emergency Habitability System (VES) provides a protected environment from which operators can control the plant following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. The system is designed to operate following a Design Basis Accident (DBA) which requires protection from the release of radioactivity.
In these events, the Nuclear Island Non-Radioactive Ventilation System (VBS) would continue to function if AC power is available. If AC power is lost for greater than 10 minutes, or Low main control room differential pressure is sensed for greater than 10 minutes, or a High-2 iodine or particulate Main Control Room Envelope (MCRE) radiation signal is received, the VES is actuated. The MCRE radioactivity is measured by detectors in the MCR supply air duct, downstream of the filtration units. Commented [HZS2]: Ext-03 The major functions of the VES are: 1) to provide forced ventilation to deliver an adequate supply of breathable air (Ref. 4) for the MCRE occupants; 2) to provide forced ventilation to maintain the MCRE at a 1/8 inch water gauge positive pressure with respect to the surrounding areas;
: 3) provide passive filtration to filter contaminated air in the MCRE; and
: 4) to limit the temperature increase of the MCRE equipment and facilities that must remain functional during an accident, via de-energizing (load shedding) nonessential, non-safety main control room (MCR) electrical equipment (e.g., wall panel information system displays, office equipment, water heater, kitchen appliances, and non-emergency lighting) andthe heat absorption of passive heat sinks.                                      Commented [HZS3]: Ext-02 The VES consists of compressed air storage tanks, two air delivery flow paths, an eductor, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), associated valves or dampers, piping, and instrumentation. The tanks contain enough breathable air to supply the required air flow to the MCRE for at least 72 hours. The VES system is designed to maintain CO2 concentration less than 0.5% for up to 11 MCRE occupants.
AP1000                                    B 3.7.6 - 1                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                132
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES BACKGROUND (continued)
The MCRE is the area within the confines of the MCRE boundary that contains the spaces that control room operators inhabit to control the unit during normal and accident conditions. This area encompasses the main control area, operations work area, operational break room, shift supervisors office, kitchen, and toilet facilities (Ref. 1). The MCRE is protected during normal operation, natural events, and accident conditions. The MCRE boundary is the combination of walls, floor, roof, electrical and mechanical penetrations, and access doors.                The OPERABILITY of the MCRE boundary must be maintained to ensure that the inleakage of unfiltered air into the MCRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to MCRE occupants. The MCRE and its boundary are defined in the Main Control Room Envelope Habitability Program.
Sufficient thermal mass exists in the surrounding concrete structure        Commented [HZS7]: Ext-02 (including walls, ceiling and floors) to absorb the heat generated inside the MCRE, which is initially at or below 75°F. Heat sources inside the MCRE include operator workstations, emergency lighting and occupants.
Sufficient insulation is provided surrounding the MCRE pressure boundary to preserve the minimum required thermal capacity of the heat sink. The insulation also limits the heat gain from the adjoining areas following the loss of VBS cooling. During normal operation, temperatures in the main control room, instrumentation and control rooms, dc equipment rooms, Class 1E electrical penetration rooms, and some adjacent rooms are maintained within a specified range by the VBS. As described in UFSAR Section 9.4.1.2, the VBS consists of independent subsystems, including the main control room / control support area HVAC subsystem and the Class 1E Electrical room HVAC subsystem. The Class 1E Electrical room HVAC subsystem is further divided into two independent subsystems, with one serving the Division A & C Class 1E electrical division rooms and the other serving the Division B & D Class 1E electrical division rooms. Each independent subsystem serves its associated rooms with two redundant, 100 percent capacity equipment trains, maintaining temperatures within the specified range.
AP1000                                  B 3.7.6 - 2                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                133
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 To support OPERABILITY of the VES, passive heat sink air temperatures are maintained by VBS in required dc Equipment rooms and required I&C rooms. Certain required room-pairs (i.e., 12201/12301, 12203/12302, 12205/12305, and 12207/12304) require the average temperature of the combined room-pair to be  85°F, as monitored by temperature elements located in the shared return air ducting. Other required individual rooms (i.e., 12202, 12204, 12300, 12313, 12412, and 12501) are each required to be  85°F. Additionally, a maximum air temperature limit of  75°F is also placed on the MCRE. The passive heat sinks limit the temperature rise inside each room and the MCRE during the 72-hour period following VES actuation.
BASES BACKGROUND (continued)
Access corridors, stairwells, rooms separated by an air gap, and other rooms without significant heat loads are not monitored because these areas do not contain significant heat sources and their temperatures are assumed to match the connected spaces. These unmonitored rooms are identified as: 12211, 12311, 12400, 12405, 12411, 21480, 40400, and Stairwells.
Initial temperatures assumed for remaining rooms are conservatively selected to match the initial 115°F outdoor ambient (12212, 12213, 12306, 12312, 12404, and 12406) or do not have an appreciable impact on the analyses. These unmonitored rooms are identified as: 12212, 12213, 12306, 12312, 12404, 12406, 12504, 12505, 12506, and Level 1 rooms.
Nonessential, non-safety MCR heat loads are de-energized by the Protection and Safety Monitoring System (PMS) VES actuation signal, which is generated by the Main Control Room Isolation, Air Supply Initiation and Electrical Load De-energization ESF actuation signal, to maintain the MCRE within habitable limits for 72 hours.
AP1000                                  B 3.7.6 - 3                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                        134
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 Upon receipt of a Main Control Room Isolation, Air Supply Initiation and Electrical Load De-energization ESF actuation signal, PMS Divisions A and C energize associated redundant relays in each of the two safety-related electrical panels (VES-EP-01 and VES-EP-02). Energizing one set of relays in each panel disconnects non-safety related electrical power to the non-safety electrical loads in the MCRE. Energizing just one set of relays in one panel deenergizes the non-safety loads associated only with that panel.
De-energized non-safety loads are separated into stage 1 and stage 2 to maximize the availability of the non-safety related wall panel information system which is de-energized with stage 2 loads. Timers and associated relays, which actuate to de-energize the stage 1 and stage 2 non-safety loads, are internal to each safety-related load shed panel. Stage 1 loads are de-energized by both panels immediately after the timers in each panel receive the PMS Main Control Room Isolation, Air Supply Initiation and Electrical Load De-energization ESF actuation signal. Stage 2 loads are de-energized by both panels within 180 minutes after the timers in each panel receive the PMS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization ESF actuation signal.
BASES BACKGROUND (continued)
OPERABILITY of two redundant divisions of MCR Class 1E load shed relays and timers located in two safety-related panels is required to meet the single failure criterion. Each panel contains redundant load shed relays and timers actuated by the two PMS divisions such that actuation of either division deenergizes the specified loads associated with both panels.
In the unlikely event that power to the VBS is unavailable for more than 72 hours, MCRE habitability is maintained by operating one of the two MCRE ancillary fans to supply outside air to the MCRE.
AP1000                                  B 3.7.6 - 4                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      135
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 The compressed air storage tanks are initially filled to contain greater than 327,574 scf of compressed air. The compressed air storage tanks, the tank pressure, and the room temperature are monitored to confirm that the required volume of breathable air is stored. During operation of the VES, a self contained self-contained pressure regulating valve            Commented [HZS8]: Ext-02 maintains a constant downstream pressure regardless of the upstream pressure. An orifice downstream of the regulating valve is used to control the air flow rate into the MCRE. The MCRE is maintained at a 1/8 inch water gauge positive pressure to minimize the infiltration of airborne contaminants from the surrounding areas. The VES operation in maintaining the MCRE habitable is discussed in Reference 1.
APPLICABLE      The compressed air storage tanks are sized such that the set of tanks SAFETY          has a combined capacity that provides at least 72 hours of VES ANALYSES        operation.
Operation of the VES is automatically initiated by any of the following safety related signals:
x    Main Control Room Air Supply Iodine or Particulate Radiation -
High-2high-2 particulate or iodine radioactivity.
x    Loss of all AC power for more than 10 minutes; or x    Main Control Room differential pressure - Low (for greater than 10 minutes)                                                            Commented [HZS9]: Ext-03 In the event of a loss of all AC power, the VES functions to provide ventilation, pressurization, and cooling of the MCRE pressure boundary.      Commented [HZS10]: Ext-03 BASES APPLICABLE SAFETY ANALYSES (continued)
AP1000                                  B 3.7.6 - 5                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  136
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 In the event of that a high High-1 level of gaseous radioactivity setpoint value is reached outside of the MCRE, the non-safety VBS continues to operate to provide pressurization and filtration functions. The MCRE air supply downstream of the filtration units is monitored by a safety related radiation detectorre-aligns to supplemental filtration mode, providing MCRE pressurization, cooling, and filtration. Upon Hhigh-2 particulate or iodine radioactivity setpoint, a safety related signal is generated to isolate the MCRE and to initiate air flow from the VES storage tanks. Isolation of the MCRE consists of closing safety related valves in the lines that penetrate the MCRE pressure boundary. Valves in the VBS supply and exhaust ducts, and the Sanitary Drainage System (SDS) vent lines are automatically isolated. VES air flow is initiated by a safety related signal which opens the isolation valves in the VES supply lines.                        Commented [HZS8]: Ext-03 The VES provides protection from smoke and hazardous chemicals to the MCRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the MCRE following a hazardous chemical release (Ref. 1). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the MCRE occupants to control the reactor either from the control room or from the remote shutdown room (Ref. 2).
The VES functions to mitigate a DBA or transient that either assumes the failure of or challenges the integrity of the fission product barrier.
The VES satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The VES limits the MCRE temperature rise and maintains the MCRE at a positive pressure relative to the surrounding environment.
Two air delivery flow paths are required to be OPERABLE to ensure that at least one is available, assuming a single failure.
The VES is considered OPERABLE when the individual components necessary to deliver a supply of breathable air to the MCRE are OPERABLE. This includes components listed in SR 3.7.6.3 through 3.7.6.10. In addition, the MCRE pressure boundary must be maintained,            Commented [HZS9]: Ext-02 including the integrity of the walls, floors, ceilings, electrical and mechanical penetrations, and access doors. The MCRE pressure boundary includes the Potable Water System (PWS) and SDS running (piping drain) traps, which retain a fluid level sufficient to maintain a seal preventing gas flow through the piping. The MCRE pressure boundary also includes the Waste Water System (WWS) drain line, which is isolated by a normally closed isolation valve.
BASES AP1000                                  B 3.7.6 - 6                                Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    137
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 LCO (continued)
In order for the VES to be considered OPERABLE, the MCRE boundary must be maintained such that the MCRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analysis for DBAs, and that MCRE occupants are protected from hazardous chemicals and smoke.
The initial MCRE heat sink thermal mass, required individual room heat sink thermal mass, and required room-pair heat sink thermal mass are initial conditions required to limit the maximum MCRE temperature.
Thermal mass is the ability of a material to absorb and store heat energy.
In the context of the MCRE heat-up analysis, the thermal mass of the heat sinks provides inertia against temperature changes. Establishing the passive heat sink nominal conditions is related to the time of exposure and magnitude of relevant heat sources, and is dependent upon material properties such as specific heat capacity and density of concrete. The thermal mass of the required MCRE heat sinks (the MCRE, individual require rooms adjacent to and below the MCRE, required room-pairs adjacent to and below the MCRE, and the room above the MCRE) must be within limits to support VES OPERABILITY and limit the maximum MCRE temperature for 72 hours after VES actuation.                          Commented [HZS10]: Ext-02 The LCO is modified by a Note allowing the MCRE boundary to be opened intermittently under administrative controls. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the MCRE. This individual will have a method to rapidly close the opening and to restore the MCRE boundary to a condition equivalent to the design condition when a need for MCRE isolation is indicated.
Both PMS Divisions A and C in the two safety-related electrical panels are required to be OPERABLE, so that non-safety stage 1 and stage 2 MCR heat loads can be de-energized by the VES system actuation signal within the required time, assuming a single failure. This maintains the MCR temperature within habitable limits.                                    Commented [HZS11]: Ext-02 APPLICABILITY    In MODES 1, 2, 3, and 4 and during movement of irradiated fuel assemblies, the VES must be OPERABLE to ensure that the MCRE will AP1000                                  B 3.7.6 - 7                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                138
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 remain habitable during and following a DBA.
The VES is not required to be OPERABLE in MODES 5 and 6 when irradiated fuel is not being moved because accidents resulting in fission product release are not postulated.
ACTIONS          LCO 3.0.8 is applicable while in MODE 5 or 6. Since irradiated fuel assembly movement can occur in MODE 5 or 6, the ACTIONS have been modified by a Note stating that LCO 3.0.8 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, the fuel movement is independent of shutdown reactor operations. Entering LCO 3.0.8 while in MODE 5 or 6 would require the optimization of plant safety, unnecessarily.
A.1 When a VES valve, a VES damper, or a main control room boundary isolation valve is inoperable, action is required to restore the component to OPERABLE status. A Completion Time of 7 days is permitted to restore the valve or damper to OPERABLE status before action must be taken to reduce power. The Completion Time of 7 days is based on engineering judgment, considering the low probability of an accident that would result in a significant radiation release from the fuel, the low probability of not containing the radiation, and that the remaining components can provide the required capability.
B.1 When the MCRE air temperature is outside the acceptable range during VBS operation, action is required to restore it to an acceptable range. A Completion Time of 24 hours is permitted based upon the availability of temperature indication in the MCRE. It is judged to be a sufficient amount of time allotted to correct the deficiency in the nonsafety ventilation system before shutting down.                                                    Commented [HZS12]: Ext-02 B.1 If one division of one or more MCR load shed panel(s) is inoperable, all divisions of both MCR load shed panels must be restored to OPERABLE status within 7 days. In this condition, the OPERABLE unaffected division of the panel is capable of providing 100% of the load shed function.
A Completion Time of 7 days is permitted to restore the inoperable division of MCR load shed panel(s) to OPERABLE status before action must be taken to reduce power. The Completion Time of 7 days is based on engineering judgment, considering the low probability of an accident that would require VES actuation, and that the remaining panel division can provide the required load shed function.
AP1000                                  B 3.7.6 - 8                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    139
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES ACTIONS (continued)
As described in Subsection 6.4.2.3 of Ref. 1, any component failure in a PMS division of the load shed panel(s) renders that division inoperable. If this failure affects only one PMS division, leaving the remaining division of PMS unaffected, including the associated power and control circuit, it renders the panel(s) inoperable, while still maintaining the full load shed function. An event or action that impacts both PMS divisions in either panel does not maintain the full load shed function, and Condition F or G of LCO 3.7.6 would apply.
C.1 and C.2 When the thermal mass of one or more of the required MCRE heat sinks (the MCRE, individual required rooms adjacent to and below the MCRE, required room-pairs adjacent to and below the MCRE, and the room above the MCRE) is not within the required limit(s), the heat sink air temperature must be restored to within limit in 24 hours and the thermal mass of the required heat sink(s) must be restored to within limit(s) in 5 days.
The Required Action C.1 Completion Time of 24 hours to initially restore the heat sink air temperature to within limit is based on engineering judgment, considering the low probability of an accident that would require VES actuation under the worst case temperature conditions, and is permitted based upon the availability of temperature indication in the MCRE and individual required rooms, and in the air return ducts to the adjacent required room-pairs. It is judged to be a sufficient amount of time allotted to correct the deficiency in the non-safety VBS ventilation system.
The MCRE heat-up analysis demonstrates that the heat sink thermal mass returns to baseline assumptions after a variable time period depending upon the extent of VBS HVAC system degradation and outage time (i.e., extent and duration of the loss of VBS cooling) and upon heat sink wall thickness. For a total loss of VBS cooling that lasts for 24 hours, maintaining ambient air temperature below the limit for the MCRE (i.e.,
75F), the individual required rooms (i.e.,  85°F), and adjacent required room-pairs (i.e.,  85°F) for 4 days is one method of re-establishing the heat sink thermal mass assumed in the safety analysis. Alternatively, analyses or local measurements can evaluate ambient air temperature excursions for impact on meeting the thermal mass assumed in the main control room heat-up calculations and Condition C can be exited once the AP1000                                  B 3.7.6 - 9                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          140
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 VES B 3.7.6 thermal mass of the required heat sinks is determined to be within limits.
The Completion Time for Required Action C.2 is 5 days.
BASES ACTIONS (continued)
The selection of air temperature is an indication of heat sink temperature and heat sink thermal mass. It is recognized that the thermal mass of the passive heat sinks will not be restored to baseline assumptions after air temperature is restored within limits because the heat sinks take longer to be restored to the initial conditions assumed in the MCRE heat-up analysis.
C.1, C.2, and C.3D.1, D.2, and D.3                                            Commented [HZS13]: Ext-02 If the unfiltered inleakage of potentially contaminated air past the MCRE boundary and into the MCRE can result in MCRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of MCRE occupants from hazardous chemicals or smoke, the MCRE boundary is inoperable. Actions must be taken to restore an OPERABLE MCRE boundary within 90 days.
During the period that the MCRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on MCRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that MCRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that MCRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable MCRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of MCRE occupants within analyzed limits while limiting the probability that MCRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the MCRE boundary.
AP1000                                  B 3.7.6 - 10                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  141
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES ACTIONS (continued)
D.1, D.2, and D.3E.1, E.2, and E.3                                        Commented [HZS14]: Ext-02 If one bank of VES air tanks (8 tanks out of 32 total) is inoperable, then the VES is able to supply air to the MCRE for 54 hours (75% of the required 72 hours). If the VES is actuated, the operator must take actions to maintain habitability of the MCRE once the air in the tanks has been exhausted. The VBS supplemental filtration mode or MCRE ancillary fans are both capable of maintaining the habitability of the MCRE after 54 hours.
AP1000                                B 3.7.6 - 11                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                142
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 With one bank of VES air tanks inoperable, action must be taken to restore OPERABLE status within 7 days. In this Condition, the stored amount of compressed air in the remaining OPERABLE VES air tanks must be verified within 2 hours and every 12 hours thereafter to be at least 245,680 scf. The 245,680 scf value is 75 percent of the minimum amount of stored compressed air that must be available in the compressed air storage tanks. The standard volume is determined using the compressed air storage tank room temperature (VAS-TE-080A/B),
compressed air storage tanks pressure (VES-PT-001A/B), and Figure B 3.7.6-2, Compressed Air Storage Tanks Minimum Volume - One Bank of VES Air Tanks (8 Tanks) Inoperable. Values above the 245,680 scf line in the figure meet the Required Action criteria.
Verification that the minimum volume of compressed air is contained in the OPERABLE compressed air storage tanks ensures a 54 hour air supply will be available if needed. Additionally, within 24 hours, the VBS ancillary fans are verified to be OPERABLE so that, if needed, can be put into use once the OPERABLE compressed air storage tanks have been exhausted. The Completion Times associated with these actions and the 7 day Completion Time to restore VES to OPERABLE are based on engineering judgment, considering the low probability of an accident that would result in a significant radiation release from the reactor core, the low probability of radioactivity release, and that the remaining components and compensatory systems can provide the required capability. The 54 hours of air in the remaining OPERABLE compressed air storage tanks, along with compensatory operator actions, are adequate to protect the main control room envelope habitability. Dose calculations verify that the MCRE dose limits will remain within the requirements of GDC 19 with the compensatory actions taken at 54 hours.
BASES ACTIONS (continued)
E.1 and E.2F.1 and F.2 In MODE 1, 2, 3, or 4 if the Required Actions and Completion Times of Conditions A, B, C, or D, or E are not met, or the VES is inoperable for reasons other than Conditions A, B, C, or D, or E the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.                                                            Commented [HZS15]: Ext-02 AP1000                                B 3.7.6 - 12                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  143
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 F.1G.1 During movement of irradiated fuel assemblies, if the Required Actions and Completion Times of Conditions A, B, C, or ED are not met, or the VES is inoperable for reasons other than Conditions A, B, C, or ED, or the VES is inoperable due to an inoperable MCRE boundary, action must be taken immediately to suspend the movement of fuel. This does not preclude the movement of fuel to a safe position.                              Commented [HZS16]: Ext-02 SR 3.7.6.1 The MCRE air temperature is checked at a frequency of 24 hours to verify that the VBS is performing as required to maintain the initial condition temperature assumed in the safety analysis, and to ensure that the MCRE temperature will not exceed the required conditions after loss of VBS cooling. The surveillance limit of 75°F is the initial heat sink temperature assumed in the VES thermal analysis. The 24 hour Frequency is acceptable based on the availability of temperature indication in the MCRE.                                                        Commented [HZS17]: Ext-02 SURVEILLANCE REQUIREMENTS    SR 3.7.6.12                                                                    Commented [HZS18]: Ext-02 Verification every 24 hours that compressed air storage tanks contain greater than 327,574 scf of breathable air.
The standard volume is determined using the compressed air storage tank room temperature (VAS-TE-080A/B), compressed air storage tanks pressure (VES-PT-001A/B), and Figure B 3.7.6-1, Compressed Air Storage Tanks Minimum Volume. Values above the 327,574 scf line in the figure meet the surveillance criteria. Verification that the minimum volume of compressed air is contained in the compressed air storage tanks ensures that there will be an adequate supply of breathable air to maintain MCRE habitability for a period of 72 hours. The Frequency of 24 hours is based on the availability of pressure indication in the MCRE.
SR 3.7.6.23                                                                    Commented [HZS19]: Ext-02 VES air delivery isolation valves are required to be verified as OPERABLE. The Frequency required is in accordance with the Inservice Testing Program.SR 3.7.6.2 verifies that the thermal mass of the required heat sinks is within limit(s) every 24 hours. One method of satisfying SR 3.7.6.2 is maintaining ambient air temperature below the limit for the MCRE (i.e.,  75°F), the individual required rooms (i.e.,  85°F), and adjacent required room-pairs (i.e.,  85°F) for 4 days. Alternatively, analyses or local measurements can satisfy the verification of the heat sink thermal mass assumed in the main control room heat-up calculation.
BASES AP1000                                B 3.7.6 - 13                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  144
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 SURVEILLANCE REQUIREMENTS (continued)
Satisfying the required heat sink room temperature limits (i.e.,  75°F for the MCRE and  85°F for the individual required rooms and the adjacent required room-pairs) for sufficient duration (i.e., 4 days) establishes the equilibrium initial heat sink thermal mass assumed in the main control room heat-up calculation.
Passive heat sink air temperatures in required dc Equipment Room and required I&C roompairs (12201/12301, 12203/12302, 12205/12305, and 12207/12304) are verified by temperature elements located in the shared return air ducting (alternatively, local measurement of each room may be utilized). Other required individual rooms (12202, 12204, 12300, 12303, 12313, 12412, and 12501) are verified using indication from the temperature elements in each room.
This is done to verify that the VBS is performing as required to maintain the initial conditions assumed in the safety analyses, and to verify the VES heat sinks provide adequate thermal mass to limit the temperature increase in the MCRE, dc Equipment Rooms, and I&C Rooms from exceeding the allowable limits after VES actuation.
The 24 hour Frequency is acceptable based on the availability of automatic VBS temperature controls, alarms, and indication in the MCRE.
Air temperatures may also be verified using local measurement.
SR 3.7.6.34                                                                    Commented [HZS20]: Ext-02 Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing VES once every month provides an adequate check of the system. The 31 day Frequency is based on the reliability of the equipment and the availability of system redundancy.
SR 3.7.6.45                                                                    Commented [HZS21]: Ext-02 VES air header isolation valves are required to be verified open at 31 day intervals. This SR is designed to ensure that the pathways for supplying breathable air to the MCRE are available should loss of VBS occur.
These valves should be closed only during required testing or maintenance of downstream components, or to preclude complete depressurization of the system should the VES isolation valves in the air delivery line open inadvertently or begin to leak.
BASES AP1000                                  B 3.7.6 - 14                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  145
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.6.56                                                                      Commented [HZS22]: Ext-02 Verification that the air quality of the air storage tanks meets the requirements of Appendix C, Table C-1 of ASHRAE Standard 62 (Ref. 4) with a pressure dew point of  40°F at  3400 psig is required every 92 days. If air has not been added to the air storage tanks since the previous verification, verification may be accomplished by confirmation of the acceptability of the previous surveillance results along with examination of the documented record of air makeup. The purpose of ASHRAE Standard 62 states: This standard specifies minimum ventilation rates and indoor air quality that will be acceptable to human occupants and are intended to minimize the potential for adverse health effects. Verification of the initial air quality (in combination with the other surveillances) ensures that breathable air is available for 11 MCRE occupants for at least 72 hours. Confirmation of the pressure dew point verifies that water has not formed in the line, eliminating the potential for freezing at the pressure regulating valve during VES operation. In addition, the dry air allows the MCRE to remain below the maximum relative humidity to support the 90°F WBGT required for human factors performance.                                                                      Commented [HZS23]: Ext-02 SR 3.7.6.67                                                                      Commented [HZS24]: Ext-02 Verification that the VBS isolation valves and the Sanitary Drainage System (SDS) isolation valves are OPERABLE and will actuate upon demand is required every 24 months to ensure that the MCRE can be isolated upon loss of VBS operation.
SR 3.7.6.78 Verification that each VES pressure relief isolation valve within the MCRE pressure boundary is OPERABLE is required in accordance with the Inservice Testing Program. The SR is used in combination with SR 3.7.6.89 to ensure that adequate vent area is available to mitigate MCRE overpressurization.                                                          Commented [HZS25]: Ext-02 SR 3.7.6.89 Verification that the VES pressure relief damper is OPERABLE is required at 24 month intervals. The SR is used in combination with SR 3.7.6.78 to ensure that adequate vent area is available to mitigate MCRE overpressurization.                                                              Commented [HZS26]: Ext-02 BASES AP1000                                B 3.7.6 - 15                                Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      146
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.6.910                                                                    Commented [HZS27]: Ext-02 Verification of the OPERABILITY of the self-contained pressure regulating valve in each VES air delivery flow path is required in accordance with the Inservice Testing Program. This is done to ensure that a sufficient supply of air is provided as required, and that uncontrolled air flow into the MCRE will not occur.
SR 3.7.6.1011                                                                  Commented [HZS28]: Ext-02 This SR verifies the OPERABILITY of the MCRE boundary by testing for unfiltered air inleakage past the MCRE boundary and into the MCRE.
The details of the testing are specified in the Main Control Room Envelope Habitability Program.
The MCRE is considered habitable when the radiological dose to MCRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the MCRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the MCRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences.
When unfiltered air inleakage is greater than the assumed flow rate, Condition CD must be entered. Required Action C.3D.3 allows time to restore the MCRE boundary to OPERABLE status provided mitigating actions can ensure that the MCRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory      Commented [HZS29]: Ext-02 measures are discussed in Regulatory Guide 1.196, Section C.2.7.3 (Ref.
: 3) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 5). These compensatory measures may also be used as mitigating AP1000                                  B 3.7.6 - 16                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    147
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued) actions as required by Required Action C.2D.2. Temporary analytical          Commented [HZS30]: Ext-02 methods may also be used as compensatory measures to restore OPERABILITY (Ref. 6). Options for restoring the MCRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the MCRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the MCRE boundary has been restored to OPERABLE status.
SR 3.7.6.1112                                                                Commented [HZS31]: Ext-02 This SR verifies that the required VES testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VES filter tests are in accordance with Regulatory Guide 1.52 (Ref. 7). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and physical properties of the activated charcoal. Specific test frequencies and additional information are discussed in detail in the VFTP.
SR 3.7.6.12 Verification that the MCR load shed function actuates on an actual or simulated signal from each PMS Division is required every 24 months to confirm that the non-safety stage 1 and stage 2 MCR heat loads can be de-energized by the VES actuation signal within the required time. The ACTUATION LOGIC TEST overlaps this Surveillance to provide complete testing of the assumed safety function.The 24-month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage to minimize the potential for adversely affecting MCR operations.                                                              Commented [HZS32]: Ext-02 SR 3.7.6.13 Verification that the main VES air delivery isolation valves actuate on an actual or simulated signal to the correct position is required every 24 months to confirm that the VES operates as assumed in the safety analysis. The ACTUATION LOGIC TEST overlaps this Surveillance to provide complete testing of the assumed safety function. The 24-month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage to minimize adversely affecting MCR operations.                                                              Commented [HZS33]: Ext-02 AP1000                                B 3.7.6 - 17                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  148
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES REFERENCES      1. Section 6.4, Main Control Room Habitability Systems.
: 2. Section 9.5.1, Fire Protection System.
: 3. Regulatory Guide 1.196, Control Room Habitability at Light-Water Nuclear Power Reactors.
: 4. ASHRAE Standard 62-1989, Ventilation for Acceptable Indoor Air Quality.
: 5. NEI 99-03, Control Room Habitability Assessment, June 2001.
: 6. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability. (ADAMS Accession No. ML040300694).
: 7. Regulatory Guide 1.52, Design, Inspection, and Testing Criteria for Airfiltration and Adsorption Units of Post-Accident Engineered-Safety-Feature Atmosphere Cleanup Systems in Light-Water-Cooled Nuclear Power Plants, Revision 3.
AP1000                                B 3.7.6 - 18                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                    149
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3 VES B 3.7.6 VES Operablity Requirements (Required by Action E.1D.1)
Figure B 3.7.6-2                                        Commented [HZS34]: Ext-02 Compressed Air Storage Tanks Minimum Volume - One Bank of VES Air Tanks (8 Tanks) Inoperable AP1000                                B 3.7.6 - 20                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                              150
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Design Control Document Markup Pages Improvements to Main Control Room (MCR) Post-Accident Radiological Consequences (Ext-03)
(Non-Proprietary)
                        © 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                          151
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                      AP1000 Design Control Document 2.2.5 Main Control Room Emergency Habitability System Design Description The main control room emergency habitability system (VES) provides a supply of breathable air for the main control room (MCR) occupants and maintains the MCR at a positive pressure with respect to the surrounding areas whenever ac power is not available to operate the nuclear island nonradioactive ventilation system (VBS), MCR differential pressure is not maintained, or high radioactivity is detected in  Commented [HZS3]: Ext-03 the MCR air supply. (See Tier 1 material, Section 3.5 for Radiation Monitoring). The VES also limits the heatup of the MCR, the 1E instrumentation and control (I&C) equipment rooms, and the Class 1E dc equipment rooms by using the heat capacity of surrounding structures.
The VES is as shown in Figure 2.2.5-1 and the component locations of the VES are as shown in Table 2.2.5-6.
: 1. The functional arrangement of the VES is as described in the Design Description of this Section 2.2.5.
: 2. a) The components identified in Table 2.2.5-1 as ASME Code Section III are designed and constructed in accordance with ASME Code Section III requirements.
b) The piping identified in Table 2.2.5-2 as ASME Code Section III is designed and constructed in accordance with ASME Code Section III requirements.
: 3. a) Pressure boundary welds in components identified in Table 2.2.5-1 as ASME Code Section III meet ASME Code Section III requirements.
b) Pressure boundary welds in piping identified in Table 2.2.5-2 as ASME Code Section III meet ASME Code Section III requirements.
: 4. a) The components identified in Table 2.2.5-1 as ASME Code Section III retain their pressure boundary integrity at their design pressure.
b) The piping identified in Table 2.2.5-2 as ASME Code Section III retains its pressure boundary integrity at its design pressure.
: 5. a) The seismic Category I equipment identified in Table 2.2.5-1 can withstand seismic design basis loads without loss of safety function.
b) Each of the lines identified in Table 2.2.5-2 for which functional capability is required is designed to withstand combined normal and seismic design basis loads without a loss of its functional capability.
: 6. a) The Class 1E components identified in Table 2.2.5-1 are powered from their respective Class 1E division.
b) Separation is provided between VES Class 1E divisions, and between Class 1E divisions and non-Class 1E cable.
: 7. The VES provides the following safety-related functions:
Tier 1 Material                                    2.2.5-1                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            152
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                        AP1000 Design Control Document a) The VES provides a 72-hour supply of breathable quality air for the occupants of the MCR.
b) The VES maintains the MCR pressure boundary at a positive pressure with respect to the surrounding areas. There is a discharge of air through the MCR vestibule.
c) The heat loads within the MCR, the I&C equipment rooms, and the Class 1E dc equipment rooms are within design basis assumptions to limit the heatup of the rooms identified in Table 2.2.5-4.
d) The system provides a passive recirculation flow of MCR air to maintain main control room dose rates below an acceptable level during VES operation.
e) The system provides shielding below the VES filter that is sufficient to ensure main control room doses are below an acceptable level during VES operation.                                              Commented [HZS4]: Ext-03
: 8. Safety-related displays identified in Table 2.2.5-1 can be retrieved in the MCR.
: 9. a) Controls exist in the MCR to cause those remotely operated valves identified in Table 2.2.5-1 to perform their active functions.
b) The valves identified in Table 2.2.5-1 as having protection and safety monitoring system (PMS) control perform their active safety function after receiving a signal from the PMS.
c) The MCR Load Shed Panels identified in Table 2.2.5-1 perform their active safety function after receiving a signal from the PMS.                                                                      Commented [HZS5]: Ext-02
: 10. After loss of motive power, the remotely operated valves identified in Table 2.2.5-1 assume the indicated loss of motive power position.
: 11. Displays of the parameters identified in Table 2.2.5-3 can be retrieved in the MCR.
: 12. The background noise level in the MCR does not exceed 65 dB(A) at the operator workstations when the VES is operating.
Inspections, Tests, Analyses, and Acceptance Criteria Table 2.2.5-5 specifies the inspections, tests, analyses, and associated acceptance criteria for the VES.
Tier 1 Material                                    2.2.5-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              153
 
DCP_NRC_003343                                                        Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                        AP1000 Design Control Document Table 2.2.5-1 (cont.)
ASME                              Class 1E/                              Loss of Code              Remotely      Qual. for Safety-                      Motive Section Seismic    Operated        Harsh    Related    Control  Active    Power Equipment Name              Tag No. III    Cat. I      Valve        Envir. Display      PMS  Function  Position MCR Air Filtration Line        VES-MY-F03    No      Yes          -            -        -          -      -        -
Postfilter MCR Filter Shielding          12401-NS-01  No      Yes          -            -        -          -      -        -          Commented [HZS10]: Ext-03 MCR Gravity Relief          VES-MD-D001A    No      Yes          -            -        -          -      -        -
Dampers MCR Gravity Relief          VES-MD-D001B    No      Yes          -            -        -          -      -        -
Dampers MCR Air Filtration Line      VES-MD-D002    No      Yes          -            -        -          -      -        -
Supply Damper MCR Air Filtration Line      VES-MD-D003    No      Yes          -            -        -          -      -        -
Supply Damper MCR Air Filtration Line      VES-MY-Y01    No      Yes          -            -        -          -      -        -
Silencer MCR Air Filtration Line      VES-MY-Y02    No      Yes          -            -        -          -      -        -
Silencer MCR Air Delivery Line          VES-003A    No      Yes          -          Yes/No    Yes        -      -        -
Flow Sensor MCR Air Delivery Line          VES-003B    No      Yes          -          Yes/No    Yes        -      -        -
Flow Sensor Note: Dash (-) indicates not applicable.
Tier 1 Material                                                  2.2.5-9                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                          154
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                              AP1000 Design Control Document Table 2.2.5-5 (cont.)
Inspections, Tests, Analyses, and Acceptance Criteria Design Commitment                  Inspections, Tests, Analyses                Acceptance Criteria 7d) The system provides a passive      Testing will be performed to          The air flow rate at the outlet of the recirculation flow of MCR air to        confirm that the required amount      MCR passive filtration system is at maintain main control room dose        of air flow circulates through the    least 600 cfm greater than the flow rates below an acceptable level        MCR passive filtration system,        measured by VES-003A/B.
during VES operation.
7e) Shielding below the VES filter      Inspection will be performed for      A report exists and concludes that the is capable of providing attenuation    the existence of a report verifying  as-built shielding identified in Table that is sufficient to ensure main      that the as-built shielding meets    2.2.5-1 meets the functional control room doses are below an        the requirements for functional      requirements and exists below the acceptable level during VES            capability.                          filtration and exists below the operation.                                                                    filtration unit, and within its vertical projection.                              Commented [HZS12]: Ext-03
: 8. Safety-related displays identified  Inspection will be performed for      Safety-related displays identified in in Table 2.2.5-1 can be retrieved in    retrievability of the safety-related  Table 2.2.5-1 can be retrieved in the the MCR.                                displays in the MCR.                  MCR.
9.a) Controls exist in the MCR to      Stroke testing will be performed      Controls in the MCR operate to cause cause remotely operated valves          on remotely operated valves          remotely operated valves identified identified in Table 2.2.5-1 to          identified in Table 2.2.5-1 using    in Table 2.2.5-1 to perform their perform their active functions.        the controls in the MCR.              active safety functions.
9.b) The valves identified in          Testing will be performed on          The remotely operated valves Table 2.2.5-1 as having PMS            remotely operated valves listed in    identified in Table 2.2.5-1 as having control perform their active safety    Table 2.2.5-1 using real or          PMS control perform the active function after receiving a signal      simulated signals into the PMS.      safety function identified in the table from the PMS.                                                                after receiving a signal from the PMS.
9.c) The MCR Load Shed Panels          Testing will be performed on the      The MCR Load Shed Panels identified in Table 2.2.5-1 perform    MCR Load Shed Panels listed in        identified in Table 2.2.5-1 perform their active safety function after      Table 2.2.5-1 using real or          their active safety function identified receiving a signal from the PMS.        simulated signals into the PMS.      in the table after receiving a signal from the PMS.                            Commented [HZS13]: Ext-02
: 10. After loss of motive power, the    Testing of the remotely operated      After loss of motive power, each remotely operated valves identified    valves will be performed under        remotely operated valve identified in in Table 2.2.5-1 assume the            the conditions of loss of motive      Table 2.2.5-1 assumes the indicated indicated loss of motive power          power.                                loss of motive power position.
position.
: 11. Displays of the parameters          Inspection will be performed for      The displays identified in identified in Table 2.2.5-3 can be      retrievability of the parameters in  Table 2.2.5-3 can be retrieved in the retrieved in the MCR.                  the MCR.                              MCR.
Tier 1 Material                                        2.2.5-15                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        155
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                        AP1000 Design Control Document 2.7      HVAC Systems 2.7.1 Nuclear Island Nonradioactive Ventilation System                                                        Commented [HZS1]: Ext-03 Design Description The nuclear island nonradioactive ventilation system (VBS) serves the main control room (MCR), control support area (CSA), Class 1E dc equipment rooms, Class 1E instrumentation and control (I&C) rooms, Class 1E electrical penetration rooms, Class 1E battery rooms, remote shutdown room (RSR), reactor coolant pump trip switchgear rooms, adjacent corridors, and passive containment cooling system (PCS) valve room during normal plant operation. The VBS consists of the following independent subsystems:
the main control room/control support area HVAC subsystem, the class 1E electrical room HVAC subsystem, and the passive containment cooling system valve room heating and ventilation subsystem.
The VBS provides heating, ventilation, and cooling to the areas served when ac power is available. The system provides breathable air to the control room and maintains the main control room and control support area areas at a slightly positive pressure with respect to the adjacent rooms and outside environment during normal operations. The VBS monitors the main control room supply air for radioactive particulate and iodine concentrations and provides filtration of main control room/control support area air during conditions of abnormal (high) High-1 airborne radioactivity. In addition, the VBS isolates the HVAC penetrations in the main control room boundary on "high-high" High-2 particulate or iodine radioactivity in the main control room supply air duct or on a loss of ac power for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes. The Sanitary Drainage System (SDS) also isolates a penetration in the main control room boundary on high-high High-2particulate or iodine radioactivity in the main control room supply air duct or on a loss of ac power for more than 10 minutes of if main control room differential pressure is below the Low setpoint for more than 10 minutes. Additional penetrations from the SDS and Potable Water System (PWS) into the main control room boundary are maintained leak tight using a loop seal in the piping, and the Waste Water System (WWS) is isolated using a normally closed safety related manual isolation valve. These features support operation of the main control room emergency habitability system (VES), and have been included in Tables 2.7.1-1 and 2.7.1-2.
The VBS is as shown in Figure 2.7.1-1 and the component locations of the VBS are as shown in Table 2.7.1-5.
: 1. The functional arrangement of the VBS is as described in the Design Description of this subsection 2.7.1.
: 2. a) The components identified in Table 2.7.1-1 as ASME Code Section III are designed and constructed in accordance with ASME Code Section III requirements.
b) The piping identified in Table 2.7.1-2 as ASME Code Section III is designed and constructed in accordance with ASME Code Section III requirements.
: 3. a) Pressure boundary welds in components identified in Table 2.7.1-1 as ASME Code Section III meet ASME Code Section III requirements.
b) Pressure boundary welds in piping identified in Table 2.7.1-2 as ASME Code Section III meet ASME Code Section III requirements.
Tier 1 Material                                    2.7.1-1                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            156
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 5. Site Parameters                                                          AP1000 Design Control Document Table 5.0-1 (cont.)                                                Commented [HZS1]: Ext-03 Site Parameters Control Room Atmospheric Dispersion Factors ( /Q) for Accident Dose Analysis
                          /Q (s/m3) at HVAC Intake for the Identified Release Points(3)
Ground Level Plant Vent or      Containment        PORV and        Steam Line        Fuel        Condenser PCS Air            Release        Safety Valve        Break        Handling      Air Removal Diffuser(5)        Points(6)        Releases(7)      Releases      Area(8)        Stack(9) 0 - 2 hours          2.53E-        4.00E-036.0E-3        1.92E-          2.13E-        6.0E-3          6.0E-3 033.0E-3                            022.0E-2        022.4E-2 2 - 8 hours          1.98E-        2.28E-033.6E-3        1.60E-          1.76E-        4.0E-3          4.0E-3 032.5E-3                            021.8E-2        022.0E-2 8 - 24 hours          7.96E-        1.03E-031.4E-3        6.90E-          7.50E-        2.0E-3          2.0E-3 041.0E-3                            037.0E-3        037.5E-3 1 - 4 days            6.40E-        9.03E-041.8E-3        4.96E-          5.43E-        1.5E-3          1.5E-3 048.0E-4                            035.0E-3        035.5E-3 4 - 30 days          4.78E-        7.13E-041.5E-3        4.16E-          4.55E-        1.0E-3          1.0E-3 046.0E-4                            034.5E-3        035.0E-3
                      /Q (s/m3) at Annex Building Door for the Identified Release Points(4) 0 - 2 hours          1.0E-3            1.0E-3            4.0E-3          4.0E-3        6.0E-3          2.0E-2 2 - 8 hours          7.5E-4            7.5E-4            3.2E-3          3.2E-3        4.0E-3          1.8E-2 8 - 24 hours          3.5E-4            3.5E-4            1.2E-3          1.2E-3        2.0E-3          7.0E-3 1 - 4 days            2.8E-4            2.8E-4            1.0E-3          1.0E-3        1.5E-3          5.0E-3 4 - 30 days          2.5E-4            2.5E-4            8.0E-4          8.0E-4        1.0E-3          4.5E-3 Notes:
: 3. These dispersion factors are to be used 1) for the time period preceding the isolation of the main control room and actuation of the emergency habitability system, 2) for the time after 72 hours when the compressed air supply in the emergency habitability system would be exhausted and outside air would be drawn into the main control room, and 3) for the determination of control room doses when the nonsafety ventilation system is assumed to remain operable such that the emergency habitability system is not actuated.
: 4. These dispersion factors are to be used when the emergency habitability system is in operation and the only path for outside air to enter the main control room is that due to ingress/egress.
: 5. These dispersion factors are used for analysis of the doses due to a postulated small line break outside of containment. The plant vent and PCS air diffuser are potential release paths for other postulated events (loss-of-coolant accident, rod ejection accident, and fuel handling accident inside the containment); however, the values are bounded by the dispersion factors for ground level releases.
: 6. The listed values represent modeling the containment shell as a diffuse area source, and are used for evaluating the doses in the main control room for a loss-of-coolant accident, for the containment leakage of activity following a rod ejection accident, and for a fuel handling accident occurring inside the containment.
Tier 1 Material                                          5.0-6                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      157
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document Table 1.6-1 (Sheet 16 of 21)                                        Commented [HZS1]: Ext-03 (CRR)
MATERIAL REFERENCED DCD Section      Westinghouse Topical Number          Report Number                                          Title 15.4      WCAP-7588WCAP-              Westinghouse Control Rod Ejection Accident Analysis Methodology 15806-P-A (P) WCAP-          Using Multi-Dimensional KineticsAn Evaluation of the Rod 15807-NP-A                  Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods, Revision 1A, January 1975 WCAP-10965-P-A (P)          ANC: A Westinghouse Advanced Nodal Computer Code, WCAP-10966-A                September 1986 WCAP-11397-P-A (P)          Revised Thermal Design Procedure, April 1989 WCAP-11397-A WCAP-15644-P (P)            AP1000 Code Applicability Report, Revision 2, March 2004 WCAP-15644-NP WCAP-11596-P-A (P)          Qualification of the PHOENIX-P/ANC Nuclear Design System for WCAP-11597-A                Pressurized Water Reactor Cores, June 1988 WCAP-16045-P-A (P)          Qualification of the Two-Dimensional Transport Code PARAGON, WCAP-16045-NP-A              August 2004 WCAP-10965-P-A,              ANC - A Westinghouse Advanced Nodal Computer Code; Addendum 1 (P)              Enhancements to ANC Rod Power Recovery, April 1989 WCAP-10966-A Addendum 1 WCAP-14565-P-A (P)          VIPRE-01 Modeling and Qualification for Pressurized Water WCAP-15306-NP-A              Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, October 1999 WCAP-15063-P-A,              Westinghouse Improved Performance Analysis and Design Model Revision 1 with Errata (P)  (PAD 4.0), July 2000 WCAP-15064-NP-A WCAP-16045-P-A              Qualification of the NEXUS Nuclear Data Methodology, August, Addendum 1-A (P)            2007 WCAP-16045-NP-A Addendum 1-A WCAP-10965-P-A,              Qualification of the New Pin Power Recovery Methodology, Addendum 2-A (P)            September, 2010 WCAP-15025-P-A (P)          Modified WRB-2 Correlation, WRB-2M, for Predicting Critical WCAP-15026-NP-A              Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids, April 1999 (P) Denotes Document is Proprietary Tier 2 Material                                      1.6-17                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  158
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                    AP1000 Design Control Document Issue 79    Unanalyzed Reactor Vessel Thermal Stress During Natural Convection Cooldown Discussion:
Generic Safety Issue 79 addresses the thermal stresses that occur in the reactor vessel head flange during a natural circulation cooldown. High stresses in the flange or studs during a natural circulation cooldown in PWRs could violate ASME code allowables. Cycling of the stresses could reduce the fatigue margin. Generic Letter 92-02 repeated the reporting requirements of 10CFR 50.73 (a)(2)(ii)(B), "Licensee event report system."
AP1000 Response:
The natural circulation cooldown transient is evaluated as part of ASME Code vessel evaluations and is discussed in Subsection 3.9.1.1.2.11. The reporting requirements to address the requirements of 10CFR 50.73 (a)(2)(ii)(B) referenced in Generic Letter 92-02 are the responsibility of the Combined License holder.
Issue 82    Beyond Design Basis Accidents in Spent Fuel Pools Discussion:
This issue addresses the concern of a beyond design basis accident in which the spent fuel pool is drained and spent fuel stored there subsequently catches on fire releasing very large amounts of radioactive contamination. This issue is classified as resolved with no new requirements.
AP1000 Response:
The AP1000 includes design provisions that preclude draining of the spent fuel pool. Also, provisions are available to supply water to the pool in the event the water covering the spent fuel begins to boil off.
Issue 83    Control Room Habitability                                                                          Commented [HZS2]: Ext-03 Discussion:
Loss of control room habitability following an accidental release of external toxic or radioactive material or smoke can impair or cause loss of the control room operators' capability to safely control the reactor. Use of the remote shutdown workstation outside the control room following such events is unreliable since this station has no emergency habitability or radiation protection provisions.
AP1000 Response:
Habitability of the main control room is provided by the main control room/control support area HVAC subsystem of the nonsafety-related nuclear island nonradioactive ventilation system (VBS). If ac power is unavailable for more than 10 minutes of if main control room differential pressure is below the Low setpoint for more than 10 minutes or if "high-high" High-2 particulate or iodine radioactivity is detected in the main control room supply air duct, which Tier 2 Material                                      1.9-56                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                159
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                      AP1000 Design Control Document Criteria    Referenced                      AP1000 Section      Criteria                        Position      Clarification/Summary Description of Exceptions AP1000 practice for Class 1 components is in agreement with the guidance of this regulatory guide except for Regulatory Positions C.1(b) and 2. For AP1000 Class 2 and 3 components, the guidelines provided by this regulatory guide are not applied, however all requirements of the ASME Boiler and Pressure Vessel Code are imposed.
C.1(b)                                      Conforms      The welding procedures are qualified within the preheat temperature ranges required by ASME Code, Section IX. Experience has shown excellent quality of welds using the ASME qualification procedures.
C.2                                          Exception      The AP1000 position is that the guidance specified in this regulatory guide is both unnecessary and impractical. Code acceptable low-alloy steel welds have been and are being made under present procedures. It is not necessary to maintain the preheat temperature until a post-weld heat treatment has been performed in accordance with the guidance provided by this regulatory guide, in the case of large components.
In some cases of reactor vessel main structural welds, the practice of maintaining preheat until the intermediate or final post-weld heat treatment has been followed. In other cases, an extended preheat practice has been utilized in accordance with the reactor vessel design specification.
In this practice, the weld temperature is maintained at 400°F to 750°F for 4 hours after welding. The weld temperature may then be lowered to ambient without performing an intermediate or final post-weld heat treatment at 1100°F.
The welds have shown high integrity. Westinghouse practices are documented in WCAP-8577 (Reference 9) which has been accepted by the Nuclear Regulatory Commission.
Reg. Guide 1.51 - Withdrawn Reg. Guide 1.52, Rev. 3, 6/01 - Design, Testing, and Maintenance Criteria for Post Accident Engineered-Safety-Feature Atmosphere Cleanup System Air Filtration and Absorption Units of Light-Water-Cooled Nuclear Power Plants General                                      Conforms      The AP1000 main control room emergency habitability system (VES) includes a passive filtration system that is contained entirely within the main control room envelope. The passive filtration portion of the AP1000 Tier 2 Material                                      1A-19                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          160
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant            AP1000 Design Control Document Criteria    Referenced            AP1000 Section      Criteria              Position      Clarification/Summary Description of Exceptions C.3.10                            Conforms C.3.11                            Exception    There are no outdoor air intakes for the AP1000 passive filtration system. The system uses breathable compressed air that is stored in compressed air tanks during the post-72-hour operation time.
C.3.12                            Exception    The AP1000 passive filtration system is located completely within the CRE. Leakages as explained in this regulatory position are not applicable to this system.
C.4.1 - 4.2                        Exception    There are no moisture separators and/or heaters in the AP1000 passive filtration line.
C.4.3 - 4.7                        Conforms C.4.8                              Exception    There are no water drains in the AP1000 passive filtration line.
C.4.9                              ExceptionConforms      The credited adsorber efficiencies are 90% for elemental iodine and 30% 90% for organic iodine.
These efficiencies assume no humidity control.            Commented [HZS1]: Ext-03 C.4.10                            Conforms      Type II adsorbers are used in this application C.4.11                            Conforms      The AP1000 passive filtration line uses impregnated activated carbon as the absorbent. The absorber is designed for a minimum average atmosphere residence time of 0.25 seconds per 2 inches of absorbent bed.
C.4.12                            Conforms C.4.13                            Conforms C.4.14                            Exception    The passive filtration line requires no fans.
C.5.1                              N/A          Only one bank of filters is used.
C5.2                              Exception    This system is not used for normal HVAC, and the filters should not build up unusual levels of particulate once installed.
C.6.1                              Conforms C.6.2 - 6.6                        Conforms C.7                                Conforms Tier 2 Material                            1A-21                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          161
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document Criteria    Referenced                      AP1000 Section      Criteria                        Position        Clarification/Summary Description of Exceptions Table 1                                      ExceptionConforms          The Technical Specification methyl iodide penetration acceptance limit for the AP1000 activated carbon adsorber is 5%, which correlates to 90%
removal efficiency of both organic and elemental iodine. The calculated design basis for the AP1000 passive filtration adsorbers assumes a 30% 90%
organic iodine removal efficiency and a 90% elemental iodine efficiency. A 1% bypass leakage is accounted for by testing to increased organic iodine removal efficiency.                                              Commented [HZS2]: Ext-03 Reg. Guide 1.53, Rev. 0, 6/73 - Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems General      IEEE Std. 379-1972              Exception        Regulatory Guide 1.53 endorses IEEE Std. 379-72 (Reference 10), which has been superseded by IEEE Std. 379-2000 (Reference 11). The AP1000 uses the latest version of the industry standards (as of 4/2001).
This version is not endorsed by a regulatory guide but its use should not result in deviation from the design philosophy otherwise stated in Regulatory Guide 1.53.
IEEE Std. 379-2000 is endorsed by DG-1118 (Proposed Revision of Regulatory Guide 1.53).
The guidelines are applicable to safety-related dc power systems. There are no safety-related ac power sources in the AP1000.
Reg. Guide 1.54, Rev. 1, 7/00 - Service Level I, II and III Protective Coatings Applied to Nuclear Power Plants General      ASTM D 3843-00,                Exception        Some coatings inside containment are nonsafety-related ASTM D 3911-95,                                  and satisfy appropriate ASTM Standards. See ASTM D 5144-00                                  subsection 6.1.2 for additional information. Application is controlled by procedures using qualified personnel to provide a high quality product. The paint materials for coatings inside the containment are subject to 10 CFR Part 50 Appendix B Quality Assurance requirements.
The quality assurance features of the AP1000 coatings systems are outlined in DCD subsection 6.1.2.1.6.
Subsection 6.1.3 defines the responsibility for the coating program.
Reg. Guide 1.55 - Withdrawn Reg. Guide 1.56, Rev. 1, 7/78 - Maintenance of Water Purity in Boiling Water Reactors General                                      N/A              Applies to boiling water reactors only.
Tier 2 Material                                      1A-22                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      162
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 2. Site Characteristics                                                      AP1000 Design Control Document Table 2-1 (Sheet 4 of 4)                                              Commented [HZS1]: Ext-03 SITE PARAMETERS Control Room Atmospheric Dispersion Factors ( /Q) for Accident Dose Analysis
                          /Q (s/m3) at HVAC Intake for the Identified Release Points(1)
Ground Level Plant Vent or      Containment          PORV and        Steam Line        Fuel        Condenser PCS Air            Release          Safety Valve        Break      Handling      Air Removal Diffuser(3)        Points(4)        Releases(5)      Releases        Area(6)        Stack(7) 0 - 2 hours          2.53E-        4.00E-036.0E-3          1.92E-          2.13E-        6.0E-3          6.0E-3 033.0E-3                              022.0E-2        022.4E-2 2 - 8 hours          1.98E-        2.28E-033.6E-3          1.60E-          1.76E-        4.0E-3          4.0E-3 032.5E-3                              021.8E-2        022.0E-2 8 - 24 hours        7.96E-        1.03E-031.4E-3          6.90E-          7.50E-        2.0E-3          2.0E-3 041.0E-3                              037.0E-3        037.5E-3 1 - 4 days          6.40E-        9.03E-041.8E-3          4.96E-          5.43E-        1.5E-3          1.5E-3 048.0E-4                              035.0E-3        035.5E-3 4 - 30 days          4.78E-        7.13E-041.5E-3          4.16E-          4.55E-        1.0E-3          1.0E-3 046.0E-4                              034.5E-3        035.0E-3
                        /Q (s/m3) at Annex Building Door for the Identified Release Points(2)
Ground Level Plant Vent or      Containment          PORV and        Steam Line        Fuel        Condenser PCS Air            Release          Safety Valve        Break      Handling      Air Removal Diffuser(3)        Points(4)        Releases(5)      Releases        Area(6)        Stack(7) 0 - 2 hours          1.0E-3            1.0E-3            4.0E-3          4.0E-3        6.0E-3          2.0E-2 2 - 8 hours          7.5E-4            7.5E-4            3.2E-3          3.2E-3        4.0E-3          1.8E-2 8 - 24 hours        3.5E-4            3.5E-4            1.2E-3          1.2E-3        2.0E-3          7.0E-3 1 - 4 days          2.8E-4            2.8E-4            1.0E-3          1.0E-3        1.5E-3          5.0E-3 4 - 30 days          2.5E-4            2.5E-4            8.0E-4          8.0E-4        1.0E-3          4.5E-3 Notes:
: 1. These dispersion factors are to be used 1) for the time period preceding the isolation of the main control room and actuation of the emergency habitability system, 2) for the time after 72 hours when the compressed air supply in the emergency habitability system would be exhausted and outside air would be drawn into the main control room, and 3) for the determination of control room doses when the non-safety ventilation system is assumed to remain operable such that the emergency habitability system is not actuated.
: 2. These dispersion factors are to be used when the emergency habitability system is in operation and the only path for outside air to enter the main control room is that due to ingress/egress.
: 3. These dispersion factors are used for analysis of the doses due to a postulated small line break outside of containment. The plant vent and PCS air diffuser are potential release paths for other postulated events Tier 2 Material                                            2-24                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        163
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                            AP1000 Design Control Document Criterion 19 - Control Room A control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions, including loss of coolant accidents. Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent, to any part of the body, for the duration of the accident.
Equipment at appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.
AP1000 Compliance The AP1000 main control room provides the man-machine interfaces required to operate the plant safely and efficiently under normal conditions and to maintain it in a safe manner under accident conditions, including LOCAs. Simplified passive safety-related system designs are provided that do not rely upon operator action to maintain core cooling for design basis accidents. Operator action outside the main control room to mitigate the consequences of an accident is permitted.
The main control room is shielded by the containment and auxiliary building from direct gamma radiation and inhalation doses resulting from the postulated release of fission products inside containment. Refer to Chapter 15 for additional information on accident conditions. The main control room/control support area HVAC subsystem of the nuclear island nonradioactive ventilation system (VBS) allows access to and occupancy of the main control room under accident conditions as described in subsection 9.4.1. Sufficient shielding and the main control room/control support area HVAC subsystem provide adequate protection so that personnel will not receive radiation exposure in excess of 5 rem whole-body or its equivalent to any part of the body for the duration of the accident.
If ac power is unavailable for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes or if "high-high" High-2 particulate, low pressurizer pressure is detected, or High-2 iodine radioactivity is detected in the main control room supply air duct, which would lead to exceeding General Design Criteria 19 operator dose limits, the protection and safety monitoring system automatically isolates the main control room and operator habitability requirements are then met by the main control room emergency habitability system (VES). The main control room emergency habitability system also allows          Commented [HZS1]: Ext-03 access to and occupancy of the main control room under accident conditions. The emergency main control room habitability system is designed to satisfy seismic Category I requirements as described in Section 3.2; the system design is described in Section 6.4.
In the event that the operators are forced to abandon the main control room, a workstation is provided with remote shutdown capability. A main control room evacuation is not assumed to occur simultaneously with design basis events. The remote shutdown workstation is described in Section 7.4.
Tier 2 Material                                    3.1-11                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                164
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                      AP1000 Design Control Document 6.4        Habitability Systems The habitability systems are a set of individual systems that collectively provide the habitability functions for the plant. The systems that make up the habitability systems are the:
x    Nuclear island nonradioactive ventilation system (VBS) x    Main control room emergency habitability system (VES) x    Radiation monitoring system (RMS) x    Plant lighting system (ELS) x    Fire Protection System (FPS)
When a source of ac power is available, the nuclear island nonradioactive ventilation system (VBS) provides normal and abnormal HVAC service to the main control room (MCR),
control support area (CSA), instrumentation and control rooms, dc equipment rooms, battery rooms, and the nuclear island nonradioactive ventilation system equipment room as described in subsection 9.4.1.
If ac power is unavailable for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes or if high-high High-2 particulate or iodine radioactivity is detected in the main control room supply air duct, which would lead to exceeding General Design Criteria 19 operator dose limits, the protection and safety monitoring system automatically isolates the main control room and operator habitability requirements are then met by the main control room emergency habitability system (VES). The main control room        Commented [HZS1]: Ext-03 emergency habitability system is capable of providing emergency ventilation and pressurization for the main control room. The main control room emergency habitability system also provides emergency passive heat sinks for the main control room, instrumentation and control rooms, and dc equipment rooms.
Radiation monitoring of the main control room environment is provided by the radiation monitoring system. Smoke detection is provided in the VBS system. Emergency lighting is provided by the plant lighting system. Storage capacity is provided in the main control room for personnel support equipment. Manual hose stations outside the MCR and portable fire extinguishers are provided to fight MCR fires.
6.4.1      Safety Design Basis The safety design bases discussed here apply only to the portion of the individual system providing the specified function. The range of applicability is discussed in subsection 6.4.4.
6.4.1.1    Main Control Room Design Basis The habitability systems provide coverage for the main control room pressure boundary as defined in subsection 6.4.2.1. The following discussion summarizes the safety design bases with respect to the main control room:
x    The habitability systems are capable of maintaining the main control room environment suitable for prolonged occupancy throughout the duration of the postulated accidents discussed in Chapter 15 that require protection from the release of radioactivity. Refer to Tier 2 Material                                      6.4-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              165
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document x    Penetration sealing materials are designed to withstand at least 1/4-inch water gauge pressure differential in an air pressure barrier. Penetration sealing material is a silicone-based material or equivalent.
x    There is no HVAC duct that penetrates the main control room pressure boundary. The portions of the nuclear island nonradioactive ventilation system (VBS) that penetrate the main control room pressure boundary are safety-related piping that include redundant safety-related seismic Category I isolation valves that are physically located within the main control room envelope.
The piping, conduits, and electrical cable trays penetrating through any combination of main control room pressure boundary are sealed with seal assembly compatible with the materials of penetration commodities. Penetration sealing materials are selected to meet barrier design requirements and are designed to withstand specific area environmental design requirements and remain functional and undamaged during and following an SSE. There are no adverse environmental effects on the MCR sealant materials resulting from postulated spent fuel pool boiling events.
The main control room pressure boundary main entrance is designed with a double-door vestibule, which is purged by the pressure relief damper discharge flow during main control room emergency habitability system operation. The emergency exit door (stairs to elevation 100) is normally closed, and remains closed under design basis source term conditions. Administrative controls prohibit the emergency exit door to the remote shutdown workstation from being used for normal ingress and egress during VES operation.
When the main control room pressure boundary is isolated in an accident situation, there is no direct communication with the outside atmosphere, nor is there communication with the normal ventilation system. Leakage from the main control room pressure boundary is the result of an internal pressure of at least 1/8-inch water gauge provided by emergency habitability system operation.
The exfiltration and infiltration analysis for nuclear island nonradioactive ventilation system operation is discussed in subsection 9.4.1.
6.4.2.5    Interaction with Other Zones and Pressurized Equipment The main control room emergency habitability system is a self-contained system. There is no interaction between other zones and pressurized equipment.
For a discussion of the nuclear island nonradioactive ventilation system, refer to subsection 9.4.1.
6.4.2.6    Shielding Design The design basis loss-of-coolant accident (LOCA) dictates the shielding requirements for the main control room. Main control room shielding design bases are discussed in Section 12.3. In addition to shielding provided by building structural features, consideration is given to shielding provided by the VES filter shielding. Descriptions of the design basis LOCA source terms, main          Commented [HZS5]: Ext-03 Tier 2 Material                                        6.4-8                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    166
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document control room shielding parameters, and evaluation of doses to main control room personnel are presented in Section 15.6.
The main control room and its location in the plant are shown in Figure 12.3-1.
6.4.3      System Operation This subsection discusses the operation of the main control room emergency habitability system.
6.4.3.1    Normal Mode The main control room emergency habitability system is not required to operate during normal conditions. The nuclear island nonradioactive ventilation system maintains the air temperature of a number of rooms within a predetermined temperature range. The rooms with this requirement include the rooms with a main control room emergency habitability system passive heat sink design and their adjacent rooms.
6.4.3.2    Emergency Mode Operation of the main control room emergency habitability system is automatically initiated by either of the following conditions:
x    High-highHigh-2 particulate or iodine radioactivity in the main control room supply air  Commented [HZS6]: Ext-03 duct x    Loss of ac power for more than 10 minutes x    Low main control room differential pressure for more than 10 minutes                      Commented [HZS7]: Ext-03 Operation can also be initiated by manual actuation.
The nuclear island nonradioactive ventilation system is isolated from the main control room pressure boundary by automatic closure of the isolation devices located in the nuclear island nonradioactive ventilation system ductwork if radiation levels in the main control room supply air duct exceed the high-high High-2 setpoint or if ac power is lost for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes.. At the same time, the main control room emergency habitability system begins to          Commented [HZS8]: Ext-03 deliver air from the emergency air storage tanks to the main control room by automatically opening the isolation valves located in the supply line. The relief damper isolation valves also open allowing the pressure relief dampers to function and discharge the damper flow to purge the vestibule.
After the main control room emergency habitability system isolation valves are opened, the air supply pressure is regulated by a self-contained regulating valve. This valve maintains a constant downstream pressure regardless of the upstream pressure. A constant air flow rate is maintained by the flow metering orifice downstream of the pressure regulating valve. This flow rate is sufficient to maintain the main control room pressure boundary at least 1/8-inch water gauge positive differential pressure with respect to the surroundings and induce a flow rate of at least 600 cfm into the passive air filtration line. The main control room emergency habitability system Tier 2 Material                                      6.4-9                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              167
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document air flow rate is also sufficient to maintain the carbon dioxide levels below 0.5 percent concentration for 11 occupants and to maintain air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1.
The emergency air storage tanks are sized to provide the required air flow to the main control room pressure boundary for 72 hours. After 72 hours, the main control room is cooled by drawing in outside air and circulating it through the room, as discussed in subsection 6.4.2.2.
The temperature and humidity in the main control room pressure boundary following a loss of the nuclear island nonradioactive ventilation system remain within limits for reliable human performance (References 2 and 3 14) over a 72-hour period. The bounding initial values of temperature/relative humidity in the MCR are 75°F/60 percent, the relative humidity in the MCR varies between 5% and 95% with a corresponding dry bulb temperature variance between 75°F to under 95°F. At 3 hours, when the non-1E battery heat loads are exhausted, the conditions are 87.2°F/41 percent. At 24 hours, when the 24 hour battery heat loads are terminated, the conditions are 84.4°F/45 percent. At 72 hours, the conditions are 85.8°F/ 39 percent. The temperature/relative humidity values calculated during the 72 hours following a design basis accident equate to a maximum average WBGT Index for the MCR of less than 90°F. The 90°F WBGT Index is the design limit for minimizing performance decrements and potential harm, and preserving well-being and effectiveness of the MCR staff for an unlimited duration (Reference 14). Non-Class 1E MCR heat loads are de-energized by PMS automatic actions, and the 24- hour battery heat loads are terminated or exhausted at 24 hours to maintain the occupied zone of the MCR and the zones containing qualified safety-related equipment within the constraints of the heat loads in Table 6.4-3 (to maintain temperature below the WBGT limit) at 72 hours after VES actuation. The occupied zone is considered to be the area between the raised floor and 7 feet above the floor, which encompasses the reactor operator and the senior reactor operator consoles. Commented [HZS9]: Ext-02 Sufficient thermal mass is provided in the walls and ceiling of the main control room to absorb the heat generated by the equipment, lights, and occupants. The temperature in the instrumentation and control rooms and dc equipment rooms following a loss of the nuclear island nonradioactive ventilation system remains below acceptable limits as discussed in subsection 6.4.4. As in the main control room, sufficient thermal mass is provided surrounding these rooms to absorb the heat generated by the equipment. After 72 hours, the instrumentation and control rooms will be cooled by drawing in outside air and circulating it through the room, as discussed in subsection 6.4.2.2.
In the event of a loss of ac power or Low main control room differential pressure for more than 10 minutes, the nuclear island nonradioactive ventilation system isolation valves automatically close and the main control room emergency habitability system isolation valves automatically open. These actions protect the main control room occupants from a potential radiation release. Commented [HZS10]: Ext-03 In instances in which there is no radiological source term present, the compressed air storage tanks are refilled via a connection to the breathable quality air compressor in the compressed and instrument air system (CAS). The compressed air storage tanks can also be refilled from portable supplies by an installed connection in the CAS.
Tier 2 Material                                      6.4-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                168
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document 6.4.4      System Safety Evaluation In the event of an accident involving the release of radioactivity to the environment, the nuclear island nonradioactive ventilation system (VBS) is expected to switch from the normal operating mode to the supplemental air filtration mode to protect the main control room personnel.
Although the VBS is not a safety-related system, it is expected to be available to provide the necessary protection for realistic events. However, the design basis accident doses reported in Chapter 15 utilize conservative assumptions, and the main control room doses are calculated based on operation of the safety-related emergency habitability system (VES) since this is the system that is relied upon to limit the amount of activity the personnel are exposed to. The analyses assume that the VBS is initially in operation, but fails to enter the supplemental air filtration mode on a High-1 radioactivity indication in the main control room atmosphere. VES operation is then assumed to be initiated once the High-2 level for control room atmosphere activity iodine or particulate radioactivity is reached.                                          Commented [HZS11]: Ext-03 Doses are also calculated assuming that the VBS does operate in the supplemental air filtration mode as designed, but with no switchover to VES operation. This VBS operating case demonstrates the defense-in-depth that is provided by the system and also shows that, in the event of an accident with realistic assumptions, the VBS is adequate to protect the control room operators without depending on VES operation.
Doses were determined for the following design basis:
VES Operating          VBS Operating Large Break LOCA                                  4.414.33 rem TEDE      4.734.84    rem TEDE Fuel Handling Accident                            2.51.5 rem TEDE        1.61.1 rem TEDE Steam Generator Tube Rupture (Pre-existing iodine spike)                  4.33.4 rem TEDE        3.12.8 rem TEDE (Accident-initiated iodine spike)            1.21.0 rem TEDE        1.70.8 rem TEDE Steam Line Break (Pre-existing iodine spike)                  3.91.1 rem TEDE        2.10.6 rem TEDE (Accident-initiated iodine spike)            4.01.3 rem TEDE        4.91.6 rem TEDE Rod Ejection Accident                              1.83.6 rem TEDE        2.22.2 rem TEDE Locked Rotor Accident (Accident without feedwater available)        0.70.4 rem TEDE        0.50.5 rem TEDE (Accident with feedwater available)          0.50.2 rem TEDE        1.50.6 rem TEDE Small Line Break Outside Containment              0.80.4 rem TEDE        0.30.2 rem TEDE  Commented [HZS12]: Ext-03 For all events the doses are within the dose acceptance limit of 5.0 rem TEDE. The details of analysis assumptions for modeling the doses to the main control room personnel are delineated in the LOCA dose analysis discussion in subsection 15.6.5.3 for VES operating cases. The analysis assumptions are provided in subsection 9.4.1.2.3.1 for the VBS operating case.
No radioactive materials are stored or transported near the main control room pressure boundary (this does not apply to installed equipment, such as radiation monitors described in Section 11.5, Tier 2 Material                                    6.4-11                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              169
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document nor to portable equipment that is in use, such as calibration equipment, survey instrumentation, tools, and other such transient items).                                                            Commented [HZS13]: Ext-03 As discussed and evaluated in subsection 9.5.1, the use of noncombustible construction and heat and flame resistant materials throughout the plant reduces the likelihood of fire and consequential impact on the main control room atmosphere. Operation of the nuclear island nonradioactive ventilation system in the event of a fire is discussed in subsection 9.4.1.
The exhaust stacks of the onsite standby power diesel generators are located in excess of 150 feet away from the fresh air intakes of the main control room. The onsite standby power system fuel oil storage tanks are located in excess of 300 feet from the main control room fresh air intakes.
These separation distances reduce the possibility that combustion fumes or smoke from an oil fire would be drawn into the main control room.
The protection of the operators in the main control room from offsite toxic gas releases is discussed in Section 2.2. The sources of onsite chemicals are described in Table 6.4-1, and their locations are shown on Figure 1.2-2. Analysis of these sources is in accordance with Regulatory Guide 1.78 (Reference 5) and the methodology in NUREG-0570, Toxic Vapor Concentrations in the Control Room Following a Postulated Accidental Release (Reference 6), and the analysis shows that these sources do not represent a toxic or flammability hazard to control room personnel.
A supply of protective clothing, respirators, and self-contained breathing apparatus adequate for 11 persons is stored within the main control room pressure boundary.
The main control room emergency habitability system components discussed in subsection 6.4.2.3 are arranged as shown in Figure 6.4-2. The location of components and piping within the main control room pressure boundary provides the required supply of compressed air to the main control room pressure boundary, as shown in Figure 6.4-1.
During emergency operation, the main control room emergency habitability system passive heat sinks are designed to limit the temperature inside the main control room to remain within limits for reliable human performance (References 2 and 3 14) over 72 hours. The passive heat sinks        Commented [HZS14]: Ext-02 limit the air temperature inside the instrumentation and control rooms to 120°F and dc equipment rooms to 120°F. The walls and ceilings that act as the passive heat sinks contain sufficient thermal mass to accommodate the heat sources from equipment, personnel, and lighting for 72 hours.
The main control room emergency habitability system nominally provides 65 scfm of ventilation air to the main control room from the compressed air storage tanks. Sixty scfm of supplied ventilation flow is sufficient to induce a filtration flow of at least 600 cfm into the passive air filtration line located inside the main control room envelope. This ventilation flow is also sufficient to pressurize the control room to at least positive 1/8-inch water gauge differential pressure with respect to the surrounding areas in addition to limiting the carbon dioxide concentration below one-half percent by volume for a maximum occupancy of 11 persons and maintaining air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1.
Tier 2 Material                                      6.4-12                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                170
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document Automatic transfer of habitability system functions from the main control room/control support area HVAC subsystem of the nuclear island nonradioactive ventilation system to the main control room emergency habitability system is initiated by either any the following conditions:        Commented [HZS15]: Ext-03 x    High-highHigh-2 particulate or iodine radioactivity in MCR air supply duct x    Loss of ac power for more than 10 minutes x    Low main control room differential pressure for more than 10 minutes                            Commented [HZS16]: Ext-03 The airborne fission product source term in the reactor containment following the postulated LOCA is assumed to leak from the containment and airborne fission products are assumed to result from spent fuel pool steaming. The concentration of radioactivity, which is assumed to surround the main control room, after the postulated accident, is evaluated as a function of the fission product decay constants, the containment leak rate, and the meteorological conditions assumed. The assessment of the amount of radioactivity within the main control room takes into consideration the radiological decay of fission products and the infiltration/exfiltration rates to and from the main control room pressure boundary.
A single active failure of a component of the main control room emergency habitability system or nuclear island nonradioactive ventilation system does not impair the capability of the systems to accomplish their intended functions. The Class 1E components of the main control room emergency habitability system are connected to independent Class 1E power supplies. Both the main control room emergency habitability system and the portions of the nuclear island nonradioactive ventilation system which isolates the main control room are designed to remain functional during an SSE or design-basis tornado.
In accordance with SECY-77-439 (Reference 13), a single passive failure of a component in the passive filtration line in the main control room emergency habitability system does not impair the capability of the system to accomplish its intended function. There is no source that could create line blockage in the VES line from the air bottles to the eductor. Thus potential blockage in the filtration line does not preclude breathable air from the emergency air storage tanks from being delivered to the main control room envelope for 72 hours during VES operation. Passive filtration using the main control room habitability system is not required to maintain operator dose rates below the acceptance limit of 5.0 rem TEDE 24 hours after the initiation of a design basis event. The dose rates for the following limiting cases were determined to demonstrate that passive filtration is not required 24 hours after the initiation of a design basis event. The following cases are evaluated since they involve releases that extend beyond 24 hours after the initiation of the event:
Large Break LOCA                                            4.44.5 rem TEDE Steam Line Break (Pre-existing iodine spike)                            1.24.0 rem TEDE (Accident-initiated iodine spike)                      2.04.5 rem TEDE                    Commented [HZS17]: Ext-03 For all events, the doses are within the dose acceptance limit of 5.0 rem TEDE. The details of analysis assumptions for modeling the doses to the main control room personnel are the same as those delineated in the LOCA dose analysis discussion in subsection 15.6.5.3 assuming a passive failure disables the passive filtration flow path after 24 hours. Potential blockage in the filtration line does not preclude breathable air from the emergency air storage tanks from being delivered Tier 2 Material                                      6.4-13                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    171
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document Table 6.4-2 MAIN CONTROL ROOM HABITABILITY INDICATIONS AND ALARMS VES emergency air storage tank pressure (indication and low and low-low alarms)
VES MCR pressure boundary differential pressure (indication and high and low alarms)
VES air delivery line flowrate (indication and high and low alarms)
VES passive filtration flow rate (indication and high and low alarms)
VBS main control room supply air radiation level (High-1 and High-2 high-high alarms)                    Commented [HZS23]: Ext-03 VBS outside air intake smoke level (high alarm)
VBS isolation valve position VBS MCR pressure boundary differential pressure Tier 2 Material                                        6.4-19                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            172
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR 2.390d Figure 6.4-1 Commented [HZS25]: Ext-03 Main Control Room Envelope Tier 2 Material                                6.4-21                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    173
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                              AP1000 Design Control Document Figure 6.4-2 (Sheet 2 of 2) Commented [HZS26]: Ext-03 Main Control Room Habitability System Piping and Instrumentation Diagram Tier 2 Material                                                    6.4-25                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        174
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                            AP1000 Design Control Document Figure 7.2-1 (Sheet 13 of 21) Commented [HZS2]: Ext-02, Ext-03 Functional Diagram Containment and Other Protection      Ext-02 in Blue Ext-03 in Green Tier 2 Material                                                      7.2-51                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                              175
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document temperature is above the P-8 setpoint. It is automatically reinstated when reactor power is decreased below the P-6 power level during shutdown or reactor coolant average temperature decreases below the P-8 setpoint. The source range flux doubling function can also be manually blocked during shutdown conditions when below the P-8 setpoint. Prior to manually blocking the source range flux doubling function, the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution.                                                                        Commented [HZS3]: Ext-05 The functional logic relating to chemical and volume control system isolation is illustrated in Figure 7.2-1, sheets 6 and 11.
7.3.1.2.16 Steam Dump Block Signals to block steam dump (turbine bypass) are generated from either of the following conditions:
: 1. Low-2 reactor coolant system average temperature
: 2. Manual initiation Condition 1 results from a coincidence of two of the four divisions of reactor loop average temperature (Tavg) below the Low-2 setpoint. This blocks the opening of the steam dump valves. This signal also becomes an input to the steam dump interlock selector switch for unblocking the steam dump valves used for plant cooldown.
Condition 2 consists of three sets of controls. The first set of two controls selects whether the steam dump system has its normal manual and automatic operating modes available or is turned off. The second set of two controls enables or disables the operations of the Stage 1 cooldown steam dump valves if the reactor coolant average temperature (Tavg) is below the Low-2 setpoint. The third set of two controls enables or disables the operation of the Stage 2 cooldown steam dump valves.
The functional logic relating to the steam dump block is illustrated in Figure 7.2-1, sheet 10.
7.3.1.2.17 Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization                                                                                        Commented [HZS4]: Ext-02 Signals to initiate isolation of the main control room, to initiate the air supply, and to open the main control room pressure relief isolation valves, and to de-energize nonessential main control room electrical loads are generated from either any of the following conditions:            Commented [HZS5]: Ext-02
: 1. High-2 main control room air supply radioactivity level                                        Commented [HZS6]: Ext-02
: 2. Loss of ac power sources (low Class 1E battery charger input voltage)
: 3. Low main control room differential pressure                                                  Commented [HZS7]: Ext-03 3.4. Manual initiation Condition 1 is the occurrence one of two main control room air supply radioactivity monitors        Commented [HZS8]: Ext-02 detecting a the iodine or particulate radioactivity level above the High-2 setpoint.                Commented [HZS9]: Ext-03 Tier 2 Material                                    7.3-17                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                176
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document Condition 2 results from the loss of normal control room ventilation due to a loss of all ac        Commented [HZS9]: Ext-03 power sources. A preset time delay is provided to permit the restoration of ventilation and ac      Commented [HZS10]: Ext-03 power from the offsite sources or from the onsite diesel generators before initiation. The loss of all ac power is detected by undervoltage sensors that are connected to the input of each of the four Class 1E battery chargers. Two sensors are connected to each of the four battery charger inputs. The loss of ac power signal is based on the detection of an undervoltage condition by each of the two sensors connected to two of the four battery chargers. The two-out-of-four logic is based on an undervoltage to the battery chargers for divisions A or C coincident with an undervoltage to the battery chargers for divisions B or D.
Condition 3 results from the loss of main control room differential pressure as detected by the pressure boundary differential sensors. One out of two logic is based on main control room differential pressure below the Low setpoint for greater than 10 minutes.                          Commented [HZS11]: Ext-03 In addition, the loss of all ac power sources coincident with main control room isolation will de-energize the main control room radiation monitors in order to conserve the battery capacity.
Condition 3 4 consists of two momentary controls. Manual actuation of either of the two              Commented [HZS12]: Ext-03 controls will result in main control room isolation, and air supply initiation, and electrical load de-energization.                                                                                Commented [HZS13]: Ext-02 The functional logic relating to main control room isolation, and air supply initiation, and electrical load de-energization is illustrated in Figure 7.2-1, sSheet 13.                          Commented [HZS14]: Ext-02 7.3.1.2.18 Auxiliary Spray and Letdown Purification Line Isolation A signal to isolate the auxiliary spray and letdown purification lines is generated upon the coincidence of pressurizer level below the Low-1 setpoint in any two of four divisions. This helps to maintain reactor coolant system inventory. This function can be manually blocked when the pressurizer water level is below the P-12 setpoint. This function is automatically unblocked when the pressurizer water level is above the P-12 setpoint. The automatic auxiliary spray isolation signal can be reset by the operator, after actuation of the auxiliary spray isolation valve, by using the reset control. This will allow the operators to use the auxiliary spray to rapidly depressurize the reactor coolant system. The operator can also manually initiate auxiliary spray isolation. The functional logic relating to this is illustrated in Figure 7.2-1, sheet 12.
The auxiliary spray and letdown purification line isolation signal is also generated upon manual actuation of chemical and volume control system isolation (subsection 7.3.1.2.15).
7.3.1.2.19 Containment Air Filtration System Isolation A signal to isolate the containment air filtration system is generated from any of the following conditions:
: 1. Automatic or manual safeguards actuation signal (subsection 7.3.1.1)
Tier 2 Material                                      7.3-18                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  177
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                    AP1000 Design Control Document 7.3.1.4    Bypasses of Engineered Safety Features Actuation The channels used in engineered safety features actuation that can be manually bypassed are indicated in Table 7.3-1. A description of this bypass capability is provided in subsection 7.1.2.9. The actuation logic is not bypassed for test. During tests, the actuation logic is fully tested by blocking the actuation logic output before it results in component actuation.
7.3.1.5    Design Basis for Engineered Safety Features Actuation The following subsections provide the design bases information for engineered safety features actuation, including the information required by Section 4 of IEEE 603-1991.
Engineered safety features are initiated by the protection and safety monitoring system. Those design bases relating to the equipment that initiates and accomplishes engineered safety features are given in WCAP-15776 (Reference 1). The design bases presented here concern the variables monitored for engineered safety features actuation and the minimum performance requirements in generating the actuation signals.
7.3.1.5.1  Design Basis: Generating Station Conditions Requiring Engineered Safety Features Actuation (Paragraph 4.1 of IEEE 603-1991)
The generating station conditions requiring protective action are identified in Table 15.0-6, which summarizes the engineered safety features as they relate to the Condition II, III, or IV events analyzed in Chapter 15.
7.3.1.5.2  Design Basis: Variables, Ranges, Accuracies, and Typical Response Times Used in Engineered Safety Features Actuation (Paragraphs 4.1, 4.2, and 4.4 of IEEE 603-1991)
The variables monitored for engineered safety features actuation are:
x    Pressurizer pressure x    Pressurizer water level x    Reactor coolant temperature (Thot and Tcold) in each loop x    Containment pressure x    Containment radioactivity level x    Steam line pressure in each steam line x    Water level in each steam generator (narrow and wide ranges) x    Source range neutron flux x    Core makeup tank level x    Reactor coolant level in each of the two hot legs x    Loss of ac power sources (low Class 1E battery charger input voltage) x    In-containment refueling water storage tank level x    Main control room supply air radioactivity level x    Main control room differential pressure                                                    Commented [HZS15]: Ext-03 x    Reactor coolant pump bearing water temperature x    Startup feedwater flow x    Spent fuel pool level Tier 2 Material                                    7.3-22                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            178
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document Table 7.3-1 (Sheet 7 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Divisions/        Actuation Actuation Signal          Controls            Logic              Permissives and Interlocks
: b. High-2 steam generator      4/steam          2/4-BYP1 in                      None narrow range level          generator        either steam generator
: c. Automatic or manual                                (See items 1a through 1e) safeguards actuation signal coincident with High-1 pressurizer water        4            2/4-BYP1                        None level
: d. High-2 containment              4            2/4-BYP1                        None radioactivity
: e. Manual initiation          2 controls        1/2 controls                      None
: f. Flux doubling calculation        4            2/4-BYP1          Manual block permitted above P- 8 when critical or intentionally approaching criticality Automatically unblocked below P-6 or below P-8 Manual block permitted below P-8; demineralized water system isolation valves signaled closed when blocked below P-8                Commented [HZS18]: Ext-05
: g. High steam generator        4/steam          2/4-BYP1 in                      None narrow range level          generator        either steam coincident with                                generator Reactor trip (P-4)          1/division            2/4                          None (8)
: 15. Steam Dump Block (Figure 7.2-1, Sheet 10)
: a. Low reactor coolant          2/loop          2/4-BYP1                        None temperature (Low-2 Tavg)
: b. Mode control                2 controls        1/division                      None
: c. Manual stage 1 cooldown    2 controls        1/division                      None control
: d. Manual stage 2 cooldown    2 controls        1/division                      None control
: 16. Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization (Figure 7.2-1, Sheet 13)                                                                                                Commented [HZS19]: Ext-02 Tier 2 Material                                    7.3-33                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  179
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Table 7.3-1 (Sheet 8 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Divisions/          Actuation Actuation Signal              Controls            Logic              Permissives and Interlocks
: a. High-2 main control room          2                1/2                            None                  Commented [HZS19]: Ext-02 supply air iodine or particulate radiation                                                                                    Commented [HZS20]: Ext-03
: b. Extended                      2/charger      2/2 per charger                      None undervoltageUndervoltage                          and 2/4                                                Commented [HZS21]: Ext-03 to Class 1E battery                              chargers5 chargers(8)
: c. Extended Low main control          2                1/2                            None                  Commented [HZS22]: Ext-03 room differential pressure cd. Manual initiation(8)          2 controls        1/2 controls                      None                  Commented [HZS23]: Ext-03
: 17.      Auxiliary Spray and Purification Line Isolation (Figure 7.2-1, Sheet 12)
: a. Low-1 pressurizer level            4              2/4-BYP1          Manual block permitted below P-12 Automatically unblocked above P-12
: b. Manual initiation of                                        (See item 14e) chemical and volume control system isolation
: c. Manual initiation of              1                1/1                            None auxiliary spray isolation
: 18. Containment Air Filtration System Isolation (Figure 7.2-1, Sheets 11 and 13)
: a. Containment isolation                                (See items 2a through 2c)
: b. High-1 containment                4              2/4-BYP1                          None radioactivity
: c. N/A                                2                N/A          For containment vacuum relief valves only - close on inside containment purge isolation valve not closed
: 19. Normal Residual Heat Removal System Isolation (Figure 7.2-1, Sheets 13 and 18)
: a. Automatic or manual                                  (See items 1a through 1e) safeguards actuation signal
: b. High-2 containment                4              2/4-BYP1          Manual block permitted below P-11 radioactivity                                                      Automatically unblocked above P-11
: c. Manual initiation              4 controls      2/4 controls3                      None
: 20. Refueling Cavity Isolation (Figure 7.2-1, Sheet 13)
: a. Low spent fuel pool level          3                2/3                            None Tier 2 Material                                      7.3-34                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    180
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Table 7.3-4 (Sheet 2 of 2)                                                Commented [HZS26]: Ext-03 ENGINEERED SAFETY FEATURES ACTUATION, VARIABLES, LIMITS, RANGES, AND ACCURACIES (NOMINAL)
Typical Response Variables                Range of Variables          Typical Accuracy(1)            Time (Sec)(2)
Pressurizer water level                0 to 100% of                +/-10% of span                      1.0 cylindrical portion of pressurizer Startup feedwater flow                  0 to 600 gpm                +/-7% of span                      1.0 6
Neutron flux (flux doubling            1 to 10 c/sec              +/-30% of span                    1.0(3) calculation)
Control room supply air              10-12 to 10-2  Ci/cc        +/-50% of setpoint                    20 radiation level Control room differential          +1.00 to -1.00 in. w.g.          +3% of span                      1.0 pressure Containment radioactivity              100 to 107 R/hr            +/-50% of setpoint                    20 Notes:
: 1. Measurement uncertainty typical of actual applications. Harsh environments allowance has been included where applicable.
: 2. Delay from the time that the process variable exceeds the setpoint until the time that an output is provided to the actuated device.
: 3. Response time depends on flux doubling calculation.
Tier 2 Material                                        7.3-45                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        181
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document 9.2.5.4    Safety Evaluation The potable water system has no safety-related functions other than to prevent in-leakage into the main control room envelope during VES operation. A loop seal in the safety-related PWS piping that penetrates the main control room envelope boundary prevents in-leakage into the main control room envelope.
9.2.5.5    Tests and Inspections The potable water system is hydrostatically tested for leak-tightness in accordance with the Uniform Plumbing Code. Inspection of the system is in compliance with the Uniform Plumbing Code or governing codes having jurisdiction. The system is then disinfected, flushed with potable water, and placed in service. The presence of residual chlorine can be confirmed through laboratory tests of samples at sampling points as required. Tests for microbiological and bacteria presence in potable water are conducted periodically.
9.2.5.6    Instrumentation Applications Thermostats, high-temperature limit controls, and temperature indication are installed on the potable water system hot water tank. Thermostats and high-temperature limit controls are installed on the inline water heaters. Pressure regulators are employed in those parts of the distribution system where pressure restrictions are imposed.
9.2.6      Sanitary Drainage System The sanitary drainage system (SDS) is designed to collect the site sanitary waste for treatment, dilution and discharge.
9.2.6.1    Design Basis 9.2.6.1.1  Safety Design Basis                                                                                Commented [HZS1]: Ext-03 The sanitary drainage system isolates the SDS vent penetration in the main control room boundary on high-high High-2 particulate or iodine concentrations in the main control room air supply, extended loss of main control room differential pressure, or on extended loss of ac power to support operation of the main control room emergency habitability system as described in Section 6.4. The SDS vent line that penetrates the main control room envelope is safety related and designed as seismic Category I to provide isolation of the main control room envelope from the surrounding areas and outside environment in the event of a design basis accident. An additional penetration from the SDS into the main control room envelope is maintained leak tight using a loop seal in the safety-related seismic Category I piping.
9.2.6.1.2  Power Generation Design Basis The sanitary drainage system within the scope of the plant covered by Design Certification is designed to accommodate 25 gallons/person/day for up to 500 persons during a 24-hour period.
Tier 2 Material                                    9.2-28                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              182
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                              AP1000 Design Control Document 9.4        Air-Conditioning, Heating, Cooling, and Ventilation System The air-conditioning, heating, cooling, and ventilation system is comprised of the following systems that serve the various buildings and structures of the plant:
x    Nuclear island nonradioactive ventilation system (subsection 9.4.1) x    Annex/auxiliary buildings nonradioactive HVAC system (subsection 9.4.2) x    Radiologically controlled area ventilation system (subsection 9.4.3) x    Containment recirculation cooling system (subsection 9.4.6) x    Containment air filtration system (subsection 9.4.7) x    Radwaste building HVAC system (subsection 9.4.8) x    Turbine building ventilation system (subsection 9.4.9) x    Diesel generator building heating and ventilation system (subsection 9.4.10) x    Health physics and hot machine shop HVAC system (subsection 9.4.11) 9.4.1      Nuclear Island Nonradioactive Ventilation System The nuclear island nonradioactive ventilation system (VBS) serves the main control room (MCR), control support area (CSA), Class 1E dc equipment rooms, Class 1E instrumentation and control (I&C) rooms, Class 1E electrical penetration rooms, Class 1E battery rooms, remote shutdown room, reactor coolant pump trip switchgear rooms, adjacent corridors, and the passive containment cooling system (PCS) valve room during normal plant operation.
The main control room emergency habitability system provides main control room habitability in the event of a design basis accident (DBA) and is described in Section 6.4.
9.4.1.1    Design Basis 9.4.1.1.1  Safety Design Basis The nuclear island nonradioactive ventilation system provides the following nuclear safety-related design basis functions:
x    Monitors the main control room supply air for radioactive particulate and iodine concentrations x    Isolates the HVAC penetrations in the main control room boundary on high-high High-2 particulate or iodine concentrations in the main control room supply air, extended loss of main control room differential pressure, or on extended loss of ac power to support operation of the main control room emergency habitability system as described in Section 6.4                                                                                        Commented [HZS1]: Ext-03 Those portions of the nuclear island nonradioactive ventilation system which penetrate the main control room envelope are safety-related and designed as seismic Category I to provide isolation of the main control room envelope from the surrounding areas and outside environment in the event of a design basis accident. Other functions of the system are nonsafety-related. HVAC equipment and ductwork whose failure could affect the operability of safety-related systems or components are designed to seismic Category II requirements. The remaining portion of the Tier 2 Material                                    9.4-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            183
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document system is nonsafety-related and nonseismic. The equipment is procured to meet the environmental qualifications used in standard building practice.
The nuclear island nonradioactive ventilation system is designed to control the radiological habitability in the main control room within the guidelines presented in Standard Review Plan (SRP) 6.4 and NUREG 0696 (Reference 1), if the system is operable and ac power is available.
Portions of the system that provide the defense-in-depth function of filtration of main control room/control support area air during conditions of abnormal airborne radioactivity are designed, constructed, and tested to conform with Generic Issue B-36, as described in Section 1.9 and Regulatory Guide 1.140 (Reference 30), as described in Appendix 1A, and the applicable portions of ASME AG-1 (Reference 36), ASME N509 (Reference 2), and ASME N510 (Reference 3).
Power to the ancillary fans to provide post-72-hour ventilation of the control room and I&C rooms is supplied from divisions B and C regulating transformers through two series fuses for isolation. The fuses protect the regulating transformers from failures of the non-1E fan circuits.
When normal ventilation is available the ancillary fan circuits are disconnected from the supply with manual normally-open switches.
The nuclear island nonradioactive ventilation system is designed to provide a reliable source of heating, ventilation, and cooling to the areas served when ac power is available. The system equipment and component functional capabilities are to minimize the potential for actuation of the main control room emergency habitability system or the potential reliance on passive equipment cooling. This is achieved through the use of redundant equipment and components that are connected to standby onsite ac power sources.
9.4.1.1.2  Power Generation Design Basis Main Control Room/Control Support Area (CSA) Areas The nuclear island nonradioactive ventilation system provides the following specific functions:
x    Controls the main control room and control support area relative humidity between 25 to 60 percent x    Maintains the main control room and CSA areas at a slightly positive pressure with respect to the adjacent rooms and outside environment during normal operations to prevent infiltration of unmonitored air into the main control room and CSA areas x    Isolates the main control room and/or CSA area from the normal outdoor air intake and provides filtered outdoor air to pressurize the main control room and CSA areas to a positive pressure of at least 1/8 inch wg when a high gaseous High-1 radioactivity concentration (gaseous, particulate, or iodine) is detected in the main control room supply air duct        Commented [HZS2]: Ext-03 x    Isolates the main control room and/or CSA area from the normal outdoor air intake and provides 100 percent recirculation air to the main control room and CSA areas when a high concentration of smoke is detected in the outside air intake Tier 2 Material                                      9.4-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              184
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document 9.4.1.2.1  General Description 9.4.1.2.1.1 Main Control Room/Control Support Area HVAC Subsystem The main control room/control support area HVAC subsystem serves the main control room and control support area with two 100 percent capacity supply air handling units, return/exhaust air fans, supplemental air filtration units, associated dampers, instrumentation and controls, and common ductwork. The supply air handling units and return/exhaust air fans are connected to common ductwork which distributes air to the main control room and CSA areas. The main control room envelope consists of the main control room, shift managers office, operation work area, toilet, and operations break room area. The CSA area consists of the main control support area operations area, conference rooms, NRC room, computer rooms, shift turnover room, kitchen/rest area, and restrooms. The main control room and control support area toilets have separate exhaust fans.
Outside supply air is provided to the plant areas served by the main control room/control support area HVAC subsystem through an outside air intake duct that is protected by an intake enclosure located on the roof of the auxiliary building at elevation 153-0. The outside air intake duct is located more than 50 feet below and more than 100 feet laterally away from the plant vent discharge. The supply, return, and toilet exhaust are the only HVAC penetrations in the main control room envelope and include redundant safety-related seismic Category I isolation valves that are physically located within the main control room envelope. Redundant safety-related radiation monitor sample line connections are located upstream of the VBS supply air isolation valves. These monitors initiate operation of the nonsafety-related supplemental air filtration units on high gaseous High-1 radioactivity concentrations (gaseous, particulate, or iodine) and isolate the main control room from the nuclear island nonradioactive ventilation system on high-high High-2 particulate or iodine radioactivity concentrations. See Section 11.5 for a description of the Commented [HZS4]: Ext-03 main control room supply air radiation monitors.
Both redundant trains of supplemental air filtration units and one train of the supply air handling unit are located in the main control room mechanical equipment room at elevation 135-3 in the auxiliary building. The other supply air handling unit subsystem is located in the main control room mechanical equipment room at elevation 135-3 in the annex building. The main control room toilet exhaust fan is located at elevation 135-3 in the auxiliary building. A humidifier is provided for each supply air handling unit. The supply air handling unit cooling coils are provided with chilled water from air-cooled chillers in the central chilled water system. See subsection 9.2.7 for the chilled water system description.
The main control room/control support area HVAC subsystem is designed so that smoke, hot gases, and fire suppressant will not migrate from one fire area to another to the extent that they could adversely affect safe shutdown capabilities, including operator actions. Fire or combination fire and smoke dampers are provided to isolate each fire area from adjacent fire areas during and following a fire in accordance with NFPA 90A (Reference 27) requirements. These combination smoke/fire dampers close in response to smoke detector signals or in response to the heat from a fire. See Appendix 9A for identification of fire areas.
Tier 2 Material                                      9.4-5                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                185
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document supplemental air filtration subsystem dampers are constructed, qualified, and tested in accordance with ANSI/AMCA 500 or ASME AG-1 (Reference 36), Section DA.
Combination Fire/Smoke Dampers Combination fire/smoke dampers are provided at duct penetrations through fire barriers to maintain the fire resistance ratings of the barriers. The combination fire/smoke dampers meet the design, leakage testing, and installation requirements of UL-555S (Reference 25).
Ductwork and Accessories Ductwork, duct supports, and accessories are constructed of galvanized steel. Ductwork subject to fan shutoff pressures is structurally designed to accommodate fan shutoff pressures. Ductwork, supports, and accessories meet the design and construction requirements of SMACNA Industrial Rectangular and Round Duct Construction Standards (References 16 and 34) and SMACNA HVAC Duct Construction Standards - Metal and Flexible (Reference 17). The supplemental air filtration and main control room/control support area HVAC subsystem's ductwork, including the air filtration units and the portion of the ductwork located outside of the main control room envelope, that maintains integrity of the main control room/control support area pressure boundary during conditions of abnormal airborne radioactivity are designed in accordance with ASME AG-1 (Reference 36), Article SA-4500, to provide low leakage components necessary to maintain main control room/control support area habitability.
9.4.1.2.3  System Operation 9.4.1.2.3.1 Main Control Room/Control Support Area HVAC Subsystem Normal Plant Operation During normal plant operation, one of the two 100 percent capacity supply air handling units and return/exhaust air fans operates continuously. Outside makeup air supply to the supply air handling units is provided through an outside air intake duct. The outside airflow rate is automatically controlled to maintain the main control room and CSA areas at a slightly positive pressure with respect to the surrounding areas and the outside environment.
The main control room/control support area supply air handling units are sized to provide cooling air for personnel comfort, equipment cooling, and to maintain the main control room emergency habitability passive heat sink below its initial ambient air design temperature. The temperature of the air supplied by each air handling unit is controlled by temperature sensors located in the main control room return air duct and in the computer room B return air duct to maintain the ambient air design temperature within its normal design temperature range by modulating the electric heat or chilled water cooling. Some spaces have convection heaters for temperature control.
The outside air is continuously monitored by smoke monitors located at the outside air intake plenum and the return air is monitored for smoke upstream of the supply air handling units. The supply air to the main control room is continuously monitored for airborne radioactivity while the supplemental air filtration units remain in a standby operating mode.
Tier 2 Material                                      9.4-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      186
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document The standby supply air handling unit and corresponding return/exhaust fans are started automatically if one of the following conditions shuts down the operating unit:
x    Airflow rate of the operating fan is above or below predetermined setpoints.
x    Return air temperature is above or below predetermined setpoints.
x    Differential pressure between the main control room and the surrounding areas and outside environment is above or below predetermined setpoints.
x    Loss of electrical and/or control power to the operating unit.
Abnormal Plant Operation Control actions are taken at two levels of radioactivity as detected in the main control room supply air duct. The first is "high" High-1 radioactivity based upon gaseous radioactivity instrumentation (gaseous, particulate, or iodine). The second is "high-high" High-2 radioactivity based upon either particulate or iodine radioactivity instruments.                    Commented [HZS5]: Ext-03 If "high" gaseous High-1 radioactivity is detected in the main control room supply air duct and the main control room/control support area HVAC subsystem is operable, both supplemental air filtration units automatically start to pressurize the main control room and CSA areas to at least 1/8 inch wg with respect to the surrounding areas and the outside environment using filtered makeup air. The normal outside air makeup duct and the main control room and control support        Commented [HZS6]: Ext-03 area toilet exhaust duct isolation dampers close. The smoke/purge exhaust isolation dampers close, if open. The main control room/control support area supply air handling unit continues to provide cooling with recirculation air to maintain the main control room passive heat sink below its initial ambient air design temperature and maintains the main control room and CSA areas within their design temperatures. The supplemental air filtration subsystem pressurizes the combined volume of the main control room and control support area concurrently with filtered outside air. A portion of the recirculation air from the main control room and control support area is also filtered for cleanup of airborne radioactivity. The main control room/control support area HVAC equipment and ductwork that form an extension of the main control room/control support area pressure boundary limit the overall infiltration (negative operating pressure) and exfiltration (positive operating pressure). rates to those values shown in Table 9.4.1-1. Based on these values, the The system is designed to maintain personnel doses within allowable General Design Criteria (GDC) 19 limits during design basis accidents in both the main control room and the control support area.                                                                                        Commented [HZS7]: Ext-03 If ac power is unavailable for more than 10 minutes, or if main control room differential pressure is below the Low setpoint for more than 10 minutes, or if "high-high" High-2 particulate or iodine radioactivity is detected in the main control room supply air duct, which would lead to exceeding GDC 19 operator dose limits, the protection and safety monitoring system automatically isolates the main control room from the normal main control room/control support area HVAC subsystem by closing the supply, return, and toilet exhaust isolation valves. Main        Commented [HZS8]: Ext-03 control room habitability is maintained by the main control room emergency habitability system, which is discussed in Section 6.4.
Tier 2 Material                                      9.4-11                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                187
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document Power supply to the ancillary fans is from the respective division B or C regulating transformers which receive power from the ancillary diesel generators. For post-72-hour power supply discussion see subsection 8.3.1.1.1.
9.4.1.2.3.2 Class 1E Electrical Room HVAC Subsystem The Class 1E electrical room HVAC equipment that serves electrical division A and C equipment is described in this section. The operation of the Class 1E electrical room HVAC equipment that serves electrical division B and D is similar.
Normal Plant Operation During normal plant operation, one of the redundant supply air handling units, return fans, and battery room exhaust fans operate continuously to provide room temperature control, to maintain the Class 1E electrical room emergency passive heat sink below its initial ambient air temperature, and to purge and prevent build-up of hydrogen gas concentration in the Class 1E Battery Rooms. The temperature of the air supplied by each air handling unit is controlled by temperature sensors located in the return air duct to maintain the room air temperature within the normal design range by modulating electric heating or chilled water cooling. Duct heaters are controlled by temperature sensors located in the space served by the heater.
During normal plant operation, the exhaust airflow from the Class 1E battery rooms is vented directly to the turbine building vent to limit the concentration of hydrogen gas in the rooms to less than 2 percent by volume in accordance with the guidelines of Regulatory Guide 1.128.
The outside makeup air to the supply air handling units is provided through an outside air intake duct. The outside airflow rate is manually balanced during system startup to provide adequate makeup air for the battery room exhaust fans.
The standby supply air handling unit and the corresponding return/exhaust fans are started automatically if one of the following conditions occurs:
x    Airflow rate of the operating fan is above or below predetermined set points x    Return air temperature is above or below predetermined setpoints.
x    Loss of electrical and/or control power to the operating unit.
Abnormal Plant Operation The Class 1E electrical room HVAC divisions A/C subsystem outside air intake/exhaust dampers close on the start of one or both supplemental filtration unit fans. The Class 1E electrical room HVAC divisions B/D subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS). The operation of the Class 1E electrical room HVAC subsystem is not affected by the detection of airborne radioactivity in the main control room supply air duct of the main control room/control support area HVAC subsystem. During a design basis accident (DBA), if the plant      Commented [HZS10]: Ext-03 ac electrical system is unavailable, the Class 1E electrical room passive heat sink provides area temperature control. Refer to Section 6.4 for further details.
Tier 2 Material                                      9.4-13                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                188
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document Ductwork and Accessories Ductwork, duct supports and accessories are constructed of galvanized steel. Ductwork subject to fan shutoff pressure is structurally designed for fan shutoff pressures. Ductwork, supports and accessories meet the design and construction requirements of SMACNA Rectangular and Round Industrial Duct Construction Standards (References 16 and 34) and SMACNA HVAC Duct Construction Standards - Metal and Flexible (Reference 17).
9.4.2.2.3  System Operation 9.4.2.2.3.1 General Area HVAC Subsystem Normal Plant Operation During normal plant operation, all four supply air handling units and the toilet/shower and rest room exhaust fans operate continuously to maintain suitable temperatures in the areas served.
The temperature of the air supplied by each handling units is controlled by individual temperature controls with their sensors located in the annex building main entrance and in selected spaces. Each temperature sensor sends a signal to a temperature controller which modulates the chilled water control valve and the face and bypass dampers across the supply air heating coil to maintain the area within the design range. The switchover between cooling and heating modes is automatically controlled by the temperature controllers.
Supplemental heating is provided for the men's/women's change room areas by an electric reheat coil located in the supply air duct to the areas served. The reheat coil operates intermittently under the control of its temperature controller with sensor located in the women's change room, which modulates the electric heating elements to maintain the space temperature in the change room areas within the design range.
The supply air is humidified by a common humidifier located in the ductwork downstream of the supply air handling units. Humidistats located in the annex building operate the humidifiers to maintain a minimum space relative humidity of 35 percent in the areas served.
The differential pressure drop across each supply unit filter bank is monitored, and individual alarms are actuated when any pressure drop rises to a predetermined level indicative of the need for filter replacement. To replace the filters on a supply unit, the affected supply fan is stopped and isolated from the duct system by means of isolation dampers. The exhaust fan for the area is also stopped. During filter replacement, the system operates at approximately 50 percent capacity. This mode of operation will maintain a slight positive pressure in the building.
Abnormal Plant Operation The general area HVAC subsystem is not required to operate during any abnormal plant condition. The general area HVAC subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS).                                                                        Commented [HZS11]: Ext-03 Tier 2 Material                                    9.4-24                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                189
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document 9.4.2.2.3.2 Switchgear Room HVAC Subsystem Normal Plant Operation During normal plant operation, one air handling unit operates continuously to maintain the indoor temperatures in the two switchgear rooms. The temperature of the air supplied by the air handling unit is maintained at 62qF by a temperature controller based on outside ambient temperature conditions. When the outdoor air temperature is below 62qF, the temperature controller modulates the outside air, return air and exhaust air dampers of the air handling unit to mix return air and outside air in the proper proportion, and modulates the face and bypass dampers of the hot water heating coils to maintain a mixed air temperature of 62qF. A minimum amount of outside air is always provided for ventilation requirements. When the outdoor temperature is above 62qF, the outside air, return air and exhaust air dampers automatically reposition for minimum outside air and the temperature controller modulates the chilled water control valves to maintain the supply air at 62qF. The switchover between cooling and heating modes is automatically controlled by the supply air temperature controllers.
The differential pressure drop across each air handling unit filter bank is monitored and individual alarms are actuated when the pressure drop rises to a predetermined level indicative of the need for filter replacement. To replace the filters on an air handling unit, the unit is stopped and isolated from the duct system by means of isolation dampers. During filter replacement, the second air handling unit operates at full system capacity.
Abnormal Plant Operation The switchgear room HVAC subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS). In the event of a loss of the plant ac electrical system, the air handling unit Commented [HZS12]: Ext-03 supply and return/exhaust fans are connected to the standby power system to provide ventilation cooling to the diesel bus switchgear. This cooling permits the switchgear to perform its defense in depth functions in support of standby power system operation. In this mode of operation, the switchgear rooms are cooled utilizing once-through ventilation using outdoor air. When in the once-through ventilation mode, the switchgear rooms will be maintained at or below 122qF.
Equipment in these rooms that operate following a loss of the plant ac electrical system are designed for continuous operation at this temperature. To maintain the areas above freezing, the mixing dampers will modulate to maintain a supply air temperature of 62qF for outdoor temperatures below 62qF. For outdoor temperature above 62qF, the outside air, return air, and exhaust air dampers are positioned for a once-through flow.
In the event of a fire in a non-1E electrical switchgear room, the combination fire/smoke dampers close automatically to isolate the affected fire area in response to heat from the fire or upon receipt of a smoke signal from an area smoke detector. The VXS subsystem continues to provide ventilation/cooling to the remaining switchgear room and maintains the remaining areas at a slightly positive pressure.
Tier 2 Material                                      9.4-25                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  190
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document 9.4.2.2.3.3 Equipment Room HVAC Subsystem Normal Plant Operation During normal plant operation, one air handling unit and both battery room exhaust fans operate continuously to maintain the indoor temperatures in the equipment and security access areas served by the system.
The temperature of the air supplied by the air handling unit is maintained at 62qF by a temperature controller based on outside ambient temperature conditions. When the outdoor air temperature is below 62qF, the temperature controller modulates the outside air, return air and exhaust air dampers of the air handling unit to mix return air and outside air in the proper proportion, and modulates the face and bypass dampers of the hot water heating coils to maintain a mixed air temperature of 62qF. A minimum amount of outside air is always provided for ventilation requirements. When the outdoor air temperature is above 62qF, the outside air, return air and exhaust air dampers automatically reposition for minimum outside air and the temperature controller modulates the chilled water control valves to maintain the supply air at 62qF. The switchover between cooling and heating modes is automatically controlled by the supply air temperature controllers.
Electric reheat coils serving security (rooms 40305 and 40306) are controlled by temperature controllers with sensors located in the areas served. The temperature sensor sends a signal to a temperature controller which modulates the electric heating elements to maintain the security access areas at their design temperatures. Hot water unit heaters operate intermittently to provide supplemental heating for the north air handling equipment room to maintain the area temperature above 50qF.
A humidistat located in the security access area intermittently operates the humidifier to maintain the security office area at a minimum space relative humidity of 35 percent.
The differential pressure drop across each air handling unit filter bank is monitored, and individual alarms are actuated when the pressure drop rises to a predetermined level indicative of the need for filter replacement. To replace the filters of an air handling unit, the unit is stopped and isolated from the duct system by means of isolation dampers. During filter replacement, the second air handling unit operates at full system capacity.
A temperature controller opens the outside air intake and starts and stops the elevator machine room exhaust fan as required to maintain room design temperature conditions. A local thermostat controls the electric unit heater.
Abnormal Plant Operation The equipment room HVAC subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS). In the event of a loss of the plant ac electrical system, the air handling unit Commented [HZS13]: Ext-03 supply and return/exhaust fans are connected to the standby power system to provide ventilation cooling to the dc switchgear and inverters. This cooling permits that equipment to perform its defense in depth functions. In this mode of operation, the rooms are cooled utilizing once-Tier 2 Material                                    9.4-26                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  191
 
DCP_NRC_003343                                                                Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                                                              AP1000 Design Control Document Table 9.4-1 DESIGN FILTRATION EFFICIENCIES AND NOMINAL AIRFLOW RATES FOR HVAC SYSTEMS (1)
Maximum Design/Test      Ventilation      Recirculation      Humidity          HEPA          Charcoal    Inleakage Areas Served(1)          Standard        Airflow (cfm)      Flow (cfm)          Control          Efficiency    Efficiency(3)    (cfm)
MCR/CSA                        RG 1.140          860800          3,1403,200            Yes              99%            90%        2560(4)      Commented [HZS14]: Ext-03 (Supplemental Air)
Containment                    RG 1.140          4,000(2)            N/A                Yes              99%            90%          N/A Notes:
: 1. Ventilation cfm is shown for each train unless otherwise noted.
: 2. Both trains of the containment purge may be operated at the same time prior to and during cold shutdown.
: 3. Charcoal filters are 4-inch deep Type III adsorber cell.
: 4. This VBS inleakage represents the total inleakage into the combined MCR/CSA HVAC volume, which includes ingress/egress.
Tier 2 Material                                                                9.4-76                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                      192
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document Table 9.4.1-1 (Sheet 2 of 2)                                          Commented [HZS15]: Ext-03 COMPONENT DATA - NUCLEAR ISLAND NONRADIOACTIVE VENTILATION SYSTEM MCR/CSA HVAC Subsystem (Nominal Values)
Supplemental Air Filtration Subsystem Quantity                                                            2 System capacity per unit (%)                                        100 Fan Requirements Type                                                                Centrifugal Design airflow (scfm)                                              4,000 Fan static pressure (in. wg)                                        14 Heating Coil Requirements Type                                                                Electric Capacity (kw)                                                      20 Filter Requirements High efficiency filter, minimum ASHRAE efficiency (%)              80 HEPA filter, DOP efficiency (%)                                    99.97 Post filter, DOP efficiency (%)                                    95 Charcoal Adsorber Requirements Bed depth (in.)                                                    4.0 Decontamination efficiency (%)                                      90 Air residence time (sec.)                                          0.5 MCR Envelope and CSA Leakage Rates Inleakage Rate          Outleakage Rate at 1/8 in. wg            at 1/8 in. wg Leakage                                (scfm)              (scfm) (Note 3)
MCR access doors                                                    --                    Note 1 CSA access doors                                                    --                  10Note 2 MCR structure                                                      --                    Note 1 CSA structure                                                      --                  500Note 2 MCR/CSA HVAC equipment & ductwork (operating)                    2550                    485200 Tier 2 Material                                  9.4-78                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                193
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                      AP1000 Design Control Document Note:
: 1. The total outleakage rate from the MCR access doors and the MCR structure is 535 scfm.
: 2. The total outleakage rate from the CSA doors and CSA structure is 120 scfm.
: 3. In cases where the outside air flow rate is greater than the outside air required to pressurize the MCR envelope and CSA, excess air is exhausted to the outside atmosphere.                                                    Commented [HZS16]: Ext-03 Tier 2 Material                                        9.4-79                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      194
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                                                                                          AP1000 Design Control Document Inside Auxiliary Building Figure 9.4.1-1 (Sheet 5 of 7) Commented [HZS17]: Ext-03 Nuclear Island Non-Radioactive Ventilation System Figure represents system functional arrangement. Details internal to the system may                                                            Piping and Instrumentation Diagram differ as a result of implementation factors such as vendor-specific component requirements.                                                                          (REF) VBS 007 Tier 2 Material                                                                                                                                  9.4-105                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                                                            195
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                  AP1000 Design Control Document Table 11.1-4                                            Commented [HZS1]: Ext-03 PARAMETERS USED TO CALCULATE SECONDARY COOLANT ACTIVITY Total secondary side water mass (lb/steam generator)                          1.76 x 1051.68 x 105 Steam generator steam fraction                                                    0.0550.058 Total steam flow rate (lb/hr)                                                      1.5 x 107 Moisture carryover (percent)                                                          0.1 Total makeup water feed rate (lb/hr)                                                732700 Total blowdown rate (gpm)                                                              186 Total primary-to-secondary leak rate (gpd)                                          500300 Iodine partition factor (mass basis)                                                  100 Tier 2 Material                                      11.1-9                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          196
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                              AP1000 Design Control Document Table 11.1-5                                            Commented [HZS2]: Ext-03 DESIGN BASIS STEAM GENERATOR SECONDARY SIDE LIQUID ACTIVITY Activity                                        Activity Nuclide              (Ci/g)                  Nuclide                (Ci/g)
Br-83          2.3 x 10-51.4E-05                Y-92            2.8E-074.9 x 10-7
                                    -6 Br-84          4.0 x 10 2.4E-06                Y-93            8.2E-081.5 x 10-7
                                    -8 Br-85          4.9 x 10 3.1E-08                Zr-95            1.5E-072.7 x 10-7
                                  -11 I-129          2.4 x 10 1.3E-11                Nb-95            1.5E-072.7 x 10-7
                                    -5 I-130          1.4 x 10 7.9E-06                Mo-99            1.9E-043.4 x 10-4
                                    -3 I-131          1.1 x 10 6.3E-04              Tc-99m            1.7E-043.2 x 10-4
                                    -4 I-132          7.3 x 10 4.2E-04                Ru-103            1.2E-072.3 x 10-7
                                    -3 I-133          1.8 x 10 1.0E-03                Ru-106                4.1E-08 I-134          8.1 x 10-54.9E-05            Rh-103m            1.2E-072.3 x 10-7 I-135          8.7 x 10-45.0E-04              Rh-106          4.1E-082.0 x 10-10 Rb-86                1.4E-05                Ag-110m            4.0E-076.7 x 10-7
                                    -4 Rb-88          2.3 x 10 1.4E-04              Te-125m                1.5E-07 Rb-89          8.9 x 10-65.6E-06              Te-127m            7.0E-071.3 x 10-6 Cs-134          2.1 x 10-31.1E-03              Te-127            2.2E-063.2 x 10-7
                                    -3 Cs-136          3.0 x 10 1.7E-03              Te-129m            2.4E-064.4 x 10-6
                                    -3 Cs-137          1.5 x 10 8.2E-04                Te-129            2.1E-063.8 x 10-6
                                    -5 Cs-138          9.5 x 10 5.9E-05              Te-131m            5.6E-061.0 x 10-5 H-3              1.03.8E-01                  Te-131            1.6E-062.8 x 10-6
                                    -6 Cr-51          2.2 x 10 1.3E-06                Te-132            7.0E-051.3 x 10-4
                                    -6 Mn-54          1.1 x 10 6.6E-07                Te-134            2.0E-063.2 x 10-6
                                    -4 Mn-56          1.3 x 10 7.8E-05              Ba-137m            7.7E-041.4 x 10-3
                                    -7 Fe-55          8.4 x 10 5.0E-07                Ba-140            9.4E-071.7 x 10-6
                                    -7 Fe-59          2.2 x 10 1.3E-07                La-140            3.3E-076.0 x 10-7
                                    -6 Co-58          3.2 x 10 1.9E-06                Ce-141            1.4E-072.6 x 10-7 Co-60          3.7 x 10-72.2E-07              Ce-143            1.2E-072.2 x 10-7 Sr-89          3.3 x 10-61.8E-06              Ce-144            1.1E-071.9 x 10-7 Sr-90          1.5 x 10-78.0E-08              Pr-143            1.4E-072.5 x 10-7 Sr-91          3.3 x 10-61.9E-06              Pr-144            1.1E-071.9 x 10-7 Sr-92          4.0 x 10-72.4E-07 Y-90          2.7 x 10-81.4E-08 Y-91m          1.8 x 10-61.0E-06 Y-91          2.3 x 10-71.3E-07 Tier 2 Material                              11.1-10                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  197
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                  AP1000 Design Control Document Table 11.1-6                                          Commented [HZS3]: Ext-03 DESIGN BASIS STEAM GENERATOR SECONDARY SIDE STEAM ACTIVITY Nuclide                            Activity (Ci/g)
Kr-83m                            1.10E-061.8 x 10-6 Kr-85m                            4.30E-067.2 x 10-6 Kr-85                            1.50E-052.5 x 10-5 Kr-87                            2.40E-064.1 x 10-6 Kr-88                            7.70E-061.3 x 10-5 Kr-89                            1.80E-073.0 x 10-7 Xe-131m                            6.90E-061.2 x 10-5 Xe-133m                            8.70E-061.4 x 10-5 Xe-133                            6.40E-041.1 x 10-3 Xe-135m                            5.50E-061.0 x 10-5 Xe-135                            1.90E-053.1 x 10-5 Xe-137                            3.40E-075.7 x 10-7 Xe-138                            1.30E-062.1 x 10-6 I-129                            1.50E-132.7 x 10-13 I-130                            8.70E-081.5 x 10-7 I-131                            6.90E-061.3 x 10-5 I-132                            4.70E-068.0 x 10-6 I-133                            1.10E-052.0 x 10-5 I-134                            5.40E-078.9 x 10-7 I-135                            5.50E-069.5 x 10-6 H-3                                3.80E-011.0 Tier 2 Material                    11.1-11                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                      198
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                      AP1000 Design Control Document 11.5        Radiation Monitoring The radiation monitoring system (RMS) provides plant effluent monitoring, process fluid monitoring, airborne monitoring, and continuous indication of the radiation environment in plant areas where such information is needed. Radiation monitors that have a safety-related function are qualified environmentally, seismically, or both. Class 1E radiation monitors conform to the separation criteria described in subsection 8.3.2 and to the fire protection criteria described in subsection 9.5.1. Equipment qualification requirements, including seismic qualification requirements, and general location information for radiation monitors are listed in Section 3.11.
Seismic Categories for the buildings housing radiation monitors are listed in Section 3.2.
The radiation monitoring system is installed permanently and operates in conjunction with regular and special radiation survey programs to assist in meeting applicable regulatory requirements. The radiation monitoring system is designed in accordance with ANSI N13.1-1969. The process monitors are designed in accordance with ANSI-N42.18-1980.
The radiation monitoring system is divided functionally into two subsystems:
x    Process, airborne, and effluent radiological monitoring and sampling x    Area radiation monitoring 11.5.1      Design Basis 11.5.1.1    Safety Design Basis                                                                                Commented [HZS1]: Ext-03 While the radiation monitoring system is primarily a surveillance system, certain detector channels perform safety-related functions. The components used in these channels meet the qualification requirements for safety-related equipment as described in subsection 7.1.4.
Channel and equipment redundancy is provided for safety-related monitors to maintain the safety-related function in case of a single failure.
The design objectives of the radiation monitoring system during postulated accidents are:
x    Initiate containment air filtration isolation in the event of abnormally high radiation inside the containment (High-1) x    Initiate normal residual heat removal system suction line containment isolation in the event of abnormally high radiation inside the containment (High-2) x    Initiate main control room supplemental filtration in the event of abnormally high particulate, iodine, or gaseous radioactivity in the main control room supply air (High-1) x    Initiate main control room ventilation isolation and actuate the main control room emergency habitability system in the event of abnormally high particulate or iodine radioactivity in the main control room supply air (High-2)
Tier 2 Material                                      11.5-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                199
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                      AP1000 Design Control Document 11.5.2.3.1 Fluid Process Monitors Steam Generator Blowdown Radiation Monitors The steam generator blowdown radiation monitors (BDS-JE-RE010, RE011) measure the concentration of radioactive material in the blowdown from the steam generators. One measures radiation in the purification process effluent before it is returned to the condensate system. The other measures radioactivity in the blowdown system electrodeionization waste brine before it is discharged to the waste water system. The presence of radioactive material in the steam generator blowdown indicates a leak between the primary side and the secondary side of the steam generator. Refer to subsection 5.2.5 for details of leakage monitoring and to subsections 10.4.8 and 11.2 for process system details. The steam generator blowdown radiation monitors meet the guidelines of Regulatory Guide 1.97 as discussed in Appendix 1A and Section 7.5.
AP1000 has two steam generators, each of which has a blowdown line. Each blowdown line has a heat exchanger upstream of the blowdown flow control valve. The steam generator blowdown radiation detectors are located in the lines downstream of these heat exchangers. Therefore, the radiation monitors do not require a sample cooler.
When its predetermined setpoint is exceeded, each steam generator blowdown radiation monitor initiates an alarm in the main control room, initiates closure of the steam generator blowdown containment isolation valves and the steam generator blowdown flow control valves, and diverts flow to the liquid radwaste system.
The steam generator blowdown radiation monitors use inline gamma-sensitive, thallium-activated, sodium iodide scintillation detectors. The steam generator blowdown radiation monitor detector range and principal isotopes are listed in Table 11.5-1.
The arrangement for the steam generator blowdown radiation monitor is shown in Figure 11.5-1.
Component Cooling Water System Radiation Monitor The component cooling water system radiation monitor (CCS-JE-RE001) measures the concentration of radioactive material in the component cooling water system. Radioactive material in the component cooling water system provides indication of leakage. Refer to subsection 5.2.5 for details of leakage monitoring and to subsection 9.2.2 for process system details.
If the concentration of radioactive materials exceeds a predetermined setpoint, the component cooling water system radiation monitor initiates an alarm in the main control room.
The component cooling water system radiation monitor is an offline monitor that uses a gamma-sensitive, thallium-activated, sodium iodide scintillation detector. The range and principal isotopes are listed in Table 11.5-1.
The arrangement for the component cooling water system radiation monitor is shown in Figure 11.5-7.
Tier 2 Material                                      11.5-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      200
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                      AP1000 Design Control Document radioactivity of the reactor coolant indicating a possible fuel cladding breach. When a predetermined setpoint is exceeded, the primary sampling system liquid sample radiation monitor isolates the sample flow by closing the outside containment isolation valve and initiates an alarm in the main control room and locally to alert the operator. Refer to subsection 9.3.3 for system details.
The primary sampling system liquid sample radiation monitor utilizes a gamma-sensitive radiation detector that is adjacent to the sampling line immediately downstream of the sample cooler. The range and principal isotopes are listed in Table 11.5-1.
The arrangement for the primary sampling system liquid sample radiation monitor is shown in Figure 11.5-8.
Primary Sampling System Gaseous Sample Radiation Monitor The primary sampling system gaseous sample radiation monitor (PSS-JE-RE052) measures the concentration of radioactive materials in the gaseous samples taken from containment atmosphere. The gaseous sample radiation monitor is used to provide indication of significant radioactivity in the gaseous sample being taken and the need for dilution of the sample to limit operator exposure during sampling and transport for analysis. When a predetermined setpoint is exceeded, the primary sampling system gaseous sample radiation monitor initiates an alarm locally and in the main control room to alert the operator. Refer to subsection 9.3.3 for system details.
The primary sampling system gaseous sample radiation monitor utilizes a gamma-sensitive radiation detector that is adjacent to the sampling line immediately upstream of the sample bottle.
The range and principal isotopes are listed in Table 11.5-1.
The arrangement for the primary sampling system gaseous sample radiation monitor is shown in Figure 11.5-8.
Main Control Room Supply Air Duct Radiation Monitors The main control room supply air duct radiation monitors (particulate detectors VBS-JE-RE001A and VBS-JE-RE001B, iodine detectors VBS-JE-RE002A and VBS-JE-RE002B, and noble gas detectors VBS-JE-RE003A and VBS-JE-RE003B) are offline monitors that continuously measure the concentration of radioactive materials in the air that is supplied to the main control room by the nuclear island nonradioactive ventilation system air handling units. The control support area ventilation is also part of this air supply system. The air supply is partially outside air. Refer to subsection 9.4.1 for system details. The main control room supply air duct radiation monitors receive safety-related power. When predetermined setpoints are exceeded, the monitors provide signals to initiate the supplemental air filtration system on high gaseous a High-1 gaseous, particulate, or iodine concentration, and to isolate the main control room air intake and exhaust ducts and activate the main control room emergency habitability system on high High-2 particulate or iodine concentrations. Alarms are also provided in the main control room for these    Commented [HZS2]: Ext-03 high concentrations.
Tier 2 Material                                      11.5-6                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                201
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                      AP1000 Design Control Document Figure 11.5-6 Commented [HZS3]: Ext-03 Safety-Related Main Control Room Supply Duct Radiation Monitor Tier 2 Material                        11.5-27                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                            202
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                              AP1000 Design Control Document For the evaluation of the radiological consequences of the LOCA, it is assumed that major degradation of the core takes place, including melting of the core. The source term used for the LOCA dose analysis assumes no core release for 10 minutes, then there is a gap release from a small number of fuel rods before the onset of core degradation. The first half hour of core release is restricted to releases from the fuel cladding gap; this gap release phase is followed by the in-vessel core melt phase that has a duration of 1.3 hours. After the in-vessel core melt phase, there is assumed to be no further release of activity from the core. This core activity release model is based on the source term model from NUREG-1465 (Reference 1). The source term is described in detail in subsection 15.6.5.3.
12.2.1.3.1 Containment                                                                                          Commented [HZS1]: Ext-03 If there is core degradation, core cooling would be provided by the passive core cooling system which is totally inside the containment such that no high activity sump solution would be recirculated outside the containment. The shielding provided for the containment addresses this post-LOCA source term. The source strengths as a function of time are provided in Table 12.2-20 and the integrated source strengths are provided in Table 12.2-21.
12.2.1.3.2 Main Control Room HVAC Filter During operation of the nuclear island nonradioactive ventilation system (VBS) supplemental filtration or the main control room emergency habitability system (VES), filters in the control room HVAC work to remove particulate and iodine from the air. As radioactivity accumulates within the filters, this becomes a potential source of dose. These source strengths as a function of time are provided in Table 12.2-28 and the integrated source strengths are provide in Table 12.2-
: 29.                                                                                                  Commented [HZS2]: Ext-03 12.2.2      Airborne Radioactive Material Sources This subsection deals with the models, parameters, and sources required to evaluate airborne concentration of radionuclides during plant operations in various plant radiation areas where personnel occupancy is expected.
12.2.2.1    Containment Atmosphere The main sources of airborne activity in the containment is leakage of primary coolant and activation of naturally occurring argon in the atmosphere. During normal power operation, excessive activity buildup in the containment atmosphere is prevented by periodic purging of the containment (approximately 20 hours per week). When the plant is shut down for refueling or maintenance, additional purging of the containment atmosphere is performed to further reduce the activity levels consistent with the increased level of worker presence in the containment. The assumptions and parameters used to determine the airborne activity levels in the containment are listed in Table 12.2-22. The airborne concentrations are provided in Table 12.2-23.
Three situations are considered: normal power operation without purge, normal power operation with 20 hours of purge operation per week, and shutdown operation.
Tier 2 Material                                      12.2-6                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                203
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                              AP1000 Design Control Document Table 12.2-28 (Sheet 1 of 2)                              Commented [HZS3]: Ext-03 CORE MELT ACCIDENT SOURCE STRENGTHS FROM MCR HVAC FILTERS AS A FUNCTION OF TIME VES Filter(1) Source Strengths after a Loss of Coolant Accident Energy Group (Mev/gamma)                                Source Strength (Mev/sec) 2 hours            8 hours          24 hours      30 days 0.01 - 0.02                1.19E+06          3.11E+06          1.81E+06    1.97E+05 0.03 - 0.0                1.47E+06          5.26E+06          3.89E+06    2.65E+05 0.03 - 0.06                2.87E+06          5.30E+06          5.46E+06    6.47E+05 0.06 - 0.1                3.03E+06          8.13E+06          5.22E+06    5.41E+05 0.1 - 0.2                5.76E+06          1.41E+07          8.76E+06    9.02E+05 0.2 - 0.4                6.14E+07          2.61E+08          2.46E+08    1.87E+07 0.4 - 0.6                1.86E+08          6.02E+08          3.60E+08    1.83E+07 0.6 - 0.7                1.47E+08          2.33E+08          1.47E+08    1.03E+08 0.7 - 0.8                1.09E+08          1.80E+08          1.05E+08    7.30E+07 0.8 - 1.0                1.85E+08          1.67E+08          6.99E+07    7.13E+06 1.0 - 1.5                3.36E+08          6.99E+08          1.85E+08    1.22E+07 1.5 - 2.0                1.21E+08          2.55E+08          4.97E+07    2.69E+04 2.0 - 3.0                3.13E+07          3.87E+07          7.28E+06    9.07E+03 3.0 - 4.0                3.68E+05          5.98E+03          5.56E+02    1.41E+02 4.0 - 5.0                1.42E+04          3.16E+01          8.55E-04    7.80E-04 5.0 - 6.0                3.31E-05          3.12E-04          3.35E-04    3.21E-04 6.0 - 7.0                1.32E-05          1.24E-04          1.33E-04    1.28E-04 7.0 - 8.0                5.11E-06          4.82E-05          5.17E-05    4.96E-05 8.0 - 10.0                2.68E-06          2.53E-05          2.71E-05    2.60E-05 10.0 - 14.0                1.69E-07          1.60E-06          1.71E-06    1.64E-06 Total                  1.19E+09          2.47E+09          1.19E+09    2.35E+08 Tier 2 Material                                      12.2-64                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          204
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                AP1000 Design Control Document Table 12.2-28 (Sheet 2 of 2)                                          Commented [HZS4]: Ext-03 CORE MELT ACCIDENT SOURCE STRENGTHS FROM MCR HVAC FILTERS AS A FUNCTION OF TIME VES Filter(2) Source Strengths after a Loss of Coolant Accident Energy Group (Mev/gamma)                                  Source Strength (Mev/sec) 2 hours            8 hours            24 hours            30 days 0.01 - 0.02                6.86E+08            1.00E+09            5.75E+08            6.21E+07 0.03 - 0.0                  9.55E+08            1.76E+09            1.27E+09            8.46E+07 0.03 - 0.06                1.71E+09            2.71E+09            1.75E+09            2.10E+08 0.06 - 0.1                  1.72E+09            2.60E+09            1.63E+09            1.70E+08 0.1 - 0.2                  3.49E+09            4.61E+09            2.81E+09            2.91E+08 0.2 - 0.4                  3.54E+10            8.45E+10            7.59E+10            5.76E+09 0.4 - 0.6                  1.03E+11            1.91E+11            1.10E+11            5.61E+08 0.6 - 0.7                  7.99E+10            7.20E+10            4.39E+10            3.04E+10 0.7 - 0.8                  5.97E+10            5.62E+10            3.17E+10            2.16E+10 0.8 - 1.0                  1.03E+11            5.63E+10            2.13E+10            2.11E+09 1.0 - 1.5                  1.86E+11            2.20E+11            5.64E+10            3.62E+09 1.5 - 2.0                  6.71E+10            8.03E+10            1.53E+10            8.78E+06 2.0 - 3.0                  1.66E+10            1.22E+10            2.24E+09            3.09E+06 3.0 - 4.0                  1.82E+08            1.93E+06            1.89E+05            4.81E+04 4.0 - 5.0                  6.86E+06            7.65E+03            2.91E-01            2.65E-01 5.0 - 6.0                  3.74E-02            1.12E-01            1.14E-01            1.09E-01 6.0 - 7.0                  1.49E-02            4.47E-02            4.54E-02            4.35E-02 7.0 - 8.0                  5.78E-03            1.74E-02            1.76E-02            1.69E-02 8.0 - 10.0                  3.03E-03            9.11E-03            9.24E-03            8.86E-03 10.0 - 14.0                1.92E-04            5.75E-04            5.84E-04            5.60E-04 Total                    6.59E+11            7.82E+11            3.65E+11            7.00E+10 Notes:
: 1. Based upon a particulate filter density of 0.212 g/cc and charcoal filter density of 0.440 g/cc.
: 2. Based upon a particulate filter density of 0.230 g/cc and charcoal filter density of 0.632 g/cc.
Tier 2 Material                                        12.2-65                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      205
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                AP1000 Design Control Document Table 12.2-29                                                  Commented [HZS5]: Ext-03 CORE MELT ACCIDENT INTEGRATED SOURCE STRENGTHS FROM MCR HVAC FILTERS Energy Group (Mev/gamma)                        30-Day Integrated Source Strength (Mev)
VES(1)                                VBS(2) 0.01 - 0.02                          1.75E+08                              5.65E+10 0.03 - 0.0                          3.81E+08                              1.26E+11 0.03 - 0.06                          5.89E+08                              1.90E+11 0.06 - 0.1                          5.77E+08                              1.84E+11 0.1 - 0.2                          9.03E+08                              2.95E+11 0.2 - 0.4                          3.34E+10                              1.05E+13 0.4 - 0.6                          2.36E+10                              7.44E+12 0.6 - 0.7                          3.81E+10                              1.15E+13 0.7 - 0.8                          2.63E+10                              7.92E+12 0.8 - 1.0                          7.57E+09                              2.39E+12 1.0 - 1.5                          1.77E+10                              5.67E+12 1.5 - 2.0                          4.03E+09                              1.34E+12 2.0 - 3.0                          6.47E+08                              2.18E+11 3.0 - 4.0                          1.20E+06                              4.46E+08 4.0 - 5.0                          4.17E+04                              1.52E+07 5.0 - 6.0                          1.03E-01                              3.51E+01 6.0 - 7.0                          4.08E-02                              1.40E+01 7.0 - 8.0                          1.59E-02                              5.42E+00 8.0 - 10.0                          8.32E-03                              2.84E+00 10.0 - 14.0                          5.25E-04                              1.80E-01 Total                            1.54E+11                              4.79E+13 Notes:
: 1. Based upon a particulate filter density of 0.212 g/cc and charcoal filter density of 0.440 g/cc.
: 2. Based upon a particulate filter density of 0.230 g/cc and charcoal filter density of 0.632 g/cc.
Tier 2 Material                                        12.2-66                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      206
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                            AP1000 Design Control Document the permanent shield walls surrounding the waste accumulation and packaged waste storage rooms inside the radwaste building.
12.3.2.2.6 Turbine Building Shielding Design The steam generator blowdown demineralizers are shielded to meet the radiation zone and access requirements. Radiation shielding is not required for other process equipment located in the turbine building. Space has been provided so that shielding may be added around the condensate polishing demineralizers if they become radioactive.
12.3.2.2.7 Control Room Shielding Design                                                                        Commented [HZS1]: Ext-03 The design basis loss-of-coolant accident dictates the shielding requirements for the control room. The rod ejection accident dictates the shielding requirements for the main control room emergency habitability (VES) filter in the operator break room. Consideration is given to shielding provided by the shield building structure. Shielding combined with other engineered safety features is provided to permit access and occupancy of the control room following a postulated loss-of-coolant accident, so that radiation doses are limited to five rem whole body from contributing modes of exposure for the duration of the accident, in accordance with General Design Criterion 19.
Shielding of the VES filtration unit is accomplished by safety-related metal shielding. This shielding is composed of either tungsten that is 0.25 inches thick or stainless steel shown to provide an equivalent amount of shielding. The length and width of the shielding are designed to match the length and width of the filtration unit being shielded.
12.3.2.2.8 Miscellaneous Plant Areas and Plant Yard Areas Sufficient shielding is provided for plant buildings containing radiation sources so that radiation levels at the outside surfaces of the buildings are maintained below Zone I levels. Plant yard areas that are frequently occupied by plant personnel are fully accessible during normal operation and shutdown. Tanks containing radioactive materials are not located in the yard.
12.3.2.2.9 Spent Fuel Transfer Canal and Tube Shielding The spent fuel transfer tube is shielded to within adjacent area radiation zone limits. This is primarily achieved through the use of concrete and water. The only removable shielding consists of concrete or steel hatches which reduce radiation in accessible areas to within those levels prescribed in the normal operation radiation zone maps (Figure 12.3-1).
The spent fuel transfer tube is completely enclosed in concrete and there is no unshielded portion of the spent fuel transfer tube during the refueling operation. The only potential radiation streaming path associated with the tube shielding configuration is the 2 inch (5.08 cm) seismic gap between the fuel transfer tube shielding and the steel containment wall. Shielding of this gap is provided by a water-filled bladder. This "expansion gap" radiation shield provides effective reduction of the radiation fields during fuel transfer and accommodates relative movement between the containment and the concrete transfer tube shielding with no loss in shield integrity.
A removable hatch in the shield configuration provides access for inspection of the fuel transfer Tier 2 Material                                    12.3-13                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                207
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                                                      AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR Figure 12.3-1 (Sheet 6 of 16) Commented [HZS2]: Ext-03 Radiation Zones, Normal Operations/Shutdown Nuclear Island, Elevation 100-0 & 107-2 Tier 2 Material                                                                                    12.3-33                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                            208
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                                                  AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR
                                                                                                                                              ) Commented [HZS3]: Ext-03 Radiation Zones, Post-Accident Nuclear Island, Elevation 117-6 Tier 2 Material                                                                                    12.3-67                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                    209
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                                                  AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR Figure 12.3-2 (Sheet 8 of 15) Commented [HZS4]: Ext-03 Radiation Zones, Post-Accident Nuclear Island, Elevation 135-3 Tier 2 Material                                                                                    12.3-69                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                      210
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                          AP1000 Design Control Document of advanced technology into the refueling process also reduces doses. Table 12.4-11 lists some of the AP1000 features that reduce doses during refueling operations.
Table 12.4-12 provides dose estimates for the various refueling activities.
12.4.1.7    Overall Plant Doses The estimated annual personnel doses associated with the six activity categories discussed above are summarized below:
Estimated Annual Category                      Percent of Total            (man-rem)
Reactor operations and surveillance                21.8                      13.8 Routine inspection and maintenance                  19.2                      12.1 Inservice inspection                              22.7                      14.3 Special maintenance                                23.7                      15.0 Waste processing                                    8.2                      5.2 Refueling                                            4.4                      2.8 Total                                            100.0                      63.2 These dose estimates are based on operation with an 18-month fuel cycle and are bounding for operation with a 24-month fuel cycle.
12.4.1.8    Post-Accident Actions                                                                          Commented [HZS1]: Ext-03 Requirements of 10 CFR 52.79(b) relative to plant area access and post-accident sampling (10 CFR 50.34 (f) (2)(viii) are included in Section 1.9.3. If procedures are followed, the design prevents radiation exposures to any individual from exceeding 5 rem to the whole body or 50 rem to the extremities. Figure 12.3-2 in Section 12.3 contains radiation zone maps for plant areas including those areas requiring post-accident access. This figure shows projected radiation zones in areas requiring access and access routes or ingress, egress and performance of actions at these locations. The radiation zone maps reflect maximum radiation fields over the course of an accident. The analyses that confirm that the individual personnel exposure limits following an accident are not exceeded reflect the time-dependency of the area dose rates and the required post-accident access times. The analyses include the assumption that the appropriate respiratory protection equipment is used to maintain radiation exposure within the exposure limits. The areas that require post-accident accessibility are:
x    Main control room x    Class 1E regulating transformer areas x    Ventilation control area for MCR and I & C rooms with PAMS equipment x    Valve area to align spent fuel pool makeup x    Ancillary diesel room x    Passive containment water inventory makeup area Tier 2 Material                                    12.4-4                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            211
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-7 (Sheet 2 of 3)
RADIOLOGICAL ANALYSIS Reference                              Design Feature                            Value Section    6.5.3        The passive heat removal process and the limited leakage from the containment result in offsite doses less than the regulatory guideline limits.
Section    8.3.1.1.6    Electrical penetrations through the containment can withstand the maximum short-circuit currents available either continuously without exceeding their thermal limit, or at least longer than the field cables of the circuits so that the fault or overload currents are interrupted by the protective devices prior to a potential failure of a penetration.
Section    9.4.1.1.1    The VBS isolates the HVAC ductwork that penetrates the main control room boundary on high High-2particulate or iodine concentrations in the main control room supply air, extended Low main control room differential pressure, or on extended loss of ac power to support operation of the main control room emergency habitability system.                                    Commented [HZS4]: Ext-03 Section    12.3.2.2.1  During reactor operation, the shield building protects personnel occupying adjacent plant structures and yard areas from radiation originating in the reactor vessel and primary loop components. The concrete shield building wall and the reactor vessel and steam generator compartment shield walls reduce radiation levels outside the shield building to less than 0.25 mrem/hr from sources inside containment. The shield building completely surrounds the reactor components.
Section    12.3.2.2.2  The reactor vessel is shielded by the concrete primary shield and by the concrete secondary shield which also surrounds other primary loop components. The secondary shield is a structural module filled with concrete surrounding the reactor coolant system equipment, including piping, pumps and steam generators. Extensive shielding is provided for areas surrounding the refueling cavity and the fuel transfer canal to limit the radiation levels.
Tier 2 Material                                  14.3-51                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                        212
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document than the steady-state fission power shape, reducing the energy deposited in the hot rod at the expense of adjacent colder rods. A conservative estimate of this effect on the hot rod is a reduction of 10 percent of the gamma ray contribution or 3 percent of the total heat. Because the water density is considerably reduced at this time, an average of 98 percent of the available heat is deposited in the fuel rods; the remaining 2 percent is absorbed by water, thimbles, sleeves, and grids. Combining the 3 percent total heat reduction from gamma redistribution with this 2 percent absorption produce as the net effect a factor of 0.95, which exceeds the actual heat production in the hot rod. The actual hot rod heat generation is computed during the AP1000 large-break LOCA transient as a function of core fluid conditions.
15.0.11    Computer Codes Used Summaries of some of the principal computer codes used in transient analyses are given as follows. Other codes - in particular, specialized codes in which the modeling has been developed to simulate one given accident, such as those used in the analysis of the reactor coolant system pipe rupture (see subsection 15.6.5) - are summarized in their respective accident analyses sections. The codes used in the analyses of each transient are listed in Table 15.0-2.
WCAP-15644 (Reference 11) provides the basis for use of analysis codes.
15.0.11.1  FACTRAN Computer Code FACTRAN (Reference 5) calculates the transient temperature distribution in a cross section of a metal-clad UO2 fuel rod and the transient heat flux at the surface of the cladding using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, and density). The code uses a fuel model which simultaneously exhibits the following features:
x    A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents                                                                            Commented [HZS1]: Ext-03 (CRR) x    Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation x    The necessary calculations to handle post-DNB transients: film boiling heat transfer correlations, zircaloy-water reaction, and partial melting of the materials FACTRAN is further discussed in WCAP-7908-A (Reference 5).
15.0.11.2  LOFTRAN Computer Code The LOFTRAN (Reference 6) program is used for studies of transient response of a pressurized water reactor system to specified perturbations in process parameters. LOFTRAN simulates a multiloop system by a model containing reactor vessel, hot and cold leg piping, steam generator (tube and shell sides), and pressurizer. The pressurizer heaters, spray, and safety valves are also considered in the program. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron, and rods are included. The secondary side of the steam generator uses a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and control. The protection and safety monitoring system is simulated to include reactor trips on high neutron flux, overtemperature T, high and low pressure, low flow, and Tier 2 Material                                    15.0-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    213
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.0.11.5  COAST Computer Program The COAST computer program is used to calculate the reactor coolant flow coastdown transient for any combination of active and inactive pumps and forward or reverse flow in the hot or cold legs. The program is described in Reference 13 and was referenced in Reference 12. The program was approved in Reference 14.
The equations of conservation of momentum are written for each of the flow paths of the COAST model assuming unsteady one-dimensional flow of an incompressible fluid. The equation of conservation of mass is written for the appropriate nodal points. Pressure losses due to friction, and geometric losses are assumed proportional to the flow velocity squared. Pump dynamics are modeled using a head-flow curve for a pump at full speed and using four-quadrant curves, which are parametric diagrams of pump head and torque on coordinates of speed versus flow, for a pump at other than full speed.
15.0.11.6  ANC Computer Code The ANC computer code is used to solve the two-group neutron diffusion equation in three spatial dimensions. ANC can also solve the three-dimensional kinetics equations for six delayed neutron groups.                                                                                        Commented [HZS2]: Ext-03 (CRR) 15.0.12    Component Failures 15.0.12.1  Active Failures SECY-77-439 (Reference 9) provides a description of active failures. An active failure results in the inability of a component to perform its intended function.
An active failure is defined differently for different components. For valves, an active failure is the failure of a component to mechanically complete the movement required to perform its function. This includes the failure of a remotely operated valve to change position on demand.
The spurious, unintended movement of the valve is also considered as an active failure. Failure of a manual valve to change position under local operator action is included.
Spring-loaded safety or relief valves that are designed for and operate under single-phase fluid conditions are not considered for active failures to close when pressure is reduced below the valve set point. However, when valves designed for single-phase flow are challenged with two-phase flow, such as a steam generator or pressurizer safety valve, the failure to reseat is considered as an active failure.
For other active equipment - such as pumps, fans, and rotating mechanical components - an active failure is the failure of the component to start or to remain operating.
For electrical equipment, the loss of power, such as the loss of offsite power or the loss of a diesel generator, is considered as a single failure. In addition, the failure to generate an actuation signal, either for a single component actuation or for a system-level actuation, is also considered as an active failure.
Tier 2 Material                                    15.0-12                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      214
 
DCP_NRC_003343                                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                                                      AP1000 Design Control Document Table 15.0-2 (Sheet 4 of 5)                                                            Commented [HZS4]: Ext-03 (CRR)
 
==SUMMARY==
OF INITIAL CONDITIONS AND COMPUTER CODES USED Reactivity Coefficients Assumed Computer            Moderator          Moderator                              Initial Thermal Codes                Density          Temperature                              Power Output Section                Faults                    Used            ('k/gm/cm3)            (pcm/°F)            Doppler        Assumed (MWt) 15.4    Chemical and volume control      NA                          NA                    -        NA                        0 and 3415 system malfunction that results in a decrease in the boron concentration in the reactor coolant Inadvertent loading and          ANC                        NA                    -        NA                            3415 operation of a fuel assembly in an improper position Spectrum of RCCA ejection        TWINKLE,          Refer to subsection        Refer to    Coefficient consistent    0 and 3483.3 accidents                        FACTRANANC,        15.4.8                    subsection    with a Doppler defect      (a)Refer to VIPRE                                          15.4.8    of -0.90% 'K at        subsection 15.4.8 BOC(b) and -0.87%
                                                                                                          'K at EOC (b)Refer to subsection 15.4.8 15.5    Increase in reactor coolant inventory Inadvertent operation of the      LOFTRAN                      0.0                  -        Upper curve of            3483.3 (a) emergency core cooling system                                                                Figure 15.04-1 during power operation Chemical and volume control      LOFTRAN                      0.0                  -        Upper curve of            3483.3 (a) system malfunction that increases                                                            Figure 15.04-1 reactor coolant inventory Tier 2 Material                                                      15.0-21                                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                          215
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document water storage tank (IRWST). The PRHR heat exchanger is normally actuated automatically when the steam generator level falls below the low wide-range level. For the main steam line rupture case analyzed, the PRHR exchanger is conservatively actuated at time zero to maximize the cooldown.
15.1.5.2.4 Margin to Critical Heat Flux The case presented in subsection 15.1.5.2.2 conservatively models the expected behavior of the plant during a steam system piping failure. This includes the tripping of the reactor coolant pumps coincident with core makeup tank actuation. A DNB analysis is performed using limiting assumptions that bound those of subsection 15.1.5.2.2.
Under the low flow (natural circulation) conditions present in the AP1000 transient, the return to power is severely limited by the large negative feedback due to flow and power. The minimum DNBR is conservatively calculated and is above the 95/95 limit.
15.1.5.3    Conclusions The analysis shows that the DNB design basis is met for the steam system piping failure event.
DNB and possible cladding perforation following a steam pipe rupture are not precluded by the criteria. The preceding analysis shows that no DNB occurs for the main steam line rupture assuming the most reactive RCCA stuck in its fully withdrawn position.
15.1.5.4    Radiological Consequences The evaluation of the radiological consequences of a postulated main steam line break outside containment assumes that the reactor has been operating with the design basis fuel defect level (0.25 percent of power produced by fuel rods containing cladding defects) and that leaking steam generator tubes have resulted in a buildup of activity in the secondary coolant.
Following the rupture, startup feedwater to the faulted loop is isolated and the steam generator is allowed to steam dry. Any radioiodines carried from the primary coolant into the faulted steam generator via leaking tubes are assumed to be released directly to the environment. It is conservatively assumed that the reactor is cooled by steaming from the intact loop.
15.1.5.4.1 Source Term The only significant radionuclide releases due to the main steam line break are the iodines and alkali metals that become airborne and are released to the environment as a result of the accident.
Noble gases are also released to the environment. Their impact is secondary because any noble gases entering the secondary side during normal operation are rapidly released to the environment.
The analysis considers two different reactor coolant iodine source terms, both of which consider the iodine spiking phenomenon. In one case, the initial iodine concentrations are assumed to be those associated with equilibrium operating limits for primary coolant iodine activity. The iodine spike is assumed to be initiated by the accident with the spike causing an increasing level of iodine in the reactor coolant.
Tier 2 Material                                  15.1-18                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                      216
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document The second case assumes that the iodine spike occurs prior to the accident and that the maximum resulting reactor coolant iodine concentration exists at the time the accident occurs.
The reactor coolant noble gas concentrations are assumed to be those associated with equilibrium operating limits for primary coolant noble gas activity. The reactor coolantand alkali metal      Commented [HZS1]: Ext-03 (CRR) concentrations are assumed to be those associated with the design basis fuel defect level.
The secondary coolant is assumed to have an iodine source term of 0.10.01 PCi/g dose equivalent I-131. This is 101 percent of the maximum primary coolant activity at equilibrium operating conditions. The secondary coolant alkali metal concentration is also assumed to be 101 percent of the primary concentration.                                                                        Commented [HZS2]: Ext-03 15.1.5.4.2 Release Pathways There are three components to the accident releases:
x    The secondary coolant in the steam generator of the faulted loop is assumed to be released out the break as steam. Any iodine and alkali metal activity contained in the coolant is assumed to be released.
x    The reactor coolant leaking into the steam generator of the faulted loop is assumed to be released to the environment without any credit for partitioning or plateout onto the interior of the steam generator.
x    The reactor coolant leaking into the steam generator of the intact loop would mix with the secondary coolant and thus raise the activity concentrations in the secondary water. While the steam release from the intact loop would have partitioning of non-gaseous activity, this analysis conservatively assumes that any activity entering the secondary side is released.
Credit is taken for decay of radionuclides until release to the environment. After release to the environment, no consideration is given to radioactive decay or to cloud depletion by ground deposition during transport offsite.
15.1.5.4.3 Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.1.5.4.4 Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.1.5-1.
15.1.5.4.5 Identification of Conservatisms The assumptions and parameters used in the analysis contain a number of significant conservatisms:
x    The reactor coolant activities are based on a fuel defect level of 0.25 percent. The expected fuel defect level is far less than this (see Section 11.1).
Tier 2 Material                                      15.1-19                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  217
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document x    The assumed leakage of 150 gallons of reactor coolant per day into each steam generator is conservative. The leakage is expected to be a small fraction of this during normal operation.
x    The conservatively selected meteorological conditions are present only rarely.
15.1.5.4.6 Doses Using the assumptions from Table 15.1.5-1, the calculated total effective dose equivalent (TEDE) doses for the case with accident-initiated iodine spike are determined to be less than 0.6 rem at the site boundary for the limiting 2-hour interval (0 4.8 to 2 6.8 hours) and 1.1 rem at the  Commented [HZS3]: Ext-03 low population zone outer boundary. These doses are small fractions of the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34. A small fraction is defined, consistent with the Standard Review Plan, as being 10 percent or less. The TEDE doses for the case with pre-existing iodine spike are determined to be less than 0.5 rem at the site boundary for the limiting 2-hour interval (0 to 2 hours) and 0.4 rem at the low population zone outer boundary. These doses are within the dose guidelines of 10 CFR Part 50.34.
At the time the main steam line break occurs, the potential exists for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour site boundary dose because the pool boiling would not occur until after the first 2 hours. The 30-day contribution to the dose at the site boundary and the low population zone boundary is less than 0.01 rem TEDE. When this is added to the dose calculated for the main steam line break, the          Commented [HZS4]: Ext-03 resulting total dose remains less than the values reported above.
15.1.6      Inadvertent Operation of the PRHR Heat Exchanger 15.1.6.1    Identification of Causes and Accident Description The inadvertent actuation of the PRHR heat exchanger causes an injection of relatively cold water into the reactor coolant system. This produces a reactivity insertion in the presence of a negative moderator temperature coefficient. To prevent this reactivity increase from causing reactor power increase, a reactor trip is initiated when either PRHR discharge valve comes off of its fully shut seat.
The inadvertent actuation of the PRHR heat exchanger could be caused by operator error or a false actuation signal, or by malfunction of a discharge valve. Actuation of the PRHR heat exchanger involves opening one of the isolation valves, which establishes a flow path from one reactor coolant system hot leg, through the PRHR heat exchanger, and back into its associated steam generator cold leg plenum.
The PRHR heat exchanger is located above the core to promote natural circulation flow when the reactor coolant pumps are not operating. With the reactor coolant pumps in operation, flow through the PRHR heat exchanger is enhanced. The heat sink for the PRHR heat exchanger is provided by the IRWST, in which the PRHR heat exchanger is submerged. Because the fluid in the heat exchanger is in thermal equilibrium with water in the tank, the initial flow out of the PRHR heat exchanger is significantly colder than the reactor coolant system fluid. Following this Tier 2 Material                                      15.1-20                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                218
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.1.5-1 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A MAIN STEAM LINE BREAK Reactor coolant iodine activity
      -    Accident-initiated spike            Initial activity equal to the equilibrium operating limit for reactor coolant activity of 1.0 PCi/g dose equivalent I-131 with an assumed iodine spike that increases the rate of iodine release from fuel into the coolant by a factor of 500 (see Appendix 15A).
Duration of spike is 3.65 hours.                                      Commented [HZS5]: Ext-03 (CRR)
      -    Preaccident spike                  An assumed iodine spike that has resulted in an increase in the reactor coolant activity to 60 PCi/g of dose equivalent I-131 (see Appendix 15A)
Reactor coolant noble gas activity          Equal to the operating limit for reactor coolant activity of 280 PCi/g dose equivalent Xe-133 Reactor coolant alkali metal activity        Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and alkali  10%1% of reactor coolant concentrations at maximum equilibrium        Commented [HZS6]: Ext-03 metal activity                              conditions Duration of accident (hr)                    72 Atmospheric dispersion (/Q) factors        See Table 15A-5 in Appendix 15A Steam generator in faulted loop
      -    Initial water mass (lb)            3.03 E+053.32 E+05                                                    Commented [HZS7]: Ext-03
      -    Primary to secondary leak rate      52.1425(a)                                                            Commented [HZS8]: Ext-03 (CRR)
(lb/hr)
      -    Iodine partition coefficient        1.0
      -    Steam released (lb) 0 - 2 hr                            3.031E+053.321 E+05                                                    Commented [HZS9]: Ext-03 2 - 72 hr                          3.65 E+033.66 E+03                                                    Commented [HZS10]: Ext-03 (CRR)
Steam generator in intact loop
      -    Primary to secondary leak rate      52.1425(a)                                                            Commented [HZS11]: Ext-03 (CRR)
(lb/hr)
      -    Iodine partition coefficient        1.0
      -    Steam released (lb) 0 - 2 hr                            3.031E+053.321 E+05                                                    Commented [HZS12]: Ext-03 2 - 72 hr                          3.65 E+033.66 E+03                                                    Commented [HZS13]: Ext-03 (CRR)
Nuclide data                                See Table 15A-4 Note:
: a. Equivalent to 150 gpd cooled liquid at 62.4 lb/ft3.
Tier 2 Material                                        15.1-25                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        219
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 2700°F. The cladding temperature is conservatively calculated, assuming that DNB occurs at the initiation of the transient. These results represent the most limiting conditions with respect to the locked rotor event or the pump shaft break.
The calculated sequence of events for the case analyzed is shown in Table 15.3-1. With the reactor tripped, a stable plant condition is eventually attained. Normal plant shutdown may then proceed.
15.3.3.3    Radiological Consequences The evaluation of the radiological consequences of a postulated locked reactor coolant pump rotor accident assumes that the reactor has been operating with the design basis fuel defect level (0.25 percent of power produced by fuel rods containing cladding defects) and that leaking steam generator tubes have resulted in a buildup of activity in the secondary coolant.
As a result of the accident, it is determined that no fuel rods are damaged such that the activity contained in the fuel-cladding gap is released to the reactor coolant. However, a conservative analysis has been performed assuming 10 percent of the rods are damaged. Activity carried over to the secondary side because of primary-to-secondary leakage is available for release to the environment via the steam line safety valves or the power-operated relief valves.
15.3.3.3.1 Source Term The significant radionuclide releases due to the locked rotor accident are the iodines, alkali metals (cesiums, rubidiums) and noble gases. The reactor coolant iodine source term assumes a pre-existing iodine spike. The initial reactor coolant noble gas and alkali metal concentrations are assumed to be those associated with the design basis fuel defect level. These initial reactor coolant activities are of secondary importance compared to the release of the gap inventory of fission products from the portion of the core assumed to fail because of the accident.
Based on NUREG-1465 (Reference 6), the fission product gap fraction is 3 percent of fuel inventory. For this analysis, the gap fraction is increased to 8 percent of the inventory for I-131, 10 percent for Kr-85, 5 percent for other iodines and noble gases and 12 percent for alkali metals.
Also, to address the fact that the failed fuel rods may have been operating at power levels above the core average, the source term is increased by the lead rod radial peaking factor.
The initial secondary coolant activity is assumed to be 101 percent of the maximum equilibrium        Commented [HZS1]: Ext-03 primary coolant activity for iodines and alkali metals.
15.3.3.3.2 Release Pathways There are two components to the accident releases:
x    The activity initially in the secondary coolant is available for release as long as steam releases continue.
x    The reactor coolant leaking into the steam generators is assumed to mix with the secondary coolant. The activity from the primary coolant mixes with the secondary coolant. As steam Tier 2 Material                                      15.3-8                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  220
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.3-3 (Sheet 1 of 2)
PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A LOCKED ROTOR ACCIDENT Initial reactor coolant iodine activity        An assumed iodine spike that has resulted in an increase in the reactor coolant activity to 60 PCi/gm of dose equivalent I-131 (see Appendix 15A)(a)
Reactor coolant noble gas activity            Equal to the operating limit for reactor coolant activity of 280 PCi/gm dose equivalent Xe-133 Reactor coolant alkali metal activity          Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and alkali    10%1% of design basis reactor coolant concentrations at                Commented [HZS2]: Ext-03 metal activity                                maximum equilibrium conditions Fraction of fuel rods assumed to fail          0.10 Core activity                                  See Table 15A-3 Radial peaking factor (for determination of    1.6575                                                                Commented [HZS3]: Ext-03 (CRR) activity in failed fuel rods)
Fission product gap fractions I-131                                    0.08 Kr-85                                    0.10 Other iodines and noble gases            0.05 Alkali metals                            0.12 Reactor coolant mass (lb)                      3.7 E+05 Secondary coolant mass (lb)                    6.06 04 E+05                                                          Commented [HZS4]: Ext-03 (CRR)
Condenser                                      Not available Atmospheric dispersion factors                See Table 15A-5 Primary to secondary leak rate (lb/hr)        104.35(b)                                                              Commented [HZS5]: Ext-03 (CRR)
Partition coefficient in steam generators iodine                                    0.01 alkali metals                            0.0010.0035                                                            Commented [HZS6]: Ext-03 Accident scenario in which startup feedwater is not available Duration of accident (hr)                1.5 hr Steam released (lb) 0-1.5 hours(c)                      6.48 E+05 Leak flashing fraction(d) 0-60 minutes                        0.04
          > 60 minutes                        0 Tier 2 Material                                        15.3-14                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                          221
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.4.8.1.1.2 Nuclear Design If a rupture of an RCCA drive mechanism housing is postulated, the operation using chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the power control (or mechanical shim) RCCAs inserted only far enough to permit load follow. The axial offset RCCAs are positioned so that the targeted axial offset can be met throughout core life. Reactivity changes caused by core depletion and xenon transients are normally compensated for by boron changes and the mechanical shim banks, respectively.
Further, the location and grouping of the power control and axial offset RCCAs are selected with consideration for an RCCA ejection accident. Therefore, should an RCCA be ejected from its normal position during full-power operation, a less severe reactivity excursion than analyzed is expected.
It may occasionally be desirable to operate with larger than normal insertions. For this reason, a power control and axial offset rod insertion limit is defined as a function of power level.
Operation with the RCCAs above this limit provides adequate shutdown capability and an acceptable power distribution. The position of the RCCAs is continuously indicated in the main control room. An alarm occurs if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions require boration at the low level alarm and emergency boration at the low-low level alarm.
15.4.8.1.1.3 Reactor Protection The reactor protection in the event of a rod ejection accident is described in WCAP-758815806-P-A, Revision 1A (Reference 4). The protection for this accident is provided by the high neutron    Commented [HZS1]: Ext-03 (CRR) flux trip (high and low setting) and the high rate of neutron flux increase trip. These protection functions are described in Section 7.2.
15.4.8.1.1.4 Effects on Adjacent Housings Failures of an RCCA mechanism housing, due to either longitudinal or circumferential cracking, does not cause damage to adjacent housings. The control rod drive mechanism is described in subsection 3.9.4.1.1.
15.4.8.1.1.5 Not Used 15.4.8.1.1.6 Not Used 15.4.8.1.1.7 Consequences The probability of damage to an adjacent housing is considered remote. If damage is postulated, it is not expected to lead to a more severe transient because RCCAs are inserted in the core in symmetric patterns and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal. This is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.
Tier 2 Material                                    15.4-27                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    222
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.4.8.1.1.8 Summary Failure of a control rod housing does not cause damage to adjacent housings that increase the severity of the initial accident.
15.4.8.1.2 Limiting Criteria                                                                                    Commented [HZS2]: Ext-03 (CRR)
This event is a Condition IV incident (ANSI N18.2). See subsection 15.0.1 for a discussion of ANS classification. Because of the extremely low probability of an RCCA ejection accident, some fuel damage is considered an acceptable consequence.
NUREG-0800 Standard Review Plan (SRP) 4.2 Revision 3 (Reference 24) interim Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy have been carried out as part of the SPERT project (Reference 5). Extensive tests of uranium dioxide (UO2) zirconium-clad fuel rods representative of those in pressurized water reactor cores such as AP1000 have demonstrated failure thresholds in the range of 240 to 257 cal/g. Other rods of a slightly different design have exhibited failure as low as 225 cal/g. These results differ significantly from the TREAT (Reference 6) results, which indicated a failure threshold of 280 cal/g. Limited results indicate that this threshold decreases by about 10 percent with fuel burnup. The cladding failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods.
Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/g for unirradiated rods and 200 cal/g for irradiated rods.
Catastrophic failure (large fuel dispersal, large pressure rise), even for irradiated rods, did not occur below 300 cal/g.
Regulatory Guide 1.77 criteria applicable to new plant design certification are applied to provide confidence that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are the following:
x    The pellet clad mechanical interaction (PCMI) failure criteria is a change in radial average fuel enthalpy greater than the corrosion-dependent limit depicted in Figure B-1 of SRP 4.2 Revision 3 Appendix B.
x    The high cladding temperature failure criteria for zero power conditions is a peak radial average fuel enthalpy greater than 170 cal/g for fuel rods with an internal rod pressure at or below system pressure and 150 cal/g for fuel rods with an internal rod pressure exceeding system pressure.
x    For intermediate (greater than 5% rated thermal power) and full power conditions, fuel cladding is presumed to fail if local heat flux exceeds thermal design limits (e.g. DNBR).
x    For core coolability, it is conservatively assumed that the averageAverage fuel pellet enthalpy at the hot spot is remains below 200 cal/g (360 btu/lb) for irradiated fuel. This bounds non-irradiated fuel, which has a slightly higher enthalpy limit.
Tier 2 Material                                    15.4-28                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    223
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document x  For core coolability, the peak fuel temperature must remain below incipient fuel melting conditions.
x  Mechanical energy generated as a result of (1) non-molten fuel-to-coolant interaction and (2) fuel rod burst must be addressed with respect to reactor pressure boundary, reactor internals, and fuel assembly structural integrity.
x  No loss of coolable geometry due to (1) fuel pellet and cladding fragmentation and dispersal and (2) fuel rod ballooning.
x  Peak reactor coolant system pressure is less than that which could cause stresses to exceed the Service Limit C as defined in the ASME code.
x  Fuel melting is limited to less than 10 percent of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of the first criterion.
15.4.8.2    Analysis of Effects and Consequences                                                                  Commented [HZS3]: Ext-03 (CRR)
Method of Analysis The calculation of the RCCA ejection transients is performed in two stages: first, an average core channel calculation and then, a hot rod region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time, including the various total core feedback effects (Doppler reactivity and moderator reactivity). Enthalpy, fuel temperature and DNB and temperature transients at the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a conservative fuel rod transient heat transfer calculation. The power distribution calculated without feedback is conservatively assumed to persist throughout the transient.
A discussion of the method of analysis appears in WCAP-15806-P-A7588, Revision 1A (Reference 4).
Average Core Analysis The three-dimensional nodal spatial kinetics computer code ANC TWINKLE (References 14, 15, 16, 17, 21, 22 and 27Reference 1) is used for the average core transient analysis. This code solves the two-group neutron diffusion theory kinetic equation in 1, 2, or 3 spatial dimensions (rectangular coordinates) for 6 delayed neutron groups, The core moderator and fuel temperature feedbacks are based on the NRC approved Westinghouse version of the VIPRE-01 code and methods (References 18 and 19). and up to 2000 spatial points. The computer code includes a multiregion, transient fuel-clad-coolant heat transfer model for the calculation of pointwise Doppler and moderator feedback effects. In this analysis, the code is used as a one-dimensional axial kinetics code because it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. Because the radial dimension is missing, it is necessary to use conservative methods (described as follows) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in subsection 15.0.11.
Tier 2 Material                                    15.4-29                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      224
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document Hot Spot Rod Analysis The hot fuel rod models are based on the Westinghouse VIPRE models described in WCAP-15806-P-A (Reference 4). The hot rod model represents the hottest fuel rod from any channel in the core. VIPRE performs the hot rod transients for fuel enthalpy, temperature and DNBR using as input the time-dependent nuclear core power and power distribution from the core average analysis. A description of the VIPRE code is provided in Reference 18.In the hot spot analysis, the initial heat flux is equal to the nominal value multiplied by the design hot channel factor.
During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod. The assumption is made that the hot spots before and after ejection are coincident. This is conservative because the peak after ejection occurs in or adjacent to the assembly with the ejected rod, and before ejection, the power in this region is depressed.
The hot spot analysis is performed using the fuel and cladding transient heat transfer computer code FACTRAN (Reference 2). This computer code calculates the transient temperature distribution in a cross section of a metal-clad UO2 fuel rod and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and material properties are represented as functions of temperature. A parabolic radial power distribution is used within the fuel rod.
FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB and the Bishop-Sandburg-Tong correlation (Reference 8) to determine the film boiling coefficient after DNB. The Bishop-Sandburg-Tong correlation is conservatively used, assuming zero-bulk fluid quality. The DNBR is not calculated. Instead, the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient is calculated by the code. It is adjusted to force the full power, steady-state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in subsection 15.0.11.
System Overpressure Analysis If the fuel coolability limits are not exceeded, the fuel dispersal into the coolant or a sudden pressure increase from thermal to kinetic energy conversion is not needed to be considered in the overpressure analysis. Therefore, the overpressure condition may be calculated on the basis of conventional fuel rod to coolant heat transfer and the prompt heat generation in the coolant. The system overpressure analysis is conducted by first performing the core power response analysis to obtain the nuclear power transient (versus time) data. The nuclear power data is then used as input to a plant transient computer code to calculate the peak reactor coolant system pressureThere is little likelihood of fuel dispersal into the coolant. The pressure surge may be calculated on the basis of conventional heat transfer from the fuel and prompt heat absorption by the coolant.
The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a (Section 4.4) calculation is performed to determine the volume surge. Finally, the volume surge is simulated in a plant transient computer code.
Tier 2 Material                                    15.4-30                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          225
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document This code calculates the pressure transient, taking into account fluid transport in the reactor coolant system and heat transfer to the steam generators. For conservatism, no credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.
15.4.8.2.1 Calculation of Basic Parameters                                                                        Commented [HZS4]: Ext-03 (CRR)
Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. Table 15.4-3 presents the important parameters used in this analysisas described in Reference 4.
15.4.8.2.1.1 Ejected Rod Worths and Hot Channel Factors                                                          Commented [HZS5]: Ext-03 (CRR)
The values for ejected rod worths and hot channel factors are calculated using either three-dimensional static methods or by a synthesis method using one-dimensional and two-dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux-flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation.
Appropriate safety analysis allowances margins are added to the ejected rod worth and hot channel factors to account for calculational uncertainties, including an allowance for nuclear peaking due to densification as discussed in Reference 4.
Power distributions before and after ejection for a worst case can be found in WCAP-7588, Revision 1A (Reference 4). During plant startup physics testing, rod worths and power distributions have been measured in the zero-power configuration and compared to values used in the analysis. The ejected rod worth and power peaking factors are consistently overpredicted in the analysis.
15.4.8.2.1.2 Reactivity Feedback Weighting FactorsNot Used                                                        Commented [HZS6]: Ext-03 (CRR)
The largest temperature rises, and hence the largest reactivity feedbacks, occur in channels where the power is higher than average. This means that the reactivity feedback is larger than that indicated by a simple single channel analysis.
Physics calculations are carried out for temperature changes with a flat temperature distribution and with a large number of axial and radial temperature distributions. Reactivity changes are compared, and effective reactivity feedback weighting factors are shown to be conservative.
These weighting factors take the form of multipliers that, when applied to single-channel feedbacks, correct them to effective whole-core feedbacks for the appropriate flux shape.
In this analysis, because a one-dimensional (axial) spatial kinetics method is used, axial reactivity weighting is not necessary if the initial condition matches the ejected rod configuration. In addition, no reactivity weighting is applied to the moderator feedback.
A conservative radial reactivity weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time, accounting for the missing spatial Tier 2 Material                                    15.4-31                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      226
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document dimension. These reactivity weighting factors are shown to be conservative compared to three-dimensional analysis (Reference 5).
15.4.8.2.1.3 Moderator and Doppler Coefficients                                                                      Commented [HZS7]: Ext-03 (CRR)
The critical boron concentrations is at the beginning of cycle and end of cycle are adjusted in the nuclear code to obtain a moderator temperature density coefficient curves that are is conservative compared to actual design conditions for the plant consistent with Reference 4. The fuel temperature feedback in the neutronics code is reduced consistent with Reference 4 requirements.
No weighting factor is applied to these results.
The Doppler reactivity defect is determined as a function of power level using a one-dimensional, steady-state computer code with a Doppler weighting factor of one. The Doppler defect used is given in subsection 15.0.4. The Doppler weighting factor increases under accident conditions.
15.4.8.2.1.4 Delayed Neutron Fraction, Eeff                                                                          Commented [HZS8]: Ext-03 (CRR)
Calculations of the effective delayed neutron fraction (Eeff) typically yield values no less than 0.70 percent at beginning of cycle and 0.50 percent at the end of cycle for the first cycle. The accident is sensitive to Eeff if the ejected rod worth is equal to or greater than Eeff as in zero-power transients. To allow for future cycles, a pessimistic estimates of Eeff of 0.49 percent at beginning of cycle and 0.44 percent at end of cycle areis used in the analysis.
15.4.8.2.1.5 Trip Reactivity Insertion                                                                                Commented [HZS9]: Ext-03 (CRR)
The trip reactivity insertion accounts for assumed is given in Table 15.4-3 and includes the effect of the ejected rod and one adjacent stuck RCCArod. These values are reduced by the ejected rod reactivity. The shutdown trip reactivity is simulated by dropping a limited set of rods of the required worth into the core. The start of rod motion occurs 0.9 second after the high neutron flux trip setpoint is reached. This delay is assumed to consist of 0.583 second for the instrument channel to produce a signal, 0.167 second for the trip breakers to open, and 0.15 second for the coil to release the rods. A curve of trip rod insertion versus time is used, which assumes that insertion to the dashpot does not occur until 2.472.7 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over 1 second after the trip setpoint is reached before significant shutdown reactivity is inserted into the core. This conservatism is important for the hot full power accidents.
The minimum design shutdown margin available at hot zero power may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Calculations show that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown by about an additional 1-percent 'k.
Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor is subcritical when the core returns to hot zero power.
Tier 2 Material                                        15.4-32                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                          227
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.4.8.2.1.6 Reactor Protection As discussed in subsection 15.4.8.1.1.3, reactor protection for a rod ejection is provided by the high neutron flux trip (high and low setting) and the high rate of neutron flux increase trip. These protection functions are part of the protection and safety monitoring system. No single failure of the protection and safety monitoring system negates the protection functions required for the rod ejection accident or adversely affects the consequences of the accident.
15.4.8.2.1.7 Results                                                                                              Commented [HZS10]: Ext-03 (CRR)
For all cases, the core is preconditioned by assuming a fuel cycle depletion with control rod insertion that is conservative relative to expected baseload operation. All Because the control rod insertion limits for the AP1000 are multidimensional, a significant number of rodded configurations are evaluated to determine the most limiting cases, (that is, those cases that produced the least amount of margin to the Standard Review Plan Section 15.4.8 evaluation acceptance criteria). The hot zero power cases and hot full power cases assume that the mechanical shim and axial offset control RCCAs are inserted to their insertion limits before the event and xenon is skewed to yield a conservative initial axial power shape. The limiting RCCA ejection cases for a typical cycle, for both the beginning and end of cycle at zero and full power, are summarized following the criteria outlined in Section 15.4.8.1.2presented next.
x    Pellet-Clad Mechanical Interaction (PCMI) and High Clad Temperature (Hot Zero Power)
The resulting maximum fuel average enthalpy rise and maximum fuel average enthalpy are less than the criteria given in Section 15.4.8.1.2.
x    High Clad Temperature ( 5% Rated Thermal Power)
The fraction of the core calculated to have a DNBR less than the safety analysis limit is less than the amount of failed fuel assumed in the dose analysis described in Section 15.4.8.3.
x    Core Coolability The resulting maximum fuel average enthalpy is less than the criterion given in Section 15.4.8.1.2. Fuel melting is not predicted to occur at the hot spot.
There are no fuel failures due to the fuel enthalpy deposition, i.e., both fuel and cladding enthalpy limits were met. Additionally, the coolability criteria for peak fuel enthalpy and the fuel melting criteria were met. Therefore, the fuel dispersal into the coolant, a sudden pressure increase from thermal to kinetic energy conversion, gross lattice distortion, or severe shock waves are precluded.
x    Beginning of cycle, full power The limiting ejected rod worth and hot channel factor are conservatively assumed to be 0.37-percent 'k and 4.9, respectively. The peak hot spot cladding average temperature is 2265°F. The peak hot spot fuel center temperature reaches melting at 4900°F. However, melting is restricted to less than 10 percent of the pellet at the hot spot.
Tier 2 Material                                      15.4-33                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      228
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document x    Beginning of cycle, zero power For this condition, the limiting ejected rod worth and hot channel factor are conservatively assumed to be 0.65-percent 'k and 12.0, respectively. The peak hot spot cladding average temperature is 1907°F, and the peak hot spot fuel center temperature is 3018°F.
x    End of cycle, full power The ejected rod worth and hot channel factor are conservatively assumed to be 0.30-percent 'k and 6.0, respectively. The peak hot spot cladding average temperature is 2151°F. The peak hot spot fuel temperature reaches melting at 4800°F. However, melting is restricted to less than 10 percent of the pellet at the hot spot.
x    End of cycle, zero power The ejected rod worth and hot channel factor for this case are conservatively assumed to be 0.75-percent 'k and 19.6, respectively. The peak hot spot cladding average temperature is 2122°F, and the peak hot spot fuel center temperature is 3263°F.
A summary of the preceding cases is given in Table 15.4-3. The nuclear power and fuel and cladding temperature transients for the limiting cases are presented in Figures 15.4.8-1 through 15.4.8-43.
The calculated sequence of events for the limiting cases are rod ejection accidents, as shown in Figures 15.4.8-1 through 15.4.8-4, is presented in Table 15.4-1. Reactor trip occurs early in the transients, after which the nuclear power excursion is terminated.
The ejection of an RCCA constitutes a break in the reactor coolant system, located in the reactor pressure vessel head. The effects and consequences of loss-of-coolant accidents (LOCAs) are discussed in subsection 15.6.5. Following the RCCA ejection, the plant response is the same as a LOCA.
The consequential loss of offsite power described in subsection 15.0.14 is not limiting for the enthalpy and temperature transients resulting from an RCCA ejection accident. Due to the delay from reactor trip until turbine trip and the rapid power reduction produced by the reactor trip, the peak fuel and cladding temperatures occur before the reactor coolant pumps begin to coast down.
15.4.8.2.1.8 Fission Product Release                                                                            Commented [HZS11]: Ext-03 (CRR)
It is assumed that fission products are released from the gaps of all rods entering DNB. In the cases considered, less than 10 percent of the rods are assumed to enter DNB based on a detailed three-dimensional kinetics and hot rod analysis. The maximum fuel average enthalpy rise of rods predicted to enter DNB will be less than 60 cal/g. Fuel melting does not occur at the hot spot.
THINC analysis (Reference 4). Although limited (less than 10 percent) fuel melting at the hot spot is allowed for the full-power cases, in practice, melting is not expected because the analysis conservatively assumes that the hot spots before and after ejection are coincident.
Tier 2 Material                                      15.4-34                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    229
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document The consequential loss of offsite power described in subsection 15.0.14 is not limiting for the calculation of the number of rods assumed to enter DNB for the RCCA ejection accident. Due to the delay from reactor trip until turbine trip and the rapid power reduction produced by the reactor trip, the minimum DNBR, for rods where the DNBR did not fall below the design limit (see Section 4.4) in the cases described, occurs before the reactor coolant pumps begin to coast down.
15.4.8.2.1.9 Peak RCS Pressure Surge                                                                                  Commented [HZS12]: Ext-03 (CRR)
Calculations of the peak reactor coolant system pressure demonstrate that the peak pressure does not exceed that which would cause the stress to exceed the Service Level C Limit as described in the ASME Code, Section III. Therefore, the accident for this plant does not result in an excessive pressure rise or further damage to the reactor coolant system.
A calculation of the pressure surge for an ejection worth of about one dollar at beginning of cycle, hot full power, demonstrates that the peak pressure does not exceed that which would cause the stress to exceed the Service Level C Limit as described in the ASME Code, Section III.
Because the severity of the analysis does not exceed the worst-case analysis, the accident for this plant does not result in an excessive pressure rise or further damage to the reactor coolant system.
The consequential loss of offsite power described in subsection 15.0.14 is not limiting for the pressure surge transient resulting from an RCCA ejection accident. Due to the delay from reactor trip until turbine trip and the rapid power reduction produced by the reactor trip, the peak system pressure occurs before the reactor coolant pumps begin to coast down.
15.4.8.2.1.10 Lattice Deformations A large temperature gradient exists in the region of the hot spot. Because the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion, tending to bow the midpoint of the rods toward the hotter side of the rod.
Calculations indicate that this bowing results in a negative reactivity effect at the hot spot because the core is undermoderated, and bowing tends to increase the undermoderation at the hot spot. In practice, no significant bowing is anticipated because the structural rigidity of the core is sufficient to withstand the forces produced.
Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that crossflow is sufficient to produce lattice deformation. Even if massive and rapid boiling, sufficient to distort the lattices, is hypothetically postulated, the large void fraction in the hot spot region produces a reduction in the total core moderator to fuel ratio and a large reduction in this ratio at the hot spot. The net effect is therefore a negative feedback.
In conclusion, no credible mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.
Tier 2 Material                                        15.4-35                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                          230
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.4.8.3    Radiological Consequences                                                                            Commented [HZS13]: Ext-03 (CRR)
The evaluation of the radiological consequences of a postulated rod ejection accident assumes that the reactor is operating with a limited number of fuel rods containing cladding defects and that leaking steam generator tubes result in a buildup of activity in the secondary coolant. Refer to section 15.4.8.3.1 and Table 15.4-4.
As a result of the accident, 10 percent of the fuel rods are assumed to be damaged (see subsection 15.4.8.2.1.8) such that the activity contained in the fuel-cladding gap is released to the reactor coolant. No fuel melt is calculated to occur as a result of the rod ejection (see subsection 15.4.8.2.1.8).
The evaluation of the radiological consequences of a postulated rod ejection accident assumes that the reactor is operating with the design basis fuel defect level (0.25 percent of power produced by fuel rods containing cladding defects) and that leaking steam generator tubes result in a buildup of activity in the secondary coolant.
As a result of the accident, 10 percent of the fuel rods are assumed to be damaged (see subsection 15.4.8.2.1.8) such that the activity contained in the fuel-cladding gap is released to the reactor coolant. In addition, a small fraction of fuel is assumed to melt and release core inventory to the reactor coolant.
Activity released to the containment via the spill from the reactor vessel head is assumed to be available for release to the environment because of containment leakage. Activity carried over to the secondary side due to primary-to-secondary leakage is available for release to the environment through the steam line safety or power-operated relief valves.
15.4.8.3.1 Source Term                                                                                            Commented [HZS14]: Ext-03 (CRR)
The significant radionuclide releases due to the rod ejection accident are the iodines, alkali metals, and noble gases. The reactor coolant iodine source term assumes a pre-existing iodine spike. The reactor coolant noble gas concentrations are assumed to be those associated with equilibrium operating limits for primary coolant noble gas activity. The initial reactor coolant alkali metal concentrations are assumed to be those associated with the design fuel defect level.
These initial reactor coolant activities are of secondary importance compared to the release of fission products from the portion of the core assumed to fail.
Based on NUREG-1465 (Reference 12), the fission product gap fraction is 3 percent of fuel inventory. For this analysis, the gap fractions are modified following the guidance of Draft Guide 1199 (Reference 25), which incorporates the effects of enthalpy rise in the fuel following the reactivity insertion, consistent with Appendix B of SRP 4.2, Revision 3 (Reference 24). Draft Guide 1199 included expanded guidance for determining nuclide gap fractions available for release following a rod ejection. Reference 26 was issued as a clarification to the gap fraction guidance in Draft Guide 1199. An enthalpy rise of 60 cal/gm is used to calculate the gap fractions (see subsection 15.4.8.2.1.8). Also, to address the fact that the failed fuel rods may have been operating at power levels above the core average, the source term is increased by the lead rod radial peaking factor. No fuel melt is calculated to occur as a result of the rod ejection (see subsection 15.4.8.2.1.8).The significant radionuclide releases due to the rod ejection accident are Tier 2 Material                                      15.4-36                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      231
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document the iodines, alkali metals, and noble gases. The reactor coolant iodine source term assumes a pre-existing iodine spike. The initial reactor coolant noble gas and alkali metal concentrations are assumed to be those associated with the design fuel defect level. These initial reactor coolant activities are of secondary importance compared to the release of fission products from the portion of the core assumed to fail.
Based on NUREG-1465 (Reference 12), the fission product gap fraction is 3 percent of fuel inventory. For this analysis, the gap fraction is increased to 10 percent of the inventory for iodine and noble gases and 12 percent for alkali metals. Also, to address the fact that the failed fuel rods may have been operating at power levels above the core average, the source term is increased by the lead rod radial peaking factor.
Even though no fuel centerline melting is expected, a conservative upper limit for fuel melting was determined to be 0.25 percent of the core based on the following assumptions:
: 1. No more than 50 percent of the rods experiencing clad damage will experience centerline melting. (Based on 10 percent of rods failing, this is 5 percent of the core.)
: 2. Due to the power distribution within the core, no more than 50 percent of the axial length of the affected fuel rods will experience melting. (This reduces the equivalent number of rods experiencing melting to 2.5 percent of the core.)
: 3. Of rods experiencing centerline melting, only a conservative maximum of the innermost 10 percent of the fuel volume will actually melt. (Based on 2.5 percent of the rods experiencing melting, the resulting fraction of the core experiencing melting is 0.25 percent.)
All of the noble gases and half of the iodines and alkali metals are assumed to be released from the melted fuel.
The initial secondary coolant activity is assumed to be 101 percent of the maximum equilibrium        Commented [HZS15]: Ext-03 primary coolant activity for iodines and alkali metals.
15.4.8.3.2 Release Pathways There are three components to the accident releases:
x    The activity initially in the secondary coolant is available for release as long as steam releases continue.
x    The reactor coolant leaking into the steam generators is assumed to mix with the secondary coolant. The activity from the primary coolant mixes with the secondary coolant and, as steam is released, a portion of the iodine and alkali metal in the coolant is released. The fraction of activity released is defined by the assumed flashing fraction and the partition coefficient assumed for the steam generator. The noble gas activity entering the secondary side is released to the environment. These releases are terminated when the steam releases stop.
Tier 2 Material                                      15.4-37                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  232
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document x    The activity from the reactor coolant system and the core is released to the containment atmosphere and is available for leakage to the environment through the assumed design basis containment leakage.
Credit is taken for decay of radionuclides until release to the environment. After release to the environment, no consideration is given to radioactive decay or to cloud depletion by ground deposition during transport offsite.
15.4.8.3.3 Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.4.8.3.4 Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.4-4.
15.4.8.3.5 Identification of Conservatisms                                                                        Commented [HZS16]: Ext-03 (CRR)
The assumptions used in the analysis contain a number of conservatisms:
x    Although fuel damage is assumed to occur as a result of the accident, no fuel damage is anticipated.
x    The reactor coolant activities are based on conservative assumptions (refer to Table 15.4-4);
whereas, the activities based on the expected fuel defect level are far less (see Section 11.1).The reactor coolant activities are based on an assumed fuel defect level of 0.25 percent; whereas, the expected fuel defect level is far less than this (see Section 11.1).
x    The leakage of reactor coolant into the secondary system, at 300 gallons per day, is conservative. The leakage is normally a small fraction of this.
x    It is unlikely that the conservatively selected meteorological conditions are present at the time of the accident.
x    The leakage from containment is assumed to continue for a full 30 days. It is expected that containment pressure is reduced to the point that leakage is negligible before this time.
15.4.8.3.6 Doses                                                                                                  Commented [HZS17]: Ext-03 (CRR)
Using the assumptions from Table 15.4-4, the calculated total effective dose equivalent (TEDE) doses are determined to be 4.0 rem at the site boundary for the limiting 2-hour interval (0 to 2 hours) and 5.9 rem at the low population zone outer boundary. These doses are well within the dose guideline of 25 rem total effective dose equivalent identified in 10 CFR Part 50.34. The phrase well within is taken as being 25 percent or less.Using the assumptions from Table 15.4-4, the calculated total effective dose equivalent (TEDE) doses are determined to be less than 1.8 rem at the site boundary for the limiting 2-hour interval (0 to 2 hours) and less than 2.5 rem at the low population zone outer boundary. These doses are well within the dose guideline of 25 Tier 2 Material                                      15.4-38                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      233
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document rem total effective dose equivalent identified in 10 CFR Part 50.34. The phrase well within is taken as being 25 percent or less.
At the time the rod ejection accident occurs, the potential exists for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour site boundary dose because the pool boiling would not occur until after the first 2 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE, and when this is added to the dose calculated for the rod ejection accident, the resulting total dose remains less than the value reported above.
15.4.9      Combined License Information This section has no requirement for additional information to be provided in support of the Combined License application.
15.4.10    References                                                                                            Commented [HZS18]: Ext-03 (CRR)
: 1. Barry, R. F., and Risher, D. H., Jr., TWINKLE--A Multi-Dimensional Neutron Kinetics Computer Code, WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Nonproprietary),
January 1975.
: 2. Hargrove, H. G., FACTRAN--A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod, WCAP-7908-A, December 1989.
: 3. Burnett. T. W. T., et al., LOFTRAN Code Description, WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Nonproprietary), April 1984.
: 4. Beard, C. L. et. al, Westinghouse Control Rod Ejection Accident Analysis Methodology Using Multi-Dimensional Kinetics, WCAP-15806-P-A (Proprietary) and WCAP-15807-NP-A (Nonproprietary), November, 2003Risher, D. H., Jr., An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods, WCAP-7588, Revision 1A, January 1975.
: 5. Taxelius, T. G., ed, Annual Report-SPERT Project, October 1968, September 1969, Idaho Nuclear Corporation, IN-1370, June 1970.
: 6. Liimataninen, R. C., and Testa, F. J., Studies in TREAT of Zircaloy-2-Clad, UO2-Core Simulated Fuel Elements, ANL-7225, January-June 1966, p 177, November 1966.
: 7. Liu, Y.S., et al., ANC - A Westinghouse Advanced Nodal Computer Code, WCAP-10965-P-A (Proprietary) and WCAP-10966-A (Nonproprietary), September 1986.Davidson, S. L., (Ed.), et al., ANC: A Westinghouse Advanced Nodal Computer Code, WCAP-10965-P-A (Proprietary) and WCAP-10966-A (Nonproprietary), September 1986.
: 8. Bishop, A. A., Sandberg, R. O., and Tong, L. S., Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux, ASME 65-HT-31, August 1965Not Used.
Tier 2 Material                                    15.4-39                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      234
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                              AP1000 Design Control Document
: 9. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A (Proprietary) and WCAP-11397-A (Nonproprietary), April 1989.
: 10. American National Standards Institute N18.2, Nuclear Safety Criteria for the Design of Stationary PWR Plants, 19721973.
: 11. AP1000 Code Applicability Report, WCAP-15644-P (Proprietary) and WCAP-15644-NP (Nonproprietary), Revision 2, March 2004.
: 12. Soffer, L. et al., Accident Source Terms for Light-Water Nuclear Power Plants, NUREG-1465, February 1995.
: 13. AP1000 Standard Combined License Technical Report, Bases of Digital Overpower and Overtemperature Delta-T (OPT / OT'T) Reactor Trips, APP-GW-GLR-137, Revision 1, February 2011Not Used.
: 14. Nguyen, T. Q., et al., Qualification of the PHOENIX-P/ANC Nuclear Design System for Pressurized Water Reactor Cores, WCAP-11596-P-A (Proprietary) and WCAP-11597-A (Nonproprietary), June 1988.
: 15. Ouisloumen, M., et. al., Qualification of the Two-Dimensional Transport Code PARAGON, WCAP-16045-P-A (Proprietary) and WCAP-16045-NP-A (Nonproprietary),
August, 2004.
: 16. Liu, Y.S., ANC - A Westinghouse Advanced Nodal Computer Code; Enhancements to ANC Rod Power Recovery, WCAP-10965-P-A, Addendum 1 (Proprietary) and WCAP-10966-A Addendum 1 (Nonproprietary), April 1989.
: 17. Letter from Liparulo, N.J. (Westinghouse) to Jones, R. C., (NRC), Notification to the NRC Regarding Improvements to the Nodal Expansion Method Used in the Westinghouse Advanced Nodal Code (ANC), NTD-NRC-95-4533, August 22, 1995.
: 18. Sung, Y.X., Schueren, P. and Meliksetian, A., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A (Proprietary) and WCAP-15306-NP-A (Nonproprietary), October 1999.
: 19. Stewart, C. W., et al., VIPRE-01: A Thermal/Hydraulic Code for Reactor Cores, Volumes 1,2,3 (Revision 3, August 1989), and Volume 4 (April 1987), NP-2511-CCM-A, Electric Power Research Institute, Palo Alto, California.
: 20. Foster, J.P. and Sidener, S., Westinghouse Improved Performance Analysis and Design Model (PAD 4.0), WCAP-15063-P-A, Revision 1 with Errata (Proprietary) and WCAP-15064-NP-A (Nonproprietary), July 2000
: 21. Zhang, B. et. al., Qualification of the NEXUS Nuclear Data Methodology, WCAP-16045-P-A Addendum 1-A (Proprietary) and WCAP-16045-NP-A Addendum 1-A (Nonproprietary), August, 2007.
Tier 2 Material                                    15.4-40                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                  235
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                            AP1000 Design Control Document
: 22. Zhang, B, et. al., Qualification of the New Pin Power Recovery Methodology, WCAP-10965-P-A, Addendum 2-A (Proprietary), September, 2010.
: 23. Smith, L. D., et. al. Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids, WCAP-15025-P-A (Proprietary) and WCAP-15026-NP-A (Nonproprietary), April 1999
: 24. NUREG-0800, Standard Review Plan, Section 4.2, Revision 3, Fuel System Design, Appendix B, Interim Acceptance Criteria and Guidance for the Reactivity Initiated Accidents, March 2007
: 25. Draft Regulatory Guide DG-1199, Proposed Revision 1 of Regulatory Guide 1.183; Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, October 2009. NRC ADAMS Accession Number: ML090960464
: 26. NRC Memorandum from Anthony Mendiola to Travis Tate, Technical Basis for Revised Regulatory Guide 1.183 (DG-1199) Fission Product Fuel-to-Cladding Gap Inventory, July 2011. NRC ADAMS Accession Number: ML111890397
: 27. Letter from Liparulo, N.J. (Westinghouse) to Jones, R. C., (NRC), Process Improvement to the Westinghouse Neutronics Code System, NSD-NRC-96-4679, March 29, 1996 Tier 2 Material                                  15.4-41                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                  236
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document Table 15.4-1 (Sheet 2 of 3)
TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN REACTIVITY AND POWER DISTRIBUTION ANOMALIES Time Accident                                    Event                        (seconds)
Chemical and volume control system malfunction that results in a decrease in the boron concentration in the rector coolant
: 1. Dilution during startup          Power range - low setpoint reactor trip due          0.0 to dilution Dilution automatically terminated by                215.0 demineralized water transfer and storage system isolation
: 2. Dilution during full-power Operation
: a. Automatic reactor control    Operator receives low-low rod insertion              0.0 limit alarm due to dilution Shutdown margin lost                              19,680
: b. Manual reactor control      Initiate dilution                                    0.0 Reactor trip on overtemperature 'T due to          180.0 dilution Dilution automatically terminated by                395.0 demineralized water transfer and storage system isolation RCCA ejection accident
: 1. Beginning of cycle, full        Initiation of rod ejection                          0.00 powerPCMI Limiting Event                                                                                              Commented [HZS19]: Ext-03 (CRR)
Peak nuclear power occurs Power range          0.140.03 high neutron flux (high setting) setpoint reached Reactor trip setpoint reached Peak nuclear    < 0.300.14 power occurs Peak cladding temperature occurs Rods          0.360.93 begin to fall into core Peak enthalpy deposition occurs Peak            0.442.36 cladding temperature occurs Tier 2 Material                                        15.4-43                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                237
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                    AP1000 Design Control Document Rods begin to fall into core Peak heat flux    1.202.37 occurs Peak fuel center temperature occurs                4.54 Tier 2 Material                        15.4-44                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                    238
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                              AP1000 Design Control Document Table 15.4-1 (Sheet 3 of 3)
TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN REACTIVITY AND POWER DISTRIBUTION ANOMALIES Time Accident                              Event                        (seconds)
: 2. Peak Clad Temperature      Initiation of rod ejection                          0.00 Limiting EventBeginning Peak nuclear power occursPower range            0.370.08 of cycle, zero power                                                                          Commented [HZS20]: Ext-03 (CRR) high neutron flux (low setting) setpoint reached Minimum DNBR occursPeak nuclear                0.440.11 power occurs Peak cladding temperature occursRods            1.270.11 begin to fall into core Reactor trip setpoint reached Peak heat flux  1.53< 0.30 occurs Rods begin to fall into corePeak cladding      2.551.20 temperature occurs
: 3. Peak enthalpy / Peak Fuel  Initiation of rod ejection                          0.00 Centerline Temperature Event                  Peak nuclear power occurs                            0.06 Reactor trip setpoint reached                      < 0.30 Rods begin to fall into core                        1.20 Peak fuel center temperature occurs                  2.50 Peak cladding temperature occurs                    2.80
: 3. End of cycle, full power    Initiation of rod ejection                          0.00 Power range high neutron flux (high                0.035 setting) setpoint reached Peak nuclear power occurs                            0.14 Rods begin to fall into core                        0.94 Peak cladding temperature occurs                    2.36 Peak heat flux occurs                                2.37 Peak fuel center temperature occurs                  4.34
: 4. End of cycle, zero power    Initiation of rod ejection                          0.00 Tier 2 Material                                  15.4-45                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          239
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                    AP1000 Design Control Document Power range high neutron flux (low setting)      0.23 setpoint reached Peak nuclear power occurs                        0.27 Rods begin to fall into core                      1.13 Peak cladding temperature occurs                  1.83 Peak heat flux occurs                            1.85 Peak fuel center temperature occurs              2.94 Tier 2 Material                        15.4-46                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                    240
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document Table 15.4-3 Not Used                                                    Commented [HZS21]: Ext-03 (CRR)
Table 15.4-3 PARAMETERS USED IN THE ANALYSIS OF THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT HZP(1)              HFP(2)              HZP              HFP Time in Life                Beginning          Beginning              End              End Power level (%)                              0                102(3)                0              102(3)
Ejected rod worth (%'k)                    0.65                0.37                0.75              0.30 Delayed neutron fraction (%)              0.49                0.49                0.44              0.44 Feedback reactivity weighting              2.155                1.22                2.9              1.35 Trip reactivity (%'k)                      2.0                  4.0                2.0              4.0 Fq before rod ejection                      -                  2.6                  -                2.6 Fq after rod ejection                      12.0                  4.9                19.6              6.0 Number of operational pumps                  2                    4                  2                4 Maximum fuel pellet average                2573                4118                2848              3926 temperature (&deg;F)
Maximum fuel center                        3018                4974                3263              4871 temperature (&deg;F)
Maximum cladding average                  1907                2265                2122              2151 temperature (&deg;F)
Maximum fuel stored energy (cal/g)          104                  181                117              170 Percent of fuel melted at hot spot          0                  <10                  0                <10 Notes:
: 1. HZP - Hot zero power
: 2. HFP - Hot full power
: 3. The main feedwater flow measurement supports a 1-percent power uncertainty; use of a 2-percent power uncertainty is conservative.
Tier 2 Material                                    15.4-48                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      241
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.4-4 (Sheet 1 of 2)
PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A ROD EJECTION ACCIDENT Initial reactor coolant iodine activity              An assumed iodine spike that has resulted in an increase in the reactor coolant activity to 60 PCi/g (22.2E+06 Bq/g) of      Commented [HZS21]: Ext-03 (CRR) dose equivalent I-131 (see Appendix 15A)(a)
Reactor coolant noble gas activity                    Equal to the operating limit for reactor coolant activity of 280 PCi/g (1.036E+07 Bq/g) dose equivalent Xe-133                Commented [HZS22]: Ext-03 (CRR)
Reactor coolant alkali metal activity                Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and                  10%1% of reactor coolant concentrations at maximum              Commented [HZS23]: Ext-03 alkali metal activity                                equilibrium conditions Radial peaking factor (for determination              1.6575                                                          Commented [HZS24]: Ext-03 (CRR) of activity in damagedfailed/melted fuel)
Fuel cladding failure
    -    Fraction of fuel rods assumed to            0.1 fail
    -    Fuel Enthalpy Increase (cal/gm)            60
    -    Fission product gap fractions Iodine 131                                  0.1238 Iodine 132                                  0.1338 Krypton 85                                  0.5120 Other noble gases                          0.1238 Other halogens                              0.0938 Alkali metalsIodines and noble gases        0.68600.1 Alkali metals                              0.12                                                            Commented [HZS25]: Ext-03 (CRR)
Core melting                                                                                                          Commented [HZS26]: Ext-03 (CRR)
    -    Fraction of core melting                    0.0025
    -    Fraction of activity released Iodines and alkali metals                  0.5 Noble gases                                1.0 Iodine chemical form (%)
    -    Elemental                                  4.85
    -    Organic                                    0.15
    -    Particulate                                95.0 Core activity                                        See Table 15A-3 in Appendix 15A Nuclide data                                          See Table 15A-4 in Appendix 15A Tier 2 Material                                        15.4-49                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                        242
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Reactor coolant mass (lb)                              3.7 E+05 (1.68E+05 kg)                                          Commented [HZS26]: Ext-03 (CRR)
Note:
: a. The assumption of a pre-existing iodine spike is a conservative assumption for the initial reactor coolant activity.
However, compared to the activity assumed to be released from damaged fuel, it is not significant.
Table 15.4-4 (Sheet 2 of 2)
PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A ROD EJECTION ACCIDENT Condenser                                              Not available Duration of accident (days)                            30 Atmospheric dispersion (/Q) factors                  See Table 15A-5 in Appendix 15A Secondary system release path
    -  Primary to secondary leak rate (lb/hr)        104.35(a) (47.4 kg/hr)                                          Commented [HZS27]: Ext-03 (CRR)
    -  Leak flashing fraction                        0.04(b)
    -  Secondary coolant mass (lb)                    6.06 E+05 (2.75E+05 kg)                                          Commented [HZS28]: Ext-03 (CRR)
    -  Duration of steam release from                1800 secondary system (sec)
    -  Steam released from secondary                  1.08 E+05 (4.90E+04 kg)                                          Commented [HZS29]: Ext-03 (CRR) system (lb)
    -  Partition coefficient in steam generators x Iodine                                      0.01 x Alkali metals                                0.0010.0035                                                      Commented [HZS30]: Ext-03 Containment leakage release path
    -  Containment leak rate (% per day) x 0-24 hr                                      0.10 x >24 hr                                      0.05
    -  Airborne activity removal coefficients (hr-1) x Elemental iodine                            1.97(c)                                                          Commented [HZS31]: Ext-03 x Organic iodine                              0 x Particulate iodine or alkali metals          0.1
    -  Decontamination factor limit for              200 elemental iodine removal
    -  Time to reach the decontamination              3.12.78                                                          Commented [HZS32]: Ext-03 factor limit for elemental iodine (hr)
Tier 2 Material                                        15.4-50                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                            243
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document Notes:
: a. Equivalent to 300 gpd (1.14 m3/day) cooled liquid at 62.4 lb/ft3(999.6 kg/m3).                          Commented [HZS33]: Ext-03 (CRR)
: b. No credit for iodine partitioning is taken for flashed leakage.
: c. From Appendix 15B.
Tier 2 Material                                        15.4-51                                Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                244
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                    AP1000 Design Control Document Figure 15.4.8-1 Commented [HZS34]: Ext-03 (CRR)
Nuclear Power Transient Versus Time at Beginning of Life, Full Powerfor the PCMI Rod Ejection Accident Tier 2 Material                          15.4-80                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    245
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                      AP1000 Design Control Document Figure 15.4.8-2 Commented [HZS35]: Ext-03 (CRR)
Nuclear Power Transient Versus Time for the High Clad Temperature Rod Ejection Hot Spot Fuel, Average Fuel, and Outer Cladding Temperature Versus Time at Beginning of Life, Full Power Tier 2 Material                            15.4-81                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      246
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                      AP1000 Design Control Document Figure 15.4.8-3 Commented [HZS36]: Ext-03 (CRR)
Nuclear Power Transient Versus Time for the Peak Enthalpy and Fuel Centerline Temperature Rod Ejection Accidentat End of Life, Zero Power Tier 2 Material                              15.4-82                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      247
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                              AP1000 Design Control Document Figure 15.4.8-4 Not Used                                    Commented [HZS37]: Ext-03 (CRR)
Tier 2 Material                  15.4-83                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                          248
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document A pressurizer safety valve is assumed to step open at the start of the event. The reactor coolant system then depressurizes until the overtemperature 'T reactor trip setpoint is reached.
Figure 15.6.1-3 shows the pressurizer pressure transient.
In the case where offsite power is lost, ac power is assumed to be lost 3 seconds after a turbine trip signal occurs. At this time, the reactor coolant pumps are assumed to start coasting down and reactor coolant system flow begins decreasing (Figure 15.6.1-5). The availability of offsite power has minimal impact on the pressure transient during the period of interest.
Prior to tripping of the reactor, the core power remains relatively constant (Figure 15.6.1-1). The minimum DNBR during the event occurs shortly after the rods begin to be inserted into the core (Figure 15.6.1-2). In the case where offsite power is lost, reactor trip has already been initiated and core heat flux has started decreasing when the reactor coolant system flow reduction starts.
The DNBR continues to increase when reactor coolant system flow begins to decrease due to the loss of offsite power. Therefore, the minimum DNBR occurs at the same time for cases with and without offsite power available. The DNBR remains above the design limit values as discussed in Section 4.4 throughout the transient.
The system response for inadvertent operation of the ADS is shown in Figures 15.6.1-6 through 15.6.1-10. The figures show the results for cases with and without offsite power available. The sequences of events are provided in Table 15.6.1-1. The responses for inadvertent operation of the ADS are very similar to those obtained for inadvertent opening of a pressurizer safety valve.
15.6.1.3    Conclusion The results of the analysis show that the overtemperature 'T reactor protection system signal provides adequate protection against the reactor coolant system depressurization events. The calculated DNBR remains above the design limit defined in Section 4.4. The long-term plant responses due to a stuck-open ADS valve or pressurizer safety valve, which cannot be isolated, is bounded by the small-break LOCA analysis.
15.6.2      Failure of Small Lines Carrying Primary Coolant Outside Containment                                Commented [HZS1]: Ext-03 The small lines carrying primary coolant outside containment are the reactor coolant system sample line and the discharge line from the chemical and volume control system to the liquid radwaste system. These lines are used only periodically. No instrument lines carry primary coolant outside the containment.
When excess primary coolant is generated because of boron dilution operations, the chemical and volume control system purification flow is diverted out of containment to the liquid radwaste system. Before passing outside containment, the flow stream passes through the chemical and volume control system heat exchangers and mixed bed demineralizer. The flow leaving the containment is at a temperature of less than 140&deg;F and has been cleaned by the demineralizer.
The flow out a postulated break in this line is limited to the chemical and volume control system purification flow rate of 100 gpm. Considering the low temperature of the flow and the reduced iodine activity because of demineralization, this event is not analyzed. The postulated sample line break is more limiting.
Tier 2 Material                                      15.6-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                249
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document A continuous sample of the RCS hot legs flows through the normally open isolation valves inside and outside containment. The sample line isolation valves inside and outside containment are open only when sampling. The failure of the sample line is postulated to occur between the isolation valve outside the containment and the sample panel. Because the isolation valves are open only when sampling, the The loss of sample flow provides indication of the break to plant personnel. In addition, a break in a sample line results in activity release and a resulting actuation of area and air radiation monitors. The loss of coolant reduces tends to reduce the pressurizer level and creates a demand for makeup to the reactor coolant system providing additional indication. Upon indication of a sample line break, the operator would take action to isolate the break.
The sample line includes a flow restrictor at the point of sample to limit the break flow to less than 130 gpm. The liquid sampling lines are 1/4 inch tubing which further restricts the break flow of a sampling line outside containment. Offsite doses are based on a conservative break flow of 130 gpm with isolation after 30 minutes.
15.6.2.1    Source Term The only significant radionuclide releases are the iodines and the noble gases. The analysis assumes that the reactor coolant iodine is at the maximum Technical Specification level for continuous operation. In addition, it is assumed that an iodine spike occurs at the time of the accident. The reactor coolant noble gas activities are assumed to be those associated with the design basis fuel defect level.
15.6.2.2    Release Pathway The reactor coolant that is spilled from the break is assumed to be at high temperature and pressure. A large portion of the flow flashes to steam, and the iodine in the flashed liquid is assumed to become airborne.
The iodine and noble gases are assumed to be released directly to the environment with no credit for depletion, although a large fraction of the airborne iodine is expected to deposit on building surfaces. No credit is assumed for radioactive decay after release.
15.6.2.3    Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.6.2.4    Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.6.2-1.
15.6.2.5    Identification of Conservatisms The assumptions used contain the following significant conservatisms:
x    The reactor coolant activities are based on a fuel defect level of 0.25 percent; whereas, the expected fuel defect level is far less than this (see Section 11.1).
Tier 2 Material                                      15.6-5                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          250
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document x    It is unlikely that the conservatively selected meteorological conditions would be present at the time of the accident.
15.6.2.6    Doses                                                                                                Commented [HZS2]: Ext-03 (CRR)
Using the assumptions from Table 15.6.2-1, the calculated total effective dose equivalent (TEDE) doses are determined to be < 1.1 3 rem at the exclusion area boundary and < 0.5 6 rem at the low population zone outer boundary. These doses are a small fraction of the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34. The phrase a small fraction is taken as being ten percent or less.
At the time the accident occurs, there is the potential for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour site boundary dose because pool boiling would not occur until after 2 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE and, when this is added to the dose calculated for the small line break outside containment, the resulting total dose remains less than the value reported above.
15.6.3      Steam Generator Tube Rupture 15.6.3.1    Identification of Cause and Accident Description 15.6.3.1.1 Introduction The accident examined is the complete severance of a single steam generator tube. The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited number of defective fuel rods within the allowance of the Technical Specifications. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system. In the event of a coincident loss of offsite power, or a failure of the condenser steam dump, discharge of radioactivity to the atmosphere takes place via the steam generator power-operated relief valves or the safety valves.
The assumption of a complete tube severance is conservative because the steam generator tube material (Alloy 690) is a corrosion-resistant and ductile material. The more probable mode of tube failure is one or more smaller leaks of undetermined origin. Activity in the secondary side is subject to continual surveillance, and an accumulation of such leaks, which exceeds the limits established in the Technical Specifications, is not permitted during operation.
The AP1000 design provides automatic protective actions to mitigate the consequences of an SGTR. The automatic actions include reactor trip, actuation of the passive residual heat removal (PRHR) heat exchanger, initiation of core makeup tank flow, termination of pressurizer heater operation, and isolation of chemical and volume control system flow and startup feedwater flow on high-2 steam generator level or high steam generator level coincident with reactor trip (P-4).
These protective actions result in automatic cooldown and depressurization of the reactor coolant system, termination of the break flow and release of steam to the atmosphere, and long-term Tier 2 Material                                      15.6-6                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    251
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.6.3.3    Radiological Consequences The evaluation of the radiological consequences of the postulated SGTR assumes that the reactor is operating with the design basis fuel defect level (0.25 percent of power produced by fuel rods containing cladding defects) and that leaking steam generator tubes result in a buildup of activity in the secondary coolant.
Following the rupture, any noble gases carried from the primary coolant into the ruptured steam generator via the break flow are released directly to the environment. The iodine and alkali metal activity entering the secondary side is also available for release, with the amount of release dependent on the flashing fraction of the reactor coolant and on the partition coefficient in the steam generator. In addition to the activity released through the ruptured loop, there is also a small amount of activity released through the intact loop.
15.6.3.3.1 Source Term The significant radionuclide releases from the SGTR are the noble gases, alkali metals and the iodines that become airborne and are released to the environment as a result of the accident.
The analysis considers two different reactor coolant iodine source terms, both of which consider the iodine spiking phenomenon. In one case, the initial iodine concentrations are assumed to be those associated with the equilibrium operating limits for primary coolant iodine activity. The iodine spike is assumed to be initiated by the accident with the spike causing an increasing level of iodine in the reactor coolant.
The second case assumes that the iodine spike occurs before the accident and that the maximum reactor coolant iodine concentration exists at the time the accident occurs.
The reactor coolant noble gas and alkali metal concentrations are assumed to be those associated with the design fuel defect level.
The secondary coolant iodine and alkali metal activity is assumed to be 10 1 percent of the        Commented [HZS3]: Ext-03 maximum equilibrium primary coolant activity.
15.6.3.3.2 Release Pathways The noble gas activity contained in the reactor coolant that leaks into the intact steam generator and enters the ruptured steam generator through the break is assumed to be released immediately as long as a pathway to the environment exists. There are three components to the modeling of iodine and alkali metal releases:
x    Intact loop steaming, with credit for partitioning of iodines and alkali metals (includes continued primary-to-secondary leakage at the maximum rate allowable by the Technical Specifications) x    Ruptured loop steaming, with credit for partitioning of iodines and alkali metals (includes modeling of increasing activity in the secondary coolant due to the break flow)
Tier 2 Material                                    15.6-14                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                252
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document x    Release of flashed reactor coolant through the ruptured loop, with no credit for scrubbing (this conservatively assumes that break location is at the top of the tube bundle)
Credit is taken for decay of radionuclides until release to the environment. After release to the environment, no consideration is given to radioactive decay or to cloud depletion of iodines by ground deposition during transport offsite.
15.6.3.3.3 Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.6.3.3.4 Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.6.3-3.
15.6.3.3.5 Identification of Conservatisms The assumptions used in the analysis contain a number of significant conservatisms, such as:
x    The reactor coolant activities are based on a fuel defect level of 0.25 percent; whereas, the expected fuel defect level is far less (see Section 11.1).
x    It is unlikely that the conservatively selected meteorological conditions are present at the time of the accident.
15.6.3.3.6 Doses Using the assumptions from Table 15.6.3-3, the calculated TEDE doses for the case in which the iodine spike is assumed to be initiated by the accident are determined to be less than 0.60.7 rem    Commented [HZS4]: Ext-03 (CRR) at the exclusion area boundary for the limiting 2-hour interval (0-2 hours) and less than 0.5 rem    Commented [HZS5]: Ext-03 at the low population zone outer boundary. These doses are a small fraction of the dose guideline    Commented [HZS6]: Ext-03 (CRR) of 25 rem TEDE identified in 10 CFR Part 50.34. A small fraction is defined, consistent with the Standard Review Plan, as being ten percent or less.
For the case in which the SGTR is assumed to occur coincident with a pre-existing iodine spike, the TEDE doses are determined to be less than 1.4 rem at the exclusion area boundary for the        Commented [HZS7]: Ext-03 (CRR) limiting 2-hour interval (0 to 2 hours) and less than 0.7 rem at the low population zone outer      Commented [HZS8]: Ext-03 (CRR) boundary. These doses are within the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34.
At the time the accident occurs, there is the potential for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour exclusion area boundary dose because pool boiling would not occur until after 2.0 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE and, when this is added to the doses calculated for the steam generator tube rupture, the resulting total doses remain as reported above.
Tier 2 Material                                      15.6-15                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    253
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                              AP1000 Design Control Document 15.6.5.3.1.3 Iodine Form The iodine form is consistent with the NUREG-1465 model. The model shows the iodine to be predominantly in the form of nonvolatile cesium iodide with a small fraction existing as elemental iodine. Additionally, the model assumes that a portion of the elemental iodine reacts with organic materials in the containment to form organic iodine compounds. The resulting iodine species split is as follows:
x    Particulate                    0.95 x    Elemental                      0.0485 x    Organic                        0.0015 If the post-LOCA cooling solution has a pH of less than 6.0, part of the cesium iodide may be converted to the elemental iodine form. The passive core cooling system provides sufficient trisodium phosphate to the post-LOCA cooling solution to maintain the solution pH at 7.0 or greater following a LOCA (see subsection 6.3.2.1.4).
15.6.5.3.2 In-containment Activity Removal Processes The AP1000 does not include active systems for the removal of activity from the containment atmosphere. The containment atmosphere is depleted of elemental iodine and of particulates as a result of natural processes within the containment.
Elemental iodine is removed by deposition onto surfaces. Particulates are removed by sedimentation, diffusiophoresis (deposition driven by steam condensation), and thermophoresis (deposition driven by heat transfer). No removal of organic iodine is assumed. Appendix 15B provides a discussion of the models and assumptions used in calculating the removal coefficients.
Particulates removed from the containment atmosphere to the containment shell are assumed to be washed off the shell by the flow of water resulting from condensing steam (i.e., condensate flow). The particulates may be either washed into the sump, which is controlled to a pH 7 post-accident or into the IRWST, which is not pH controlled post-accident. Due to the conditions in the IRWST, a portion of the particulate iodine washed into the IRWST may chemically convert to an elemental form and re-evolve, subject to partitioning, as airborne. A water-steam partition factor of 10 for elemental iodine is applied. This value bounds the time- dependent partition factors calculated using the NUREG/CR-5950 (Reference 36) models and the calculated IRWST water temperature and pH as a function of time.
The IRWST is a closed tank with weighted louvers, and without boiling, there would be no motive force for the release of re-evolved gaseous iodine from the IRWST gas space to the containment. Thus the assumption of boiling in the IRWST liquid is imposed to force the release of the re-evolved iodine to the containment atmosphere. A portion (3%) of the re- evolved elemental iodine is assumed to convert to an organic form upon its release to containment.        Commented [HZS9]: Ext-03 Tier 2 Material                                    15.6-21                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              254
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.6.5.3.3 Release Pathways The release pathways are the containment purge line and containment leakage. The activity releases are assumed to be ground level releases.
During the initial part of the accident, before the containment is isolated, it is assumed that containment purge is in operation and that activity is released through this pathway until the purge valves are closed. No credit is taken for the filters in the purge exhaust line.
The majority of the releases due to the LOCA are the result of containment leakage. The containment is assumed to leak at its design leak rate for the first 24 hours and at half that rate for the remainder of the analysis period.
15.6.5.3.4 Offsite Dose Calculation Models The offsite dose calculation models are provided in Appendix 15A. The models address the determination of the TEDE doses from the combined acute doses and the committed effective dose equivalent doses.
The exclusion area boundary dose is calculated for the 2-hour period over which the highest doses would be accrued by an individual located at the exclusion area boundary. Because of the delays associated with the core damage for this accident, the first 2 hours of the accident are not the worst 2-hour interval for accumulating a dose.
The low population zone boundary dose is calculated for the nominal 30-day duration of the accident.
For both the exclusion area boundary and low population zone dose determinations, the calculated doses are compared to the dose guideline of 25 rem TEDE from 10 CFR Part 50.34.
15.6.5.3.5 Main Control Room Dose Model There are two approaches used for modeling the activity entering the main control room. If power is available, the normal heating, ventilation, and air-conditioning (HVAC) system will switch over to a supplemental filtration mode (Section 9.4). The normal HVAC system is not a safety-class system but provides defense in depth.
Alternatively, if the normal HVAC is inoperable or, if operable, the supplemental filtration train does not function properly resulting in increasing levels of airborne iodine in the main control room, the emergency habitability system (Section 6.4) would be actuated when high iodine High-2 iodine or particulate activity is detected. The emergency habitability system provides passive        Commented [HZS10]: Ext-03 pressurization of the main control room from a bottled air supply to prevent inleakage of contaminated air to the main control room. The bottled air also induces flow through the passive air filtration system which filters contaminated air in the main control room. There is a 72-hour supply of air in the emergency habitability system. After this time, the main control room is assumed to be opened and unfiltered air is drawn into the main control room by way of an ancillary fan. After 7 days, offsite support is assumed to be available to reestablish operability of the control room habitability system by replenishing the compressed air supply. As a defense-in-Tier 2 Material                                      15.6-22                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    255
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document depth measure, the nonsafety-related normal control room HVAC would be brought back into operation with the supplemental filtration train if power is available.
The main control room is accessed by a vestibule entrance, which restricts the volume of contaminated air that can enter the main control room from ingress and egress. The design of the emergency habitability system (VES) provides 65 scfm +/-5 scfm to the control room and maintains it in a pressurized state. The path for the purge flow out of the main control room is through the vestibule entrance and this should result in a dilution of the activity in the vestibule and a reduction in the amount of activity that might enter the main control room. However, no additional credit is taken for dilution of the vestibule via the purge. The projected inleakage into the main control room through ingress/egress is 5 cfm. An additional 10 cfm of unfiltered inleakage is conservatively assumed from other sources.
Activity entering the main control room is assumed to be uniformly dispersed. With the VES in operation, airborne activity is removed from the main control room atmosphere via the passive        Commented [HZS11]: Ext-03 recirculation filtration portion of the VES.
The main control room dose calculation models are provided in Appendix 15A for the determination of doses resulting from activity which enters the main control room envelope.
15.6.5.3.6 Analytical Assumptions and Parameters The analytical assumptions and parameters used in the radiological consequences analysis are listed in Table 15.6.5-2.
15.6.5.3.7 Identification of Conservatisms The LOCA radiological consequences analysis assumptions include a number of conservatisms.
Some of these conservatisms are discussed in the following subsections.
15.6.5.3.7.1 Primary Coolant Source Term The source term is based on operation with the design fuel defect level of 0.25 percent; whereas, the expected fuel defect level is far less.
15.6.5.3.7.2 Core Release Source Term The assumed core melt is a major conservatism associated with the analysis. In the event of a postulated LOCA, no major core damage is expected. Release of activity from the core is limited to a fraction of the core gap activity.
15.6.5.3.7.3 Atmospheric Dispersion Factors The atmospheric dispersion factors assumed to be present during the course of the accident are conservatively selected. Actual meteorological conditions are expected to result in significantly higher dispersion of the released activity.
Tier 2 Material                                      15.6-23                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  256
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.6.5.3.8 LOCA Doses 15.6.5.3.8.1 Offsite Doses The doses calculated for the exclusion area boundary and the low population zone boundary are listed in Table 15.6.5-3. The doses are within the 10 CFR 50.34 dose guideline of 25 rem TEDE.
The reported exclusion area boundary doses are for the time period of 1.41.3 to 3.43.3 hours.        Commented [HZS12]: Ext-03 (CRR)
This is the 2-hour interval that has the highest calculated doses. The dose that would be incurred over the first 2 hours of the accident is well below the reported dose.
At the time the LOCA occurs, there is the potential for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour site boundary dose because pool boiling would not occur until after the limiting 2 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE and, when this is added to the dose calculated for the LOCA, the resulting total dose remains less than that reported in Table 15.6.5-3.
15.6.5.3.8.2 Doses to Operators in the Main Control Room                                                        Commented [HZS13]: Ext-03 The doses calculated for the main control room personnel due to airborne activity entering the main control room are listed in Table 15.6.5-3. Also listed on Table 15.6.5-3 are the doses due to direct shine from the activity in the adjacent buildings, shine from radioactivity accumulated on the VES or VBS filters, and sky-shine from the radiation that streams out the top of the containment shield building and is reflected back down by air-scattering. The total of the threethese dose paths is within the dose criteria of 5 rem TEDE as defined in GDC 19.
As discussed above for the offsite doses, there is the potential for a dose to the operators in the main control room due to iodine releases from postulated spent fuel boiling. The calculated dose from this source is less than 0.01 rem TEDE and is reported in Table 15.6.5-3.
15.6.5.4    Core and System Performance Subsection 15.6.5.4A describes the large-break LOCA analysis methodology and results.
Subsections 15.6.5.4B.1.0 through 15.6.5.4B.4.0 describe the small-break LOCA analysis methodology and results.
15.6.5.4A Large-Break LOCA Analysis Methodology and Results Westinghouse applies the WCOBRA/TRAC computer code to perform best-estimate large-break LOCA analyses in compliance with 10 CFR 50 (Reference 5). WCOBRA/TRAC is a thermal-hydraulic computer code that calculates realistic fluid conditions in a PWR during the blowdown and reflood of a postulated large-break LOCA. The methodology used for the AP1000 analysis is documented in WCAP-12945-P-A, WCAP-14171, Revision 2, and WCAP-16009-P-A (References 10, 11, and 32).
Tier 2 Material                                      15.6-24                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    257
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                              AP1000 Design Control Document case was chosen because it reaches sump recirculation at the earliest time (and highest decay heat). A window mode case at the minimum containment water level postulated to occur 2 weeks into long-term cooling was also performed.
The DEDVI small-break LOCA exhibits no core  ncover due to its adequate reactor coolant system mass inventory condition during the long-term cooling phase from initiation into containment recirculation. Adequate flow through the core is provided to maintain a low cladding temperature and to prevent any buildup of boric acid on the fuel rods. The wall-to-wall floodup case using the window mode technique demonstrates that effective core cooling is also provided at the minimum containment water level. The results of these cases demonstrate the capability of the AP1000 passive systems to provide long-term cooling for a limiting LOCA event.
15.6.6      References
: 1. 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors, and Appendix K to 10 CFR 50, ECCS Evaluation Models.
: 2. American Nuclear Society Proposed Standard, ANS 5.1 Decay Energy Release Rates Following Shutdown of Uranium-Cooled Thermal Reactors, October (1971), Revised October (1973).
: 3. Final Safety Evaluation Report Related to Certification of the AP600 Standard Design, NUREG-1512, September 1998.
: 4. Not used.
: 5. Emergency Core Cooling Systems; Revision to Acceptance Criteria, Federal Register, Vol. 53, No. 180, September 16, 1988.
: 6. Not used.
: 7. AP600 Design Control Document, Revision 3, December 1999.
: 8. Letter from R. C. Jones, Jr., (USNRC), to N. J. Liparulo, (W),
 
==Subject:==
Acceptance for Referencing of the Topical Report, WCAP-12945 (P), Westinghouse CQD for Best Estimate LOCA Analysis, June 28, 1996.
: 9. Not used.
: 10. Bajorek, S. M., et al., Code Qualification Document for Best-Estimate LOCA Analysis, WCAP-12945-P-A, Volume 1, Revision 2, and Volumes 2 through 5, Revision 1, and WCAP-14747 (Non-Proprietary), 1998.
: 11. Hochreiter, L. E., et al., WCOBRA/TRAC Applicability to AP600 Large-Break Loss-of-Coolant Accident, WCAP-14171, Revision 2 (Proprietary) and WCAP-14172, Revision 2 (Nonproprietary), March 1998.
Tier 2 Material                                    15.6-54                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                    258
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document
: 26. Kemper, R. M., Applicability of the NOTRUMP Computer Code to AP600 SSAR Small-Break LOCA Analyses, WCAP-14206 (Proprietary) and WCAP-14207 (Nonproprietary), November 1994.
: 27. Not used.
: 28. Zuber, et al., The Hydrodynamic Crisis in Pool Boiling of Saturated and Subcooled Liquids, Part II, No. 27, International Developments in Heat Transfer, 1961.
: 29. Griffith, et al., PWR Blowdown Heat Transfer, Thermal and Hydraulic Aspects of Nuclear Reactor Safety, ASME, New York, Volume 1, 1977.
: 30. Chang, S. H. et al. A study of critical heat flux for low flow of water in vertical round tubes under low pressure, Nuclear Engineering and Design, 132, 225-237, 1991.
: 31. Not used.
: 32. Nissley, M. E., et al., 2005, Realistic Large Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM), WCAP-16009-P-A and WCAP-16009-NP-A (Non-proprietary).
: 33. Dederer, S. I., et al., 1999, Application of Best Estimate Large Break LOCA Methodology to Westinghouse PWRs with Upper Plenum Injection, WCAP-14449-P-A, Revision 1 and WCAP-14450 (Non-proprietary).
: 34. APP-GW-GLE-026, Change to ASTRUM Methodology for Best Estimate Large Break Loss of Coolant Accident Analysis, Westinghouse Electric Company LLC.
: 35. Not Used.
: 36. Beahm, E. C. et al., NUREG/CR-5950, Iodine Evolution and pH Control, December 1992.                                                                                            Commented [HZS14]: Ext-03 Tier 2 Material                                    15.6-56                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  259
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.6.2-1 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A SMALL LINE BREAK OUTSIDE CONTAINMENT Reactor coolant iodine activity                        Initial activity equal to the design basis reactor coolant activity of 1.0 PCi/g dose equivalent I-131 with an assumed iodine spike that increases the rate of iodine release from fuel into the coolant by a factor of 500 (see Table 15A-2 in Appendix 15A)(a)
Reactor coolant noble gas activity                      280 PCi/g dose equivalent Xe-133 Break flow rate (gpm)                                  130(b)
Fraction of reactor coolant flashing                    0.410.47                                                      Commented [HZS15]: Ext-03 (CRR)
Duration of accident (hr)                                0.5 Atmospheric dispersion (/Q) factors                    See Table 15A-5 Nuclide data                                            See Table 15A-4 Notes:
: a. Use of accident-initiated iodine spike is consistent with the guidance in the Standard Review Plan.
: b. At density of 62.4 lb/ft3.
Tier 2 Material                                        15.6-58                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                            260
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.6.3-3 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A STEAM GENERATOR TUBE RUPTURE Reactor coolant iodine activity
  - Accident initiated spike                              Initial activity equal to the equilibrium operating limit for reactor coolant activity of 1.0 PCi/g dose equivalent I-131 with an assumed iodine spike that increases the rate of iodine release from fuel into the coolant by a factor of 335 (see Appendix 15A). Duration of spike is 5.3 8.0          Commented [HZS16]: Ext-03 (CRR) hours.
  - Preaccident spike                                      An assumed iodine spike that results in an increase in the reactor coolant activity to 60 PCi/g of dose equivalent I-131 (see Appendix 15A)
Reactor coolant noble gas activity                      280 PCi/g dose equivalent Xe-133 Reactor coolant alkali metal activity                    Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and alkali metal        10% 1% of reactor coolant concentrations at maximum          Commented [HZS17]: Ext-03 equilibrium conditions Reactor coolant mass (lb)                                3.84 E+053.7 E+05                                            Commented [HZS18]: Ext-03 (CRR)
Offsite power                                            Lost on reactor trip Condenser                                                Lost on reactor trip Time of reactor trip                                    Beginning of the accident Duration of steam releases (hr)                          13.1915.94                                                    Commented [HZS19]: Ext-03 (CRR)
Atmospheric dispersion factors                          See Appendix 15A Nuclide data                                            See Appendix 15A Steam generator in ruptured loop
  - Initial secondary coolant mass (lb)                    1.66 E+051.16 E+05                                            Commented [HZS20]: Ext-03 (CRR)
  - Primary-to-secondary break flow                        See Figure 15.6.3-5
  - Integrated flashed break flow (lb)                    See Figure 15.6.3-10
  - Steam released (lb)                                    See Table 15.6.3-2
  - Iodine partition coefficient                          1.0 E-02(a)
  - Alkali metals partition coefficient                    1.0 E-03(a) 3.5 E-03(a)                                      Commented [HZS21]: Ext-03 Steam generator in intact loop
  - Initial secondary coolant mass (lb)                    2.00 E+052.30 E+04                                            Commented [HZS22]: Ext-03 (CRR)
  - Primary-to-secondary leak rate (lb/hr)                52.14(b) 52.16(b)                                            Commented [HZS23]: Ext-03 (CRR)
  - Steam released (lb)                                    See Table 15.6.3-2
  - Iodine partition coefficient                          1.0 E-02(a)
  - Alkali metals partition coefficient                    1.0 E-03(a) 3.5 E-03(a)                                      Commented [HZS24]: Ext-03 Notes:
: a. Iodine Ppartition coefficient does not apply to flashed break flow.
Tier 2 Material                                        15.6-61                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                            261
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document
: b. Equivalent to 150 gpd at psia cooled liquid at 62.4 lb/ft3.
Tier 2 Material                                        15.6-62                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    262
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.6.5-2 (Sheet 1 of 3)
ASSUMPTIONS AND PARAMETERS USED IN CALCULATING RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT Primary coolant source data
-  Noble gas concentration                                                280 PCi/g dose equivalent Xe-133
-  Iodine concentration                                                  1.0 PCi/g dose equivalent I-131
-  Primary coolant mass (lb)                                              3.72 E+054.39 E+05                    Commented [HZS25]: Ext-03 (CRR)
Containment purge release data
-  Containment purge flow rate (cfm)                                      880016,000                            Commented [HZS26]: Ext-03 (CRR)
-  Time to isolate purge line (seconds)                                  30
-  Time to blow down the primary coolant system (minutes)                10
-  Fraction of primary coolant iodine that becomes airborne              0.51.0                                Commented [HZS27]: Ext-03 Core source data
-  Core activity at shutdown                                              See Table 15A-3
-  Release of core activity to containment atmosphere (timing and        See Table 15.6.5-1 fractions)
-  Iodine species distribution (%)
x    Elemental                                                        4.85 x    Organic                                                          0.15 x    Particulate                                                      95 Containment leakage release data
-  Containment volume (ft3)                                              2.06 E+06
-  Containment leak rate, 0-24 hr (% per day)                            0.10
-  Containment leak rate, > 24 hr (% per day)                            0.05
-  Elemental iodine deposition removal coefficient (hr-1)                1.71.9                                Commented [HZS28]: Ext-03 (CRR)
-  Decontamination factor limit for elemental iodine removal              200
-  Removal coefficient for particulates (hr-1)                            See Appendix 15B Main control room model
-  Main control room volume (ft3)                                        35,7003.89 E+04                      Commented [HZS29]: Ext-03
-  Volume of HVAC, including main control room and control support        105,5001.158 E+05                    Commented [HZS30]: Ext-03 area (ft3)
-  Normal HVAC operation (prior to switchover to an emergency mode) x    Air intake flow (cfm)                                            19251650                              Commented [HZS31]: Ext-03 x    Filter efficiency                                                Not applicable
-  Atmospheric dispersion factors (sec/m3)                                See Table 15A-6 Tier 2 Material                                        15.6-64                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    263
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.6.5-2 (Sheet 2 of 3)
ASSUMPTIONS AND PARAMETERS USED IN CALCULATING RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT Main control room model (cont.)
-  Occupancy x    0        -  24 hr                                                    1.0 x    24        -  96 hr                                                    0.6 x    96        -  720 hr                                                    0.4
-  Breathing rate (m3/sec)                                                      3.5 E-04 Control room with emergency habitability system credited (VES Credited)
-  Main control room activity level at which the emergency habitability system  2.0 E-062.0 E-07            Commented [HZS32]: Ext-03 actuation is actuated (Ci/m3 of dose equivalent I-131)
-  Response time to actuate VES based on radiation monitor response time and    180200                      Commented [HZS33]: Ext-03 VBS isolation (sec)
-  Interval with operation of the emergency habitability system x    Flow from compressed air bottles of the emergency habitability system  60 (cfm) x    Unfiltered inleakage via ingress/egress (scfm)                          5 x    Unfiltered inleakage from other sources (scfm)                          10 x    Recirculation flow through filters (scfm)                              600 x    Filter efficiency (%)
o Elemental iodine                                                        90 o Organic iodine                                                          3090                        Commented [HZS34]: Ext-03 o Particulates                                                            99
-  Time at which the compressed air supply of the emergency habitability        72 system is depleted (hr)
-  After depletion of emergency habitability system bottled air supply (>72 hr) x    Air intake flow (cfm)                                                  17001900                    Commented [HZS35]: Ext-03 x    Intake flow filter efficiency (%)                                      Not applicable x    Recirculation flow (cfm)                                                Not applicable
-  Time at which the compressed air supply is restored and emergency            168 habitability system returns to operation (hr)
Tier 2 Material                                        15.6-65                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              264
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.6.5-2 (Sheet 3 of 3)
ASSUMPTIONS AND PARAMETERS USED IN CALCULATING RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT Control room/CSA with credit for continued operation of HVAC (VBS Supplemental Filtration Mode Credited)
-  Time delay to switch from normal operation to the supplemental air    60265                          Commented [HZS36]: Ext-03 filtration mode (sec)
-  Unfiltered air inleakage (cfm)Unfiltered inleakage via ingress/egress  2510                            Commented [HZS37]: Ext-03
-  Unfiltered inleakage from other sources (cfm)                          50                              Commented [HZS38]: Ext-03
-  Filtered air intake flow (cfm)                                        860800                          Commented [HZS39]: Ext-03
-  Filtered air recirculation flow (cfm)                                  27403200                        Commented [HZS40]: Ext-03
-  Filter efficiency (%)
o Elemental iodine                                                    9099                            Commented [HZS41]: Ext-03 o Organic iodine                                                      9099                            Commented [HZS42]: Ext-03 o Particulates                                                        99 Miscellaneous assumptions and parameters
-  Offsite power                                                          Not applicable
-  Atmospheric dispersion factors (offsite)                              See Table 15A-5
-  Nuclide dose conversion factors                                        See Table 15A-4
-  Nuclide decay constants                                                See Table 15A-4
-  Offsite breathing rate (m3/sec) 0  - 8 hr                                                      3.5 E-04 8  - 24 hr                                                      1.8 E-04 24 - 720 hr                                                      2.3 E-04 Tier 2 Material                                      15.6-66                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            265
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document Table 15.6.5-3                                          Commented [HZS43]: Ext-03 RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT WITH CORE MELT TEDE Dose (rem)
Exclusion zone boundary dose (1.4 - 3.4 hr)(1)                                          24.623.5 Low population zone boundary dose (0 - 30 days)                                        23.422.2 Main control room dose (emergency habitability system in operation)
-  Airborne activity entering the main control room                                    4.253.70
-  Direct radiation from adjacent structures, including sky shine                      0.150.30
-  Sky-shineFilter shine                                                              0.010.32
-  Spent fuel pooling boiling                                                            0.01
-  Total                                                                              4.414.33 Main control room dose (normal HVAC operating in the supplemental filtration mode)
-  Airborne activity entering the main control room                                    4.564.50
-  Direct radiation from adjacent structures, including sky shine                      0.150.30
-  Sky-shineFilter shine                                                              0.010.03
-  Spent fuel pooling boiling                                                            0.01
-  Total                                                                              4.734.84 Note:
: 1. This is the 2-hour period having the highest dose.
Tier 2 Material                                        15.6-67                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            266
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.7.4.1.3 Assembly Power Level All fuel assemblies are assumed to be handled inside the containment during the core shuffle so a peak power assembly is considered for the accident. Any fuel assembly can be transferred to the spent fuel pool; during a core off-load, all fuel assemblies are discharged to the spent fuel pool.
To obtain a bounding condition for the fuel handling accident analysis, it is assumed that the accident involves a fuel assembly that operated at the maximum rated fuel rod peaking factor.
This is conservative because the entire fuel assembly does not operate at this level.
15.7.4.1.4 Radiological Decay The fission product decay time experienced prior to the fuel handling accident is at least 48 hours.
15.7.4.2    Release Pathways                                                                                    Commented [HZS1]: Ext-03 The spent fuel handling operations take place underwater. Thus, activity releases are first scrubbed by the column of water 23 feet in depth. This has no effect on the releases of noble gases or organic iodine but there is a significant removal of elemental iodine. Consistent with the guidance in Regulatory Guide 1.183, the overall pool scrubbing decontamination factor for iodine is assumed to be 200.
In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, there may be less than 23 feet of water above the top of the fuel bundle and the surface of the water, indicated by the width of the bundle. The fuel handling accident analysis bounds the case of a single bundle lying horizontally on top of the spent fuel racks by demonstrating that the overall decontamination factor of 200 is valid for pool depths of 21.5 feet.
After the activity escapes from the water pool, it is assumed that it is released directly to the environment within a 2-hour period without credit for any additional iodine removal process.
If the fuel handling accident occurs in the containment, the release of activity can be terminated by closure of the containment purge lines on detection of high radioactivity. No credit is taken for this in the analysis. Additionally, no credit is taken for removal of airborne iodine by the filters in the containment purge lines.
For the fuel handling accident postulated to occur in the spent fuel pool, there is assumed to be no filtration in the release pathway. Activity released from the pool is assumed to pass directly to the environment with no credit for holdup or delay of release in the building.
15.7.4.3    Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
Table 15.7-1 lists the assumptions used in the analysis. The guidance of Regulatory Guide 1.183 is reflected in the analysis assumptions.
Tier 2 Material                                      15.7-3                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                267
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document 15.7.4.4.8 Time Available for Radioactive Decay The dose analysis assumes that the fuel handling accident involves one of the first fuel assemblies handled. If it were one of the later fuel handling operations, there is additional decay and a reduction in the source term.
The dose evaluation was performed assuming 48 hours decay.
15.7.4.5    Offsite Doses                                                                                      Commented [HZS2]: Ext-03 (CRR)
Using the assumptions from Table 15.7-1, the calculated doses from the initial releases are determined to be 2.72.8 rem TEDE at the site boundary and 1.2 rem TEDE at the low population zone outer boundary. These doses are well within the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34. The phrase "well within" is taken as meaning 25 percent or less.
15.7.5      Spent Fuel Cask Drop Accident The spent fuel cask handling crane is prevented from travelling over the spent fuel. No radiological consequences analysis is necessary for the dropped cask event.
15.7.6      Combined License Information Combined License applicant referencing the AP1000 certified design will perform an analysis of the consequences of potential release of radioactivity to the environment due to a liquid tank failure as outlined in subsection 15.7.3.
15.7.7      References
: 1. Sofer, L., et al., "Accident Source Terms for Light-Water Nuclear Power Plants,"
NUREG-1465, February 1995.
: 2. U. S. NRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, " July 2000.
Tier 2 Material                                    15.7-5                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    268
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document Table 15.7-1                                                        Commented [HZS3]: Ext-03 (CRR)
ASSUMPTIONS USED TO DETERMINE FUEL HANDLING ACCIDENT RADIOLOGICAL CONSEQUENCES Source term assumptions
    -    Core power (MWt)                                          34683434(1)
    -    Decay time (hr)                                            48 Core source term after 48 hours decay (Ci)
I-130                                                      2.491.28 E+05 I-131                                                      8.26 8.18 E+07 I-132                                                      9.27 9.10 E+07 I-133                                                      4.11 4.06 E+07 I-135                                                      1.21 1.17 E+06 Kr-85m                                                    1.59 1.52 E+04 Kr-85                                                      1.05 1.07 E+06 Kr-88                                                      5.81 5.45 E+02 Xe-131m                                                    1.051.02 E+06 Xe-133m                                                    4.374.47 E+06 Xe-133                                                    1.691.70 E+08 Xe-135m                                                    1.941.91 E+05 Xe-135                                                    1.081.04 E+07 Number of fuel assemblies in core                                  157 Amount of fuel damage                                              One assembly Maximum rod radial peaking factor                                  1.651.75 Percentage of fission products in gap I-131                                                      8 Other iodines                                              5 Kr-85                                                      10 Other noble gases                                          5 Pool decontamination factor for iodine                              200 Activity release period (hr)                                        2 Atmospheric dispersion factors                                      See Table 15A-5 in Appendix 15A Breathing rates (m3/sec)                                            3.5 E-4 Nuclide data                                                        See Appendix 15A Note:
: 1. The main feedwater flow measurement supports a 1-percent power uncertainty; use of a 2-percent power uncertainty is conservative.
Tier 2 Material                                    15.7-6                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      269
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document accident and for which the peak primary coolant activity is reached at the time the accident is assumed to occur. These isotopic concentrations are also defined as 60 PCi/g dose equivalent I-131. The probability of this adverse timing of the iodine spike and accident is small.
Although it is unlikely for an accident to occur at the same time that an iodine spike is at its maximum reactor coolant concentration, for many accidents it is expected that an iodine spike would be initiated by the accident or by the reactor trip associated with the accident. Table 15A-2 lists the iodine appearance rates (rates at which the various iodine isotopes are transferred from the core to the primary coolant by way of the assumed cladding defects) for normal operation.
The iodine spike appearance rates are assumed to be as much as 500 times the normal appearance rates.
15A.3.1.2 Secondary Coolant Source Term                                                                          Commented [HZS1]: Ext-03 The secondary coolant source term used in the radiological consequences analyses is conservatively assumed to be 101 percent of the primary coolant equilibrium source term. This is more conservative than using the design basis secondary coolant source terms listed in Table 11.1-5.
Because the iodine spiking phenomenon is short-lived and there is a high level of conservatism for the assumed secondary coolant iodine concentrations, the effect of iodine spiking on the secondary coolant iodine source terms is not modeled.
There is assumed to be no secondary coolant noble gas source term because the noble gases entering the secondary side due to primary-to-secondary leakage enter the steam phase and are discharged via the condenser air removal system.
15A.3.1.3 Core Source Term Table 15A-3 lists the core source terms at shutdown for an assumed three-region equilibrium cycle at end of life after continuous operation at 2 percent above full core thermal power. The main feedwater flow measurement supports a 1-percent power uncertainty; use of a 2-percent power uncertainty is conservative. In addition to iodines and noble gases, the source terms listed include nuclides that are identified as potentially significant dose contributors in the event of a degraded core accident. The design basis loss-of-coolant accident analysis is not expected to result in significant core damage, but the radiological consequences analysis assumes severe core degradation.
15A.3.2    Nuclide Parameters The radiological consequence analyses consider radioactive decay of the subject nuclides prior to their release, but no additional decay is assumed after the activity is released to the environment.
Table 15A-4 lists the decay constants for the nuclides of concern.
Table 15A-4 also lists the dose conversion factors for calculation of the CEDE doses due to inhalation of iodines and other nuclides and EDE dose conversion factors for calculation of the dose due to immersion in a cloud of activity. The CEDE dose conversion factors are from EPA Tier 2 Material                                      15A-4                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  270
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document Table 15A-6                                              Commented [HZS2]: Ext-03 CONTROL ROOM ATMOSPHERIC DISPERSION FACTORS (/Q)
FOR ACCIDENT DOSE ANALYSIS
                        /Q (s/m3) at HVAC Intake for the Identified Release Points(1)
Ground Level Plant Vent or    Containment      PORV and        Steam Line        Fuel    Condenser PCS Air          Release      Safety Valve        Break        Handling  Air Removal Diffuser(3)      Points(4)    Releases(5)      Releases      Area(6)    Stack(7) 0 - 2 hours    3.0E-3 2.53E-    6.0E-34.00E-    2.0E-21.92E-        2.13E-        6.0E-3    6.0E-3 03              03              02          022.4E-2 2 - 8 hours    2.5E-31.98E-    3.6E-32.28E-    1.8E-21.60E-    2.0E-21.76E-      4.0E-3    4.0E-3 03              03              02              02 8 - 24 hours  1.0E-37.96E-    1.4E-31.03E-    7.0E-36.90E-    7.5E-37.50E-      2.0E-3    2.0E-3 04              03              03              03 1 - 4 days    8.0E-4 6.40E-    1.8E-39.03E-    5.0E-34.96E-    5.5E-35.43E-      1.5E-3    1.5E-3 04              04              03              03 4 - 30 days    6.0E-4 4.78E-    1.5E-37.13E-    4.5E-34.16E-    5.0E-34.55E-      1.0E-3    1.0E-3 04              04              03              03
                    /Q (s/m3) at Annex Building Door for the Identified Release Points(2)
Ground Level Plant Vent or    Containment      PORV and      Steam Line        Fuel    Condenser PCS Air          Release      Safety Valve      Break        Handling  Air Removal Diffuser(3)      Points(4)      Releases(5)      Releases      Area(6)    Stack(7) 0 - 2 hours        1.0E-3          1.0E-3          4.0E-3          4.0E-3        6.0E-3    2.0E-2 2 - 8 hours        7.5E-4          7.5E-4          3.2E-3          3.2E-3        4.0E-3    1.8E-2 8 - 24 hours      3.5E-4          3.5E-4          1.2E-3          1.2E-3        2.0E-3    7.0E-3 1 - 4 days        2.8E-4          2.8E-4          1.0E-3          1.0E-3        1.5E-3    5.0E-3 4 - 30 days        2.5E-4          2.5E-4          8.0E-4          8.0E-4        1.0E-3    4.5E-3 Tier 2 Material                                    15A-15                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          271
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15A-7                                                      Commented [HZS3]: Ext-03 CONTROL ROOM SOURCE/RECEPTOR DATA FOR DETERMINATION OF ATMOSPHERIC DISPERSION FACTORS Horizontal Straight-Line Distance To Receptor Control Room Release            HVAC Intake          Annex Building Elevation      (Elevation 19.919.7            Access Source                  Note 1                    m)            (Elevation 1.5 m)
Description                  (m)                    (1)                  (2)              Comment Plant Vent            ( 1)          55.7              147.2 ft128 ft        379.3 ft350 ft (44.9 m)(39.0m)      (115.6 m)(106.6 m)
PCS Air Diffuser      ( 2)          69.8            118.1 ft 114 ft        343.2 ft332 ft (104.6 m)
(36.0 m)(34.7 m)          (101.1 m)
Fuel Building Auxiliary              17.4            203.2 ft 201 ft        427.4 ft416 ft          Note 3 Building Fuel Handling                                                          (130.3 m)
Area                                                  (61.9 m)(61.2 m)          (126.8 m)
Blowout Panel          ( 3)
Radwaste Building                      1.5              218.5 ft204 ft        433.5 ft411 ft          Note 3 Truck Staging                                                                    (132.1 m)
Area Door              ( 4)                          (66.6 m)(62.1 m)          (125.2 m)
Steam Vent            ( 5)          17.1              61.5 ft55 ft          261.6 ft250 ft (18.8 m)                (79.7 m)
(16.7 m)                (76.2 m)
PORV/Safety                          19.2              66.9 ft58 ft          255.4 ft235 ft Valves                ( 6)                              (20.4 m)                (77.8 m)
(17.6 m)                (71.6 m)
Condenser Air                      38.449.5            198.3 ft307 ft          58.3 ft112 ft          Note 3 Removal Stack          ( 7)                                (60.4 m)              (17.8 m)
(93.5 m)                (34.1 m)
Containment Shell              Same as Receptor        42.0 ft 48 ft        272.3 ft268 ft          Note 2 (Diffuse Area                      Elevation              (12.8 m)                (83.0 m)
Source)                ( 8)      (19.919.7 m or          (14.6 m)                (81.6 m) 1.5 m)
Notes:
: 1. All elevations relative to grade at 0.0 m.
: 2. For calculating distance, the source is defined as the point on the containment shell closest to receptor.
: 3. Vertical distance traveled is conservatively neglected.
: 4.    - Refer to Symbols on Figure 15A-1.
: 5.  - Refer to Symbols on Figure 15A-1.
Tier 2 Material                                        15A-18                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      272
 
DCP_NRC_003343            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                  AP1000 Design Control Document Figure 15A-1 Commented [HZS4]: Ext-03 Site Plan with Release and Intake Locations Tier 2 Material          15A-19                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                              273
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                AP1000 Design Control Document APPENDIX 15B REMOVAL OF AIRBORNE ACTIVITY FROM THE CONTAINMENT ATMOSPHERE FOLLOWING A LOCA The AP1000 design does not depend on active systems to remove airborne particulates or elemental iodine from the containment atmosphere following a postulated loss-of-coolant accident (LOCA) with core melt. Naturally occurring passive removal processes provide significant removal capability such that airborne elemental iodine is reduced to very low levels within a few hours and the airborne particulates are reduced to extremely low levels within 12 hours.
15B.1      Elemental Iodine Removal Elemental iodine is removed by deposition onto the structural surfaces inside the containment.
The removal of elemental iodine is modeled using the equation from the Standard Review Plan (Reference 1):
KwA Od =
V where:
Od      =  first order removal coefficient by surface deposition Kw      =  mass transfer coefficient (specified in Reference 1 as 4.9 m/hr)
A        =  surface area available for deposition V        =  containment building volume The available deposition surface is 219,000251,000 ft2, and the containment building net free volume is 2.06 x 106 ft3. From these inputs, the elemental iodine removal coefficient is 1.71.9 hr-1
            .                                                                                                  Commented [HZS1]: Ext-03 Consistent with the guidance of Reference 1, credit for elemental iodine removal is assumed to continue until a decontamination factor (DF) of 200 is reached in the containment atmosphere.
Because the source term for the LOCA (defined in subsection 15.6.5.3) is modeled as a gradual release of activity into the containment, the determination of the time at which the DF of 200 is reached needs to be based on the amount of elemental iodine that enters the containment atmosphere over the duration of core activity release.
15B.2      Aerosol Removal The deposition removal of aerosols from the containment atmosphere is accomplished by a number of processes including sedimentation, diffusiophoresis, and thermophoresis. All three of the deposition processes are significant contributors to the overall removal process in the AP1000. The large contributions from diffusiophoresis and thermophoresis to the total removal Tier 2 Material                                      15B-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                274
 
DCP_NRC_003343                                  Westinghouse Non-Proprietary Class 3 Secondary Specific Activity 3.7.4 3.7 PLANT SYSTEMS 3.7.4  Secondary Specific Activity                                                                  Commented [HZS10]: Ext-03 LCO 3.7.4              The specific activity of the secondary coolant shall be < 0.10.01 Ci/gm DOSE EQUIVALENT I-131.
APPLICABILITY:          MODES 1, 2, 3 and 4.
ACTIONS CONDITION                          REQUIRED ACTION                  COMPLETION TIME A. Specific activity not        A.1        Be in MODE 3.                6 hours within limit.
AND A.2        Be in MODE 5.                36 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE                                        FREQUENCY SR 3.7.4.1        Verify the specific activity of the secondary coolant      31 days 0.10.01 Ci/gm DOSE EQUIVALENT I-131.
AP1000                                        3.7.4 - 1                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      275
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 RCS Specific Activity B 3.4.10 BASES APPLICABLE SAFETY ANALYSES (continued) assumed to be the LCO of 280 Ci/gm DOSE EQUIVALENT XE-133.
The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.10.01 Ci/gm DOSE EQUIVALENT I-131 from LCO 3.7.4,            Commented [HZS1]: Ext-03 Secondary Specific Activity.
The LCO limits ensure that, in either case, the doses reported in Chapter 15 remain bounding.
The RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              The specific iodine activity is limited to 1.0 Ci/gm DOSE EQUIVALENT I-131, and the specific noble gas activity is limited to 280 Ci/gm DOSE EQUIVALENT XE-133. These limits ensure that the doses resulting from a DBA will be within the values reported in Chapter 15. Secondary coolant activities are addressed by LCO 3.7.4, Secondary Specific Activity.
The SLB and SGTR accident analyses (Refs. 1 and 2) show that the offsite doses are within acceptance limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR accident, lead to doses that exceed those reported Chapter 15.
APPLICABILITY    In MODES 1 and 2, and in MODE 3 with RCS average temperature 500&deg;F, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 specific activity are necessary to contain the potential consequences of a SGTR to within the calculated site boundary dose values.
For operation in MODE 3 with RCS average temperature < 500&deg;F and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves.
ACTIONS          A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to verify that DOSE EQUIVALENT I-131 is  60 Ci/gm. The Completion Time of 4 hours is required to obtain and analyze a sample. Sampling is to continue to provide a trend.
AP1000                                  B 3.4.10 - 2                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  276
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 Secondary Specific Activity B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Secondary Specific Activity BASES BACKGROUND          Activity in the secondary coolant results from steam generator tube LEAKAGE from the Reactor Coolant System (RCS). Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant. While fission products present in the primary coolant, as well as activated corrosion products, enter the secondary coolant system due to the primary to secondary LEAKAGE, only the iodines are of a significant concern relative to airborne release of activity in the event of an accident or abnormal occurrence (radioactive noble gases that enter the secondary side are not retained in the coolant but are released to the environment via the condenser air removal system throughout normal operation).
The limit on secondary coolant radioactive iodines minimizes releases to the environment due to anticipated operational occurrences or postulated accidents.
APPLICABLE          The accident analysis of the main steam line break (SLB) as discussed in SAFETY              Chapter 15 (Ref. 1) assumes the initial secondary coolant specific activity ANALYSES            to have a radioactive isotope concentration of 0.10.01 Ci/gm DOSE              Commented [HZS3]: Ext-03 EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident.
The accident analysis, based on this and other assumptions, shows that the radiological consequences of a postulated SLB are within the acceptance criteria in SRP Section 15.0.1, and within the exposure guideline values of 10 CFR Part 50.34.
Secondary specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                As indicated in the Applicable Safety Analyses, the specific activity limit of the secondary coolant is required to be  0.10.01 Ci/gm DOSE                  Commented [HZS4]: Ext-03 EQUIVALENT I-131 to maintain the validity of the analyses reported in Chapter 15 (Ref. 1).
Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.
AP1000                                    B 3.7.4 - 1                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    277
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Main Control Room Emergency Habitability System (VES)
BASES BACKGROUND          The Main Control Room Emergency Habitability System (VES) provides a protected environment from which operators can control the plant following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. The system is designed to operate following a Design Basis Accident (DBA) which requires protection from the release of radioactivity.
In these events, the Nuclear Island Non-Radioactive Ventilation System (VBS) would continue to function if AC power is available. If AC power is lost for greater than 10 minutes, or Low main control room differential pressure is sensed for greater than 10 minutes, or a High-2 iodine or particulate Main Control Room Envelope (MCRE) radiation signal is received, the VES is actuated. The MCRE radioactivity is measured by detectors in the MCR supply air duct, downstream of the filtration units. Commented [HZS2]: Ext-03 The major functions of the VES are: 1) to provide forced ventilation to deliver an adequate supply of breathable air (Ref. 4) for the MCRE occupants; 2) to provide forced ventilation to maintain the MCRE at a 1/8 inch water gauge positive pressure with respect to the surrounding areas;
: 3) provide passive filtration to filter contaminated air in the MCRE; and
: 4) to limit the temperature increase of the MCRE equipment and facilities that must remain functional during an accident, via de-energizing (load shedding) nonessential, non-safety main control room (MCR) electrical equipment (e.g., wall panel information system displays, office equipment, water heater, kitchen appliances, and non-emergency lighting) andthe heat absorption of passive heat sinks.                                      Commented [HZS3]: Ext-02 The VES consists of compressed air storage tanks, two air delivery flow paths, an eductor, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), associated valves or dampers, piping, and instrumentation. The tanks contain enough breathable air to supply the required air flow to the MCRE for at least 72 hours. The VES system is designed to maintain CO2 concentration less than 0.5% for up to 11 MCRE occupants.
AP1000                                    B 3.7.6 - 1                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                278
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 The compressed air storage tanks are initially filled to contain greater than 327,574 scf of compressed air. The compressed air storage tanks, the tank pressure, and the room temperature are monitored to confirm that the required volume of breathable air is stored. During operation of the VES, a self contained self-contained pressure regulating valve            Commented [HZS8]: Ext-02 maintains a constant downstream pressure regardless of the upstream pressure. An orifice downstream of the regulating valve is used to control the air flow rate into the MCRE. The MCRE is maintained at a 1/8 inch water gauge positive pressure to minimize the infiltration of airborne contaminants from the surrounding areas. The VES operation in maintaining the MCRE habitable is discussed in Reference 1.
APPLICABLE      The compressed air storage tanks are sized such that the set of tanks SAFETY          has a combined capacity that provides at least 72 hours of VES ANALYSES        operation.
Operation of the VES is automatically initiated by any of the following safety related signals:
x    Main Control Room Air Supply Iodine or Particulate Radiation -
High-2high-2 particulate or iodine radioactivity.
x    Loss of all AC power for more than 10 minutes; or x    Main Control Room differential pressure - Low (for greater than 10 minutes)                                                            Commented [HZS9]: Ext-03 In the event of a loss of all AC power, the VES functions to provide ventilation, pressurization, and cooling of the MCRE pressure boundary.      Commented [HZS10]: Ext-03 BASES APPLICABLE SAFETY ANALYSES (continued)
AP1000                                  B 3.7.6 - 5                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  279
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 VES B 3.7.6 In the event of that a high High-1 level of gaseous radioactivity setpoint value is reached outside of the MCRE, the non-safety VBS continues to operate to provide pressurization and filtration functions. The MCRE air supply downstream of the filtration units is monitored by a safety related radiation detectorre-aligns to supplemental filtration mode, providing MCRE pressurization, cooling, and filtration. Upon Hhigh-2 particulate or iodine radioactivity setpoint, a safety related signal is generated to isolate the MCRE and to initiate air flow from the VES storage tanks. Isolation of the MCRE consists of closing safety related valves in the lines that penetrate the MCRE pressure boundary. Valves in the VBS supply and exhaust ducts, and the Sanitary Drainage System (SDS) vent lines are automatically isolated. VES air flow is initiated by a safety related signal which opens the isolation valves in the VES supply lines.                        Commented [HZS8]: Ext-03 The VES provides protection from smoke and hazardous chemicals to the MCRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the MCRE following a hazardous chemical release (Ref. 1). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the MCRE occupants to control the reactor either from the control room or from the remote shutdown room (Ref. 2).
The VES functions to mitigate a DBA or transient that either assumes the failure of or challenges the integrity of the fission product barrier.
The VES satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The VES limits the MCRE temperature rise and maintains the MCRE at a positive pressure relative to the surrounding environment.
Two air delivery flow paths are required to be OPERABLE to ensure that at least one is available, assuming a single failure.
The VES is considered OPERABLE when the individual components necessary to deliver a supply of breathable air to the MCRE are OPERABLE. This includes components listed in SR 3.7.6.3 through 3.7.6.10. In addition, the MCRE pressure boundary must be maintained,            Commented [HZS9]: Ext-02 including the integrity of the walls, floors, ceilings, electrical and mechanical penetrations, and access doors. The MCRE pressure boundary includes the Potable Water System (PWS) and SDS running (piping drain) traps, which retain a fluid level sufficient to maintain a seal preventing gas flow through the piping. The MCRE pressure boundary also includes the Waste Water System (WWS) drain line, which is isolated by a normally closed isolation valve.
BASES AP1000                                  B 3.7.6 - 6                                Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    280
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 Refueling Cavity Water Level B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Refueling Cavity Water Level BASES BACKGROUND          The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange.
During refueling, this maintains sufficient water level in containment, refueling cavity, refueling canal, fuel transfer canal, and spent fuel pool to retain iodine fission product activity in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to within the values reported in Chapter 15.
APPLICABLE          During movement of irradiated fuel assemblies, the water level in the SAFETY              refueling cavity and the refueling canal is an initial condition design ANALYSES            parameter in the analysis of a fuel-handling accident in containment, as postulated by Regulatory Guide 1.183 (Ref. 1).
The fuel handling accident analysis inside containment is described in Reference 2. This analysis assumes a minimum water level of 23 feet.
In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, there may be less than 23-feet of water above the top of the fuel bundle and the surface of the water, indicated by the width of the bundle. This slight reduction in water depth does not adversely affect the margin of conservatism associated with the assumed pool scrubbing factor of 200 for iodine.                                                      Commented [HZS38]: Ext-03 Refueling Cavity Water Level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                  A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within the values calculated in Reference 2.
APPLICABILITY        Refueling Cavity Water Level is applicable when moving irradiated fuel assemblies in containment. The LCO minimizes the possibility of radioactive release due to a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel assemblies are not being moved in containment, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.5, Spent Fuel Pool Water Level.
AP1000                                      B 3.9.4 - 1                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      281
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Design Control Document Markup Pages Hydrogen Venting from Passive Core Cooling System (PXS) Compartments (Ext-04)
(Non-Proprietary)
                        &#xa9; 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                                    282
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                              AP1000 Design Control Document Table 2.3.9-3 (cont.)                                                Commented [HZS1]: Ext-04 Inspections, Tests, Analyses, and Acceptance Criteria Design Commitment                  Inspections, Tests, Analyses              Acceptance Criteria
: 3. The VLS provides the                i) Inspection for the number of      i) At least 64 hydrogen igniters are nonsafety-related function to          igniters will be performed.          provided inside containment at the control the containment hydrogen                                            locations specified in Table 2.3.9-2.
concentration for beyond design ii) Operability testing will be      ii) The surface temperature of the basis accidents.
performed on the igniters.            igniter exceeds 1700&deg;F.
iii) An inspection of the as-built    iii) The equipment access opening containment internal structures      and CMT-A opening constitute at will be performed.                    least 98% of the vent path area from Room 11206 to Room 11300. The minimum distance between the equipment access opening primary openings through the ceilings of the passive core cooling system valve/accumulator rooms (11206, 11207) and the containment shell is at least 24.3 19 feet. The minimum distance between the CMT-A opening and the containment shell is at least 9.4 feet. The CMT-B opening constitutes at least 98% of the vent path area from Room 11207 to Room 11300 and is a minimum distance of 24.6 feet away from the containment shell. Primary openings are those that constitute 98% of the opening area. Other openings through the ceilings of these rooms must be at least 3 feet from the containment shell.
iv) An inspection will be            iv) The discharge from each of these performed of the as-built IRWST      IRWST vents is oriented generally vents that are located in the roof    away from the containment shell.
of the IRWST along the side of the IRWST next to the containment shell.
4.a) Controls exist in the MCR to      Testing will be performed on the      Controls in the MCR operate to cause the components identified in    igniters using the controls in the    energize the igniters.
Table 2.3.9-2 to perform the listed    MCR.
function.
Tier 1 Material                                        2.3.9-7                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      283
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document application of the criteria to specific compartments is provided in Table 6.2.4-6. The location of igniters throughout containment is provided in Figures 6.2.4-5 through 6.2.4-13. The location of igniters is also summarized in Table 6.2.4-7 identifying subcompartment/regions and which igniters by power group provide protection. The locations identified are considered approximations (+ 2.5 feet) with the final locations governed by the installation details.
The igniter assembly is designed to maintain the surface temperature within a range of 1600&deg; to 1700&deg;F in the anticipated containment environment following a loss of coolant accident. A spray shield is provided to protect the igniter from falling water drops (resulting from condensation of steam on the containment shell and on nearby equipment and structures). Design parameters for the igniters are provided in Table 6.2.4-3.
6.2.4.2.4  Containment Purge Containment purge is not part of the containment hydrogen control system. The purge capability of the containment air filtration system (see subsection 9.4.7) can be used to provide containment venting prior to post-loss of coolant accident cleanup operations.
6.2.4.3    Design Evaluation (Design Basis Accident)
A design basis accident evaluation is not required.
6.2.4.4    Design Evaluation (Severe Accident)
Although a severe accident involving major core degradation or core melt is not a design basis accident, the containment hydrogen control system contains design features to address this potential occurrence. The hydrogen monitoring subsystem has sufficient range to monitor concentrations up to 20 percent hydrogen. The hydrogen ignition subsystem is provided so that hydrogen is burned off in a controlled manner, preventing the possibility of deflagration with supersonic flame front propagation which could result in large pressure spikes in the containment.
It is assumed that 100 percent of the active fuel cladding zirconium reacts with steam. This reaction may take several hours to complete. The igniters initiate hydrogen burns at concentrations less than 10 percent by volume and prevent the containment hydrogen concentration from exceeding this limit. Further evaluation of hydrogen control by the igniters is presented in the AP1000 Probabilistic Risk Assessment.
6.2.4.5    Tests and Inspections 6.2.4.5.1  Preoperational Inspection and Testing                                                                  Commented [HZS1]: Ext-04 Hydrogen Monitoring Subsystem Pre-operational testing is performed either before or after installation but prior to plant startup to verify performance.
Tier 2 Material                                      6.2-43                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  284
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document Hydrogen Recombination Subsystem The performance of the autocatalytic recombiner plates (or cartridges) is tested by the manufacturer for each lot or batch of catalyst material. The number of plates tested is based on the guidance provided in ANSI/ASQC Z1.4-1993, Sampling Procedures and Tables for Inspection by Attributes, (formerly Military Standard 105), required to achieve Inspection Level III quality level.
Hydrogen Ignition Subsystem Pre-operational testing and inspection is performed after installation of the hydrogen ignition system and prior to plant startup to verify operability of the hydrogen igniters. It is verified that 64 igniter assemblies are installed at the locations defined by Figures 6.2.4-5 through 6.2.4-11.
Operability of the igniters is confirmed by verification of the surface temperature in excess of the value specified in Table 6.2.4-3. This temperature is sufficient to ensure ignition of hydrogen concentrations above the flammability limit.
Pre-operational inspection is performed to verify the location of openings through the ceilings of the passive core cooling system valve/accumulator rooms with respect to the containment pressure boundary. The primary openings must be at least 19 feet from the containment shell.
Primary openings are those that constitute at least 98% of the opening area. The primary openings in Room 11206 that vent to Room 11300 are the equipment access opening and CMT-A opening. These openings are verified to be a minimum distance of 24.3 feet and 9.4 feet, respectively, from the containment shell. The primary opening in Room 11207 that vents to Room 11300 is the CMT-B opening, which is verified to be a minimum distance of 24.6 feet from the containment shell. Other openings must be at least 3 feet from the containment shell.
Pre-operational inspection is performed to verify the orientation of the vents from the IRWST that are located along the side of the IRWST next to the containment. The discharge of each of these IRWST vents must be oriented generally away from the containment shell.
6.2.4.5.2  In-service Testing Hydrogen Monitoring Subsystem The system is normally in service. Periodic testing and calibration are performed to provide ongoing confirmation that the hydrogen monitoring function can be reliably performed.
Hydrogen Recombination Subsystem Periodic inspection and testing are performed on the passive autocatalytic recombiners. The testing is performed by testing a sample of the catalyst plates as specified in subsection 6.2.4.5.1.
Hydrogen Ignition Subsystem Periodic inspection and testing are performed to confirm the continued operability of the hydrogen ignition system. Operability testing consists of energizing the igniters and confirming the surface temperature exceeds the value specified in Table 6.2.4-3.
Tier 2 Material                                    6.2-44                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        285
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document natural circulation. A diffusion flame can be postulated at the exit of the dead ended compartments in the maintenance floor. The exterior wall of the maintenance floor is the steel containment shell below the passive containment cooling system annulus, the lower-level equipment hatch, and the personnel hatch. Many electrical penetrations pass through the maintenance floor wall to the auxiliary building.
19.41.6.3  Early Hydrogen Combustion Ignition Sources For a burn to be initiated, an ignition source is required. Igniters mitigate the threat to the containment integrity from global deflagration and detonation. If a hydrogen plume can produce a diffusion flame, the igniters provide the ignition source.
19.41.7    Diffusion Flame Analysis                                                                        Commented [HZS1]: Ext-04 Diffusion flames can be postulated to occur at vents or exits from compartments with a hydrogen source that are dead-ended or not well-mixed. Incombustible gas mixtures that include a high concentration of hydrogen may develop in the compartment. When the plume of hydrogen exits the compartment into a room containing oxygen and an ignition source, burning of the plume as a standing flame at the vent may produce locally high temperatures. If the release of hydrogen is sustained, the heat load from the burning may threaten equipment, including the containment shell integrity.
The overall geometry of the AP1000 containment is relatively open. Ninety-seven percent of the containment free volume participates in containment natural circulation and is well-mixed.
However, the IRWST, PXS and CVS compartments are small, confined rooms that may have a hydrogen source, and thus may be postulated to produce a diffusion flame at vents. This section discusses the conditions that may produce a standing diffusion flame in these locations, and presents the quantification of the containment failure probability given the presence of a sustained diffusion flame at a dead-ended compartment vent.
AP1000 Diffusion Flame Mitigation Strategy Hydrogen is a byproduct of a severe accident, and hydrogen pathways to the IRWST, PXS and CVS subcompartments cannot be completely ruled out, particularly in the IRWST, to which the effluent of the first stages of the reactor coolant system automatic depressurization system are directed. The other compartments can only have hydrogen releases in the event that a break occurs there, but some of the highest frequency severe accident sequences have breaks in a DVI line, which traverses a PXS compartment. Therefore, the potential for diffusion flames from these subcompartment locations cannot be excluded from the probabilistic risk assessment.
The AP1000 addresses diffusion flames by adopting a defense-in-depth philosophy in the design.
In the highest frequency severe accidents, sustained hydrogen release is prevented from occurring in the dead-ended compartments. In sequences where diffusion flames at IRWST or PXS/CVS compartment vents may be postulated, design strategies are initiated to mitigate the threat to the containment integrity by locating hydrogen plumes away from the containment shellwhere they do not challenge containment integrity.
Tier 2 Material                                      19.41-8                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            286
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document The first level of defense against the threat to containment integrity from diffusion flames is the prevention of sustained hydrogen releases to dead-ended compartments. The highest frequency severe accident sequences have full reactor coolant system depressurization prior to core damage.
Hydrogen is released at low pressure to the containment as it is produced in the core. Stage four of the automatic depressurization system provides a pathway of substantially lower resistance (by approximately one order of magnitude) compared to the maximum break size in the DVI line that relieves to the PXS compartment and to the other three ADS stages that relieve to the IRWST.
Additionally, the ADS spargers in the IRWST generally have a 10-ft static head of water above them, which further increases the resistance to flow of hydrogen to the IRWST.
Hydrogen released from ADS stage 4 is relieved to the loop compartments, which are supplied with oxygen by the containment natural circulation and shielded from the containment shell by high concrete walls. Hydrogen is able to burn in the loop compartments without threatening the containment integrity. Therefore, ADS stage 4 provides the first level of defense against diffusion flames.
In the event that ADS stage 4 fails to adequately direct hydrogen away from confined compartments, the compartment vents are designed to preferentially release the hydrogen at locations where it burns, but does not challenge containment integrity away from the containment shell.
Vents from the PXS and CVS compartments to the CMT room are located well away from the containment shell and containment penetrations. Access hatches to the subcompartments that are near the containment shell are covered and secured closed such that they will not open as a result of a pipe break inside the compartment. Therefore, hydrogen releases to the CMT room from the subcompartments have been shown to not challenge are not considered as a threat to the containment integrity.
19.41.8    Early Hydrogen Detonation Hydrogen detonation can be initiated from a high-energy ignition source or by deflagration-to-detonation transition during flame acceleration. A review of potential ignition sources in containment concludes that the maximum source is too small to directly initiate a detonation (Reference 19.41-2: Since AP1000 is very similar to AP600, the phenomenological evaluations are valid for AP1000.). Therefore, the occurrence of detonation is related to the potential for deflagration-to-detonation transition in the AP1000 containment analysis.
The methodology of Sherman and Berman (Reference 19.41-6) is used to evaluate the likelihood of deflagration-to-detonation transition. The analysis considers the hydrogen release rates to the containment, core reflooding, the containment release locations, and in-containment refueling water storage tank and PXS valve/accumulator room water levels to determine the probabilities.
19.41.9    Deflagration in Time Frame 3 The design certification of the AP1000 included consideration by the NRC of the topic referred to in this section.
Tier 2 Material                                    19.41-9                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      287
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document boundary. Reducing the reactor coolant system pressure during a severe accident significantly lowers the likelihood of phenomena that may induce large fission product releases early in the accident sequence.
19.59.9.5.5 In-Vessel Retention of Molten Core Debris The AP1000 reactor vessel and containment configuration have features that enhance the designs ability to maintain molten core debris in the reactor vessel. The AP1000 automatic depressurization system provides reliable pressure reduction in the reactor coolant system to reduce the stresses on the vessel wall. The reactor vessel lower head has no vessel penetrations.
This eliminates penetration failure as a potential vessel failure mode. The containment configuration directs water to the reactor cavity and allows the in-containment refueling water storage tank water to be drained into the cavity to submerge the vessel to cool the external surface of the lower head. Cooling the vessel and reducing the stresses prevent the creep rupture failure of the vessel wall. The reactor vessel reflective insulation has been designed with provisions to allow water inside the insulation panel to cool the vessel surface, and with vents to allow steam to exit the insulation without failing the insulation support structures. The insulation is designed so that it promotes the cooling of the external surface of the vessel.
Preventing the relocation of molten core debris to the containment eliminates the occurrence of several severe accident phenomena, such as ex-vessel fuel-coolant interactions and core-concrete interaction, which may threaten the containment integrity. Through the prevention of core debris relocation to the containment, the AP1000 design significantly reduces the likelihood of containment failure.
19.59.9.5.6 Combustible Gases Generation and Burning                                                              Commented [HZS1]: Ext-04 In severe accident sequences, high-temperature metal oxidation, particularly zirconium, results in the rapid generation of hydrogen and possibly carbon monoxide. The first combustible gas release occurs in the accident sequence during core uncovery when the oxidation of the zircaloy cladding by passing steam generates hydrogen. A second release may occur if the vessel fails and ex-vessel debris degrades the concrete basemat. Steam and carbon dioxide are liberated from the concrete and are reduced to hydrogen and carbon monoxide as they pass through the molten metal in the debris. These gases are highly combustible and in high concentrations in the containment may lead to detonable mixtures.
The AP1000 uses a nonsafety-related hydrogen igniter system for severe releases of combustible gases. The igniters are powered from ac buses from either of the nonsafety-related diesel generators or from the non-Class 1E batteries. Multiple glow plugs are located in each compartment. The igniters burn the gases at the lower flammability limit. At this low concentration, the containment pressure increase from the burning is small and the likelihood of detonation is negligible. The igniters are spaced such that the distance between them will not allow the burn to transition from deflagration to detonation. The combustible gases are removed with no threat to the containment integrity.
There is little threat of the failure of the system power in the event that it is required to operate.
The igniters are needed only in core damage accidents, and the AP1000 is designed to mitigate Tier 2 Material                                      19.59-33                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  288
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document loss of power events without the sequence evolving into a severe accident. Loss of ac power is a small contributor to the core damage frequency.
The reliability of reactor coolant system depressurization reduces the threat to the containment from sudden releases of hydrogen from the reactor coolant system. Low pressure release of in-vessel hydrogen enhances the ability of the igniter system to maintain the containment atmosphere at the lower flammability limit.
During a severe accident, hydrogen, which could be injected from the reactor coolant system into the containment through the spargers in the in-containment refueling water storage tank or into the core makeup tank room, has the potential to produce a diffusion flame. A diffusion flame is produced when a combustible gas plume that is too rich to burn enters an oxygen-rich atmosphere and is ignited by a glow plug or a random ignition source. The plume is ignited into a standing flame, which lasts as long as there is a fuel source. Via convection and radiation, the flame can heat the containment wall to high temperatures, increasing the likelihood of creep rupture failure of the containment pressure boundary. The AP1000 uses a defense-in-depth approach to release hydrogen in benign locations away from the containment shell and penetrations where it burns, but does not challenge containment integrity. Therefore, the potential for containment failure from the formation of a diffusion flame at the in-containment refueling water storage tank vents is considered to be low.
There is little threat to the containment integrity from severe accident hydrogen releases and hydrogen combustion events. The igniter system maintains the hydrogen concentration at the lower flammability limit.
19.59.9.5.7 Intermediate and Long-Term Containment Failure The passive containment cooling system reduces the potential for decay heat pressurization of the containment. However, containment failure can also occur as a result of combustion. Due to the high likelihood of in-vessel retention of core debris, the potential for ex-vessel combustible gas generation from core-concrete interaction is low. The frequency of containment failures due to hydrogen combustion events is low given the high reliability of the hydrogen igniters.
19.59.9.5.8 Fission-Product Removal The AP1000 relies on the passive, natural removal of aerosol fission products from the containment atmosphere, primarily from gravitational settling, diffusiophoresis, and thermophoresis. Natural removal is enhanced by the passive containment cooling system, which provides a large, cold surface area for condensation of steam. This increases the diffusiophoretic and thermophoretic removal processes. Accident offsite doses at the site boundary, which could exist in the first 24 hours after a severe accident, are either less than 25 rem, or for those releases that are greater than 25 rem, have a frequency of much less than 1E-06. Minimal credit is taken for deposition of fission products in the auxiliary building. The site boundary dose and large release frequency are much less than the established goals.
Tier 2 Material                                      19.59-34                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          289
 
DCP_NRC_003343                                            Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                          AP1000 Design Control Document Table 19.59-18 (Sheet 16 of 25)                                        Commented [HZS3]: Ext-04 AP1000 PRA-BASED INSIGHTS Insight                                              Disposition
: 27. The reactor cavity design provides a reasonable balance between the regulatory        19.39 &
requirements for sufficient ex-vessel debris spreading area and the need to quickly    Appendix 19B submerge the reactor vessel for the in-vessel retention of core debris.
: 28. The design can withstand a best-estimate ex-vessel steam explosion without failing    Appendix 19B the containment integrity.
: 29. The containment design incorporates defense-in-depth for mitigating direct            Appendix 19B containment heating by providing no significant direct flow path for the transport of particulated molten debris from the reactor cavity to the upper containment regions.
: 30. The hydrogen control system is comprised of passive autocatalytic recombiners          Tier 1 Information (PARs) and hydrogen igniters to limit the concentration of hydrogen in the containment during accidents and beyond design basis accidents, respectively.
Operability of the hydrogen igniters is addressed by short-term availability controls  16.3 during modes 1, 2, 5 (with RCS pressure boundary open), and 6 (with upper internals in place or cavity levels less than full).
The operator action to activate the igniters is the first step in ERG AFR.C-1 to      Emergency ensure that the igniter activation occurs prior to rapid cladding oxidation.          Response Guidelines
: 31. Mitigation of the effects of a diffusion flames on the containment shell are addressed 1.2, General by the following containment layout features:                                          Arrangement Drawings
      -  Vents from the PXS and CVS compartments (where hydrogen releases can be            3.4.1.2.2.1 &
postulated) to the CMT room are located well away from the containment shell      19.41.7 and containment penetrations. The access hatch to the PXS-B compartment is located near the containment wall and is normally closed to address severe accident considerations. Hydrogen releases to the CMT room from the subcompartments have been shown not to challenge containment integrity. The access hatch to the PXS-B compartment is accessible from Room 11300 on elevation 107-2.
      -  IRWST vents are designed so that those located away from the containment wall      6.2.4.5.1 open to vent hydrogen releases. In this situation IRWST vents located close to the containment wall would not open because flow of hydrogen through the other vents would not result in a IRWST pressure sufficient to open them.
: 32. The containment structure can withstand the pressurization from a LOCA and the        19.41 global combustion of hydrogen released in-vessel (10 CFR 50.44).
Tier 2 Material                                          19.59-90                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  290
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                  AP1000 Design Control Document Table 19D-7 (Sheet 2 of 3)                                              Commented [HZS1]: Ext-04 SUSTAINED HYDROGEN COMBUSTION SURVIVABILITY ASSESSMENT EQUIPMENT AND                SUSTAINED HYDROGEN COMBUSTION SURVIVABILITY INSTRUMENTATION                                          ASSESSMENT Equipment Containment Shell        As discussed in Section 19.41.7 of this document, hydrogen plumes are located away from the containment shell to mitigate the threat to the containment integrity.
Containment Lower        The lower equipment hatch and seals on the containment vessel may be exposed Equipment Hatch and      to heat transfer from a sustained flame at the vents from the PXS Seals                    valve/accumulator room to the maintenance floor. The equipment hatch and seals have been shown by analysis to be unlikely to fail or leak.
Igniters                Igniters are specified and designed to withstand the effects of sustained burning and, therefore, are considered operable for these events.
Instrumentation RCS Pressure            There are four RCS pressurizer pressure transmitters. Two transmitters are located at a distance greater than 75 feet from the vent from the PXS valve/accumulator room and are therefore beyond the distance that potentially causes operability concerns from a sustained flame. The other two transmitters are located in a different room from the fourth stage ADS valves. This precludes radiative heating, which could potentially cause operability concerns.
Containment Pressure    There are three extended range containment pressure transmitters. The three transmitters are located such that they cannot all be exposed to a sustained flame from either of the vents from the PXS valve/accumulator room into the maintenance floor at the base of the CMTs. Therefore, continued operability of the containment pressure function is provided.
SG 1 Wide Range Level    There are four steam generator wide range levels for SG 1. Two of the transmitters are located at a distance of greater than 20 feet from a CMT and are, therefore, beyond the distance that could potentially cause operability concerns from a sustained flame from the vent from the PXS valve/accumulator room into the maintenance floor at the base of the CMT. The other two transmitters are located over 20 feet below the fourth stage ADS valves. This precludes radiative heating, which could potentially cause operability concerns.
SG 2 Wide Range Level    Based on the layout of the four steam generator wide range levels for SG 2, at least two of the transmitters will not be exposed to a sustained flame from either of the vents from the PXS valve/accumulator room into the maintenance floor at the base of the CMTs. Therefore, continued operability of the SG 2 wide range level indication function is provided.
Tier 2 Material                                  19D-35                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                291
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Design Control Document Markup Pages PMS Logic Changes for Source Range Flux Doubling (Ext-05)
(Non-Proprietary)
                        &#xa9; 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                          292
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                            AP1000 Design Control Document Figure 7.2-1 (Sheet 3 of 21) Commented [HZS1]: Ext-05 Functional Diagram Nuclear Startup Protection Tier 2 Material                                                      7.2-31                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                      293
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                    AP1000 Design Control Document Condition 2 results from a coincidence of two of the four divisions of containment pressure above the High-2 setpoint. Manual reset is provided to block this actuation signal for passive containment cooling. Separate momentary controls are provided for resetting each division.
The functional logic relating to actuation of the passive containment cooling system is illustrated in Figure 7.2-1, sheet 13.
7.3.1.2.13 Startup Feedwater Isolation Signals to isolate the startup feedwater supply to the steam generators are generated from either of the following conditions:
: 1. Low cold leg temperature
: 2. High-2 steam generator narrow range water level
: 3. Manual actuation of main feedwater isolation (subsection 7.3.1.2.6)
: 4. High steam generator narrow range water level (coincident with P-4 permissive)
Any of these conditions isolates the startup feedwater supply by tripping the startup feedwater pumps and closing the startup feedwater isolation and control valves.
Condition 1 results from the coincidence of reactor coolant system cold leg temperature below the Low Tcold setpoint in any loop. Startup feedwater isolation on this condition may be manually blocked when the pressurizer pressure is below the P-11 setpoint. This function is automatically unblocked when the pressurizer pressure is above the P-11 setpoint.
Condition 2 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High-2 setpoint for either steam generator.
Condition 3 is discussed in other subsections as noted.
Condition 4 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High setpoint for either steam generator coincident with the P-4 permissive (reactor trip).
The functional logic relating to the isolation of the startup feedwater is illustrated in Figure 7.2-1, sheets 9 and 10.
7.3.1.2.14 Boron Dilution Block                                                                            Commented [HZS1]: Ext-05 Signals to block boron dilution are generated from any of the following conditions:
: 1. Excessive increasing rate of source range flux doubling signal
: 2. Loss of ac power sources (low Class 1E battery charger input voltage)
: 3. Reactor trip (Table 7.3-2, interlock P-4)
In the event of an excessive increasing rate of source range flux doubling signal, the block of boron dilution is accomplished by closing the chemical and volume control system makeup isolation valves and closing the makeup pump suction valves to the demineralized water storage tanks. This signal also provides a non-safety trip of the makeup pumps. These actions Tier 2 Material                                      7.3-14                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            294
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                    AP1000 Design Control Document terminate the supply of potentially unborated water to the reactor coolant system as quickly as possible.
In the event of a loss of ac power sources or a reactor trip (as indicated by P-4), the block of boron dilution is accomplished by closing the makeup pump suction valves to the demineralized water storage tanks and aligning the boric acid tank to the suction of the makeup pumps. This permits makeup as needed but ensures that it will be from a borated source that will not reduce the available shutdown margin in the reactor core.
Condition 1 is an average of the source range count rate, sampled at least N times over the most recent time period T1, compared to a similar average taken at time period T2 earlier. If the ratio of the current average count rate to the earlier average count rate is greater than a preset value, a partial trip is generated in the division. On a coincidence of excessively increasing source range neutron flux in two of the four divisions, boron dilution is blocked.
The Flux Doubling function is also delayed from actuating each time the source range detectors high voltage power is energized to prevent a spurious dilution block due to the short term instability of the processed source range values. This source range flux doubling signal may be manually blocked to permit plant startup and normal power operation when reactor coolant average temperature is above the P-8 setpoint. It is automatically reinstated when reactor power is decreased below the P-6 power level during shutdown or reactor coolant average temperature decreases below the P-8 setpoint.
Condition 2 results from the loss of ac power. A short, preset time delay is provided to prevent actuation upon momentary power fluctuations; however, actuation occurs before ac power is restored by the onsite diesel generators. The loss of all ac power is detected by undervoltage sensors that are connected to the input of each of the four Class 1E battery chargers. Two sensors are connected to each of the four battery charger inputs. The loss of ac power signal is based on the detection of an undervoltage condition by each of the two sensors connected to two of the four battery chargers. The two-out-of-four logic is based on an undervoltage to the battery chargers for divisions A or C coincident with an undervoltage to the battery chargers for divisions B or D.
The source range flux doubling function can also be manually blocked during shutdown conditions when below the P-8 setpoint. Prior to manually blocking the source range flux doubling function, the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent boron dilution.
Condition 3 results from a reactor trip as indicated by the P-4 interlock.
The functional logic relating to the boron dilution block is illustrated in Figure 7.2-1, sheets 3 and 15.
7.3.1.2.15 Chemical and Volume Control System Isolation                                                      Commented [HZS2]: Ext-05 A signal to close the isolation valves of the chemical and volume control system is generated from any of the following conditions:
Tier 2 Material                                    7.3-15                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            295
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                    AP1000 Design Control Document
: 1. High-2 pressurizer level
: 2. High-2 steam generator narrow range water level
: 3. Automatic or manual safeguards actuation signal (subsection 7.3.1.1) coincident with High-1 pressurizer level
: 4. High-2 containment radioactivity
: 5. Manual initiation
: 6. High steam generator narrow range water level (coincident with P-4 permissive)
: 7. Excessive increasing rate of source range flux doubling signal Condition 1 results from the coincidence of pressurizer level above the High-2 setpoint in any two of the four divisions. This function can be manually blocked when the reactor coolant system pressure is below the P-19 permissive setpoint to permit pressurizer water solid conditions with the plant cold and to permit pressurizer level makeup during plant cooldowns. This function is automatically unblocked when reactor coolant system pressure is above the P-19 setpoint.
Condition 2 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High-2 setpoint for either steam generator.
Condition 3 results from the coincidence of two of the four divisions of pressurizer level above the High-1 setpoint, coincident with an automatic or manual safeguards actuation.
Condition 4 results from the coincidence of containment radioactivity above the High-2 setpoint in any two of the four divisions.
Condition 5 consists of two momentary controls. This action also initiates auxiliary spray and letdown purification line isolation (subsection 7.3.1.2.18).
Condition 6 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High setpoint for either steam generator coincident with the P-4 permissive (reactor trip).
Condition 7 is an average of the source range count rate, sampled at least N times over the most recent time period T1, compared to a similar average taken at time period T2 earlier. If the ratio of the current average count rate to the earlier average count rate is greater than a preset value, a partial trip is generated in the division. On a coincidence of excessively increasing source range neutron flux in two of the four divisions, chemical and volume control system makeup is isolated. The flux doubling function is also delayed from actuating each time the source range detectors high voltage power is energized to prevent a spurious chemical and volume control system makeup isolation due to the short-term instability of the processed source range values. This source range flux doubling signal may be manually blocked to permit plant startup and normal power operation when reactor coolant average Tier 2 Material                                    7.3-16                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                  296
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document temperature is above the P-8 setpoint. It is automatically reinstated when reactor power is decreased below the P-6 power level during shutdown or reactor coolant average temperature decreases below the P-8 setpoint. The source range flux doubling function can also be manually blocked during shutdown conditions when below the P-8 setpoint. Prior to manually blocking the source range flux doubling function, the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution.                                                                        Commented [HZS3]: Ext-05 The functional logic relating to chemical and volume control system isolation is illustrated in Figure 7.2-1, sheets 6 and 11.
7.3.1.2.16 Steam Dump Block Signals to block steam dump (turbine bypass) are generated from either of the following conditions:
: 1. Low-2 reactor coolant system average temperature
: 2. Manual initiation Condition 1 results from a coincidence of two of the four divisions of reactor loop average temperature (Tavg) below the Low-2 setpoint. This blocks the opening of the steam dump valves. This signal also becomes an input to the steam dump interlock selector switch for unblocking the steam dump valves used for plant cooldown.
Condition 2 consists of three sets of controls. The first set of two controls selects whether the steam dump system has its normal manual and automatic operating modes available or is turned off. The second set of two controls enables or disables the operations of the Stage 1 cooldown steam dump valves if the reactor coolant average temperature (Tavg) is below the Low-2 setpoint. The third set of two controls enables or disables the operation of the Stage 2 cooldown steam dump valves.
The functional logic relating to the steam dump block is illustrated in Figure 7.2-1, sheet 10.
7.3.1.2.17 Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization                                                                                        Commented [HZS4]: Ext-02 Signals to initiate isolation of the main control room, to initiate the air supply, and to open the main control room pressure relief isolation valves, and to de-energize nonessential main control room electrical loads are generated from either any of the following conditions:            Commented [HZS5]: Ext-02
: 1. High-2 main control room air supply radioactivity level                                        Commented [HZS6]: Ext-02
: 2. Loss of ac power sources (low Class 1E battery charger input voltage)
: 3. Low main control room differential pressure                                                  Commented [HZS7]: Ext-03 3.4. Manual initiation Condition 1 is the occurrence one of two main control room air supply radioactivity monitors        Commented [HZS8]: Ext-02 detecting a the iodine or particulate radioactivity level above the High-2 setpoint.                Commented [HZS9]: Ext-03 Tier 2 Material                                    7.3-17                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                297
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Table 7.3-1 (Sheet 6 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Division/          Actuation Actuation Signal              Controls              Logic              Permissives and Interlocks
: 12. Passive Residual Heat Removal (Figure 7.2-1, Sheet 8)
: a. Manual initiation              2 controls        1/2 controls                      None
: b. Low narrow range steam          4/steam          2/4-BYP1 in                      None generator water level          generator        either steam coincident with                                  generator Low startup feedwater flow    2/feedwater        1/2 in either                    None line        feedwater line
: c. Low steam generator wide        4/steam          2/4-BYP1 in                      None range water level              generator        either steam generator
: d. Core makeup tank injection                            (See Items 6a through 6e)
: e. Automatic reactor coolant                              (See items 3a through 3c) system depressurization (first stage)
: f. High-3 pressurizer level            4            2/4-BYP1        Manual block permitted below P-19 Automatically unblocked above P-19
: 13. Block of Boron Dilution (Figure 7.2-1, Sheets 3 and 15)
: a. Flux doubling calculation            4            2/4-BYP1          Manual block permitted above P-8 when critical or intentionally approaching criticality Automatically unblocked below P-6 or below P-8 Manual block permitted below P-8; demineralized water system isolation valves signaled closed when blocked below P-8                Commented [HZS17]: Ext-05
: b. Undervoltage to Class 1E      2/charger      2/2 per charger                    None battery chargers(8)                                and 2/4 chargers5
: c. Reactor trip (P-4)            1/division            2/4                          None
: 14. Chemical Volume Control System Isolation (See Figure 7.2-1, Sheets 6 and 11)
: a. High-2 pressurizer water            4            2/4-BYP1        Automatically unblocked above P-19 level                                                              Manual block permitted below P-19 Tier 2 Material                                      7.3-32                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    298
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document Table 7.3-1 (Sheet 7 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Divisions/        Actuation Actuation Signal          Controls            Logic              Permissives and Interlocks
: b. High-2 steam generator      4/steam          2/4-BYP1 in                      None narrow range level          generator        either steam generator
: c. Automatic or manual                                (See items 1a through 1e) safeguards actuation signal coincident with High-1 pressurizer water        4            2/4-BYP1                        None level
: d. High-2 containment              4            2/4-BYP1                        None radioactivity
: e. Manual initiation          2 controls        1/2 controls                      None
: f. Flux doubling calculation        4            2/4-BYP1          Manual block permitted above P- 8 when critical or intentionally approaching criticality Automatically unblocked below P-6 or below P-8 Manual block permitted below P-8; demineralized water system isolation valves signaled closed when blocked below P-8                Commented [HZS18]: Ext-05
: g. High steam generator        4/steam          2/4-BYP1 in                      None narrow range level          generator        either steam coincident with                                generator Reactor trip (P-4)          1/division            2/4                          None (8)
: 15. Steam Dump Block (Figure 7.2-1, Sheet 10)
: a. Low reactor coolant          2/loop          2/4-BYP1                        None temperature (Low-2 Tavg)
: b. Mode control                2 controls        1/division                      None
: c. Manual stage 1 cooldown    2 controls        1/division                      None control
: d. Manual stage 2 cooldown    2 controls        1/division                      None control
: 16. Main Control Room Isolation, and Air Supply Initiation, and Electrical Load De-energization (Figure 7.2-1, Sheet 13)                                                                                                Commented [HZS19]: Ext-02 Tier 2 Material                                    7.3-33                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  299
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document Table 7.3-2 (Sheet 1 of 4)                                              Commented [HZS23]: Ext-05 INTERLOCKS FOR ENGINEERED SAFETY FEATURES ACTUATION SYSTEM Designation                  Derivation                                        Function P-3      Reactor trip breaker open                      Permits manual reset of safeguards actuation signal to block automatic safeguards actuation P-3      Reactor trip breakers closed                    Automatically resets the manual block of automatic safeguards actuation P-4      Reactor trip initiated or reactor trip          (a) Isolates main feedwater if coincident with breakers open                                        low reactor coolant temperature (b) Trips turbine (c) Blocks boron dilution P-4      No reactor trip initiated and reactor trip      Removes demand for isolation of main breakers closed                                feedwater, turbine trip and boron dilution block P-6      Intermediate range neutron flux channels        None above setpoint P-6      Intermediate range neutron flux channels        Automatically resets the manual block of flux below setpoint                                  doubling actuation of the boron dilution block P-8      Reactor coolant average temperature above      Permits manual block of flux doubling setpoint                                        actuation of the boron dilution block P-8      Reactor coolant average temperature            (a) Automatically resets the manual block of below setpoint                                      flux doubling actuation of the boron dilution block (b) Permits manual block of flux doubling actuation of the boron dilution block; signals the demineralized water system isolation valves closed if flux doubling actuation of the boron dilution block is blocked below P-8 P-11    Pressurizer pressure below setpoint            (a) Permits manual block of safeguards actuation on low pressurizer pressure, low compensated steam line pressure, or low reactor coolant inlet temperature (b) Permits manual block of steam line isolation on low reactor coolant inlet temperature Tier 2 Material                                      7.3-37                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    300
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document purification flow during normal plant operation and to have a minimum design life of one core cycle.
The construction of the mixed bed demineralizers is identical to that of the cation bed demineralizer.
9.3.6.3.5  Chemical and Volume Control System Filters Makeup Filter One makeup filter is provided to collect particulates in the makeup stream, such as boric acid storage tank sediment. The filter is designed to accept maximum makeup flow. The unit is constructed of austenitic stainless steel with a disposable synthetic cartridge and is designed for reactor coolant system hydrostatic test pressure.
Reactor Coolant Filters Two reactor coolant filters are provided. The filters are designed to collect resin fines and particulate matter from the purification stream. Each filter is designed to accept maximum purification flow.
The units are constructed of austenitic stainless steel with disposable synthetic cartridges and are designed for reactor coolant system pressure.
9.3.6.3.6  Chemical and Volume Control System Letdown Orifice One letdown orifice is provided in the letdown line, where fluid leaves the high-pressure purification loop before it exits containment. The orifice limits the letdown flow to a rate compatible with the chemical and volume control system equipment and also plant heatup and dilution requirements.
The orifice consists of an assembly that provides for permanent pressure loss without recovery and is made of austenitic stainless steel.
A manual bypass line is provided around the orifice to allow shutdown purification and degassing when the reactor coolant system pressure is low.
9.3.6.3.7  Chemical and Volume Control System Valves                                                            Commented [HZS1]: Ext-05 The chemical and volume control system valves are stainless steel for compatibility with the borated reactor coolant. Isolation valves are provided at connections to the reactor coolant system.
Lines penetrating the reactor containment meet the containment isolation criteria described in subsection 6.2.3.
Purification Stop Valves These normally open, motor-operated valves are located inside containment and close automatically on a low pressurizer level signal from the protection and safety monitoring system to Tier 2 Material                                    9.3-31                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                301
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document boundary. This valve is operated from the main control room and the remote shutdown workstation.
Makeup Line Containment Isolation Valves These normally open, motor-operated globe valves provide containment isolation of the chemical and volume control system makeup line and automatically close on a high-2 pressurizer level, high steam generator level, or high-2 containment radiation signal from the protection and safety monitoring system. The valves close on a source range flux doubling signal to terminate possible unplanned boron dilution events. The valves also close on a safeguards actuation signal coincident with high-1 pressurizer level. This allows the chemical and volume control system to continue providing reactor coolant system makeup flow, if the makeup pumps are operating following a safeguards actuation signal. These valves are also controlled by the reactor makeup control system and close when makeup to other systems is provided. Manual control is provided in the main control room and at the remote shutdown workstation.
Hydrogen Addition Containment Isolation Valve This normally open, fail closed, air-operated globe valve is located outside containment in the hydrogen addition line. The valve automatically closes on a containment isolation signal from the protection and safety monitoring system. Manual control is provided in the main control room and at the remote shutdown workstation.
Demineralized Water System Isolation Valves These normally open, air-operated butterfly valves are located outside containment in the line from the demineralized water storage and transfer system. These valves close on a signal from the protection and safety monitoring system derived by either a reactor trip signal, a source range flux doubling signal, low input voltage (loss of ac power) to the 1E dc and uninterruptable power supply system battery chargers, or a safety injection signal, isolating the demineralized water source to prevent inadvertent boron dilution events. The protection and safety monitoring system also issues a close signal to these valves when below the P-8 setpoint when the source range flux doubling signal is blocked to prevent inadvertent boron dilution. Manual control for these valves is provided from the main control room and at the remote shutdown workstation.
Makeup Pump Suction Header Valve This air-operated, three-way valve is automatically controlled by the makeup control system to provide the desired boric acid concentration of makeup to the reactor coolant system (boric acid, demineralized water, or blend based on the desired reactor coolant system boron concentration).
The valve fails with the pump suction aligned to the boric acid storage tank on a loss of instrument air. This valve will also align to the boric acid storage tank on either a reactor trip, source range flux doubling signal, low input voltage (loss of ac power) to the 1E dc and uninterruptable power supply system battery chargers, or a safety injection signal from the protection and safety monitoring system. This valve also aligns the makeup pump suction to the boric acid storage tank when low pressure is detected in the demineralized water supply line to protect the pump from a loss of suction supply. Manual control for this valve is provided in the main control room and at the remote shutdown workstation.
Tier 2 Material                                      9.3-33                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        302
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document 9.3.6.4.4    Abnormal              Operation 9.3.6.4.4.1 Reactor Coolant System Leak The chemical and volume control system is capable of making up for a small reactor coolant system leak with either makeup pump at reactor coolant system pressures above the low-pressure setpoint.
9.3.6.4.5    Accident Operation The chemical and volume control system can provide borated makeup to the reactor coolant system following accidents such as small loss-of-coolant accidents, steam generator tube rupture events, and small steam line breaks. In addition, pressurizer auxiliary spray can reduce reactor coolant system pressure during certain events such as a steam generator tube rupture.
To protect against steam generator overfill, the makeup function is isolated by closing the makeup line containment isolation valves, if a high steam generator level signal is generated. These valves also close and isolate the system on a high pressurizer level signal.
Some of the valves in the chemical and volume control system are required to operate under accident conditions to effect reactor coolant system pressure boundary and containment isolation, as discussed in subsection 9.3.6.3.7.
9.3.6.4.5.1 Boron Dilution Events                                                                                  Commented [HZS1]: Ext-05 The chemical and volume control system is designed to address a boron dilution accident by closing redundant safety-related valves, tripping the makeup pumps and/or aligning the suction of the makeup pumps to the boric acid tank.
For dilution events occurring at power (assuming the operator takes no action), a reactor trip is initiated on either an overpower trip or an overtemperature T trip. Following a reactor trip signal, the line from the demineralized water system is isolated by closing two safety-related, air-operated valves. The three-way pump suction control valve aligns so the makeup pumps take suction from the boric acid tank. If the event occurs while the makeup pumps are operating, the realignment of these valves causes the makeup pumps, if they continue to operate, to borate the plant.
For dilution events during shutdown, the source range flux doubling signal is used to isolate the makeup line to the reactor coolant system by closing the two safety-related, motor-operated valves, isolate the line from the demineralized water system by closing the two safety-related, air-operated valves, and trip the makeup pumps. The source range flux doubling function can be manually blocked during shutdown conditions when below the P-8 setpoint after the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution. For refueling operations, administrative controls are used to prevent boron dilutions by verifying the valves in the line from the demineralized water system are closed and secured.
Tier 2 Material                                      9.3-38                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  303
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                AP1000 Design Control Document 9.3.6.6.1.1 Valve Inspection and Testing The inspection requirements of the chemical and volume control system valves that constitute the reactor coolant pressure boundary are consistent with those identified in subsection 5.2.4. The inspection requirements of the chemical and volume control system valves that isolate the lines penetrating containment are consistent with those identified in Section 6.6.
9.3.6.6.1.2 Flow Testing Each chemical and volume control system pump is tested to measure the flow rate from each makeup pump to the reactor coolant system. Testing will be performed with the pump suction aligned to the boric acid storage tank and the discharge aligned to the reactor coolant system.
Testing will also be performed with the pump suction aligned to the boric acid storage tank and the discharge aligned to the pressurizer auxiliary spray. Flow will be measured using instrumentation in the pump discharge line. Testing will confirm that each pump provides at least 100 gallons per minute of makeup flow at normal reactor coolant system operating pressure. This is the minimum flow rate necessary to meet the chemical and volume control system functional requirement of providing makeup and pressurizer spray to support the functions described in subsection 9.3.6.4.4.1. Testing is performed to verify that the maximum makeup flow with both pumps operating is less than 175 gpm, as assumed in the boron dilution analyses presented in subsection 15.4.6. Testing is performed with both pumps operating and taking suction from the demineralized water system. The chemical and volume control system is aligned to the reactor coolant system at a pressure at or near atmospheric pressure.
9.3.6.6.1.3 Boric Acid Storage Tank Inspection Inspection of the boric acid storage tank will be performed to verify that the volume in the tank is sufficient to provide 70,000 gallons of borated makeup to the reactor coolant system. This volume of boric acid is required to meet the functional requirement of providing makeup to the reactor coolant system to support the functions described in subsection 9.3.6.4.4.
9.3.6.7    Instrumentation Requirements                                                                        Commented [HZS1]: Ext-05 Process control instrumentation is provided to acquire data concerning key parameters about the chemical and volume control system. The location of the instrumentation is shown on the chemical and volume control system piping and instrumentation diagram.
The instrumentation furnishes input signals for monitoring and/or alarming. Indications and/or alarms are provided in the main control room for the following parameters:
x    Pressure and differential pressure x    Flow x    Temperature x    Water level Tier 2 Material                                    9.3-40                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                304
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document The instrumentation also supplies input signals for control purposes to maintain proper system operation and to prevent equipment damage. Some specific control functions are listed below:
x    Purification isolation - To preserve the reactor coolant pressure boundary in the event of a break in the chemical and volume control system loop piping. The purification stop valves close automatically on a signal from the protection and safety monitoring system generated by a low-1 pressurizer level signal. This isolation also serves as an equipment protection function to prevent uncovering of the heater elements in the pressurizer. One of these valves also closes on high temperature downstream of the letdown heat exchanger, to protect the resin in the mixed bed and cation demineralizers from being exposed to temperatures that could damage the resins.
x    Containment isolation - To preserve the containment boundary, containment isolation valves are provided in the letdown line to the liquid radwaste system, the chemical and volume control system makeup line, and the hydrogen addition line. These valves are opened or closed manually from the main control room and the remote shutdown workstation.
Interlocks are provided to close these valves automatically upon receipt of a containment isolation signal from the protection and safety monitoring system and require operator action to reopen.
x    Letdown isolation valves - The letdown isolation valves are used to isolate letdown flow to the liquid radwaste system in addition to the containment isolation function described above.
The plant control system provides a signal to automatically open these valves on a high-pressurizer level signal derived from the pressurizer level control system. On a containment isolation signal from the protection and safety monitoring system, a high-high liquid radwaste system degassifier level signal (plant control system), or a low-pressurizer level signal (plant control system), these valves automatically close to provide isolation of the letdown line. The letdown isolation valves also receive a signal from the protection and safety monitoring system to automatically close and isolate letdown during midloop operations based on a low hot leg level. Manual control is provided from the main control room and at the remote shutdown workstation. The letdown flow control valve controls reactor coolant system pressure during startup, as described in subsection 9.3.6.4.1.
x    Demineralized water system isolation valves - To prevent inadvertent boron dilution, the demineralized water system isolation valves close on a signal from the protection and safety monitoring system derived from either a reactor trip signal, a source range flux doubling signal, low input voltage (loss of ac power) to the 1E dc and uninterruptible power supply system battery chargers, or a safety injection signal providing a safety-related method of stopping an inadvertent dilution. The valves are closed to prevent inadvertent boron dilution when the source range flux doubling logic is blocked below P-8. The main control room and remote shutdown workstation provide manual control for these valves.
x    Makeup isolation valves - To isolate the makeup flow to the reactor coolant system, two valves are provided in the chemical and volume control system makeup line. These valves automatically close on a signal from the protection and safety monitoring system derived from source range flux doubling, high-2 pressurizer level, high steam generator level, or a safeguards signal coincident with high-1 pressurizer level to protect against pressurizer or steam generator overfill. Manual control for these valves is provided in the main control Tier 2 Material                                    9.3-41                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        305
 
DCP_NRC_003343                                                      Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 9 of 13)
Engineered Safeguards Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED                REQUIRED                                  SURVEILLANCE FUNCTION                          CONDITIONS                  CHANNELS            CONDITIONS            REQUIREMENTS
: 15. Boron Dilution Block
: a. Source Range Neutron Flux                2(n),3(n, e),4(e)                4                  B,T                  SR  3.3.2.1      Commented [HZS1]: Ext-05 Doubling                                                                                                        SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 5(e)                      4                  B,P                  SR  3.3.2.1 SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Reactor Trip                            Refer to Function 18.b (ESFAS Interlocks, Reactor Trip, P-4) for all requirements.
: 16. Chemical Volume and Control System Makeup Isolation
: a. SG Narrow Range Water                    1,2,3(e),4(b,e)              4 per SG              B,R                  SR  3.3.2.1 Level - High 2                                                                                                  SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Pressurizer Water Level -                  1,2,3(e)                      4                  B,Q                  SR  3.3.2.1 High 1                                                                                                          SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 Coincident with Safeguards                1,2,3(e)            Refer to Function 1 (Safeguards Actuation) for initiating functions Actuation                                                      and requirements.
: c. Pressurizer Water Level -              1,2,3,4(b,e,m)                  4                  B,T                  SR  3.3.2.1 High 2                                                                                                          SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: d. Containment Radioactivity -                1,2,3(e)                      4                  B,Q                  SR  3.3.2.1 High 2                                                                                                          SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: e. Manual Initiation                        1,2,3(e),4(b,e)            2 switches              E,R                  SR 3.3.2.3
: f. Source Range Neutron Flux Refer to Function 15.a (Boron Dilution Block, Source Range Neutron Flux Doubling) for all Doubling                      requirements.
: g. SG Narrow Range Water                    1,2,3(e),4(b,e)              4 per SG              B,R                  SR  3.3.2.1 Level High                                                                                                      SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 Coincident with Reactor Trip Refer to Function 18.b (ESFAS Interlocks, Reactor Trip, P-4) for all requirements.
(P-4)
(b) With the RCS not being cooled by the Normal Residual Heat Removal System (RNS).
(e) Not applicable for valve isolation Functions whose associated flow path is isolated.
(m) Above the P-19 (RCS Pressure) interlock.
(n) Not applicable when critical or during intentional approach to criticality.
AP1000                                                            3.3.2 - 22                                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                            306
 
DCP_NRC_003343                                              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 10 of 13)
Engineered Safeguards Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED          REQUIRED                                      SURVEILLANCE FUNCTION                      CONDITIONS              CHANNELS            CONDITIONS              REQUIREMENTS
: 17. Normal Residual Heat Removal System Isolation
: a. Containment Radioactivity -            1,2,3(e)                  4                    B,Q                  SR  3.3.2.1 High 2                                                                                                    SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Safeguards Actuation                  1,2,3(e)          Refer to Function 1 (Safeguards Actuation) for all initiating functions and requirements.
: c. Manual Initiation                    1,2,3(e)            2 switch sets              E,Q                  SR 3.3.2.3
: 18. ESFAS Interlocks
: a. Reactor Trip Breaker Open,              1,2,3                3 divisions              D,M                  SR 3.3.2.3 P-3
: b. Reactor Trip, P-4                      1,2,3                3 divisions              D,M                  SR 3.3.2.3
: c. Intermediate Range                      2                      4                    J,L                  SR 3.3.2.1 Neutron Flux, P-6                                                                                          SR 3.3.2.4 SR 3.3.2.5
: d. Reactor Coolant Average              2,3(e),4(e)                4                    J,T                  SR 3.3.2.1 Temperature, P-8                                                                                          SR 3.3.2.4 SR 3.3.2.5      Commented [HZS2]: Ext-05 5(e)                    4                    J,P                  SR 3.3.2.1 SR 3.3.2.4 SR 3.3.2.5      Commented [HZS3]: Ext-05 ed. Pressurizer Pressure, P-11            1,2,3                    4                    J,M                  SR 3.3.2.1      Commented [HZS4]: Ext-05 SR 3.3.2.4 SR 3.3.2.5 fe. Pressurizer Level, P-12                1,2,3                    4                    J,M                  SR 3.3.2.1      Commented [HZS5]: Ext-05 SR 3.3.2.4 SR 3.3.2.5 4,5,6                    4                  BB,Y                  SR 3.3.2.1 SR 3.3.2.4 SR 3.3.2.5 gf. RCS Pressure, P-19                  1,2,3,4(b)                  4                    J,N                  SR 3.3.2.1      Commented [HZS6]: Ext-05 SR 3.3.2.4 SR 3.3.2.5
: 19. Containment Air Filtration System Isolation
: a. Containment Radioactivity -          1,2,3,4(b)                  4                    B,Z                  SR  3.3.2.1 High 1                                                                                                    SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Containment Isolation              Refer to Function 3 (Containment Isolation) for initiating functions and requirements.
(b) With the RCS not being cooled by the Normal Residual Heat Removal System (RNS).
AP1000                                                    3.3.2 - 23                                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                    307
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued)
A reactor trip is initiated every time a Safeguards Actuation signal is present. Therefore, this trip Function must be OPERABLE in MODES 1 and 2, when the reactor is critical, and must be shutdown in the event of an accident. In MODE 3, 4, 5, or 6, the reactor is not critical.
: 16. Reactor Trip System Interlocks Reactor protection interlocks are provided to ensure reactor trips are in the correct configuration for the current plant status. They back up operator actions to ensure protection system Functions are not blocked during plant conditions under which the safety analysis assumes the Functions are OPERABLE. Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip Functions are outside the applicable MODES.
These are:
: a. Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is actuated when the respective PMS Intermediate Range Neutron Flux channel increases to approximately one decade above the channel lower range limit. The LCO requirement for the P-6 interlock ensures that the following Functions are performed:
(1) on increasing power, the P-6 interlock allows the manual block of the respective PMS Source Range, Neutron Flux reactor trip. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range. When the source range trip is blocked, the high voltage to the detectors is also removed.
(2) on decreasing power, the P-6 interlock automatically energizes the PMS source range detectors and enables the PMS Source Range Neutron Flux reactor trip.
(3) on increasing decreasing power, the P-6 interlock automatically resets the provides a backupflux doubling block control ensuring the signal to the source range neutron flux doubling circuit is enabled. Normally, this Function the source range neutron flux doubling circuit is manually blocked by the main control room operator during the reactor startup.                                          Commented [HZS1]: Ext-05 The LCO requires four channels of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 when below AP1000                                B 3.3.1 - 23                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                308
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued)
OPERABLE in MODE 4 if the steam generator blowdown line is isolated.
14.a. PRHR Heat Exchanger Actuation (Function 13)
Steam Generator Blowdown Isolation is also initiated by all Functions that initiate PRHR actuation. The Steam Generator Blowdown Isolation requirements for these Functions are the same as the requirements for the PRHR Actuation. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 13, PRHR HX Actuation, is referenced for all initiating Functions and requirements.
14.b. Steam Generator Narrow Range Level - Low The Steam Generator Blowdown isolation is actuated when the Steam Generator Narrow Range Level reaches its Low Setpoint.
The LCO requires four channels per steam generator to be OPERABLE to satisfy the requirements with a two-out-of-four logic. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function. Setpoint reflects both steady state and adverse environmental instrument uncertainties as the detectors provide protection for an event that results in a harsh environment.
: 15. Boron Dilution Block The block of boron dilution is accomplished by closing the CVS makeup line isolation suction valves or closing theto demineralized water system isolation storage tanksvalve to CVS, and aligning the boric acid tank to the CVS makeup pumps. This Function is actuated by Source Range Neutron Flux Doubling and Reactor Trip.            Commented [HZS2]: Ext-05 15.a. Source Range Neutron Flux Doubling A signal to block boron dilution in MODES 2 or 3, when not critical or during an intentional approach to criticality, and MODES 4 or 5 is derived from source range neutron flow increasing at an excessive rate (source range flux doubling).
This Function is not applicable in MODES 3, 4 and 5 if the demineralized water makeup flow path is isolated. The source AP1000                                B 3.3.2 - 36                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  309
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) range neutron detectors are used for this Function. The LCO requires four divisions to be OPERABLE. There are four divisions and two-out-of-four logic is used. On a coincidence of excessively increasing source range neutron flux in two of the four divisions, demineralized water is isolated (CVS demineralized water system isolation valves closed) from the makeup pumps and reactor coolant makeup is isolated (CVS makeup line isolation valves closed) from the reactor coolant      Commented [HZS3]: Ext-05 system to preclude a boron dilution event. In MODE 6, a dilution event is precluded by the requirement in LCO 3.9.2 to close, lock and secure at least one valve in each unborated water source flow path.
15.b. Reactor Trip (Function 18.b)
Demineralized Water Makeup is also isolated CVS demineralized water system isolation valves closed and the boric acid aligned to the CVS makeup pumps) by all the Functions that initiate a Reactor Trip. The isolation requirements for these Functions are the same as the requirements for the Reactor Trip Function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 18.b, (P-4 Reactor Trip Breakers), is referenced for all initiating Functions and requirements. A P-4 signal initiates isolation of RCS makeup from the CVS by closing the demineralized water system isolation valves, and aligning the CVS makeup pump suction to the boric acid tank. Unborated water source makeup isolation is initiated by all the Functions that initiate a Reactor Trip.                                      Commented [HZS4]: Ext-05
: 16. Chemical Volume and Control System Makeup Line Isolation The CVS makeup line is isolated following certain events to prevent overfilling of the RCS. In addition, this line is isolated on High 2 containment radioactivity to provide containment isolation following an accident. This line is not isolated on a containment isolation signal, to allow the CVS makeup pumps to perform their defense-in-depth functions. However, if very high containment radioactivity exists (above the High 2 setpoint) this line is isolated.
A signal to isolate the CVS is derived from two-out-of-four high steam generator levels on either steam generator, two-out-of-four channels of pressurizer level indicating high or two-out-of-four channels of containment radioactivity indicating high. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip AP1000                                  B 3.3.2 - 37                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  310
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) x    Trip the main turbine x    Block boron dilution x    Isolate main feedwater coincident with low reactor coolant temperature (This function is not assumed in safety analysis therefore, it is not included in the technical specifications.)
The reactor trip breaker position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this Function has no adjustable trip setpoint.
This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality. This Function does not have to be OPERABLE in MODE 4, 5, or 6 to trip the main turbine, because the main turbine is not in operation.
The P-4 Function does not have to be OPERABLE in MODE 4 or 5 to block boron dilution, because Function 15.a, Source Range Neutron Flux Doubling, provides the required block. In MODE 6, the P-4 interlock with the Boron Dilution Block Function is not required, since the unborated water source flow path isolation valves are locked closed in accordance with LCO 3.9.2.
18.c. Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is actuated when the respective NIS intermediate range channel increases to approximately one decade above the channel lower range limit. Above the setpoint, the P-6 interlock allows manual block of the source range neutron flux reactor trip.
Below the setpoint, the P-6 interlock automatically unblocks the energizes the source range detectors and unblocks the source range neutron flux reactor trip. As intermediate range flux decreases from above the setpoint to below the setpoint P-6 interlock automatically resets the flux doubling block function ensuring the source range neutron flux doubling function, permitting the block of boron dilution is enabled.
Normally, this the source range neutron flux doubling Function      Commented [HZS5]: Ext-05 is blocked by the main control room operator during reactor startup. This Function is required to be OPERABLE in MODE AP1000                                B 3.3.2 - 42                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  311
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) 2.
18.d. Reactor Coolant Average Temperature, P-8 The P-8 interlock is provided to permit a manual block of or to reset a manual block of the automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block (Function 15.a).
The automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block Function may be manually blocked (disabled) to permit plant startup and normal power operation when above the P-8 reactor coolant average temperature setpoint.
The manual block to disable the automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block Function is automatically reset upon decreasing reactor coolant average temperature to below the P-8 setpoint.
Once reactor coolant average temperature is below the P-8 setpoint, the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block Function may also be manually blocked to prevent inadvertent actuation during refueling operations and post-refueling control rod testing.
When the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block is manually blocked below P-8 during shutdown conditions, the CVS demineralized water system isolation valves will automatically close to prevent inadvertent boron dilution.
The P-8 interlock is required to be OPERABLE in MODES 2, 3, 4 and 5. This Function is not applicable in MODES 3, 4 and 5, if the demineralized water makeup flow path is isolated. In MODE 6, a dilution event is precluded by the requirement in LCO 3.9.2 to close, lock and secure at least one valve in each unborated water source flow path.                                Commented [HZS6]: Ext-05 18.de. Pressurizer Pressure, P-11                                        Commented [HZS7]: Ext-05 The P-11 interlock permits a normal unit cooldown and depressurization without Safeguards Actuation or main steam line and feedwater isolation. With pressurizer pressure channels less than the P-11 setpoint, the operator can manually block the Pressurizer pressure - Low, Steam Line Pressure - Low, and Tcold - Low Safeguards Actuation AP1000                                B 3.3.2 - 43                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                312
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) signals and the Steam Line Pressure - Low and Tcold - Low steam line isolation signals. When the Steam Line Pressure -
Low is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate - High is enabled. This provides protection for an SLB by closure of the main steam isolation valves. Manual block of feedwater isolation on Tavg - Low 1, Low 2, and Tcold - Low is also permitted below P-11. With pressurizer pressure channels  P-11 setpoint, the Pressurizer Pressure - Low, Steam Line Pressure - Low, and Tcold - Low Safeguards Actuation signals and the Steam Line Pressure Low and Tcold - Low steam line isolation signals are automatically enabled. The feedwater isolation signals on Tcold - Low, Tavg - Low 1 and Low 2 are also automatically enabled above P-11. The operator can also enable these signals by use of the respective manual reset buttons. When the Steam Line Pressure - Low and Tcold - Low steam line isolation signals are enabled, the main steam isolation on Steam Line Pressure-Negative Rate - High is disabled. The Setpoint reflects only steady state instrument uncertainties.
This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the Safeguards Actuation or main steam or feedwater isolation. This Function does not have to be OPERABLE in MODE 4, 5, or 6, because plant pressure must already be below the P-11 setpoint for the requirements of the heatup and cooldown curves to be met.
18.ef. Pressurizer Level, P-12                                            Commented [HZS8]: Ext-05 The P-12 interlock is provided to permit midloop operation without core makeup tank actuation, reactor coolant pump trip, CVS letdown isolation, or purification line isolation. With pressurizer level channels less than the P-12 setpoint, the operator can manually block low pressurizer level signal used for these actuations. Concurrent with blocking CMT actuation on low pressurizer level, ADS 4th Stage actuation on Low 2 RCS hot leg level is enabled. Also CVS letdown isolation on Low 1 RCS hot leg level is enabled. When the pressurizer level is above the P-12 setpoint, the pressurizer level signal is automatically enabled and a confirmatory open signal is issued to the isolation valves on the CMT cold leg balance lines. This Function is required to be OPERABLE in MODES 1, 2, 3, 4, 5, and 6.
AP1000                                B 3.3.2 - 44                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                313
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) 18.fg. RCS Pressure, P-19                                                Commented [HZS9]: Ext-05 The P-19 interlock is provided to permit water solid conditions (i.e., when the pressurizer water level is >92%) in lower MODES without automatic isolation of the CVS makeup pumps. With RCS pressure below the P-19 setpoint, the operator can manually block CVS isolation on High 2 pressurizer water level, and block Passive RHR actuation and Pressurizer Heater Trip on High 3 pressurizer water level.
When RCS pressure is above the P-19 setpoint, these Functions are automatically unblocked. This Function is required to be OPERABLE IN MODES 1, 2, 3, and 4 with the RCS not being cooled by the RNS. When the RNS is cooled by the RNS, the RNS suction relief valve provides the required overpressure protection (LCO 3.4.14).
: 19. Containment Air Filtration System Isolation Some DBAs such as a LOCA may release radioactivity into the containment where the potential would exist for the radioactivity to be released to the atmosphere and exceed the acceptable site dose limits. Isolation of the Containment Air Filtration System provides protection to prevent radioactivity inside containment from being released to the atmosphere.
19.a. Containment Radioactivity - High 1 Three channels of Containment Radioactivity - High 1 are required to be OPERABLE in MODES 1, 2, 3, and 4 with the RCS not being cooled by the RNS, when the potential exists for a LOCA, to protect against radioactivity inside containment being released to the atmosphere. These Functions are not required to be OPERABLE in MODE 4 with the RCS being cooled by the RNS or MODES 5 and 6, because any DBA release of radioactivity into the containment in these MODES would not require containment isolation.
19.b. Containment Isolation (Function 3)
Containment Air Filtration System Isolation is also initiated by all Functions that initiate Containment Isolation. The Containment Air Filtration System Isolation requirements for these Functions are the same as the requirements for the Containment Isolation. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 3, Containment AP1000                                B 3.3.2 - 45                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                314
 
DCP_NRC_003343                                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (Continued)
J.1 and J.2 Condition J applies to the P-6, P-8, P-11, P-12, and P-19 interlocks. With      Commented [HZS10]: Ext-05 one or two required channel(s) inoperable, the associated interlock must be verified to be in its required state for the existing plant condition within 1 hour, or any Function channel associated with the inoperable interlock(s) placed in a bypassed condition within 7 hours. Verifying the interlock state manually accomplishes the interlock role.
If one interlock channel is inoperable, the associated Function(s) must be placed in a bypass or trip condition within 7 hours. If one channel is bypassed, the logic becomes two-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent the protective function.) If one channel is tripped, the logic becomes one-out-of-three, while still meeting the single failure criterion.
(A failure in one of the three remaining channels will not prevent the protective function.)
If two interlock channels are inoperable, one channel of the associated Function(s) must be bypassed and one channel of the associated Function(s) must be tripped. In this state, the logic becomes one-out-of-two, while still meeting the single failure criterion. The 7 hours allowed to place the inoperable channel(s) in the bypassed or tripped condition is justified in Reference 6.
K.1 LCO 3.0.8 is applicable while in MODE 5 or 6. Since irradiated fuel assembly movement can occur in MODE 5 or 6, the ACTIONS have been modified by a Note stating that LCO 3.0.8 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, the fuel movement is independent of shutdown reactor operations. Entering LCO 3.0.8 while in MODE 5 or 6 would require the optimization of plant safety, unnecessarily.
Condition K is applicable to the Main Control Room IsolationMCR Isolation, and Air Supply Initiation and Electrical Load De-energization        Commented [HZS11]: Ext-02 (Function 20), during movement of irradiated fuel assemblies. If the Required Action and associated Completion Time of the first Condition listed in Table 3.3.2-1 is not met, the plant must suspend movement of the irradiated fuel assemblies immediately. The required action suspends activities with potential for releasing radioactivity that might enter the MCR. This action does not preclude the movement of fuel to a safe position.
AP1000                                    B 3.3.2 - 58                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      315
 
DCP_NRC_003343                                      Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document isolatable on at least one side by closure of the flange within containment or the gate valve outside containment.
19E.2.7    Chemical and Volume Control System 19E.2.7.1 System Description The chemical and volume control system (CVS) is described in subsection 9.3.6.
19E.2.7.2 Design Features to Address Shutdown Safety                                                              Commented [HZS2]: Ext-05 The AP1000 CVS is a nonsafety-related system. However, portions of the system are safety-related and perform safety-related functions, such as containment isolation, termination of inadvertent RCS boron dilution, RCS pressure boundary preservation, and isolation of excessive makeup.
Boron dilution events during low power modes can occur for a number of reasons, including malfunctions of the makeup control system. Regardless of the cause, the protection is the same.
The CVS is designed to avoid and/or terminate boron dilution events by automatically closing either one of two series, safety-related valves in the demineralized water supply line to the makeup pump suction to isolate the dilution source. Additionally, the suction line for the CVS makeup pump is automatically realigned to draw borated water from the boric acid tank. The automatic boron dilution protection signal is safety-related and is generated upon any reactor trip signal, source-range flux multiplication signal, low input voltage to the Class 1E dc and uninterruptible power supply system battery chargers, or a safety injection signal.
The safety analysis of boron dilution accidents is provided in Chapter 15 and is discussed in subsection 19E.4.5 of this appendix. For dilution events that occur during shutdown, the source-range flux-doubling signal closes the safety-related remotely operated CVS makeup line isolation valves to terminate the event. In addition, the signal is used to isolate the line from the demineralized water system to the makeup pump suction by closing the two safety-related remotely operated valves. The three-way pump suction control valve aligns the makeup pumps to take suction from the boric acid tank and, therefore, stops the dilution.
For refueling operations, administrative controls are used to prevent boron dilutions by verifying that the valves in the line from the demineralized water system are closed and locked. These valves block the flow paths that can allow unborated makeup water to reach the RCS. Makeup required during refueling uses borated water supplied from the boric acid tank by the CVS makeup pumps.
During refueling operations (Mode 6), two source-range neutron flux monitors are operable to monitor core reactivity. This is required by the plant Technical Specifications. The two operable source-range neutron flux monitors provide a signal to alert the operator to unexpected changes in core reactivity. The potential for an uncontrolled boron dilution accident is precluded by isolating the unborated water sources. This is also required by the plant Technical Specifications.
The source range flux doubling function can be manually blocked during shutdown conditions when below the P-8 setpoint after the operator isolates unborated water source flow paths. When Tier 2 Material                                    19E-17                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  316
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution.
19E.2.8    Spent Fuel Pool Cooling System 19E.2.8.1 System Description The spent fuel pool cooling system (SFS) is discussed in subsection 9.1.3.
19E.2.8.2 Design Features to Address Shutdown Safety The AP1000 has incorporated various design features to improve shutdown safety. The SFS features that have been incorporated to address shutdown safety are described in this subsection.
19E.2.8.2.1 Seismic Design The spent fuel pool, fuel transfer canal (FTC), cask loading pit (CLP), cask washdown pit (CWP), and gates from the spent fuel pool-CLP and FTC-spent fuel pool are all integral with the auxiliary building structure. The auxiliary building is seismic Class I design and is designed to retain its integrity when exposed to a safe shutdown earthquake (SSE). The suction and discharge connections between the spent fuel pool and RNS are safety Class C, which is also seismic Class I. The emergency makeup water line from the PCS water storage tank to the spent fuel pool actually connects with the RNS pump suction line. This emergency makeup line is also safety Class C and seismic Class I. The spent fuel pool level instruments connections to the spent fuel pool are safety Class C, seismic Class I, and have 3/8-inch flow restricting orifices at the pool wall to limit the amount of a leak from the pool if the instrument or its piping develops a leak.
The refueling cavity is integral with the containment internal structure, and as such, is seismic Class I, and is designed to retain its integrity when exposed to an SSE. In addition, the AP1000 has incorporated a permanently welded seal ring to provide the seal between the vessel flange and the refueling cavity floor. This refueling cavity seal is part of the refueling cavity and is seismic Class I. Figure 19E.2-3 is a simplified drawing of the AP1000 permanent reactor cavity seal. The cavity seal is designed to accommodate the thermal transients associated with the reactor vessel flange.
19E.2.9    Control and Protection Systems The AP1000 control and protection systems support the operations necessary for the AP1000 to achieve shutdown. These systems consist of a nonsafety-related plant control system (PLS), a safety-related protection and safety monitoring system (PMS), and a nonsafety-related diverse actuation system (DAS). These systems are discussed in Chapter 7.
19E.3      Shutdown Maintenance Guidelines and Procedures This section presents an overview discussion of AP1000 shutdown maintenance guidelines and procedures captured as part of the AP1000 design and design certification program. Shutdown Tier 2 Material                                      19E-18                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      317
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3 Design Control Document Replacement Information All Change Pages Combined (Non-Proprietary)
                    &#xa9; 2021 Westinghouse Electric Company LLC All Rights Reserved APP-GW-GL-705 Rev. 0                                                  318
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                          AP1000 Design Control Document Table 2.2.3-1 ASME                                  Class 1E/                              Loss of Code                  Remotely          Qual. Safety-  Control            Motive Section    Seismic    Operated        Harsh  Related    PMS/    Active    Power Equipment Name                Tag No. III        Cat. I      Valve          Envir. Display    DAS    Function  Position Passive Residual Heat            PXS-ME-01  Yes        Yes          -            -/-      -        -/-      -        -
Removal Heat Exchanger (PRHR HX)
Accumulator Tank A              PXS-MT-01A  Yes        Yes          -            -/-      -        -/-      -        -
Accumulator Tank B              PXS-MT-01B  Yes        Yes          -            -/-      -        -/-      -        -
Core Makeup Tank                PXS-MT-02A  Yes        Yes          -            -/-      -        -/-      -        -
(CMT) A CMT B                          PXS-MT-02B  Yes        Yes          -            -/-      -        -/-      -        -
IRWST                            PXS-MT-03  No          Yes          -            -/-      -        -/-      -        -
IRWST Screen A                PXS-MY-Y01A  No          Yes          -            -/-      -        -/-      -        -
IRWST Screen B                PXS-MY-Y01B  No          Yes          -            -/-      -        -/-      -        -
IRWST Screen C                PXS-MY-Y01C  No          Yes          -            -/-      -        -/-      -        -
Containment Recirculation      PXS-MY-Y02A  No          Yes          -            -/-      -        -/-      -        -
Screen A Containment Recirculation      PXS-MY-Y02B  No          Yes          -            -/-      -        -/-      -        -
Screen B pH Adjustment Basket 3A        PXS-MY-Y03A  No          Yes          -            -/-      -        -/-      -        -
pH Adjustment Basket 3B        PXS-MY-Y03B  No          Yes          -            -/-      -        -/-      -        -
pH Adjustment Basket 4A        PXS-MY-Y04A  No          Yes                        -/-              -/-
pH Adjustment Basket 4B        PXS-MY-Y04B  No          Yes                        -/-              -/-
Downspout Screen 1A            PXS-MY-Y81  No          Yes          -            -/-      -        -/-      -        -
Downspout Screen 1B            PXS-MY-Y82  No          Yes          -            -/-      -        -/-      -        -
Note: Dash (-) indicates not applicable.
Tier 1 Material                                                    2.2.3-3                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                319
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                            AP1000 Design Control Document Table 2.2.3-1 (cont.)
ASME                                  Class 1E/                                Loss of Code                  Remotely        Qual. Safety-    Control            Motive Section    Seismic      Operated        Harsh    Related      PMS/    Active  Power Equipment Name                Tag No. III        Cat. I      Valve          Envir. Display      DAS    Function Position Downspout Screen 1C            PXS-MY-Y83    No          Yes            -            -/-        -          -/-      -      -
Downspout Screen 1D            PXS-MY-Y84    No          Yes            -            -/-        -          -/-      -      -
Downspout Screen 2A            PXS-MY-Y85    No          Yes            -            -/-        -          -/-      -      -
Downspout Screen 2B            PXS-MY-Y86    No          Yes            -            -/-        -          -/-      -      -
Downspout Screen 2C            PXS-MY-Y87    No          Yes            -            -/-        -          -/-      -      -
Downspout Screen 2D            PXS-MY-Y88    No          Yes            -            -/-        -          -/-      -      -
CMT A Inlet Isolation        PXS-PL-V002A  Yes        Yes          Yes          Yes/Yes    Yes      Yes/No  None      As Is Motor-operated Valve                                                                        (Position)
CMT B Inlet Isolation        PXS-PL-V002B  Yes        Yes          Yes          Yes/Yes    Yes      Yes/No  None      As Is Motor-operated Valve                                                                        (Position)
CMT A Discharge              PXS-PL-V014A  Yes        Yes          Yes          Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                            (Position)            Open CMT B Discharge              PXS-PL-V014B  Yes        Yes          Yes          Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                            (Position)            Open CMT A Discharge              PXS-PL-V015A  Yes        Yes          Yes          Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                            (Position)            Open CMT B Discharge              PXS-PL-V015B  Yes        Yes          Yes          Yes/Yes    Yes      Yes/Yes Transfer  Open Isolation Valve                                                                            (Position)            Open CMT A Discharge Check        PXS-PL-V016A  Yes        Yes          No            -/-      No          -/-  Transfer    -
Valve                                                                                                            Open/
Transfer Closed Note: Dash (-) indicates not applicable.
Tier 1 Material                                                    2.2.3-4                                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    320
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                            AP1000 Design Control Document Table 2.2.3-2 (cont.)
ASME      Leak      Functional Code      Before      Capability Line Name                            Line Number                      Section III Break        Required IRWST screen cross-connect line        PXS-L180A, PXS-L180B                            Yes        No          Yes Containment recirculation line A      PXS-L113A, PXS-L131A, PXS-L132A                  Yes        No          Yes Containment recirculation line B      PXS-L113B, PXS-L131B, PXS-L132B                  Yes        No          Yes IRWST gutter drain line                PXS-L142A, PXS-L142B                            Yes        No          Yes PXS-L141A, PXS-L141B                            Yes        No          No Downspout drain lines from polar      PXS-L301A, PXS-L302A, PXS-L303A,                Yes        No          Yes crane girder and internal stiffener to PXS-L304A, PXS-L305A, PXS-L306A, collection box A                      PXS-L307A, PXS-L308A, PXS-L309A, PXS-L310A Downspout drain lines from polar      PXS-L301B, PXS-L302B, PXS-L303B,                Yes        No          Yes crane girder and internal stiffener to PXS-L304B, PXS-L305B, PXS-L306B, collection box B                      PXS-L307B, PXS-L308B, PXS-L309B, PXS-L310B Tier 1 Material                                                      2.2.3-13                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    321
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                            AP1000 Design Control Document 2.2.5 Main Control Room Emergency Habitability System Design Description The main control room emergency habitability system (VES) provides a supply of breathable air for the main control room (MCR) occupants and maintains the MCR at a positive pressure with respect to the surrounding areas whenever ac power is not available to operate the nuclear island nonradioactive ventilation system (VBS), MCR differential pressure is not maintained, or high radioactivity is detected in the MCR air supply. (See Tier 1 material, Section 3.5 for Radiation Monitoring). The VES also limits the heatup of the MCR, the 1E instrumentation and control (I&C) equipment rooms, and the Class 1E dc equipment rooms by using the heat capacity of surrounding structures.
The VES is as shown in Figure 2.2.5-1 and the component locations of the VES are as shown in Table 2.2.5-6.
: 1. The functional arrangement of the VES is as described in the Design Description of this Section 2.2.5.
: 2. a) The components identified in Table 2.2.5-1 as ASME Code Section III are designed and constructed in accordance with ASME Code Section III requirements.
b) The piping identified in Table 2.2.5-2 as ASME Code Section III is designed and constructed in accordance with ASME Code Section III requirements.
: 3. a) Pressure boundary welds in components identified in Table 2.2.5-1 as ASME Code Section III meet ASME Code Section III requirements.
b) Pressure boundary welds in piping identified in Table 2.2.5-2 as ASME Code Section III meet ASME Code Section III requirements.
: 4. a) The components identified in Table 2.2.5-1 as ASME Code Section III retain their pressure boundary integrity at their design pressure.
b) The piping identified in Table 2.2.5-2 as ASME Code Section III retains its pressure boundary integrity at its design pressure.
: 5. a) The seismic Category I equipment identified in Table 2.2.5-1 can withstand seismic design basis loads without loss of safety function.
b) Each of the lines identified in Table 2.2.5-2 for which functional capability is required is designed to withstand combined normal and seismic design basis loads without a loss of its functional capability.
: 6. a) The Class 1E components identified in Table 2.2.5-1 are powered from their respective Class 1E division.
b) Separation is provided between VES Class 1E divisions, and between Class 1E divisions and non-Class 1E cable.
: 7. The VES provides the following safety-related functions:
Tier 1 Material                                      2.2.5-1                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                      322
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                          AP1000 Design Control Document a) The VES provides a 72-hour supply of breathable quality air for the occupants of the MCR.
b) The VES maintains the MCR pressure boundary at a positive pressure with respect to the surrounding areas. There is a discharge of air through the MCR vestibule.
c) The heat loads within the MCR, the I&C equipment rooms, and the Class 1E dc equipment rooms are within design basis assumptions to limit the heatup of the rooms identified in Table 2.2.5-4.
d) The system provides a passive recirculation flow of MCR air to maintain main control room dose rates below an acceptable level during VES operation.
e) The system provides shielding below the VES filter that is sufficient to ensure main control room doses are below an acceptable level during VES operation.
: 8. Safety-related displays identified in Table 2.2.5-1 can be retrieved in the MCR.
: 9. a) Controls exist in the MCR to cause those remotely operated valves identified in Table 2.2.5-1 to perform their active functions.
b) The valves identified in Table 2.2.5-1 as having protection and safety monitoring system (PMS) control perform their active safety function after receiving a signal from the PMS.
c) The MCR Load Shed Panels identified in Table 2.2.5-1 perform their active safety function after receiving a signal from the PMS.
: 10. After loss of motive power, the remotely operated valves identified in Table 2.2.5-1 assume the indicated loss of motive power position.
: 11. Displays of the parameters identified in Table 2.2.5-3 can be retrieved in the MCR.
: 12. The background noise level in the MCR does not exceed 65 dB(A) at the operator workstations when the VES is operating.
Inspections, Tests, Analyses, and Acceptance Criteria Table 2.2.5-5 specifies the inspections, tests, analyses, and associated acceptance criteria for the VES.
Tier 1 Material                                    2.2.5-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      323
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                          AP1000 Design Control Document Table 2.2.5-1 ASME                                  Class 1E/                            Loss of Code                  Remotely        Qual. for Safety-                    Motive Section    Seismic    Operated          Harsh  Related  Control  Active  Power Equipment Name                Tag No. III      Cat. I      Valve          Envir. Display  PMS    Function Position MCR Load Shed Panel 1          VES-EP-01  No          Yes          -          Yes/No    Yes      Yes      De-        -
energize MCR Loads MCR Load Shed Panel 2          VES-EP-02  No          Yes          -          Yes/No    Yes      Yes      De-        -
energize MCR Loads Emergency Air Storage          VES-MT-01  No          Yes          -              -/-      -        -        -        -
Tank 01 Emergency Air Storage          VES-MT-02  No          Yes          -              -/-      -        -        -        -
Tank 02 Emergency Air Storage          VES-MT-03  No          Yes          -              -/-      -        -        -        -
Tank 03 Emergency Air Storage          VES-MT-04  No          Yes          -              -/-      -        -        -        -
Tank 04 Emergency Air Storage          VES-MT-05  No          Yes          -              -/-      -        -        -        -
Tank 05 Emergency Air Storage          VES-MT-06  No          Yes          -              -/-      -        -        -        -
Tank 06 Note: Dash (-) indicates not applicable.
Tier 1 Material                                                    2.2.5-3                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  324
 
DCP_NRC_003343                                        Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                          AP1000 Design Control Document Table 2.2.5-1 (cont.)
ASME                                  Class 1E/                            Loss of Code                Remotely        Qual. for Safety-                    Motive Section  Seismic    Operated          Harsh  Related  Control  Active  Power Equipment Name              Tag No. III      Cat. I      Valve          Envir. Display  PMS    Function  Position Emergency Air Storage        VES-MT-31    No        Yes          -              -/-      -        -        -        -
Tank 31 Emergency Air Storage        VES-MT-32    No        Yes          -              -/-      -        -        -        -
Tank 32 Air Delivery Alternate      VES-PL-V001  Yes        Yes          No              -/-    No        -    Transfer    -
Isolation Valve                                                                                            Open Eductor Flow Path            VES-PL-V045  Yes        Yes          No              -/-    No        -    Transfer    -
Isolation Valve                                                                                            Close Eductor Bypass Isolation    VES-PL-V046  Yes        Yes          No              -/-    No        -    Transfer    -
Valve                                                                                                      Open Pressure Regulating        VES-PL-V002A  Yes        Yes          No              -/-    No        -    Throttle    -
Valve A                                                                                                    Flow Pressure Regulating        VES-PL-V002B  Yes        Yes          No              -/-    No        -    Throttle    -
Valve B                                                                                                    Flow MCR Air Delivery            VES-PL-V005A  Yes        Yes        Yes            Yes/No    No      Yes    Transfer  Open Isolation Valve A                                                                                          Open MCR Air Delivery            VES-PL-V005B  Yes        Yes        Yes            Yes/No    No      Yes    Transfer  Open Isolation Valve B                                                                                          Open Temporary Instrument        VES-PL-V018  Yes        Yes          No              -/-    No      No    Transfer    -
Isolation Valve A                                                                                          Open Temporary Instrument        VES-PL-V019  Yes        Yes          No              -/-    No      No    Transfer    -
Isolation Valve B                                                                                          Open Note: Dash (-) indicates not applicable.
Tier 1 Material                                                    2.2.5-7                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                325
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                                                          AP1000 Design Control Document Table 2.2.5-1 (cont.)
ASME                                  Class 1E/                            Loss of Code                Remotely        Qual. for Safety-                    Motive Section  Seismic    Operated          Harsh  Related  Control  Active    Power Equipment Name              Tag No. III      Cat. I      Valve          Envir. Display  PMS    Function  Position MCR Air Filtration Line        VES-MY-F03    No        Yes          -              -      -      -        -        -
Postfilter MCR Filter Shielding          12401-NS-01  No        Yes          -              -      -      -        -        -
MCR Gravity Relief          VES-MD-D001A    No        Yes          -              -      -      -        -        -
Dampers MCR Gravity Relief          VES-MD-D001B    No        Yes          -              -      -      -        -        -
Dampers MCR Air Filtration Line      VES-MD-D002    No        Yes          -              -      -      -        -        -
Supply Damper MCR Air Filtration Line      VES-MD-D003    No        Yes          -              -      -      -        -        -
Supply Damper MCR Air Filtration Line      VES-MY-Y01    No        Yes          -              -      -      -        -        -
Silencer MCR Air Filtration Line      VES-MY-Y02    No        Yes          -              -      -      -        -        -
Silencer MCR Air Delivery Line          VES-003A    No        Yes          -            Yes/No    Yes      -        -        -
Flow Sensor MCR Air Delivery Line          VES-003B    No        Yes          -            Yes/No    Yes      -        -        -
Flow Sensor Note: Dash (-) indicates not applicable.
Tier 1 Material                                                      2.2.5-9                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                  326
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                      AP1000 Design Control Document Table 2.2.5-2 ASME Code            Functional Capability Line Name            Line Number                  Section III              Required MCR Relief Line            VES-PL-022A                      Yes                    Yes MCR Relief Line            VES-PL-022B                      Yes                    Yes Table 2.2.5-3 Equipment                            Tag No.                      Display Air Storage Tank Pressure                          VES-001A                          Yes Air Storage Tank Pressure                          VES-001B                        Yes Table 2.2.5-4 Heat Load 0 to 24 Hours    Heat Load 24 to 72 Hours Room Name          Room Numbers                    (Btu/s)                  (Btu/s)
MCR Envelope                  12401                                                  3.95 23.5 (hour 0 to 0.5) 14.5 (hour 0.5 to 3.5) 4.75 (hour 3.5 through 24)
I&C Rooms                  12301, 12305                      8.8                        0 I&C Rooms                  12302, 12304                      13.0                      4.2 dc Equipment Rooms        12201, 12205            3.7 (hour 0 through 1)                0 2.4 (hour 2 through 24) dc Equipment Rooms        12203, 12207            5.8 (hour 0 through 1)              2.0 4.5 (hour 2 through 24)
Tier 1 Material                                2.2.5-11                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                327
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                              AP1000 Design Control Document Table 2.2.5-5 (cont.)
Inspections, Tests, Analyses, and Acceptance Criteria Design Commitment                  Inspections, Tests, Analyses                Acceptance Criteria 7d) The system provides a passive      Testing will be performed to          The air flow rate at the outlet of the recirculation flow of MCR air to        confirm that the required amount      MCR passive filtration system is at maintain main control room dose        of air flow circulates through the    least 600 cfm greater than the flow rates below an acceptable level        MCR passive filtration system,        measured by VES-003A/B.
during VES operation.
7e) Shielding below the VES filter      Inspection will be performed for      A report exists and concludes that the is capable of providing attenuation    the existence of a report verifying  as-built shielding identified in Table that is sufficient to ensure main      that the as-built shielding meets    2.2.5-1 meets the functional control room doses are below an        the requirements for functional      requirements and exists below the acceptable level during VES            capability.                          filtration and exists below the operation.                                                                    filtration unit, and within its vertical projection.
: 8. Safety-related displays identified  Inspection will be performed for      Safety-related displays identified in in Table 2.2.5-1 can be retrieved in    retrievability of the safety-related  Table 2.2.5-1 can be retrieved in the the MCR.                                displays in the MCR.                  MCR.
9.a) Controls exist in the MCR to      Stroke testing will be performed      Controls in the MCR operate to cause cause remotely operated valves          on remotely operated valves          remotely operated valves identified identified in Table 2.2.5-1 to          identified in Table 2.2.5-1 using    in Table 2.2.5-1 to perform their perform their active functions.        the controls in the MCR.              active safety functions.
9.b) The valves identified in          Testing will be performed on          The remotely operated valves Table 2.2.5-1 as having PMS            remotely operated valves listed in    identified in Table 2.2.5-1 as having control perform their active safety    Table 2.2.5-1 using real or          PMS control perform the active function after receiving a signal      simulated signals into the PMS.      safety function identified in the table from the PMS.                                                                after receiving a signal from the PMS.
9.c) The MCR Load Shed Panels          Testing will be performed on the      The MCR Load Shed Panels identified in Table 2.2.5-1 perform    MCR Load Shed Panels listed in        identified in Table 2.2.5-1 perform their active safety function after      Table 2.2.5-1 using real or          their active safety function identified receiving a signal from the PMS.        simulated signals into the PMS.      in the table after receiving a signal from the PMS.
: 10. After loss of motive power, the    Testing of the remotely operated      After loss of motive power, each remotely operated valves identified    valves will be performed under        remotely operated valve identified in in Table 2.2.5-1 assume the            the conditions of loss of motive      Table 2.2.5-1 assumes the indicated indicated loss of motive power          power.                                loss of motive power position.
position.
: 11. Displays of the parameters          Inspection will be performed for      The displays identified in identified in Table 2.2.5-3 can be      retrievability of the parameters in  Table 2.2.5-3 can be retrieved in the retrieved in the MCR.                  the MCR.                              MCR.
Tier 1 Material                                        2.2.5-15                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  328
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                              AP1000 Design Control Document Table 2.3.9-3 (cont.)
Inspections, Tests, Analyses, and Acceptance Criteria Design Commitment                  Inspections, Tests, Analyses              Acceptance Criteria
: 3. The VLS provides the                i) Inspection for the number of      i) At least 64 hydrogen igniters are nonsafety-related function to          igniters will be performed.          provided inside containment at the control the containment hydrogen                                            locations specified in Table 2.3.9-2.
concentration for beyond design ii) Operability testing will be      ii) The surface temperature of the basis accidents.
performed on the igniters.            igniter exceeds 1700&deg;F.
iii) An inspection of the as-built    iii) The equipment access opening containment internal structures      and CMT-A opening constitute at will be performed.                    least 98% of the vent path area from Room 11206 to Room 11300. The minimum distance between the equipment access opening and the containment shell is at least 24.3 feet.
The minimum distance between the CMT-A opening and the containment shell is at least 9.4 feet. The CMT-B opening constitutes at least 98% of the vent path area from Room 11207 to Room 11300 and is a minimum distance of 24.6 feet away from the containment shell. Other openings through the ceilings of these rooms must be at least 3 feet from the containment shell.
iv) An inspection will be            iv) The discharge from each of these performed of the as-built IRWST      IRWST vents is oriented generally vents that are located in the roof    away from the containment shell.
of the IRWST along the side of the IRWST next to the containment shell.
4.a) Controls exist in the MCR to      Testing will be performed on the      Controls in the MCR operate to cause the components identified in    igniters using the controls in the    energize the igniters.
Table 2.3.9-2 to perform the listed    MCR.
function.
4.b) The components identified in      Testing will be performed on the      The igniters energize after receiving Table 2.3.9-2 perform the listed      igniters using the DAS controls.      a signal from DAS.
function after receiving manual a signal from DAS.
Tier 1 Material                                        2.3.9-7                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                329
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                            AP1000 Design Control Document Table 2.5.2-3 PMS Automatically Actuated Engineered Safety Features Safeguards Actuation Containment Isolation Automatic Depressurization System (ADS) Actuation Main Feedwater Isolation Reactor Coolant Pump Trip CMT Injection Turbine Trip (Isolated signal to nonsafety equipment)
Steam Line Isolation Steam Generator Relief Isolation Steam Generator Blowdown Isolation Passive Containment Cooling Actuation Startup Feedwater Isolation Passive Residual Heat Removal (PRHR) Heat Exchanger Alignment Block of Boron Dilution Chemical and Volume Control System (CVS) Makeup Line Isolation Steam Dump Block (Isolated signal to nonsafety equipment)
Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization Auxiliary Spray and Letdown Purification Line Isolation Containment Air Filtration System Isolation Normal Residual Heat Removal Isolation Refueling Cavity Isolation In-Containment Refueling Water Storage Tank (IRWST) Injection IRWST Containment Recirculation CVS Letdown Isolation Pressurizer Heater Block (Isolated signal to nonsafety equipment)
Containment Vacuum Relief Tier 1 Material                                        2.5.2-6                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    330
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                            AP1000 Design Control Document Table 2.5.2-4 PMS Manually Actuated Functions Reactor Trip Safeguards Actuation Containment Isolation Depressurization System Stages 1, 2, and 3 Actuation Depressurization System Stage 4 Actuation Feedwater Isolation Core Makeup Tank Injection Actuation Steam Line Isolation Passive Containment Cooling Actuation Passive Residual Heat Removal Heat Exchanger Alignment IRWST Injection Containment Recirculation Actuation Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization Steam Generator Relief Isolation Chemical and Volume Control System Isolation Normal Residual Heat Removal System Isolation Containment Vacuum Relief Tier 1 Material                                      2.5.2-7                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                  331
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 2. System Based Design Descriptions and ITAAC                            AP1000 Design Control Document 2.7      HVAC Systems 2.7.1 Nuclear Island Nonradioactive Ventilation System Design Description The nuclear island nonradioactive ventilation system (VBS) serves the main control room (MCR), control support area (CSA), Class 1E dc equipment rooms, Class 1E instrumentation and control (I&C) rooms, Class 1E electrical penetration rooms, Class 1E battery rooms, remote shutdown room (RSR), reactor coolant pump trip switchgear rooms, adjacent corridors, and passive containment cooling system (PCS) valve room during normal plant operation. The VBS consists of the following independent subsystems:
the main control room/control support area HVAC subsystem, the class 1E electrical room HVAC subsystem, and the passive containment cooling system valve room heating and ventilation subsystem.
The VBS provides heating, ventilation, and cooling to the areas served when ac power is available. The system provides breathable air to the control room and maintains the main control room and control support area areas at a slightly positive pressure with respect to the adjacent rooms and outside environment during normal operations. The VBS monitors the main control room supply air for radioactive particulate and iodine concentrations and provides filtration of main control room/control support area air during conditions of abnormal High-1 airborne radioactivity. In addition, the VBS isolates the HVAC penetrations in the main control room boundary on High-2 particulate or iodine radioactivity in the main control room supply air duct or on a loss of ac power for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes. The Sanitary Drainage System (SDS) also isolates a penetration in the main control room boundary on High-2particulate or iodine radioactivity in the main control room supply air duct or on a loss of ac power for more than 10 minutes of if main control room differential pressure is below the Low setpoint for more than 10 minutes. Additional penetrations from the SDS and Potable Water System (PWS) into the main control room boundary are maintained leak tight using a loop seal in the piping, and the Waste Water System (WWS) is isolated using a normally closed safety related manual isolation valve. These features support operation of the main control room emergency habitability system (VES), and have been included in Tables 2.7.1-1 and 2.7.1-2.
The VBS is as shown in Figure 2.7.1-1 and the component locations of the VBS are as shown in Table 2.7.1-5.
: 1. The functional arrangement of the VBS is as described in the Design Description of this subsection 2.7.1.
: 2. a) The components identified in Table 2.7.1-1 as ASME Code Section III are designed and constructed in accordance with ASME Code Section III requirements.
b) The piping identified in Table 2.7.1-2 as ASME Code Section III is designed and constructed in accordance with ASME Code Section III requirements.
: 3. a) Pressure boundary welds in components identified in Table 2.7.1-1 as ASME Code Section III meet ASME Code Section III requirements.
b) Pressure boundary welds in piping identified in Table 2.7.1-2 as ASME Code Section III meet ASME Code Section III requirements.
Tier 1 Material                                      2.7.1-1                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      332
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 5. Site Parameters                                                          AP1000 Design Control Document Table 5.0-1 (cont.)
Site Parameters Control Room Atmospheric Dispersion Factors ( /Q) for Accident Dose Analysis
                          /Q (s/m3) at HVAC Intake for the Identified Release Points(3)
Ground Level Plant Vent or      Containment        PORV and        Steam Line        Fuel        Condenser PCS Air            Release        Safety Valve        Break        Handling      Air Removal Diffuser(5)        Points(6)        Releases(7)      Releases      Area(8)        Stack(9) 0 - 2 hours          2.53E-03          4.00E-03          1.92E-02        2.13E-02      6.0E-3          6.0E-3 2 - 8 hours          1.98E-03          2.28E-03          1.60E-02        1.76E-02      4.0E-3          4.0E-3 8 - 24 hours        7.96E-04          1.03E-03          6.90E-03        7.50E-03      2.0E-3          2.0E-3 1 - 4 days          6.40E-04          9.03E-04          4.96E-03        5.43E-03      1.5E-3          1.5E-3 4 - 30 days          4.78E-04          7.13E-04          4.16E-03        4.55E-03      1.0E-3          1.0E-3
                      /Q (s/m3) at Annex Building Door for the Identified Release Points(4) 0 - 2 hours          1.0E-3            1.0E-3            4.0E-3          4.0E-3        6.0E-3          2.0E-2 2 - 8 hours          7.5E-4            7.5E-4            3.2E-3          3.2E-3        4.0E-3          1.8E-2 8 - 24 hours          3.5E-4            3.5E-4            1.2E-3          1.2E-3        2.0E-3          7.0E-3 1 - 4 days            2.8E-4            2.8E-4            1.0E-3          1.0E-3        1.5E-3          5.0E-3 4 - 30 days          2.5E-4            2.5E-4            8.0E-4          8.0E-4        1.0E-3          4.5E-3 Notes:
: 3. These dispersion factors are to be used 1) for the time period preceding the isolation of the main control room and actuation of the emergency habitability system, 2) for the time after 72 hours when the compressed air supply in the emergency habitability system would be exhausted and outside air would be drawn into the main control room, and 3) for the determination of control room doses when the nonsafety ventilation system is assumed to remain operable such that the emergency habitability system is not actuated.
: 4. These dispersion factors are to be used when the emergency habitability system is in operation and the only path for outside air to enter the main control room is that due to ingress/egress.
: 5. These dispersion factors are used for analysis of the doses due to a postulated small line break outside of containment. The plant vent and PCS air diffuser are potential release paths for other postulated events (loss-of-coolant accident, rod ejection accident, and fuel handling accident inside the containment); however, the values are bounded by the dispersion factors for ground level releases.
: 6. The listed values represent modeling the containment shell as a diffuse area source, and are used for evaluating the doses in the main control room for a loss-of-coolant accident, for the containment leakage of activity following a rod ejection accident, and for a fuel handling accident occurring inside the containment.
Tier 1 Material                                          5.0-6                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                              333
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of the Plant                      AP1000 Design Control Document Table 1.1-1 (Sheet 4 of 4)
AP1000 DCD ACRONYMS ORE            Occupation Radiation Exposure PCS            Passive Containment Cooling System P&ID          Piping and Instrumentation Diagram PRA            Probabilistic Risk Assessment PRHR          Passive Residual Heat Removal PRHR HX        Passive Residual Heat Removal Heat Exchanger PWR            Pressurized Water Reactor PXS            Passive Core Cooling System QA            Quality Assurance RAM            Reliability, Availability, Maintainability RAP            Reliability Assurance Program RCS            Reactor Coolant System RCDT          Reactor Coolant Drain Tank RFI            Radio Frequency Interference R.G.          Regulatory Guide RNS            Normal Residual Heat Removal RSW            Remote Shutdown Workstation RV            Reactor Vessel SECY          Secretary of the Commission Letter SER            Safety Evaluation Report SMACNA        Sheet Metal and Air Conditioning Contractors National Association SRP            Standard Review Plan SSAR          Standard Safety Analysis Report SSD            System Specification Document SSE            Safe Shutdown Earthquake SSI            Soil Structure Interaction SUFCV          Startup Feedwater Control Valve SUFIV          Startup Feedwater Isolation Valve TID            Total Integrated Dose TMI            Three Mile Island TSC            Technical Support Center UBC            Uniform Building Code UL            Underwriters Laboratories UPS            Uninterruptible Power Supply URD            Utility Requirements Document USI            Unresolved Safety Issue USPHS          United States Public Health Service WBGT          Wet Bulb Globe Temperature Tier 2 Material                                          1.1-6                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    334
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                                        AP1000 Design Control Document Table 1.6-1 (Sheet 12 of 21)
MATERIAL REFERENCED DCD Section          Westinghouse Topical Number                Report Number                                                          Title 6.2        WCAP-15644-P (P)                        AP1000 Code Applicability Report, Revision 2, March 2004 WCAP-15644-NP 6.3        WCAP-8966 (P)                          Evaluation of Mispositioned ECCS Valves, September 1977 WCAP-13594 (P)                          FMEA of Advanced Passive Plant Protection System, Revision 1, WCAP-13662 (NP)                        June 1998 6A          WCAP-15846 (P)                          WGOTHIC Application to AP600 and AP1000, Revision 1, WCAP-15862                              March 2004 WCAP-14135 (P)                          Final Data Report for Passive Containment Cooling System Large WCAP-14138                              Scale Test, Phase 2 and Phase 3, Revision 3, November 1998 WCAP-15613 (P)                          AP1000 PIRT and Scaling Assessment Report, March 2001 WCAP-15706 7.1        WCAP-14605 (P)                          Westinghouse Setpoint Methodology for Protection Systems -
WCAP-14606 (NP)                        AP600, April 1996 WCAP-16361-P                            Westinghouse Setpoint Methodology for Protection Systems -
WCAP-16361-NP                          AP1000, February 2011 WCAP-15775                              AP1000 Instrumentation and Control Defense-in-Depth and Diversity Report
[WCAP-16096-NP-A                        Software Program Manual for Common Q Systems, Revision 01A, December 2004]*
[WCAP-16097-P-A                        Common Qualified Platform, Revision 01, May 2003]*
WCAP-16097-NP-A WCAP-15776                              Safety Criteria for the AP1000 Instrumentation and Control Systems, April 2002 WCAP-16674-P                            AP1000 I&C Data Communication and Manual Control of Safety WCAP-16674-NP                          Systems and Components, Revision 4 WCAP-16675-P                            AP1000 Protection and Safety Monitoring System Architecture WCAP-16675-NP                          Technical Report, Revision 5 (as modified by changes provided in Appendix 7A)
APP-GW-GLR-017                          AP1000 Standard Combined License Technical Report, Resolution of Common Q NRC Items (P) Denotes Document is Proprietary
*NRC Staff approval is required prior to implementing a change in this information; see DCD Introduction Section 3.5.
Tier 2 Material                                                    1.6-13                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          335
 
DCP_NRC_003343                                    Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                                        AP1000 Design Control Document Table 1.6-1 (Sheet 13 of 21)
MATERIAL REFERENCED DCD Section          Westinghouse Topical Number                Report Number                                                          Title 7.1        [WCAP-17179-P                          AP1000 Component Interface Module Technical Report]*
WCAP-17179-NP
[WCAP-15927 (NP)                        Design Process for AP1000 Common Q Safety Systems, Revision 2, November 2008]*
Westinghouse Electric Company Quality Management System (QMS), (Non-Proprietary), Revision 5, October 2002 APP-GW-J0R-012                          AP1000 Protection and Safety Monitoring System Computer Security Plan, Revision 1
[WCAP-17201-P                          AC160 High Speed Link Communication Compliance to DI&C-ISG-04 Staff Positions 9, 12, 13 and 15, Revision 0, February 2010]*
WCAP-17184-P (P)                        AP1000' Diverse Actuation System Planning and Functional Design Summary Technical Report 7.2        WCAP-16438-P                            FMEA of AP1000 Protection and Safety Monitoring System, WCAP-16438-NP                          Revision 3 (as modified by changes provided in Appendix 7A)
WCAP-16592-P                            Software Hazards Analysis of AP1000 Protection and Safety WCAP-16592-NP                          Monitoring System, Revision 2 WCAP-15776                              Safety Criteria for the AP1000 Instrumentation and Control Systems, April 2002 WCAP-16097-P-A                          Common Qualified Platform, Digital Plant Protection System, WCAP-16097-NP-A                        Appendix 3, May 2003 7.3        WCAP-15776                              Safety Criteria for the AP1000 Instrumentation and Control Systems, April 2002 7.7        WCAP-17184-P                            AP1000' Diverse Actuation System Planning and Functional Design Summary Technical Report 9.5        WCAP-15871                              AP1000 Assessment Against NFPA 804, Revision 1, December 2002 10.2        WCAP-16650-P (P)                        Analysis of the Probability of the Generation of Missiles for AP1000 WCAP-16650-NP                          Fully Integral Low Pressure Turbines, Revision 0, February 2007 WCAP-16651-P (P)                        Probabilistic Evaluation of Turbine Valve Test Frequency, WCAP-16651-NP                          Revision 1, May 2009 13          WCAP-14690                              Designers Input to Procedure Development for the AP600, Revision 1, June 1997 (P) Denotes Document is Proprietary
*NRC Staff approval is required prior to implementing a change in this information; see DCD Introduction Section 3.5.
Tier 2 Material                                                    1.6-14                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                          336
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                          AP1000 Design Control Document Table 1.6-1 (Sheet 16 of 21)
MATERIAL REFERENCED DCD Section      Westinghouse Topical Number          Report Number                                            Title 15.4      WCAP-15806-P-A (P)            Westinghouse Control Rod Ejection Accident Analysis Methodology WCAP-15807-NP-A              Using Multi-Dimensional Kinetics WCAP-10965-P-A (P)            ANC: A Westinghouse Advanced Nodal Computer Code, WCAP-10966-A                  September 1986 WCAP-11397-P-A (P)            Revised Thermal Design Procedure, April 1989 WCAP-11397-A WCAP-15644-P (P)              AP1000 Code Applicability Report, Revision 2, March 2004 WCAP-15644-NP WCAP-11596-P-A (P)            Qualification of the PHOENIX-P/ANC Nuclear Design System for WCAP-11597-A                  Pressurized Water Reactor Cores, June 1988 WCAP-16045-P-A (P)            Qualification of the Two-Dimensional Transport Code PARAGON, WCAP-16045-NP-A              August 2004 WCAP-10965-P-A,              ANC - A Westinghouse Advanced Nodal Computer Code; Addendum 1 (P)                Enhancements to ANC Rod Power Recovery, April 1989 WCAP-10966-A Addendum 1 WCAP-14565-P-A (P)            VIPRE-01 Modeling and Qualification for Pressurized Water WCAP-15306-NP-A              Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, October 1999 WCAP-15063-P-A,              Westinghouse Improved Performance Analysis and Design Model Revision 1 with Errata (P)    (PAD 4.0), July 2000 WCAP-15064-NP-A WCAP-16045-P-A                Qualification of the NEXUS Nuclear Data Methodology, August, Addendum 1-A (P)              2007 WCAP-16045-NP-A Addendum 1-A WCAP-10965-P-A,              Qualification of the New Pin Power Recovery Methodology, Addendum 2-A (P)              September, 2010 WCAP-15025-P-A (P)            Modified WRB-2 Correlation, WRB-2M, for Predicting Critical WCAP-15026-NP-A              Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids, April 1999 15.5      WCAP-7907-P-A (P)            LOFTRAN Code Description, April 1984 (P) Denotes Document is Proprietary Tier 2 Material                                        1.6-17                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                        337
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document 1.9.4.2.2  Task Action Plan Items A-1        Water Hammer Discussion:
Generic Safety Issue A-1 was raised after the occurrence of various incidents of water hammer that involved steam generator feedrings and piping, emergency core cooling systems, residual heat removal systems, containment spray, service water, feedwater, and steam lines. The incidents have been attributed to such causes as rapid condensation of steam pockets, steam-driven slugs of water, pump startup with partially empty lines, and rapid valve motion.
Most of the damage has been relatively minor and involved pipe hangers and restraints.
However, several incidents have resulted in piping and valve damage. This item was originally identified in NUREG-0371, (Reference 4) and was later determined to be an Unresolved Safety Issue.
AP1000 Response:
Specific sections of the Standard Review Plan (NUREG-0800) address criteria for mitigation of water hammer concerns. The applicable Standard Review Plan sections as well as information provided in NUREG-0927 (Reference 5) were reviewed. The AP1000 meets the water hammer provisions as specified. The discussion that follows provides a brief description of selected systems identified as being subject to water hammer occurrences and special design features that mitigate or prevent water hammer damage.
Design features are incorporated as appropriate to prevent water hammer damage in applicable systems including steam generator feedrings and piping, passive core cooling system, passive residual heat removal system, service water system, feedwater system, and steam lines.
Water hammer issues are considered in the design of the AP1000 passive core cooling system.
The passive core cooling system design includes a number of design features specifically to prevent or mitigate water hammer.
The automatic depressurization system operation uses multiple, sequenced valve stages to provide a relatively slow, controlled depressurization of the reactor coolant system, which helps to reduce the potential for water hammer.
Once the depressurization is complete, gravity injection from the in-containment refueling water storage tank is initiated by opening squib valves and then check valves, which reposition slowly.
Gravity injection flow actuates slowly, without water hammer, as the pressure differential across the gravity injection check valves equalizes, and the valves open and initiate flow.
The passive residual heat removal heat exchanger is normally aligned with an open inlet valve and closed discharge valves. This alignment keeps the system piping at reactor coolant system pressure, preventing water hammer upon initiation of flow through the heat exchanger.
Instrumentation is provided at the system high point to detect a void in the system.
Tier 2 Material                                      1.9-32                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      338
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document AP1000 Response:
The AP1000 incorporates the NRC criteria. The heat load is evaluated for the spent fuel storage capacity.
A-29        Nuclear Power Plant Design for the Reduction of Vulnerability to Industrial Sabotage Description This item addresses potential methods to reduce vulnerability to sabotage. The NRC staff concluded that existing requirements dealing with plant physical security, controlled access to vital areas, screening for reliable personnel appear to be effective. This item was resolved with no new requirements.
AP1000 Response:
The passive systems in the AP1000 provided to mitigate the effects of potential accidents may have an inherent advantage when considering potential acts of sabotage compared to the active systems in operating plants. The AP1000 includes provisions for access control to the vital area.
The provisions for security are discussed in the AP1000 Security Design Report and outlined in Section 13.6.
A-31        Residual Heat Removal Requirements Discussion:
Generic Issue A-31 addresses the desire for plants to be able to go from hot-standby to cold-shutdown conditions (when this is determined to be the safest course of action) under an accident condition. The safe shutdown of a nuclear power plant following an accident not related to a loss-of-coolant accident has been typically interpreted as achieving a hot standby condition (the reactor is shut down, but system temperature and pressure are at or near normal operating values). There are events that require eventual cooldown and long-term cooling to perform inspection and repairs.
AP1000 Response:
The AP1000 employs safety-related core decay heat removal systems that establish and maintain the plant in a safe, stable condition following design basis events. It is not necessary that these passive systems achieve cold shutdown as defined by Regulatory Guide 1.139.
The AP1000 complies with General Design Criteria 34 by using a more reliable and simplified system design. The passive core cooling system is employed for both hot-standby and long-term cooling modes. Hot-standby conditions are achieved immediately and a temperature of 420&deg;F is reached within 36 hours as discussed in Subsection 19E.4.10.2. Reactor pressure is controlled and can be reduced to about 250 psig. The passive residual heat removal system provides a closed cooling system to maintain long-term core cooling. Passive feed and bleed cooling, using the passive injection features for the feed and the automatic depressurization system for bleed, Tier 2 Material                                      1.9-38                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                        339
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                      AP1000 Design Control Document provides another closed-loop safety-related cooling capability. See Section 7.4 for a discussion of safe shutdown and Section 6.3 for a description of the passive core cooling system.
Since the passive core cooling system maintains safe conditions indefinitely, cold shutdown is necessary only to gain access to the reactor coolant system for inspection or repair. On the AP1000, cold shutdown is accomplished by using non-safety-related systems. These systems are highly reliable. They have similar redundancy as current generation safety-related systems and are supplied with ac power from either onsite or offsite sources. See subsection 5.4.7 for a description of the normal residual heat removal system and subsection 7.4.1.3 for a discussion of cold shutdown achieved by use of non-safety-related systems.
A-35        Adequacy of Offsite Power Systems Discussion:
Generic Issue A-35 addresses the susceptibility of safety-related electric equipment to offsite power source degradation. The NRC considers this issue as technically resolved with the issuance of the Standard Review Plan, Section 8.3.1 criteria specified in Appendix A, Branch Technical Position BTP PSB 1, "Adequacy of Station Electric Distribution System Voltages."
AP1000 Response:
The AP1000 ac power system is discussed in subsections 8.1 through 8.3. The AP1000 does not require any ac power source to achieve and maintain safe shutdown.
A-36        Control of Heavy Loads Near Spent Fuel Discussion:
Generic Issue A-36 addresses the need to review requirements, facility designs, and Technical Specifications regarding the movement of heavy loads near spent fuel. The NRC has documented its technical position on this issue in NUREG-0612 (Reference 10) and that issued Standard Review Plan, Section 9.1.5, which includes NUREG-0612 as a part of the review plan.
AP1000 Response:
The AP1000 design conforms to NUREG-0612 and Standard Review Plan, Section 9.1.5. Light load handling systems are described in subsection 9.1.4, and overhead heavy-load handling systems are described in subsection 9.1.5.
A-39        Determination of Safety Relief Valve Pool Dynamic Loads and Temperature Limits for BWR Containments Discussion:
Generic Issue A-39 addresses operation of BWR primary system pressure relief valves whose operation can result in hydrodynamic loads on the suppression pool retaining structures or those structures located within the pool. These loads result from initial vent clearing of relief valve Tier 2 Material                                    1.9-39                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        340
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document Issue 79    Unanalyzed Reactor Vessel Thermal Stress During Natural Convection Cooldown Discussion:
Generic Safety Issue 79 addresses the thermal stresses that occur in the reactor vessel head flange during a natural circulation cooldown. High stresses in the flange or studs during a natural circulation cooldown in PWRs could violate ASME code allowables. Cycling of the stresses could reduce the fatigue margin. Generic Letter 92-02 repeated the reporting requirements of 10CFR 50.73 (a)(2)(ii)(B), "Licensee event report system."
AP1000 Response:
The natural circulation cooldown transient is evaluated as part of ASME Code vessel evaluations and is discussed in Subsection 3.9.1.1.2.11. The reporting requirements to address the requirements of 10CFR 50.73 (a)(2)(ii)(B) referenced in Generic Letter 92-02 are the responsibility of the Combined License holder.
Issue 82    Beyond Design Basis Accidents in Spent Fuel Pools Discussion:
This issue addresses the concern of a beyond design basis accident in which the spent fuel pool is drained and spent fuel stored there subsequently catches on fire releasing very large amounts of radioactive contamination. This issue is classified as resolved with no new requirements.
AP1000 Response:
The AP1000 includes design provisions that preclude draining of the spent fuel pool. Also, provisions are available to supply water to the pool in the event the water covering the spent fuel begins to boil off.
Issue 83    Control Room Habitability Discussion:
Loss of control room habitability following an accidental release of external toxic or radioactive material or smoke can impair or cause loss of the control room operators' capability to safely control the reactor. Use of the remote shutdown workstation outside the control room following such events is unreliable since this station has no emergency habitability or radiation protection provisions.
AP1000 Response:
Habitability of the main control room is provided by the main control room/control support area HVAC subsystem of the nonsafety-related nuclear island nonradioactive ventilation system (VBS). If ac power is unavailable for more than 10 minutes of if main control room differential pressure is below the Low setpoint for more than 10 minutes or if High-2 particulate or iodine radioactivity is detected in the main control room supply air duct, which would lead to Tier 2 Material                                      1.9-56                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        341
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document Administrative controls require containment closure capability in modes 5 and 6, during reduced inventory operations, and when the upper internals are in place. Containment closure capability is defined as the capability to close the containment prior to core uncovery following a loss of the normal decay heat removal system (that is, normal residual heat removal system). The containment design also includes penetrations for temporary cables and hoses needed for shutdown operations. These penetrations are isolated in an emergency.
In addition to these design features, appropriate procedures are defined to guide and direct the operator in the proper conduct of midloop operation and to aid in identifying and correcting abnormal conditions that might occur during shutdown operations.
1.9.5.1.5  Station Blackout NRC Position:
The NRC has issued NUREG-0649 (Reference 34), NUREG-1032 (Reference 35), and NUREG-1109 (Reference 36) to address the unresolved safety issue of station blackout (USI-44).
See subsection 1.9.4 for a discussion of USI-44.
To resolve this issue, the NRC published 10 CFR 50.63 and Regulatory Guide 1.155, which establish new requirements so that an operating plant can safely shut down following a loss of all ac power. SECY-94-084 (Reference 67), discusses station blackout for passive plants.
AP1000 Response:
The AP1000 is in conformance with the NRC guidelines for station blackout.
The AP1000 design minimizes the potential risk contribution of station blackout by not requiring ac power sources for design basis events. Safety-related systems do not need nonsafety-related ac power sources to perform safety-related functions.
The AP1000 safety-related passive systems automatically establish and maintain safe, stable conditions for the plant following design basis events, including an extended loss of ac power sources. The passive systems can maintain these safe, stable conditions after design basis events for at least 72 hours, without operator action, following a loss of both onsite and offsite ac power sources. Subsection 1.9.5.4 provides additional information on long-term actions following an extended station blackout beyond 72 hours.
The AP1000 also includes redundant nonsafety-related onsite ac power sources (diesel-generators) to provide electrical power for the nonsafety-related active systems which provide defense in depth.
AP1000 design features that mitigate the consequences of a station blackout are as follows:
x    A full-load rejection capability to reduce the probability of loss of onsite power x    Safety-related passive residual heat removal heat exchanger Tier 2 Material                                      1.9-76                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        342
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document Criteria    Referenced                      AP1000 Section      Criteria                        Position      Clarification/Summary Description of Exceptions AP1000 practice for Class 1 components is in agreement with the guidance of this regulatory guide except for Regulatory Positions C.1(b) and 2. For AP1000 Class 2 and 3 components, the guidelines provided by this regulatory guide are not applied, however all requirements of the ASME Boiler and Pressure Vessel Code are imposed.
C.1(b)                                        Conforms      The welding procedures are qualified within the preheat temperature ranges required by ASME Code, Section IX. Experience has shown excellent quality of welds using the ASME qualification procedures.
C.2                                          Exception      The AP1000 position is that the guidance specified in this regulatory guide is both unnecessary and impractical. Code acceptable low-alloy steel welds have been and are being made under present procedures. It is not necessary to maintain the preheat temperature until a post-weld heat treatment has been performed in accordance with the guidance provided by this regulatory guide, in the case of large components.
In some cases of reactor vessel main structural welds, the practice of maintaining preheat until the intermediate or final post-weld heat treatment has been followed. In other cases, an extended preheat practice has been utilized in accordance with the reactor vessel design specification.
In this practice, the weld temperature is maintained at 400&deg;F to 750&deg;F for 4 hours after welding. The weld temperature may then be lowered to ambient without performing an intermediate or final post-weld heat treatment at 1100&deg;F.
The welds have shown high integrity. Westinghouse practices are documented in WCAP-8577 (Reference 9) which has been accepted by the Nuclear Regulatory Commission.
Reg. Guide 1.51 - Withdrawn Reg. Guide 1.52, Rev. 3, 6/01 - Design, Testing, and Maintenance Criteria for Post Accident Engineered-Safety-Feature Atmosphere Cleanup System Air Filtration and Absorption Units of Light-Water-Cooled Nuclear Power Plants General                                      Conforms      The AP1000 main control room emergency habitability system (VES) includes a passive filtration system that is contained entirely within the main control room envelope. The passive filtration portion of the AP1000 Tier 2 Material                                      1A-19                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                            343
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant              AP1000 Design Control Document Criteria    Referenced            AP1000 Section      Criteria              Position      Clarification/Summary Description of Exceptions C.3.10                              Conforms C.3.11                              Exception      There are no outdoor air intakes for the AP1000 passive filtration system. The system uses breathable compressed air that is stored in compressed air tanks during the post-72-hour operation time.
C.3.12                              Exception      The AP1000 passive filtration system is located completely within the CRE. Leakages as explained in this regulatory position are not applicable to this system.
C.4.1 - 4.2                        Exception      There are no moisture separators and/or heaters in the AP1000 passive filtration line.
C.4.3 - 4.7                        Conforms C.4.8                              Exception      There are no water drains in the AP1000 passive filtration line.
C.4.9                              Conforms      The credited adsorber efficiencies are 90% for elemental iodine and 90% for organic iodine. These efficiencies assume no humidity control.
C.4.10                              Conforms      Type II adsorbers are used in this application C.4.11                              Conforms      The AP1000 passive filtration line uses impregnated activated carbon as the absorbent. The absorber is designed for a minimum average atmosphere residence time of 0.25 seconds per 2 inches of absorbent bed.
C.4.12                              Conforms C.4.13                              Conforms C.4.14                              Exception      The passive filtration line requires no fans.
C.5.1                              N/A            Only one bank of filters is used.
C5.2                                Exception      This system is not used for normal HVAC, and the filters should not build up unusual levels of particulate once installed.
C.6.1                              Conforms C.6.2 - 6.6                        Conforms C.7                                Conforms Tier 2 Material                            1A-21                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                    344
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 1. Introduction and General Description of Plant                        AP1000 Design Control Document Criteria    Referenced                      AP1000 Section      Criteria                        Position        Clarification/Summary Description of Exceptions Table 1                                      Conforms        The Technical Specification methyl iodide penetration acceptance limit for the AP1000 activated carbon adsorber is 5%, which correlates to 90% removal efficiency of both organic and elemental iodine. The calculated design basis for the AP1000 passive filtration adsorbers assumes a 90% organic iodine removal efficiency and a 90% elemental iodine efficiency. A 1% bypass leakage is accounted for by testing to increased organic iodine removal efficiency.
Reg. Guide 1.53, Rev. 0, 6/73 - Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems General      IEEE Std. 379-1972              Exception      Regulatory Guide 1.53 endorses IEEE Std. 379-72 (Reference 10), which has been superseded by IEEE Std. 379-2000 (Reference 11). The AP1000 uses the latest version of the industry standards (as of 4/2001).
This version is not endorsed by a regulatory guide but its use should not result in deviation from the design philosophy otherwise stated in Regulatory Guide 1.53.
IEEE Std. 379-2000 is endorsed by DG-1118 (Proposed Revision of Regulatory Guide 1.53).
The guidelines are applicable to safety-related dc power systems. There are no safety-related ac power sources in the AP1000.
Reg. Guide 1.54, Rev. 1, 7/00 - Service Level I, II and III Protective Coatings Applied to Nuclear Power Plants General      ASTM D 3843-00,                Exception        Some coatings inside containment are nonsafety-related ASTM D 3911-95,                                  and satisfy appropriate ASTM Standards. See ASTM D 5144-00                                  subsection 6.1.2 for additional information. Application is controlled by procedures using qualified personnel to provide a high quality product. The paint materials for coatings inside the containment are subject to 10 CFR Part 50 Appendix B Quality Assurance requirements.
The quality assurance features of the AP1000 coatings systems are outlined in DCD subsection 6.1.2.1.6.
Subsection 6.1.3 defines the responsibility for the coating program.
Reg. Guide 1.55 - Withdrawn Reg. Guide 1.56, Rev. 1, 7/78 - Maintenance of Water Purity in Boiling Water Reactors General                                      N/A            Applies to boiling water reactors only.
Tier 2 Material                                      1A-22                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                              345
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3
: 2. Site Characteristics                                                      AP1000 Design Control Document Table 2-1 (Sheet 4 of 4)
SITE PARAMETERS Control Room Atmospheric Dispersion Factors ( /Q) for Accident Dose Analysis
                          /Q (s/m3) at HVAC Intake for the Identified Release Points(1)
Ground Level Plant Vent or      Containment          PORV and        Steam Line          Fuel        Condenser PCS Air            Release          Safety Valve        Break        Handling      Air Removal Diffuser(3)        Points(4)        Releases(5)      Releases          Area(6)        Stack(7) 0 - 2 hours        2.53E-03          4.00E-03            1.92E-02        2.13E-02          6.0E-3          6.0E-3 2 - 8 hours        1.98E-03          2.28E-03            1.60E-02        1.76E-02          4.0E-3          4.0E-3 8 - 24 hours        7.96E-04          1.03E-03            6.90E-03        7.50E-03          2.0E-3          2.0E-3 1 - 4 days          6.40E-04          9.03E-04            4.96E-03        5.43E-03          1.5E-3          1.5E-3 4 - 30 days        4.78E-04          7.13E-04            4.16E-03        4.55E-03          1.0E-3          1.0E-3
                        /Q (s/m3) at Annex Building Door for the Identified Release Points(2)
Ground Level Plant Vent or      Containment          PORV and        Steam Line          Fuel        Condenser PCS Air            Release          Safety Valve        Break        Handling      Air Removal Diffuser(3)        Points(4)        Releases(5)      Releases          Area(6)        Stack(7) 0 - 2 hours          1.0E-3            1.0E-3            4.0E-3          4.0E-3          6.0E-3          2.0E-2 2 - 8 hours          7.5E-4            7.5E-4            3.2E-3          3.2E-3          4.0E-3          1.8E-2 8 - 24 hours        3.5E-4            3.5E-4            1.2E-3          1.2E-3          2.0E-3          7.0E-3 1 - 4 days          2.8E-4            2.8E-4            1.0E-3          1.0E-3          1.5E-3          5.0E-3 4 - 30 days          2.5E-4            2.5E-4            8.0E-4          8.0E-4          1.0E-3          4.5E-3 Notes:
: 1. These dispersion factors are to be used 1) for the time period preceding the isolation of the main control room and actuation of the emergency habitability system, 2) for the time after 72 hours when the compressed air supply in the emergency habitability system would be exhausted and outside air would be drawn into the main control room, and 3) for the determination of control room doses when the non-safety ventilation system is assumed to remain operable such that the emergency habitability system is not actuated.
: 2. These dispersion factors are to be used when the emergency habitability system is in operation and the only path for outside air to enter the main control room is that due to ingress/egress.
: 3. These dispersion factors are used for analysis of the doses due to a postulated small line break outside of containment. The plant vent and PCS air diffuser are potential release paths for other postulated events (loss-of-coolant accident, rod ejection accident, and fuel handling accident inside the containment); however, the values are bounded by the dispersion factors for ground level releases.
Tier 2 Material                                            2-24                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  346
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                AP1000 Design Control Document Criterion 19 - Control Room A control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions, including loss of coolant accidents. Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent, to any part of the body, for the duration of the accident.
Equipment at appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.
AP1000 Compliance The AP1000 main control room provides the man-machine interfaces required to operate the plant safely and efficiently under normal conditions and to maintain it in a safe manner under accident conditions, including LOCAs. Simplified passive safety-related system designs are provided that do not rely upon operator action to maintain core cooling for design basis accidents. Operator action outside the main control room to mitigate the consequences of an accident is permitted.
The main control room is shielded by the containment and auxiliary building from direct gamma radiation and inhalation doses resulting from the postulated release of fission products inside containment. Refer to Chapter 15 for additional information on accident conditions. The main control room/control support area HVAC subsystem of the nuclear island nonradioactive ventilation system (VBS) allows access to and occupancy of the main control room under accident conditions as described in subsection 9.4.1. Sufficient shielding and the main control room/control support area HVAC subsystem provide adequate protection so that personnel will not receive radiation exposure in excess of 5 rem whole-body or its equivalent to any part of the body for the duration of the accident.
If ac power is unavailable for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes or if High-2 particulate or High-2 iodine radioactivity is detected in the main control room supply air duct, which would lead to exceeding General Design Criteria 19 operator dose limits, the protection and safety monitoring system automatically isolates the main control room and operator habitability requirements are then met by the main control room emergency habitability system (VES). The main control room emergency habitability system also allows access to and occupancy of the main control room under accident conditions. The emergency main control room habitability system is designed to satisfy seismic Category I requirements as described in Section 3.2; the system design is described in Section 6.4.
In the event that the operators are forced to abandon the main control room, a workstation is provided with remote shutdown capability. A main control room evacuation is not assumed to occur simultaneously with design basis events. The remote shutdown workstation is described in Section 7.4.
Tier 2 Material                                      3.1-11                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        347
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Table 3.2-3 (Sheet 16 of 75)
AP1000 CLASSIFICATION OF MECHANICAL AND FLUID SYSTEMS, COMPONENTS, AND EQUIPMENT AP1000      Seismic      Principal Con-Tag Number          Description                Class      Category    struction Code    Comments Passive Core Cooling System (Continued)
PXS-MY-Y01C          IRWST Screen C              C          I            Manufacturer Std. Structural frame and attachment use ASME III, Subsection NF criteria. Screen modules use manufacturer std.
PXS-MY-Y02A          Containment Recirculation  C          I            Manufacturer Std. Structural frame Screen A                                                              and attachment use ASME III, Subsection NF criteria. Screen modules use manufacturer std.
PXS-MY-Y02B          Containment Recirculation  C          I            Manufacturer Std. Structural frame Screen B                                                              and attachment use ASME III, Subsection NF criteria. Screen modules use manufacturer std.
PXS-MY-Y03A          pH Adjustment Basket A      C          I            Manufacturer Std.
PXS-MY-Y03B          pH Adjustment Basket B      C          I            Manufacturer Std.
PXS-MY-Y03C          pH Adjustment Basket C      C          I            Manufacturer Std.
PXS-MY-Y03D          pH Adjustment Basket D      C          I            Manufacturer Std.
PXS-MY-Y81          Downspout Screen 1A        C          I            Manufacturer Std.
PXS-MY-Y82          Downspout Screen 1B        C          I            Manufacturer Std.
PXS-MY-Y83          Downspout Screen 1C        C          I            Manufacturer Std.
PXS-MY-Y84          Downspout Screen 1D        C          I            Manufacturer Std.
PXS-MY-Y85          Downspout Screen 2A        C          I            Manufacturer Std.
PXS-MY-Y86          Downspout Screen 2B        C          I            Manufacturer Std.
PXS-MY-Y87          Downspout Screen 2C        C          I            Manufacturer Std.
PXS-MY-Y88          Downspout Screen 2D        C          I            Manufacturer Std.
PXS-PL-V002A        CMT A CL Inlet Isolation    A          I            ASME III-1 PXS-PL-V002B        CMT B CL Inlet Isolation    A          I            ASME III-1 PXS-PL-V010A        CMT A Upper Sample          B          I            ASME III-2 PXS-PL-V010B        CMT B Upper Sample          B          I            ASME III-2 PXS-PL-V011A        CMT A Lower Sample          B          I            ASME III-2 PXS-PL-V011B        CMT B Lower Sample          B          I            ASME III-2 Tier 2 Material                                    3.2-35                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        348
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                  AP1000 Design Control Document Table 3.7.3-1 (Sheet 1 of 3)
SEISMIC CATEGORY I EQUIPMENT OUTSIDE CONTAINMENT BY ROOM NUMBER Room No.                      Room Name                                    Equipment Description 12101      Division A battery room                          Batteries 12102      Division C battery room 1                        Batteries 12103      Spare battery room                                Spare batteries 12104      Division B battery room 1                        Batteries 12105      Division D battery room                          Batteries 12113      Spare battery charger room 12162      RNS pump room A                                  RNS pressure boundary 12163      RNS pump room B                                  RNS pressure boundary 12201      Division A dc equipment room                      dc equipment 12202      Division C battery room 2                        Batteries 12203      Division C dc equipment room                      dc equipment 12204      Division B battery room 2                        Batteries 12205      Division D dc equipment room                      dc equipment 12207      Division B dc equipment room                      dc equipment 12211      Corridor                                          Divisional cables 12212      Division B RCP trip switchgear room              RCP trip switchgear 12244      Lower annulus valve area                          CVS/WLS containment isolation valves 12251      Demineralizer/filter access area                  CVS/DWS isolation valves 12254      SFS penetration room                              SFS containment isolation valve 12256      Containment isolation valve room                  RNS containment isolation valves 12259      Pipe chase                                        RNS piping 12262      Piping/Valve room                                RNS pressure boundary, SFS piping 12265      Waste monitor tank room C                        SFS piping 12269      Pipe chase                                        RNS pressure boundary 12300      Corridor                                          Divisional cable, MCR load shed panel 12301      Division A I&C room                              Divisional I&C 12302      Division C I&C room                              Divisional I&C Tier 2 Material                                        3.7-63                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          349
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                AP1000 Design Control Document Table 3.7.3-1 (Sheet 2 of 3)
SEISMIC CATEGORY I EQUIPMENT OUTSIDE CONTAINMENT BY ROOM NUMBER Room No.                      Room Name                                    Equipment Description 12303    Remote shutdown room                              Divisional cabling 12304    Division B I&C/penetration room                  Divisional I&C/electrical penetrations 12305    Division D I&C/penetration room                  Divisional I&C/electrical penetrations 12306    Valve/piping penetration room                    CCS/CVS/DWS/FPS/SGS containment isolation valves 12311    Corridor                                          Divisional cabling 12312    Division C RCP trip switchgear room              RCP trip switchgear 12313    Division C I&C/penetration room                  Divisional I&C/electrical penetrations 12321    Non-1E equipment/penetration room                Divisional cabling 12341    Middle annulus                                    Class 1E electrical penetrations Various mechanical piping penetrations 12351    Maintenance floor staging area                    Divisional cabling (ceiling) 12352    Personnel hatch                                  Personnel airlock (interlocks) 12354    Middle annulus access room                        PSS/SFS containment isolation valves 12362    RNS HX room                                      RNS pressure boundary 12365    Waste monitor tank room B                        SFS piping 12400    Control room vestibule                            Control room access 12401    Main control room                                Dedicated safety panel VBS HVAC dampers VES isolation valves Lighting circuits Mounting for lighting fixtures 12404    Lower MSIV compartment B                          SGS containment isolation valves, instrumentation and controls 12405    Lower VBS B and D equipment room                  VWS/PXS/CAS containment isolation valves 12406    Lower MSIV compartment A                          SGS containment isolation valves, instrumentation and controls 12412    Electrical penetration room Division A            Divisional electrical penetrations, MCR load shed panel Tier 2 Material                                      3.7-64                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                            350
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Table 3.9-12 (Sheet 6 of 7)
LIST OF ASME CLASS 1, 2, AND 3 ACTIVE VALVES Valve No.          Description                                                          Function(a)
Steam Generator System (Cont.)
SGS-PL-V040A        Main Steam Line Isolation                                            2,3,4 SGS-PL-V040B        Main Steam Line Isolation                                            2,3,4 SGS-PL-V057A        Main Feedwater Isolation                                            2,3,4 SGS-PL-V057B        Main Feedwater Isolation                                            2,3,4 SGS-PL-V067A        Startup Feedwater Isolation                                          2,3,4 SGS-PL-V067B        Startup Feedwater Isolation                                          2,3,4 SGS-PL-V074A        Steam Generator Blowdown Isolation                                  2,3,4 SGS-PL-V074B        Steam Generator Blowdown Isolation                                  2,3,4 SGS-PL-V075A        Steam Generator Series Blowdown Isolation                            3,4 SGS-PL-V075B        Steam Generator Series Blowdown Isolation                            3,4 SGS-PL-V086A        Steam Line Condensate Drain Control                                  3,4 SGS-PL-V086B        Steam Line Condensate Drain Control                                  3,4 SGS-PL-V233A        Power Operated Relief Valve                                          3,4 SGS-PL-V233B        Power Operated Relief Valve                                          3,4 SGS-PL-V240A        Main Steam Isolation Valve Bypass Isolation                          2,3,4 SGS-PL-V240B        Main Steam Isolation Valve Bypass Isolation                          2,3,4 SGS-PL-V250A        Main Feedwater Control                                              3,4 SGS-PL-V250B        Main Feedwater Control                                              3,4 SGS-PL-V255A        Startup Feedwater Control                                            3,4 SGS-PL-V255B        Startup Feedwater Control                                            3,4 Nuclear Island Nonradioactive Ventilation System VBS-PL-V186        MCR Supply Air Isolation Valve                                      3 VBS-PL-V187        MCR Supply Air Isolation Valve                                      3 VBS-PL-V188        MCR Return Air Isolation Valve                                      3 VBS-PL-V189        MCR Return Air Isolation Valve                                      3 VBS-PL-V190        MCR Exhaust Air Isolation Valve                                      3 VBS-PL-V191        MCR Exhaust Air Isolation Valve                                      3 Main Control Room Habitability System VES-PL-V001        Air Delivery Alternate Isolation Valve                              3 VES-PL-V002A        Pressure Regulating Valve A                                          3 VES-PL-V002B        Pressure Regulating Valve B                                          3 VES-PL-V005A        Air Delivery Isolation Valve A                                      3 VES-PL-V005B        Air Delivery Isolation Valve B                                      3 VES-PL-V018        Temporary Instrument Isolation Valve A                              3 VES-PL-V019        Temporary Instrument Isolation Valve B                              3 VES-PL-V022A        Pressure Relief Isolation Valve A                                    3 Tier 2 Material                                    3.9-126                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                  351
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                                                                                                                          AP1000 Design Control Document Table 3.9-16 (Sheet 23 of 26)
VALVE INSERVICE TEST REQUIREMENTS Valve Tag                                                Valve/Actuator  Safety-Related                              ASME Class/
Number                                    Description(1)      Type          Missions            Safety Functions(2) IST Category                Inservice Testing Type and Frequency            IST Notes VES-PL-V001        Air Delivery Isolation Valve                  Manual      Maintain Close      Active                    Class 3  Exercise Full Stroke/2 Years                                        37 Transfer Open                                  Category B Maintain Open VES-PL-V002A      Pressure Regulating Valve A                Press. Reg. Throttle Flow        Active                    Class 3  Exercise Stroke/Quarterly                                          31, 38 Augmented  Operability Test VES-PL-V002B      Pressure Regulating Valve B                Press. Reg. Throttle Flow        Active                    Class 3  Exercise Stroke/Quarterly                                          31, 38 Augmented  Operability Test VES-PL-V005A      Air Delivery Isolation Valve A              Remote SO    Maintain Open        Active-to-Failed          Class 3  Remote Position Indication, Exercise/2 Years                        31 GLOBE        Transfer Open                                  Category B Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V005B      Air Delivery Isolation Valve B              Remote SO    Maintain Open        Active-to-Failed          Class 3  Remote Position Indication, Exercise/2 Years                        31 GLOBE        Transfer Open                                  Category B Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V018        Temporary Instrument Isolation Valve A        Manual      Maintain Close      Active                    Class 3  Exercise Full Stroke/2 Years Transfer Open                                Category B Maintain Open VES-PL-V019        Temporary Instrument Isolation Valve B        Manual      Maintain Close      Active                    Class 3  Exercise Full Stroke/2 Years Transfer Open                                Category B Maintain Open VES-PL-V022A      Pressure Relief Isolation Valve A          Remote AO      Maintain Open        Active-to-Failed          Class 3  Remote Position Indication, Exercise/2 Years                        31 Butterfly    Transfer Open                                  Category B Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V022B      Pressure Relief Isolation Valve B          Remote AO      Maintain Open        Active-to-Failed          Class 3  Remote Position Indication, Exercise/2 Years                        31 Butterfly    Transfer Open                                  Category B Exercise Full Stroke/Quarterly Failsafe Test/Quarterly Operability Test VES-PL-V040A      Air Tank Safety Relief Valve A                Relief      Maintain Close      Active                    Class 3  Class 2/3 Relief Valve Tests/10 Years and 20% in 4 Years Transfer Open                                Category BC VES-PL-V040B      Air Tank Safety Relief Valve B                Relief      Maintain Close      Active                    Class 3  Class 2/3 Relief Valve Tests/10 Years and 20% in 4 Years Transfer Open                                Category BC VES-PL-V041A      Air Tank Safety Relief Valve A                Relief      Maintain Close      Active                    Class 3  Class 2/3 Relief Valve Tests/10 Years and 20% in 4 Years Transfer Open                                Category BC Tier 2 Material                                                                                                                                                          3.9-177                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                                                              352
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                    AP1000 Design Control Document Table 3.9-17 SYSTEM LEVEL OPERABILITY TEST REQUIREMENTS System/Feature                                Test Purpose                Test Method        Tech Speca PCS PCCWST drain lines                        Flow capability and water coverage      Note 1            SR 3.6.6.6 PXS Accumulator injection lines                Flow capability                        Note 2            SR 3.5.1.6 CMT injection lines                        Flow capability                        Note 3            SR 3.5.2.7 PRHR HX                                    Heat transfer capability                Note 4            SR 3.5.4.6 IRWST injection lines                      Flow capability                        Note 5            SR 3.5.6.10 Containment recirculation lines            Flow capability                        Note 6            SR 3.5.6.10 Alpha Note:
: a. Refer to the Technical Specification surveillance identified in this column for the test frequency.
Notes:
: 1. The flow capability of each PCS water drain line is demonstrated by conducting a test where water is drained from the PCS water storage tank onto the containment shell by opening two of the three parallel isolation valves. During this flow test the water coverage is also demonstrated. The test is terminated when the flow measurement is obtained and the water coverage is observed. The minimum allowable flowrate is 469.1 gpm with the passive containment cooling water storage tank level 27.3 feet above the lowest standpipe. The test may be run with a higher water level and the test results adjusted for the increased level. Water coverage is demonstrated by visual inspection that there is unobstructed flow from the lower weirs. In addition, at least four air baffle panels will be removed at the containment vessel spring line, approximately 90 degrees apart, to permit visual inspection of the water coverage and the vessel coating. The water coverage observed at these locations will be compared against the coverage measured at the same locations during pre-operational testing (see item 7.(b)(i) of ITAAC Table 2.2.2-6).
: 2. The flow capability of each accumulator is demonstrated by conducting a test during cold shutdown conditions. The initial conditions of the test include reduced accumulator pressure. Flow from the accumulator to the RCS is initiated by opening the accumulator isolation valve. Sufficient flow is provided to fully open the check valves. The test is terminated when the flow measurement is obtained. The allowable calculated flow resistance between each accumulator and the reactor vessel is  1.47 x 10-5 ft/gpm2 and  1.83 x 10-5 ft/gpm2.
: 3. The flow capability of each CMT is demonstrated by conducting a test during cold shutdown conditions. The initial conditions of the test include the RCS loops drained to a level below the top of the RCS hot leg. Flow from the CMT to the RCS is initiated by opening one CMT isolation valve. The test is terminated when the flow measurement is obtained. The allowable calculated flow resistance between each CMT and the reactor vessel is 1.83 x 10-5 ft/gpm2 and  2.25 x 10-5 ft/gpm2.
Tier 2 Material                                            3.9-191                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    353
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                    AP1000 Design Control Document
: 4. The heat transfer capability of the passive residual heat exchanger is demonstrated by conducting a test during cold shutdown conditions. The test is conducted with the RCPs in operation and the RCS at a reduced temperature. Flow through the heat exchanger is initiated by opening one outlet isolation valve. The test is terminated when the flow and temperature measurements are obtained. The allowable calculated heat transfer is t 1.04E8 Btu/hr with an inlet temperature of 250qF and an IRWST temperature of 120qF and the design basis number of tubes plugged.
: 5. The flow capability of each IRWST injection line is demonstrated by conducting flow tests and inspections. A flow test is conducted to demonstrate the flow capability of the injection line from the IRWST through the IRWST injection check valves. Water flow from the IRWST through the IRWST injection check valve demonstrates the flow capability of this portion of the line. Sufficient flow is provided to fully open the check valves. The test is terminated when the flow measurement is obtained. The allowable calculated flow resistance from the IRWST to each injection line check is: Line A:  5.53 x 10-6 ft/gpm2 and  9.20 x 10-6 ft/gpm2 and Line B:  6.21 x 10-6 ft/gpm2                                                                                                          and 1.03 x 10-5 ft/gpm2.
The flow capability of the portion of the line from the IRWST check valves to the DVI line is demonstrated by conducting an inspection of the inside of the line. The inspection shows that the lines are not obstructed. It is not necessary to operate the IRWST injection squib valves for this inspection.
: 6. The flow capability of each containment recirculation line is demonstrated by conducting an inspection. The line from the containment to the containment recirculation squib valve is inspected from the containment side. The line from the squib valve to the IRWST injection line is inspected from the IRWST side. The inspection shows that the lines are not obstructed. It is not necessary to operate the containment recirculation squib valves for this inspection.
Tier 2 Material                                          3.9-192                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                    354
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                          AP1000 Design Control Document Table 3.11-1 (Sheet 17 of 51)
ENVIRONMENTALLY QUALIFIED ELECTRICAL AND MECHANICAL EQUIPMENT Operating Envir.                  Time  Qualification AP1000              Zone      Function  Required    Program Description              Tag No.          (Note 2)    (Note 1)  (Note 5)  (Note 6)
Power Range Neutron Flux        PMS-JW-007C            2          RT        5 min      E High Voltage Distribution Box C Power Range Neutron Flux        PMS-JW-007D            2          RT        5 min      E High Voltage Distribution Box D MAIN CONTROL ROOM Operator Workstation A          N/A                    3          RT        5 min      E ESF      24 hr PAMS      2 wks Operator Workstation B          N/A                    3          RT        5 min      E ESF      24 hr PAMS      2 wks Supervisor Workstation          N/A                    3          RT        5 min      E ESF      24 hr PAMS      2 wks Switch Station                  N/A                    3          RT        5 min      E (Including Switches)                                              ESF      24 hr QDPS MCR Display Unit            PMS-JY-001B            3          PAMS      2 wks      E QDPS MCR Display Unit            PMS-JY-001C            3          PAMS      2 wks      E MCR Load Shed Panel 1            VES-EP-01              2          ESF      24 hr      ES PAMS      2 wks MCR Load Shed Panel 2            VES-EP-02              2          ESF      24 hr      E PAMS      2 wks PENETRATIONS Penetrations (Mechanical)        See Table 6.2.3-1                                      M*
Penetrations (Electrical)        See Figure 3.8.2-4                                      E*
ACTIVE VALVES Containment Isolation - Air Out  CAS-PL-V014            2          ESF      5 min      MS Solenoid Valve                  CAS-PL-V014-S          2          ESF      5 min      E Limit Switch                    CAS-PL-V014-L          2          PAMS      2 wks      E Containment Isolation - Air In  CAS-PL-V015            1          ESF      5 min      M*
Containment Isolation - Inlet    CCS-PL-V200            2          ESF      5 min      MS Limit Switch                    CCS-PL-V200-L          2          PAMS      2 wks      E Motor Operator                  CCS-PL-V200-M          2          ESF      5 min      E Service Air Supply Inside        CAS-PL-V205            1          PB        1 yr      M*
Containment Isolation Containment Isolation - Inlet    CCS-PL-V201            1          ESF      5 min      M*
Tier 2 Material                                  3.11-22                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                355
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Table 3.11-1 (Sheet 30 of 51)
ENVIRONMENTALLY QUALIFIED ELECTRICAL AND MECHANICAL EQUIPMENT Operating Envir.                    Time  Qualification AP1000            Zone        Function  Required    Program Description                Tag No.        (Note 2)      (Note 1)  (Note 5)  (Note 6)
MCR Isolation Valve                  VBS-PL-V191          3            ESF      24 hr      M Limit Switch                        VBS-PL-V191-L        3            PAMS      2 wks      E Motor Operator                      VBS-PL-V191-M        3            ESF      24 hr      E Air Delivery Isolation Valve        VES-PL-V001          3            ESF      2 wks      M Pressure Regulator Valve A          VES-PL-V002A        7            ESF      2 wks      M Pressure Regulator Valve B          VES-PL-V002B        7            ESF      2 wks      M Actuation Valve A                    VES-PL-V005A        3            ESF      2 wks      M Limit Switch                        VES-PL-V005A-L      3            PAMS      2 wks      E Solenoid Operator                  VES-PL-V005A-S      3            ESF      2 wks      E Actuation Valve B                    VES-PL-V005B        3            ESF      2 wks      M Limit Switch                        VES-PL-V005B-L      3            PAMS      2 wks      E Solenoid Operator                  VES-PL-V005B-S      3            ESF      2 wks      E Temporary Instrument Isolation Valve VES-PL-V018          7            ESF      2 wks      M A
Temporary Instrument Isolation Valve VES-PL-V019          7            ESF      2 wks      M B
Relief Isolation Valve A            VES-PL-V022A        3            ESF      2 wks      M Limit Switch                        VES-PL-V022A-L      3            PAMS      2 wks      E Solenoid Valve                      VES-PL-V022A-S      3            ESF      2 wks      E Relief Isolation Valve B            VES-PL-V022B        3            ESF      2 wks      M Limit Switch                        VES-PL-V022B-L      3            PAMS      2 wks      E Solenoid Valve                      VES-PL-V022B-S      3            ESF      2 wks      E Air Tank Relief A                    VES-PL-V040A        7            ESF      2 wks      M Air Tank Relief B                    VES-PL-V040B        7            ESF      2 wks      M Air Tank Relief C                    VES-PL-V040C        7            ESF      2 wks      M Air Tank Relief D                    VES-PL-V040D        7            ESF      2 wks      M Main Air Flow Path Isolation Valve  VES-PL-V044          3            ESF      2 wks      M Eductor Flow Path Isolation Valve    VES-PL-V045          3            ESF      2 wks      M Eductor Bypass Isolation Valve      VES-PL-V046          3            ESF      2 wks      M Containment Purge Inlet Isolation    VFS-PL-V003          7            ESF      5 min      MS Limit Switch                        VFS-PL-V003-L        7            PAMS      2 wks      E Solenoid Valve                      VFS-PL-V003-S1      7            ESF      5 min      E Containment Purge Inlet Isolation    VFS-PL-V004          1            ESF      5 min      M*
Limit Switch                        VFS-PL-V004-L        1            PAMS      1 yr      E*
Solenoid Valve                      VFS-PL-V004-S1      1            ESF      5 min      E*
Tier 2 Material                                    3.11-35                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    356
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                AP1000 Design Control Document Table 3.11-1 (Sheet 47 of 51)
ENVIRONMENTALLY QUALIFIED ELECTRICAL AND MECHANICAL EQUIPMENT Operating Envir.                    Time  Qualification AP1000            Zone        Function  Required    Program Description                    Tag No.        (Note 2)      (Note 1)  (Note 5)  (Note 6)
Steam Line Condensate Drain Level      SGS-PL-V096B        5            PB        1 yr      M*
Isolation Valve Steam Line Condensate Drain Level      SGS-PL-V097A        5            PB        1 yr      M*
Isolation Valve Steam Line Condensate Drain Level      SGS-PL-V097B        5            PB        1 yr      M*
Isolation Valve Startup Feedwater Check Valve          SGS-PL-V256A        5            PB        1 yr      M*
Startup Feedwater Check Valve          SGS-PL-V256B        5            PB        1 yr      M*
Air Delivery Line Pressure Instrument  VES-PL-V006A        7            PB        1 yr      M Isolation Valve A Air Delivery Line Pressure Instrument  VES-PL-V006B        7            PB        1 yr      M Isolation Valve B Air Delivery Line Maintenance          VES-PL-V010A        7            PB        1 yr      M Isolation Valve A Air Delivery Line Maintenance          VES-PL-V010B        7            PB        1 yr      M Isolation Valve B Air Delivery Line Maintenance          VES-PL-V011A        7            PB        1 yr      M Isolation Valve A Air Delivery Line Maintenance          VES-PL-V011B        7            PB        1 yr      M Isolation Valve B Temporary Instrument                  VES-PL-V016          7            PB        1 yr      M Isolation Valve A Temporary Instrument                  VES-PL-V020          7            PB        1 yr      M Isolation Valve B Air Bank 1 Isolation Valve A          VES-PL-V024A        7            PB        1 yr      M Air Bank 2 Isolation Valve B          VES-PL-V024B        7            PB        1 yr      M Air Bank 3 Isolation Valve C          VES-PL-V024C        7            PB        1 yr      M Air Bank 4 Isolation Valve D          VES-PL-V024D        7            PB        1 yr      M Air Bank 1 Isolation Valve A          VES-PL-V025A        7            PB        1 yr      M Air Bank 2 Isolation Valve B          VES-PL-V025B        7            PB        1 yr      M Air Bank 3 Isolation Valve C          VES-PL-V025C        7            PB        1 yr      M Air Bank 4 Isolation Valve D          VES-PL-V025D        7            PB        1 yr      M Air Bank 1 Fill/Vent Isolation Valve A VES-PL-V026A        7            PB        1 yr      M Tier 2 Material                                      3.11-53                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      357
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                          AP1000 Design Control Document Table 3D.5-4 (Sheet 1 of 2)
ABNORMAL OPERATING ENVIRONMENTS OUTSIDE CONTAINMENT Conditions/Parameter            Abnormal Extreme                      Duration      Notes Zone 2 - Loss of AC Power Temperature              Figure 3D.5-1 (Sheet 2)                7 days          Note 3 Pressure                  Atmospheric Humidity                  40 - 95%                                              Note 2 Radiation                Same as normal Chemistry/Submergence    None Zone 3 - Loss of HVAC Temperature              Figure 3D.5-1 (Sheet 1)                7 days Pressure                  Atmospheric                                            Note 1 Humidity                  5 - 95%                                                Note 2 Radiation                Same as normal Chemistry/Submergence    None Zone 4 - Loss of AC Power Temperature              120&deg;F max                              10x4 hrs Pressure                  Atmospheric Humidity                  Same as normal Radiation                Same as normal Chemistry/Submergence    None Zone 5 - Loss of AC Power Temperature              150&deg;F max                              10x4 hrs Pressure                  Atmospheric Humidity                  Same as normal Radiation                Same as normal Chemistry/Submergence    None Zone 6 - Loss of AC Power Temperature              140&deg;F max                              10x4 hrs Pressure                  Atmospheric Humidity                  Same as normal Radiation                Same as normal Chemistry/Submergence    None Tier 2 Material                                3D-45                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                            358
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                          AP1000 Design Control Document Figure 3D.5-1 (Sheet 1 of 3)
Typical Abnormal Environmental Test Profile:
Main Control Room Tier 2 Material                                    3D-49                                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  359
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                              AP1000 Design Control Document Table 3I.6-2 (Sheet 11 of 28)
LIST OF POTENTIAL HIGH FREQUENCY SENSITIVE AP1000 SAFETY-RELATED ELECTRICAL AND ELECTRO-MECHANICAL EQUIPMENT AP1000 Description                                        Tag Number Intermediate Range Neutron Flux Preamplifier Panel D                        PMS-JW-006D Power Range Neutron Flux High Voltage Distribution Box A                    PMS-JW-007A Power Range Neutron Flux High Voltage Distribution Box B                    PMS-JW-007B Power Range Neutron Flux High Voltage Distribution Box C                    PMS-JW-007C Power Range Neutron Flux High Voltage Distribution Box D                    PMS-JW-007D Main Control Room Operator Workstation A                                                      N/A Operator Workstation B                                                      N/A Supervisor Workstation                                                      N/A Switch Station (Including Switches)                                          N/A QDPS MCR Display Unit                                                        PMS-JY-001B QDPS MCR Display Unit                                                        PMS-JY-001C MCR Load Shed Panel 1                                                        VES-EP-01 MCR Load Shed Panel 2                                                        VES-EP-02 Active Valves Containment Isolation - Air Out Solenoid Valve                                                          CAS-PL-V014-S Limit Switch                                                            CAS-PL-V014-L Containment Isolation - Inlet Limit Switch                                                            CCS-PL-V200-L Motor Operator                                                          CCS-PL-V200-M Containment Isolation - Outlet Limit Switch                                                            CCS-PL-V207-L Motor Operator                                                          CCS-PL-V207-M Tier 2 Material                                      3I-22                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                  360
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 3. Design of Structures, Components, Equipment and Systems                                                AP1000 Design Control Document Table 3I.6-3 (Sheet 28 of 32)
LIST OF AP1000 SAFETY-RELATED ELECTRICAL AND MECHANICAL EQUIPMENT NOT HIGH FREQUENCY SENSITIVE AP1000 Description                                      Tag Number    Comment Startup Feedwater Check Valve                                              SGS-PL-V256B        2 Air Delivery Line Pressure Instrument Isolation Valve A                    VES-PL-V006A        2 Air Delivery Line Pressure Instrument Isolation Valve B                    VES-PL-V006B        2 Temporary Instrument Isolation Valve A                                    VES-PL-V016          2 Temporary Instrument Isolation Valve B                                    VES-PL-V020          2 Air Tank Isolation Valve A                                                VES-PL-V024A        2 Air Tank Isolation Valve B                                                VES-PL-V024B        2 Air Tank Isolation Valve A                                                VES-PL-V025A        2 Air Tank Isolation Valve B                                                VES-PL-V025B        2 Refill Line Isolation Valve                                                VES-PL-V038          2 DP Instrument Line Isolation Valve A                                      VES-PL-V043A        2 DP Instrument Line Isolation Valve B                                      VES-PL-V043B        2 Containment Isolation Test Connection                                      VFS-PL-V008          2 Containment Isolation Test Connection                                      VFS-PL-V012          2 Containment Isolation Test Connection                                      VFS-PL-V015          2 Main Equipment Hatch Test Connection                                      VUS-PL-V015          2 Maintenance Equipment Hatch Test Connection                                VUS-PL-V016          2 Personnel Hatch Test Connection                                            VUS-PL-V017          2 Personnel Hatch Test Connection                                            VUS-PL-V018          2 Personnel Hatch Test Connection                                            VUS-PL-V019          2 Personnel Hatch Test Connection                                            VUS-PL-V020          2 Personnel Hatch Test Connection                                            VUS-PL-V021          2 Personnel Hatch Test Connection                                            VUS-PL-V022          2 Fuel Transfer Tube Test Connection                                        VUS-PL-V023          2 Tier 2 Material                                        3I-68                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                  361
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                        AP1000 Design Control Document 5.4.5.2    Design Description 5.4.5.2.1  Pressurizer The pressurizer is a vertical, cylindrical vessel having hemispherical top and bottom heads constructed of low alloy steel. Internal surfaces exposed to the reactor coolant are clad austenitic stainless steel. Material specifications are provided in Table 5.2-1 for the pressurizer.
The general configuration of the pressurizer is shown in Figure 5.4-5. The design data for the pressurizer are given in Table 5.4-9. Codes and material requirements are provided in Section 5.2. Nickel-chromium-iron alloys are not used for heater wells or instrument nozzles.
The spray line nozzles and the automatic depressurization and safety valve connections are located in the top head of the pressurizer vessel. Spray flow is modulated by automatically controlled air-operated valves. The spray valves can also be operated manually from the control room. In the bottom head at the connection of the surge line to the surge nozzle a thermal sleeve protects the nozzle from thermal transients.
A retaining screen above the surge nozzle prevents passage of any foreign matter from the pressurizer to the reactor coolant system. Baffles in the lower section of the pressurizer prevent an in-surge of cold water from flowing directly to the steam/water interface. The baffles also assist in mixing the incoming water with the water in the pressurizer. The retaining screen and baffles also act as a diffuser. The baffles also support the heaters to limit vibration.
Electric direct-immersion heaters are installed in vertically oriented heater wells located in the pressurizer bottom head. The heater wells are welded to the bottom head and form part of the pressure boundary. The heaters can be removed for maintenance or replacement.
The heaters are grouped into a control group and backup groups. The heaters in the control group are proportional heaters which are supplied with continuously variable power to match heating needs. The heaters in the backup group are either off or at full power. The power supply to the heaters is a 480-volt 60 Hz. three-phase circuit. Each heater is connected to one leg of a delta-connected circuit and is rated at 480 volts with one-phase current. The capacity of the control and backup groups is defined in Table 5.4-10.
A manway in the upper shell provides access to the internal space of the pressurizer in order to inspect or maintain the spray nozzle. The manway closure is a gasketed cover held in place with threaded fasteners. Periodic planned inspections of the pressurizer interior are not required.
Brackets on the upper shell attach the structure (a ring girder) of the pressurizer safety and relief valve (PSARV) module. The pressurizer safety and relief valve module includes the safety valves and the first three stages of automatic depressurization system valves. The support brackets on the pressurizer represent the primary vertical load path to the building structure. Sway struts between the ring girder and pressurizer compartment walls also provide lateral support to the upper portion of the pressurizer. See subsection 5.4.10 for additional details.
Tier 2 Material                                      5.4-29                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        362
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                        AP1000 Design Control Document Four steel columns attach to pads on the lower head to provide vertical support for the vessel.
The columns are based at elevation 107'-2". Lateral support for the lower portion of the vessel is provided by sway struts between the columns and compartment walls.
The AP1000 pressurizer has metallic reflective insulation (MRI) installed on the external surfaces; the insulation is designed to minimize heat losses from the pressurizer, to reduce heat load on the containment cooling system, and to limit temperatures in nearby concrete or components. During normal operating conditions, the insulation has an average maximum heat transfer rate of 65 Btu/hr-ft2 at a containment design temperature of 120&deg;F.
5.4.5.2.2  Instrumentation Instrument connections are provided in the pressurizer shell to measure important parameters.
Eight level taps are provided for four channels of level measurement. Level taps are also used for connection to the pressure measurement instrumentation. Two temperature taps monitor water/steam temperature. A sample tap connection is provided for connection to the sampling system to monitor coolant chemistry. The instrument and sample taps are constructed of stainless steel and designed for a socket weld of the connecting lines to the taps. The sample and instrument taps incorporate an integral flow restrictor with a diameter of 0.38 inch or smaller.
See Chapter 7 for details of the instrumentation associated with pressurizer pressure, level, and temperature.
5.4.5.2.3  Operation During steady-state operation at 100 percent power, approximately 50 percent of the pressurizer volume is water and 50 percent is steam. Electric immersion heaters in the bottom of the vessel keep the water at saturation temperature. The heaters also maintain a constant operating pressure.
A small continuous spray flow is provided through a manual bypass valve around each power-operated spray valve to minimize the boron concentration difference between the pressurizer liquid and the reactor coolant. This continuous flow also prevents excessive cooling of the spray piping. Proportional heaters in the control group are continuously on during normal operation to compensate for the continuous introduction of cooler spray water and for losses to ambient.
These conditions result in a continuous outsurge in most cases during normal operation and anticipated transients. The outsurge minimizes the potential for thermal stratification in the surge line.
During an outsurge of water from the pressurizer, flashing of water to steam and generation of steam by automatic actuation of the heaters keep the pressure above the low-pressure engineered safety features actuation setpoint. During an in-surge from the reactor coolant system, the spray system (which is fed from two cold legs) condenses steam in the pressurizer. This prevents the pressurizer pressure from reaching the high-pressure reactor trip setpoint. The heaters are energized on high water level during in-surge to heat the subcooled surge water entering the pressurizer from the reactor coolant loop.
Tier 2 Material                                      5.4-30                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      363
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                        AP1000 Design Control Document 5.4.11.2    System Description Each safety valve discharge is directed to a rupture disk at the end of the discharge piping. A small pipe is connected to the discharge piping to drain away condensed steam leaking past the safety valve. The discharge is directed away from any safety related equipment, structures, or supports that could be damaged to the extent that emergency plant shutdown is prevented by such a discharge.
The discharge from each of two groups of automatic depressurization system valves is connected to a separate sparger below the water level in the in-containment refueling water storage tank.
The piping and instrumentation diagram for the connection between the automatic depressurization system valves and the in-containment refueling water storage tank is shown in Figure 6.3-1. The in-containment refueling water storage tank is a stainless steel lined compartment integrated into the containment interior structure. The discharge of water, steam, and gases from the first-stage automatic depressurization system valves when used to vent noncondensable gases does not result in pressure in excess of the in-containment refueling water storage tank design pressure. Additionally, vents on the top of the tank protect the tank from overpressure, as described in subsection 6.3.2.
Overflow provisions prevent overfilling of the tank. The overflow is directed into the refueling cavity. The in-containment refueling water storage tank does not have a cover gas and does not require a connection to the waste gas processing system. The normal residual heat removal system provides nonsafety-related cooling of the in-containment refueling water storage tank.
5.4.11.3    Safety Evaluation The design of the control for the reactor coolant system and the volume of the pressurizer is such that a discharge from the safety valves is not expected. The containment design pressure, which is based on loss of coolant accident considerations, is greatly in excess of the pressure that would result from the discharge of a pressurizer safety valve. The heat load resulting from a discharge of a pressurizer safety valve is considerably less than the capacity of the passive containment cooling system or the fan coolers. See Section 6.2.
Venting of noncondensable gases, including entrained steam and water from the loop seals in the lines to the automatic depressurizations system valves, from the pressurizer into spargers below the water line in the in-containment refueling water storage tank does not result in a significant increase in the pressure or water temperature. The in-containment refueling water storage tank is not susceptible to vacuum conditions resulting from the cooling of hot water in the tank, as described in subsection 6.3.2. The in-containment refueling water storage tank has capacity in excess of that required for venting of noncondensable gases from the pressurizer following an accident.
5.4.11.4    Instrumentation Requirements The instrumentation for the safety valve discharge pipe, containment, and in-containment refueling water storage tank are discussed in subsections 5.2.5, 5.4.9, and in Sections 6.2 and 6.3, respectively. Separate instrumentation for the monitoring of the discharge of noncondensable gases is not required.
Tier 2 Material                                      5.4-66                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        364
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 5. Reactor Coolant System and Connected Systems                        AP1000 Design Control Document In addition, materials and welds are inspected according to the requirements of the ASME Code, Section III Class 1.
5.4.14      Passive Residual Heat Removal Heat Exchanger The passive residual heat removal heat exchanger (PRHR HX) is the component of the passive core cooling system that removes core decay heat for any postulated non-loss of coolant accident event where a loss of cooling capability via the steam generators occurs. Section 6.3 discusses the operation of the passive residual heat removal heat exchanger in the passive core cooling system.
5.4.14.1    Design Bases The passive residual heat removal heat exchanger automatically actuates to remove core decay heat for 72 hours as discussed in Section 6.3, assuming the condensate from steam generated in the in-containment refueling water storage tank (IRWST) is returned to the tank. The passive residual heat removal heat exchanger is designed to withstand the design environment of 2500 psia and 650qF.
The passive residual heat removal heat exchanger and the in-containment refueling water storage tank are designed to delay significant steam release to the containment for at least one hour. The passive residual heat removal heat exchanger will prevent water relief from the pressurizer and remove sufficient decay heat from the reactor coolant system to satisfy the applicable post-accident safety evaluation criteria detailed in Chapter 15 for at least 72 hours. In addition, the passive residual heat removal heat exchanger will cool the reactor coolant system, with reactor coolant pumps operating or in the natural circulation mode, so that the reactor coolant system pressure can be lowered to reduce stress levels in the system if required. See Section 6.3 for a discussion of the capability of the passive core cooling system.
The passive residual heat removal heat exchanger is designed and fabricated according to the ASME Code, Section III, as a Class 1 component. Those portions of the passive residual heat exchanger that support the primary-side pressure boundary and falls under the jurisdiction of ASME Code, Section III, Subsection NF are AP1000 equipment Class A (ANS Safety Class 1, Quality Group A). Stresses for ASME Code, Section III equipment and supports are maintained within the limits of Section III of the Code. Section 5.2 provides ASME Code, Section III and material requirements. Subsection 5.2.4 discusses inservice inspection.
Materials of construction are specified to minimize corrosion/erosion and to provide compatibility with the operating environment, including the expected radiation level. Subsection 5.2.3 discusses the welding, cutting, heat treating and other processes used to minimize sensitization of stainless steel.
5.4.14.2    Design Description The passive residual heat removal heat exchanger consists of an upper and lower tubesheet mounted through the wall of the in-containment refueling water storage tank. A series of 0.75-inch outer diameter C-shaped tubes connect the tubesheets shown in Figure 6.3-5. The primary coolant passes through the tubes, which transfer decay heat to the in-containment Tier 2 Material                                      5.4-73                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        365
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document application of the criteria to specific compartments is provided in Table 6.2.4-6. The location of igniters throughout containment is provided in Figures 6.2.4-5 through 6.2.4-13. The location of igniters is also summarized in Table 6.2.4-7 identifying subcompartment/regions and which igniters by power group provide protection. The locations identified are considered approximations (+ 2.5 feet) with the final locations governed by the installation details.
The igniter assembly is designed to maintain the surface temperature within a range of 1600&deg; to 1700&deg;F in the anticipated containment environment following a loss of coolant accident. A spray shield is provided to protect the igniter from falling water drops (resulting from condensation of steam on the containment shell and on nearby equipment and structures). Design parameters for the igniters are provided in Table 6.2.4-3.
6.2.4.2.4  Containment Purge Containment purge is not part of the containment hydrogen control system. The purge capability of the containment air filtration system (see subsection 9.4.7) can be used to provide containment venting prior to post-loss of coolant accident cleanup operations.
6.2.4.3    Design Evaluation (Design Basis Accident)
A design basis accident evaluation is not required.
6.2.4.4    Design Evaluation (Severe Accident)
Although a severe accident involving major core degradation or core melt is not a design basis accident, the containment hydrogen control system contains design features to address this potential occurrence. The hydrogen monitoring subsystem has sufficient range to monitor concentrations up to 20 percent hydrogen. The hydrogen ignition subsystem is provided so that hydrogen is burned off in a controlled manner, preventing the possibility of deflagration with supersonic flame front propagation which could result in large pressure spikes in the containment.
It is assumed that 100 percent of the active fuel cladding zirconium reacts with steam. This reaction may take several hours to complete. The igniters initiate hydrogen burns at concentrations less than 10 percent by volume and prevent the containment hydrogen concentration from exceeding this limit. Further evaluation of hydrogen control by the igniters is presented in the AP1000 Probabilistic Risk Assessment.
6.2.4.5    Tests and Inspections 6.2.4.5.1  Preoperational Inspection and Testing Hydrogen Monitoring Subsystem Pre-operational testing is performed either before or after installation but prior to plant startup to verify performance.
Tier 2 Material                                      6.2-43                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          366
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document Hydrogen Recombination Subsystem The performance of the autocatalytic recombiner plates (or cartridges) is tested by the manufacturer for each lot or batch of catalyst material. The number of plates tested is based on the guidance provided in ANSI/ASQC Z1.4-1993, Sampling Procedures and Tables for Inspection by Attributes, (formerly Military Standard 105), required to achieve Inspection Level III quality level.
Hydrogen Ignition Subsystem Pre-operational testing and inspection is performed after installation of the hydrogen ignition system and prior to plant startup to verify operability of the hydrogen igniters. It is verified that 64 igniter assemblies are installed at the locations defined by Figures 6.2.4-5 through 6.2.4-11.
Operability of the igniters is confirmed by verification of the surface temperature in excess of the value specified in Table 6.2.4-3. This temperature is sufficient to ensure ignition of hydrogen concentrations above the flammability limit.
Pre-operational inspection is performed to verify the location of openings through the ceilings of the passive core cooling system valve/accumulator rooms with respect to the containment pressure boundary. The primary openings are those that constitute at least 98% of the opening area. The primary openings in Room 11206 that vent to Room 11300 are the equipment access opening and CMT-A opening. These openings are verified to be a minimum distance of 24.3 feet and 9.4 feet, respectively, from the containment shell. The primary opening in Room 11207 that vents to Room 11300 is the CMT-B opening, which is verified to be a minimum distance of 24.6 feet from the containment shell. Other openings must be at least 3 feet from the containment shell.
Pre-operational inspection is performed to verify the orientation of the vents from the IRWST that are located along the side of the IRWST next to the containment. The discharge of each of these IRWST vents must be oriented generally away from the containment shell.
6.2.4.5.2  In-service Testing Hydrogen Monitoring Subsystem The system is normally in service. Periodic testing and calibration are performed to provide ongoing confirmation that the hydrogen monitoring function can be reliably performed.
Hydrogen Recombination Subsystem Periodic inspection and testing are performed on the passive autocatalytic recombiners. The testing is performed by testing a sample of the catalyst plates as specified in subsection 6.2.4.5.1.
Hydrogen Ignition Subsystem Periodic inspection and testing are performed to confirm the continued operability of the hydrogen ignition system. Operability testing consists of energizing the igniters and confirming the surface temperature exceeds the value specified in Table 6.2.4-3.
Tier 2 Material                                      6.2-44                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          367
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document x  Components are designed and fabricated according to industry standard quality groups commensurate with its intended safety-related functions.
x  It is tested and inspected at appropriate intervals, as defined by the ASME Code, Section XI, and by technical specifications.
x  It performs its intended safety-related functions following events such as fire, internal missiles or pipe breaks.
x  It is protected from the effects of external events such as earthquakes, tornadoes, and floods.
x  It is designed to be sufficiently reliable, considering redundancy and diversity, to support the plant core melt frequency and significant release frequency goals.
6.3.1.1    Safety Design Basis The passive core cooling system is designed to provide emergency core cooling during events involving increases and decreases in secondary side heat removal and decreases in reactor coolant system inventory. Subsection 6.3.3 provides a description of the design basis events. The performance criteria are provided in subsection 6.3.1 and also described in Chapter 15, under the respective event sections.
6.3.1.1.1  Emergency Core Decay Heat Removal For postulated non-LOCA events, where a loss of capability to remove core decay heat via the steam generators occurs, the passive core cooling system is designed to perform the following functions for at least 72 hours:
x    The passive residual heat removal heat exchanger automatically actuates to provide reactor coolant system cooling and to prevent water relief through the pressurizer safety valves.
x    The passive residual heat removal heat exchanger, in conjunction with the in-containment refueling water storage tank, the condensate collection features, and the passive containment cooling system, is designed to remove decay heat following a design basis event. Automatic depressurization actuation is not expected, but may occur depending on the amount of reactor coolant system leakage and when normal systems are recovered (refer to Subsection 6.3.1.1.4).
x    The passive residual heat removal heat exchanger is designed to maintain acceptable reactor coolant system conditions following a non-LOCA event. The applicable post-accident safety evaluation criteria are discussed in Chapter 15.
x    The passive residual heat removal heat exchanger is capable of performing its post-accident safety functions, assuming the steam generated in the in-containment refueling water storage tank is condensed on the containment vessel and returned by gravity via the in-containment refueling water storage tank condensate return gutter and downspouts.
Tier 2 Material                                        6.3-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        368
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document x    During a steam generator tube rupture event, the passive residual heat removal heat exchanger removes core decay heat and reduces reactor coolant system temperature and pressure, equalizing with steam generator pressure and terminating break flow, without overfilling the steam generator.
System operation beyond 72 hours is described in Subsection 6.3.1.2.1.
6.3.1.1.2  Reactor Coolant System Emergency Makeup and Boration For postulated non-LOCA events, sufficient core makeup water inventory is automatically provided to keep the core covered and to allow for decay heat removal. In addition, this makeup prevents actuation of the automatic depressurization system for a significant time.
For postulated events resulting in an inadvertent cooldown of the reactor coolant system, such as a steam line break, sufficient borated water is automatically provided to makeup for reactor coolant system shrinkage. The borated water also counteracts the reactivity increase caused by the resulting system cooldown.
For a Condition II steam line break described in Chapter 15, return to power is acceptable if there is no core damage. For this event, the automatic depressurization system is not actuated.
For a large steam line break, the peak return to power is limited so that the offsite dose limits are satisfied. Following either of these events, the reactor is automatically brought to a subcritical condition.
For safe shutdown, the passive core cooling system is designed to supply sufficient boron to the reactor coolant system to maintain the technical specification shutdown margin for cold, post-depressurization conditions, with the most reactive rod fully withdrawn from the core. The automatic depressurization system is not expected to actuate for these events.
6.3.1.1.3  Safety Injection The passive core cooling system provides sufficient water to the reactor coolant system to mitigate the effects of a loss of coolant accident. In the event of a large loss of coolant accident, up to and including the rupture of a hot or cold leg pipe, where essentially all of the reactor coolant volume is initially displaced, the passive core cooling system rapidly refills the reactor vessel, refloods the core, and continuously removes the core decay heat. A large break is a rupture with a total cross-sectional area equal to or greater than one square foot. Although the criteria for mechanistic pipe break are used to limit the size of pipe rupture considered in the design and evaluation of piping systems, as described in subsection 3.6.3, such criteria are not used in the design of the passive core cooling system.
Sufficient water is provided to the reactor vessel following a postulated loss of coolant accident so that the performance criteria for emergency core cooling systems, described in Chapter 15, are satisfied.
Tier 2 Material                                      6.3-3                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          369
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document The automatic depressurization system valves, provided as part of the reactor coolant system, are designed so that together with the passive core cooling system they:
x    Satisfy the small loss of coolant accident performance requirements x    Provide effective core cooling for loss of coolant accidents from when the passive core cooling system is actuated through the long-term cooling mode.
6.3.1.1.4  Safe Shutdown The functional requirements for the passive core cooling system specify that the plant be brought to a safe, stable condition using the passive residual heat removal heat exchanger for events not involving a loss of coolant. As stated in Subsection 6.3.1.1.1, the passive residual heat removal heat exchanger in conjunction with the passive containment cooling system provides sufficient heat removal to satisfy the post-accident safety evaluation criteria for at least 72 hours.
Additionally the passive core cooling system, in conjunction with the passive containment cooling system and the automatic depressurization system, has the capability to establish long-term safe shutdown conditions, in the reactor coolant system as identified in Subsection 7.4.1.1.
The core makeup tanks automatically provide injection to the reactor coolant system after they are actuated on low reactor coolant temperature or low pressurizer pressure or level. The passive core cooling system can maintain stable plant conditions for a long time in this mode of operation, depending on the reactor coolant leakage and the availability of normal systems. For example, with a technical specification leak rate of 10 gpm, stable plant conditions can be maintained for at least 10 hours. With a smaller leak a longer time is available.
In scenarios when ac power sources are unavailable for approximately 22 hours, the automatic depressurization system automatically actuates. However, after the initial plant cooldown following a non-LOCA event, operators assess plant conditions and have the option to perform recovery actions to further cool and depressurize the reactor coolant system in a closed-loop mode of operation, i.e., without actuation of the automatic depressurization system. After verifying the reactor coolant system is in an acceptable, stable condition such that automatic depressurization is not needed, the operators may take action to extend the passive residual heat removal heat exchanger operation by deenergizing the loads on the 24-hour Class 1E dc batteries powering the protection and monitoring system actuation cabinets. After operators have taken action to extend its operation, the passive residual heat removal heat exchanger, in conjunction with the passive containment cooling system, has the capability to maintain safe, stable conditions for at least 72 hours. The automatic depressurization system remains available to maintain safe shutdown conditions at a later time.
In most sequences, the operators would return the plant to normal system operations and terminate passive system operation within several hours in accordance with the plant emergency operating procedures. For loss of coolant accidents, when the core makeup tank level reaches the automatic depressurization system actuation setpoint and other postulated events where the passive residual heat removal heat exchanger operation is not extended or is exhausted, the automatic depressurization system may be initiated. This results in injection from the accumulators and subsequently from the in-containment refueling water storage tank, once the Tier 2 Material                                      6.3-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      370
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document reactor coolant system is nearly depressurized. For these conditions, the reactor coolant system depressurizes to saturated conditions at about 250&deg;F within 24 hours. The passive core cooling system can maintain this safe shutdown condition indefinitely for the plant as identified in Subsection 7.4.1.1.
The passive core cooling system functional requirements are met over the range of anticipated events and single failure assumptions. The primary function of the passive core cooling system during a safe shutdown using only safety-related equipment is to provide a means for boration, injection, and core cooling. Details of the safe shutdown design bases are presented in subsection 5.4.7 and Section 7.4. The performance of the passive residual heat removal heat exchanger to bring the plant to 420&deg;F in 36 hours is summarized in Subsection 19E.4.10.2.
6.3.1.1.5  Containment pH Control The passive core cooling system is capable of maintaining the desired post-accident pH conditions in the recirculation water after containment floodup. The pH adjustment is capable of maintaining containment pH within a range of 7.0 to 9.5, to enhance radionuclide retention in the containment and to prevent stress corrosion cracking of containment components during long-term containment floodup.
6.3.1.1.6  Reliability Requirements The passive core cooling system satisfies a variety of reliability requirements, including redundancy (such as for components, power supplies, actuation signals, and instrumentation),
equipment testing to confirm operability, procurement of qualified components, and provisions for periodic maintenance. In addition, the system provides protection in a number of areas including:
x    Single active and passive component failures x    Spurious failures x    Physical damage from fires, flooding, missiles, pipe whip, and accident loads x    Environmental conditions such as high-temperature steam and containment floodup Subsection 6.3.1.3 includes specific nonsafety-related design requirements that help to confirm satisfactory system reliability.
6.3.1.2    Nonsafety Design Basis 6.3.1.2.1  Post Accident Core Decay Heat Removal The passive residual heat removal heat exchanger is designed to cool the reactor coolant system to 420&deg;F in 36 hours, with or without reactor coolant pumps operating. This allows the reactor coolant system to be depressurized and the stress in the reactor coolant system and connecting pipe to be reduced to low levels. This non-bounding, conservative evaluation is discussed in Subsection 19E.4.10.2.
The passive residual heat removal heat exchanger, in conjunction with the in-containment refueling water storage tank, the condensate return features, and the passive containment cooling Tier 2 Material                                      6.3-5                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      371
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document system, has the capability to maintain the reactor coolant system in the specified, long-term safe shutdown condition of 420&deg;F for greater than 14 days in a closed-loop mode of operation. The automatic depressurization system can be manually actuated by the operators during the extended passive residual heat removal heat exchanger operation to initiate open-loop cooling. The operator actions necessary to achieve safe shutdown using the passive residual heat removal heat exchanger in a closed-loop mode of operation involve preventing unnecessary actuation of the automatic depressurization system as detailed in Subsection 7.4.1.
Eventually, if pressurizer heaters are not available, the pressurizer subcools due to ambient heat loss. When this happens, the steam void within the pressurizer is transferred to the reactor coolant system. It has been determined that this condition is safe as long as the passive residual heat removal performance is not affected.
If passive residual heat removal performance is affected by subcooling (or other plant conditions) and non-safety systems to control core cooling are not reestablished, then the final, long-term safe shutdown conditions may be achieved and maintained using the automatic depressurization system as discussed in Subsection 7.4.1.1.
6.3.1.3    Power Generation Design Basis The passive core cooling system is designed to be sufficiently reliable to support the probabilistic risk analysis goals for core damage frequency and severe release frequency. In assessing the reliability for probabilistic risk analysis purposes, more realistic analysis is used for both the passive core cooling system performance and for plant response.
In the event of a small loss of coolant accident, the passive core cooling system limits the increase in peak clad temperature and core uncovery with design basis assumptions. For pipe ruptures of less than eight-inch nominal diameter size, the passive core cooling system is designed to prevent core uncovery with best estimate assumptions.
The passive residual heat removal heat exchanger and the in-containment refueling water storage tank are designed to delay significant steam release to the containment for at least one hour.
The frequency of automatic depressurization system actuation is limited to a low probability to reduce safety risks and to minimize plant outages. Equipment is located so that it is not flooded or it is designed so that it is not damaged by the flooding. Major plant equipment is designed for multiple occurrences without damage.
The pH control equipment is designed to minimize the potential for and the impact of inadvertent actuation.
The passive core cooling system is capable of supporting the required testing and maintenance, including capabilities to isolate and drain equipment.
6.3.2      System Design The passive core cooling system is a seismic Category I, safety-related system. It consists of two core makeup tanks, two accumulators, the in-containment refueling water storage tank, the Tier 2 Material                                        6.3-6                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        372
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document passive residual heat removal heat exchanger, pH adjustment baskets, and associated piping, valves, instrumentation, and other related equipment. The automatic depressurization system valves and spargers, which are part of the reactor coolant system, also provide important passive core cooling functions.
The passive core cooling system is designed to provide adequate core cooling in the event of design basis events. The redundant onsite safety-related class 1E dc and UPS system provides power such that protection is provided for a loss of ac power sources, coincident with an event, assuming a single failure has occurred.
6.3.2.1    Schematic Piping and Instrumentation Diagrams Figure 6.3-1 shows the piping and instrumentation drawings of the passive core cooling system.
Simplified flow diagrams are shown in Figures 6.3-3 and 6.3-4. The accident analysis results of events analyzed in Chapter 15 provide a summary of the expected fluid conditions in the passive core cooling system for the various locations shown on the simplified flow diagrams, for the specific plant conditions identified -- safety injection and decay heat removal.
The passive core cooling system is designed to supply the core cooling flow rates to the reactor coolant system specified in Chapter 15 for the accident analyses. The accident analyses flow rates and heat removal rates are calculated by assuming a range of component parameters, including best estimate and conservatively high and low values.
The passive core cooling system design is based on the six major components, listed in subsection 6.3.2.2, that function together in various combinations to support the four passive core cooling system functions:
x    Emergency decay heat removal x    Emergency reactor makeup/boration x    Safety injection x    Containment pH control 6.3.2.1.1  Emergency Core Decay Heat Removal at High Pressure and Temperature Conditions For events not involving a loss of coolant, the emergency core decay heat removal is provided by the passive core cooling system via the passive residual heat removal heat exchanger. The heat exchanger consists of a bank of C-tubes, connected to a tubesheet and channel head arrangement at the top (inlet) and bottom (outlet). The passive residual heat removal heat exchanger connects to the reactor coolant system through an inlet line from one reactor coolant system hot leg (through a tee from one of the fourth stage automatic depressurization lines) and an outlet line to the associated steam generator cold leg plenum (reactor coolant pump suction).
The inlet line is normally open and connects to the upper passive residual heat removal heat exchanger channel head. The inlet line is connected to the top of the hot leg and is routed continuously upward to the high point near the heat exchanger inlet. The normal water temperature in the inlet line will be hotter than the discharge line.
Tier 2 Material                                      6.3-7                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        373
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document The outlet line contains normally closed air-operated valves that open on loss of air pressure or on control signal actuation. The alignment of the passive residual heat removal heat exchanger (with a normally open inlet motor-operated valve and normally closed outlet air-operated valves) maintains the heat exchanger full of reactor coolant at reactor coolant system pressure. The water temperature in the heat exchanger is about the same as the water in the in-containment refueling water storage tank, so that a thermal driving head is established and maintained during plant operation.
The heat exchanger is elevated above the reactor coolant system loops to induce natural circulation flow through the heat exchanger when the reactor coolant pumps are not available.
The passive residual heat removal heat exchanger piping arrangement also allows actuation of the heat exchanger with reactor coolant pumps operating. When the reactor coolant pumps are operating, they provide forced flow in the same direction as natural circulation flow through the heat exchanger. If the pumps are operating and subsequently trip, then natural circulation continues to provide the driving head for heat exchanger flow.
The heat exchanger is located in the in-containment refueling water storage tank, which provides the heat sink for the heat exchanger.
Although gas accumulation is not expected, there is a vertical pipe stub on the top of the inlet piping high point that serves as a gas collection chamber. Level detectors indicate when gases have collected in this area. There are provisions to allow the operators to open manual valves to locally vent these gases to the in-containment refueling water storage tank.
The passive residual heat removal heat exchanger, in conjunction with the in-containment refueling water storage tank, the condensate return features, and the passive containment cooling system, can provide core cooling for at least 72 hours. After the in-containment refueling water storage tank water reaches its saturation temperature (in several hours), the process of steaming to the containment initiates. Containment pressure increases as steam is released from the in-containment refueling water storage tank. As containment temperature increases, condensation begins to form on the subcooled metal and concrete surfaces inside containment. Condensation on these heat sink surfaces transfers energy to the bulk metal and concrete until they come into equilibrium with the containment atmosphere. Condensation that is not returned to the incontainment refueling water storage tank drains to the containment sump.
Condensation occurs on the steel containment vessel, which is cooled by the passive containment cooling system. Most of the condensate formed on the containment vessel wall is collected in a safety-related gutter arrangement. A gutter is located near the operating deck elevation, and a downspout piping system is connected at the polar crane girder and internal stiffener, to collect steam condensate inside the containment during passive containment cooling system operation and return it to the in-containment refueling water storage tank. The gutter normally drains to the containment sump, but when the passive residual heat removal heat exchanger actuates, safety-related isolation valves in the gutter drain line shut and the gutter overflow returns directly to the in-containment refueling water storage tank. Recovery of the condensate maintains the passive residual heat removal heat exchanger heat sink for greater than 14 days.
Tier 2 Material                                      6.3-8                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          374
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document The passive residual heat removal heat exchanger is used to maintain an acceptable, stable reactor coolant system condition. It transfers decay heat and sensible heat from the reactor coolant system to the in-containment refueling water storage tank, the containment atmosphere, the containment vessel, and finally to the ultimate heat sink-the atmosphere outside of containment. This occurs after in-containment refueling water storage tank saturation is reached and steaming to containment initiates.
The duration the passive residual heat removal heat exchanger can continue to remove decay heat is affected by the efficiency of the return of condensate to the in-containment refueling water storage tank. The in-containment refueling water storage tank water level is affected by the amount of steam that leaves the tank and does not return. Resources are typically recovered within 72 hours, which allows the operators to place active, defense-in-depth systems into service and to terminate passive system operation. If resources are not recovered within this time frame, cooling can be extended as described in Subsection 7.4.1.1 to maintain a safe, stable condition after a design basis event.
6.3.2.1.2  Reactor Coolant System Emergency Makeup and Boration The core makeup tanks provide reactor coolant system makeup and boration during events not involving loss of coolant when the normal makeup system is unavailable or insufficient. There are two core makeup tanks located inside the containment at an elevation slightly above the reactor coolant loops. During normal operation, the core makeup tanks are completely full of cold, borated water. The boration capability of these tanks provides adequate core shutdown margin following a steam line break.
The core makeup tanks are connected to the reactor coolant system through a discharge injection line and an inlet pressure balance line connected to a cold leg. The discharge line is blocked by two normally closed, parallel air-operated isolation valves that open on a loss of air pressure or electrical power, or on control signal actuation. The core makeup tank discharge isolation valves are diverse from the passive residual heat removal heat exchanger outlet isolation valves discussed above. They use different globe valve body styles and different air operator types.
The pressure balance line from the cold leg is normally open to maintain the core makeup tanks at reactor coolant system pressure, which prevents water hammer upon initiation of core makeup tank injection.
The cold leg pressure balance line is connected to the top of the cold leg and is routed continuously upward to the high point near the core makeup tank inlet. The normal water temperature in this line will be hotter than the discharge line.
The outlet line from the bottom of each core makeup tank provides an injection path to one of the two direct vessel injection lines, which are connected to the reactor vessel downcomer annulus.
Upon receipt of a safeguards actuation signal, the two parallel valves in each discharge line open to align the associated core makeup tank to the reactor coolant system.
There are two operating processes for the core makeup tanks, steam-compensated injection and water recirculation. During steam-compensated injection, steam is supplied to the core makeup tanks to displace the water that is injected into the reactor coolant system. This steam is provided Tier 2 Material                                      6.3-9                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        375
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document The passive residual heat removal heat exchanger is designed to remove sufficient heat so that its operation, in conjunction with available inventory in the steam generators, provide reactor coolant system cooling and prevents water relief through the pressurizer safety valves during loss of main feedwater or main feedline break events.
Passive residual heat removal heat exchanger flow and inlet and outlet line temperatures are monitored by indicators and alarms. The operator can take action, as required, to meet the technical specification requirements or follow emergency operating procedures for control of the passive residual heat removal heat exchanger operation.
6.3.2.2.6  Depressurization Spargers Two reactor coolant depressurization spargers are provided. Each one is connected to an automatic depressurization system discharge header (shared by three automatic depressurization system stages) and submerged in the in-containment refueling water storage tank. Each sparger has four branch arms inclined downward. The connection of the sparger branch arms to the sparger hub are submerged below the in-containment refueling water storage tank overflow level by d11.5 feet. The component data for the spargers is shown in Table 6.3-2. The spargers are AP1000 Equipment Class C and are designed to meet seismic Category I requirements.
The spargers perform a nonsafety-related function -- minimizing plant cleanup and recovery actions following automatic depressurization. They are designed to distribute steam into the in-containment refueling water storage tank, thereby promoting more effective steam condensation.
The first three stages of automatic depressurization system valves discharge through the spargers and are designed to pass sufficient depressurization venting flow, with an acceptable pressure drop, to support the depressurization system performance requirements. The installation of the spargers prevents undesirable and/or excessive dynamic loads on the in-containment refueling water storage tank and other structures.
Each sparger is sized to discharge at a flow rate that supports automatic depressurization system performance, which in turn, allows adequate passive core cooling system injection.
6.3.2.2.7  IRWST and Containment Recirculation Screens The passive core cooling system has two different sets of screens that are used to prevent debris from entering the reactor and blocking core cooling passages during a LOCA: IRWST screens and containment recirculation screens. The screens are AP1000 Equipment Class C and are designed to meet seismic Category I requirements. The structural frames, attachment to the building structure, and attachment of the screen modules use the criteria of ASME Code, Section III Subsection NF. The screen modules are fabricated of sheet metal and are designed and fabricated to a manufacturers standard. The IRWST screens and containment recirculation screens are designed to comply with applicable licensing regulations including:
x    GDC 35 of 10 CFR 50 Appendix A x    Regulatory Guide 1.82 Tier 2 Material                                      6.3-17                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      376
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document x    NUREG-0897 The operation of the passive core cooling system following a LOCA is described in subsection 6.3.2.1.3. Proper screen design, plant layout, and other factors prevent clogging of these screens by debris during accident operations.
6.3.2.2.7.1 General Screen Design Criteria The IRWST screens and containment recirculation screens are designed with the following criteria.
: 1. Screens are designed to Regulatory Guide 1.82, including:
x  Separate, large screens are provided for each function.
x  Screens are located well below containment floodup level. Each screen provides the function of a trash rack and a fine screen. A debris curb is provided to prevent high density debris from being swept along the floor to the screen face.
x  Floors slope away from screens (not required for AP1000).
x  Drains do not impinge on screens.
x  Screens can withstand accident loads and credible missiles.
x  Screens have conservative flow areas to account for plugging. Operation of the non-safety-related normal residual heat removal pumps with suction from the IRWST and the containment recirculation lines is considered in sizing screens.
x  System and screen performance are evaluated.
x  Screens have solid top cover. Containment recirculation screens have protective plates that are located no more than 1 foot above the top of the screens and extend at least 10 feet in front and 7 feet to the side of the screens. The plate dimensions are relative to the portion of the screens where water flow enters the screen openings. Coating debris, from coatings located outside of the ZOI, is not transported to the containment recirculation screens, to the IRWST screens, or into a direct vessel injection or a cold leg LOCA break that becomes submerged during recirculation considering the use of high density coatings discussed in subsection 6.1.2.1.5.
x  Screens are seismically qualified.
x  Screen openings are sized to prevent blockage of core cooling.
x  Screens are designed for adequate pump performance. AP1000 has no safety-related pumps.
Tier 2 Material                                      6.3-18                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        377
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document 6.3.2.2.7.2 IRWST Screens The IRWST screens are located inside the IRWST at the bottom of the tank. Figure 6.3-6 shows a plan view and Figure 6.3-7 shows a section view of these screens. Three separate screens are provided in the IRWST, one at either end of the tank and one in the center. A cross-connect pipe connects all three IRWST screens to distribute flow. The IRWST is closed off from the containment; its vents and overflows are normally closed by louvers. The potential for introducing debris inadvertently during plant operations is limited. A cleanliness program (refer to subsection 6.3.8.1) controls foreign debris from being introduced into the tank during maintenance and inspection operations. The Technical Specifications require visual inspections of the screens during every refueling outage.
The IRWST design eliminates sources of debris from inside the tank. Insulation is not used in the tank. Air filters are not used in the IRWST vents or overflows. Wetted surfaces in the IRWST are corrosion resistant such as stainless steel or nickel alloys; the use of these materials prevents the formation of significant amounts of corrosion products. In addition, the water is required to be clean because it is used to fill the refueling cavity for refueling; filtering and demineralizing by the spent fuel pit cooling system is provided during and after refueling.
During a LOCA, steam vented from the reactor coolant system condenses on the containment shell and drains down the shell to the polar crane girder or internal stiffener where it is drained via downspouts to the IRWST. Steam that condenses below the internal stiffener drains down the shell and is collected in a gutter near the operating deck elevation. It is very unlikely that debris generated by a LOCA can reach the downspouts or the gutter because of their locations. Each downspout inlet is covered with a coarse screen that prevents larger debris from entering the downspout. The gutter is covered with a trash rack which prevents larger debris from clogging the gutter or entering the IRWST through the two 4-inch drain pipes. The inorganic zinc coating applied to the inside surface of the containment shell is safety - Service Level I, and will stay in place and will not detach.
The design of the IRWST screens reduces the chance of debris reaching the screens. The screens are oriented vertically such that debris that settles out of the water does not fall on the screens.
The lowest screening surface of the IRWST screens is located 6 inches above the IRWST floor to prevent high density debris from being swept along the floor by water flow to the IRWST screens. The screen design provides the trash rack function. This is accomplished by the screens having a large surface area to prevent a single object from blocking a large portion of the screen and by the screens having a robust design to preclude an object from damaging the screen and causing by-pass. The screen prevents debris larger than 0.0625 inch from being injected into the reactor coolant system and blocking fuel cooling passages. The screen is a type that has sufficient surface area to accommodate debris that could be trapped on the screen. The design of the IRWST screens is described further in APP-GW-GLN-147 (Reference 4).
The screen flow area is conservatively designed considering the operation of the nonsafety-related normal residual heat removal system pumps which produce a higher flow than the safety-related gravity driven IRWST injection/recirculation flows. As a result, when the normal residual heat removal system pumps are not operating, there is a large margin to screen clogging.
Tier 2 Material                                      6.3-24                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          378
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document It is acceptable for the core makeup tank injection to be delayed several minutes following actuation due to high initial steam condensation rates in the tank.
6.3.2.5.4  Potential Boron Precipitation Boron precipitation in the reactor vessel is prevented by sufficient flow of passive core cooling system water through the core to limit the increase in boron concentration of the water remaining in the reactor vessel. Water along with steam leaves the core and exits the RCS through the fourth stage ADS lines. These valves connect to the hot leg and open in about 20 minutes after a loss of coolant accident or an automatic depressurization system actuation.
6.3.2.5.5  Safe Shutdown During a safe shutdown, the passive core cooling system provides redundancy for boration, makeup, and heat removal functions. Section 7.4 provides additional information about safe shutdown.
6.3.2.6    Protection Provisions The measures taken to protect the system from damage that might result from various events are described in other sections, as listed below.
x    Protection from dynamic effects is presented in Section 3.6.
x    Protection from missiles is presented in Section 3.5.
x    Protection from seismic damage is presented in Sections 3.7, 3.8, 3.9, and 3.10.
x    Protection from fire is presented subsection 9.5.1.
x    Environmental qualification of equipment is presented in Section 3.11.
x    Thermal stresses on the reactor coolant system are presented in Section 5.2.
6.3.2.7    Provisions for Performance Testing The passive core cooling system includes the capability for determination of the integrity of the pressure boundary formed by series passive core cooling system check valves. Additional information on testing can be found in subsection 6.3.6.
6.3.2.8    Manual Actions The passive core cooling system is automatically actuated for those events as presented in subsection 6.3.3. Following actuation, the passive core cooling system continues to operate in the injection mode until the transition to recirculation initiates automatically following containment floodup.
Although the passive core cooling system operates automatically, operator actions would be beneficial, in some cases, in reducing the consequences of an event. For example, in a steam generator tube rupture with no operator action, the protection and safety monitoring system automatically terminates the leak, prevents steam generator overfill, and limits the offsite doses.
However, the operator can initiate actions, similar to those taken in current plants, to identify and Tier 2 Material                                      6.3-35                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          379
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document isolate the faulted steam generator, cool down and depressurize the reactor coolant system to terminate the break flow to the steam generator, and stabilize plant conditions.
The operator can take action to avoid actuation of the automatic depressurization system when it is not needed. For non-LOCA events during which ac power has been lost for more than 22 hours, the protection and safety monitoring system will automatically open the automatic depressurization system valves to begin a controlled depressurization of the reactor coolant system and, eventually, containment floodup and recirculation prior to depletion of the 24-hour Class 1E actuation batteries. However, the operators can take action to block actuation of the automatic depressurization system should actuation be deemed unnecessary based on reactor coolant system conditions. This action allows closed loop passive residual heat removal heat exchanger operation to continue as long as acceptable reactor coolant system conditions are maintained.
Section 7.4 describes the anticipated operator actions to block the unnecessary automatic depressurization system actuation and to achieve recovery using available systems to remove decay heat. Section 7.5 describes the post-accident monitoring instrumentation available to the operator in the main control room following an event.
6.3.3      Performance Evaluation The events described in subsection 6.3.1 result in passive core cooling system actuation and are mitigated within the performance criteria. For the purpose of evaluation in Chapters 15 and 19, the events that result in passive core cooling system actuation are categorized as follows:
A. Increase in heat removal by the secondary system
: 1. Inadvertent opening of a steam generator power-operated atmospheric steam relief or safety valve
: 2. Steam system piping failure B. Decrease in heat removal by the secondary system
: 1. Loss of Main Feedwater Flow
: 2. Feedwater system piping failure C. Decrease in reactor coolant system inventory
: 1. Steam generator tube rupture
: 2. Loss of coolant accident from a spectrum of postulated reactor coolant system piping failures
: 3. Loss of coolant due to a rod cluster control assembly ejection accident (This event is enveloped by the reactor coolant system piping failures.)
Tier 2 Material                                      6.3-36                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    380
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document The core makeup tanks and passive residual heat removal heat exchangers are also actuated by the Diverse Actuation System as described in subsection 7.7.1.11.
Upon receipt of an actuation signal, the actions described in subsection 6.3.2.1 are automatically initiated to align the appropriate features of the passive core cooling system.
For non-LOCA events, the passive residual heat removal heat exchanger is actuated so that it can remove core decay heat. The passive residual heat removal heat exchanger can operate for at least 72 hours after initiation of a design basis event to satisfy Condition I, II, III, and IV safety evaluation criteria described in the relevant safety analyses. Subsection 6.3.3.2.1.1 provides an evaluation of the duration of the passive residual heat removal heat exchanger operation using the LOFTRAN code described in Subsection 15.0.11.2. In this evaluation, it is assumed that the operators power down the protection and safety monitoring actuation cabinets in the 22-hour time frame prior to the automatic timer actuating the automatic depressurization system.
In addition to mitigating the initiating events, the passive residual heat removal heat exchanger is capable of cooling the reactor coolant system to the specified safe shutdown condition of 420&deg;F within 36 hours as described in Subsection 19E.4.10.2. A non-bounding, conservative analysis of the plant response during operator-initiated, extended operation of the passive residual heat removal heat exchanger is demonstrated in the shutdown temperature evaluation of Subsection 19E.4.10.2. The closed-loop cooling mode allows the reactor coolant system pressure to decrease and reduces the stress in the reactor coolant system and connecting pipe.
For loss of coolant accidents, the core makeup tanks deliver borated water to the reactor coolant system via the direct vessel injection nozzles. The accumulators deliver flow to the direct vessel injection line whenever reactor coolant system pressure drops below the tank static pressure. The in-containment refueling water storage tank provides gravity injection once the reactor coolant system pressure is reduced to below the injection head from the in-containment refueling water storage tank. The passive core cooling system flow rates vary depending upon the type of event and its characteristic pressure transient.
As the core makeup tanks drain down, the automatic depressurization system valves are sequentially actuated. The depressurization sequence establishes reactor coolant pressure conditions that allow injection from the accumulators, and then from the in-containment refueling water storage tank and the containment recirculation path. Therefore, an injection source is continually available. If onsite or offsite ac power has not been restored after 72 hours, the post-72 hour support actions described in Subsection 1.9.5.4 maintain this mode of core cooling and provide adequate decay heat removal for an unlimited time.
The transient analyses summarized in Chapter 15 are extended long enough to demonstrate the applicable safety evaluation criteria are met. It is expected that normal systems would be available such that operators could terminate the passive safety systems and proceed with an orderly shutdown. However, as discussed in Subsection 6.3.1.1.4, the passive systems are capable of bringing the plant to a safe, stable condition for at least 72 hours in closed loop cooling mode and for longer in an open loop mode.
The events listed in group D occur during shutdown conditions that are characterized by slow plant responses and mild thermal-hydraulic transients. In addition, some of the passive core Tier 2 Material                                      6.3-38                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          381
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document For this event, the passive residual heat removal heat exchanger is actuated. If the core makeup tanks are not initially actuated, they actuate later when passive residual heat exchanger cooling sufficiently reduces pressurizer level. The passive residual heat removal heat exchanger serves to remove core decay heat and the core makeup tanks inject a borated water solution directly into the reactor vessel downcomer annulus. Since the reactor coolant pumps are tripped on actuation of the core makeup tanks, the passive residual heat removal heat exchanger operates under natural circulation conditions. The core makeup tanks operate via water recirculation, without draining, to maintain reactor coolant system inventory. Therefore, the automatic depressurization system is not actuated on the lowering of the core makeup tank level. Since the event is characterized by a heat-up transient, the injection of negative reactivity is not required and is not taken credit for in the analysis to control core reactivity.
The reactor coolant system does not depressurize to permit the accumulators to deliver makeup water to the reactor coolant system. Subsequent to stabilizing plant conditions and satisfying passive core cooling system termination criteria, the operator terminates passive core cooling system operation and initiates a normal plant shutdown.
6.3.3.2.1.1 Loss of AC Power to Plant Auxiliaries The most severe conditions resulting from a loss of ac power to the plant auxiliaries are associated with loss of offsite power with a loss of main feedwater system flow at full power. A loss of main feedwater with a loss of ac power lasting longer than a few hours presents the highest demand on passive residual heat removal heat exchanger operation. Subsection 15.2.6 provides a description of this short-term event, including criteria and analytical results.
During most events, the passive systems would be terminated in hours. When an ac power source is restored and passive core cooling system termination criteria are satisfied, the operator terminates passive core cooling system operation and initiates normal plant shutdown operations (as discussed in Subsection 6.3.1.2.1).
However, if normal systems are not recovered as expected, the passive residual heat removal heat exchanger removes core decay heat and maintains acceptable reactor coolant system conditions for at least 72 hours. For a non-LOCA event where ac power is lost, the automatic depressurization system will actuate in approximately 22 hours if operators do not act to avoid actuation when it is not needed. For this long-term transient, it is assumed operators extend passive residual heat exchanger operation as described in the Subsection 7.4.1.1.
The loss of main feedwater with loss of ac power event is analyzed for a 72-hour period, assuming operators extend closed-loop cooling beyond the time the automatic depressurization system would be actuated by the protection and safety monitoring system. This event mirrors the loss of ac power to the plant auxiliaries as described in Subsection 15.2.6, but the loss of ac power extends to 72 hours. In this event, operation of the passive residual heat removal heat exchanger continues for 72 hours and maintains acceptable reactor coolant system conditions such that the applicable Condition II safety evaluation criteria are met. If non-safety systems capable of removing decay heat are not recovered, operator action to actuate automatic depressurization system is eventually required. This condition would then be bounded by the Condition III event of inadvertent automatic depressurization system actuation.
Tier 2 Material                                      6.3-41                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          382
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document Reactor coolant system leakage could limit closed-loop capacity. A reactor coolant system leak could produce conditions that would preclude the operators from de-energizing the loads on the 24-hour Class 1E batteries, or could require the operators to re-energize the buses powered by the Class 1E batteries before 72 hours so that the automatic depressurization system valves could be actuated.
6.3.3.2.2  Feedwater System Pipe Failure The most severe core conditions resulting from a feedwater system piping failure are associated with a double-ended rupture of a feed line at full power. Depending on break size and power level, a feedwater system pipe failure could cause either a reactor coolant system cooldown transient or a reactor coolant system heat-up transient. Only the reactor coolant system heat-up transient is evaluated as a feedwater system pipe failure, since the spectrum of cooldown transients is bounded by the steam system pipe failure analyses. The heat-up transient effects of smaller piping failures at reduced power levels are bounded by the double-ended feed line rupture at full power. Subsection 15.2.8 provides a description of this event, including criteria and analytical results.
For this event, the passive residual heat removal heat exchanger and the core makeup tanks are actuated. The passive residual heat removal heat exchanger serves to remove core decay heat, and the core makeup tanks inject a borated water solution directly into the reactor vessel downcomer. Since the reactor coolant pumps are tripped on actuation of the core makeup tanks, the passive residual heat removal heat exchanger operates under natural circulation conditions.
The core makeup tanks operate via water recirculation to maintain reactor coolant system inventory. Since the event is characterized by a heat-up transient, the injection of negative reactivity is not required and is not taken credit for in the analysis to control core reactivity.
The reactor coolant system does not depressurize to permit the accumulators to deliver makeup water to the reactor coolant system. Subsequent to stabilizing plant conditions and satisfying passive core cooling system termination criteria, the operator terminates passive core cooling system operation and initiates normal plant shutdown operations.
6.3.3.3    Decrease in Reactor Coolant System Inventory A number of events have been postulated that could result in a decrease in reactor coolant system inventory. For each event, consideration has been given to operation of nonsafety-related systems that could affect the consequences of the event. The operation of the startup feedwater system and the chemical and volume control system makeup pumps can affect these events. Analyses of these events, both with and without these nonsafety-related systems operating, are presented in Section 15.6. For those events which result in passive core cooling system actuation, the following summarizes passive core cooling system performance.
6.3.3.3.1  Steam Generator Tube Rupture Although a steam generator tube rupture is an event that results in a decrease in reactor coolant system inventory, severe core conditions do not result from a steam generator tube rupture. The event analyzed is a complete severance of a single steam generator tube that occurs at power with the reactor coolant contaminated with fission products, corresponding to continuous operation Tier 2 Material                                      6.3-42                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        383
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document During shutdown conditions, some of the passive core cooling system equipment is isolated. In addition, since the normal residual heat removal system is not a safety-related system, its loss is considered.
As a result, gravity injection is automatically actuated when required during shutdown conditions prior to refueling cavity floodup, as discussed in subsection 6.3.3.3.2. The operator can also manually actuate other passive core cooling system equipment, such as the passive residual heat removal heat exchanger, if required for accident mitigation during shutdown conditions when the equipment does not automatically actuate.
6.3.3.4.1  Loss of Startup Feedwater During Hot Standby, Cooldowns, and Heat-ups During normal cooldowns, the steam generators are supplied by the startup feedwater pumps and steam from the steam generator is directed to either the main condenser or to the atmosphere.
There are two nonsafety-related startup feedwater pumps, each of which is capable of providing sufficient feedwater flow to both steam generators to remove decay heat. These pumps are also automatically loaded on the nonsafety-related diesel-generators in the event offsite power is lost.
Since these pumps are nonsafety-related, their failure is considered.
In the event of a loss of startup feedwater, the passive residual heat removal heat exchanger is automatically actuated on low steam generator water level and provides safety-related heat removal. The passive residual heat removal heat exchanger can maintain the reactor coolant system temperature, as well as provide for reactor coolant system cooldown to conditions where the normal residual heat removal system can be operated.
Since the chemical and volume control system makeup pumps are nonsafety-related, they may not be available. In this case, the core makeup tanks automatically actuate as the cooldown continues and the pressurizer level decreases. The core makeup tanks operate in a water recirculation mode to maintain reactor coolant system inventory while the passive residual heat removal heat exchanger is operating.
The in-containment refueling water storage tank provides the heat sink for the passive residual heat removal heat exchanger. Initially, the heat addition increases the water temperature. Within one to two hours, the water reaches saturation temperature and begins to boil. The steam generated in the in-containment refueling water storage tank discharges to containment. Because the containment integrity is maintained during cooldown Modes 3 and 4, the passive containment cooling system provides the safety-related ultimate heat sink. Therefore, most of the steam generated in the in-containment refueling water storage tank is condensed on the inside of the containment vessel and drains back into the in-containment refueling water storage tank via the condensate return gutter arrangement. This allows it to function as a heat sink for greater than 14 days, as discussed in Subsection 6.3.1.2.1.
6.3.3.4.2  Loss of Normal Residual Heat Removal Cooling With The Reactor Coolant System Pressure Boundary Intact During normal shutdown conditions, the normal residual heat removal system is placed into service at about 350qF to accomplish reactor coolant system cooldown to refueling temperatures.
The normal residual heat removal system piping is safety-related and meets seismic Category I Tier 2 Material                                      6.3-46                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                        384
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document Figure 6.3-1 (Sheet 1 of 3)
Passive Core Cooling System Piping and Instrumentation Diagram Tier 2 Material                                                    6.3-69                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          385
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document Figure 6.3-1 (Sheet 2 of 3)
Passive Core Cooling System Piping and Instrumentation Diagram Tier 2 Material                                                    6.3-71                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          386
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document Figure 6.3-1 (Sheet 3 of 3)
Passive Core Cooling System Piping and Instrumentation Diagram Tier 2 Material                                                    6.3-72                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          387
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                      AP1000 Design Control Document Figure 6.3-2 Not Used Tier 2 Material                                                    6.3-73                Revision 19 APP-GW-GL-705 Rev. 0                                                                                  388
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document 6.4        Habitability Systems The habitability systems are a set of individual systems that collectively provide the habitability functions for the plant. The systems that make up the habitability systems are the:
x    Nuclear island nonradioactive ventilation system (VBS) x    Main control room emergency habitability system (VES) x    Radiation monitoring system (RMS) x    Plant lighting system (ELS) x    Fire Protection System (FPS)
When a source of ac power is available, the nuclear island nonradioactive ventilation system (VBS) provides normal and abnormal HVAC service to the main control room (MCR),
control support area (CSA), instrumentation and control rooms, dc equipment rooms, battery rooms, and the nuclear island nonradioactive ventilation system equipment room as described in subsection 9.4.1.
If ac power is unavailable for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes or if High-2 particulate or iodine radioactivity is detected in the main control room supply air duct, which would lead to exceeding General Design Criteria 19 operator dose limits, the protection and safety monitoring system automatically isolates the main control room and operator habitability requirements are then met by the main control room emergency habitability system (VES). The main control room emergency habitability system is capable of providing emergency ventilation and pressurization for the main control room. The main control room emergency habitability system also provides emergency passive heat sinks for the main control room, instrumentation and control rooms, and dc equipment rooms.
Radiation monitoring of the main control room environment is provided by the radiation monitoring system. Smoke detection is provided in the VBS system. Emergency lighting is provided by the plant lighting system. Storage capacity is provided in the main control room for personnel support equipment. Manual hose stations outside the MCR and portable fire extinguishers are provided to fight MCR fires.
6.4.1      Safety Design Basis The safety design bases discussed here apply only to the portion of the individual system providing the specified function. The range of applicability is discussed in subsection 6.4.4.
6.4.1.1    Main Control Room Design Basis The habitability systems provide coverage for the main control room pressure boundary as defined in subsection 6.4.2.1. The following discussion summarizes the safety design bases with respect to the main control room:
x    The habitability systems are capable of maintaining the main control room environment suitable for prolonged occupancy throughout the duration of the postulated accidents discussed in Chapter 15 that require protection from the release of radioactivity. Refer to Tier 2 Material                                      6.4-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      389
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document main control area, operations work area, operations break room, shift supervisors office, kitchen, and toilet facilities. The pressure boundary is represented by the line around the periphery of the boundary in the figure. The stairwell leading down to elevation 100 and the area within the vestibule are specifically excluded from the boundary.
The areas, equipment, and materials to which the main control room operator requires access during a postulated accident are shown in Figure 6.4-1. This figure is a subset of Figure 1.2-8.
Areas adjacent to the main control room are shown in Figures 1.2-25 and 1.2-31. The layout, size, and ergonomics of the operator workstations and wall panel information system depicted in Figure 6.4-1 do not reflect the results of the design process described in Chapter 18. The actual size, shape, ergonomics, and layout of the operator workstations and wall panel information system is an output of the design process in Chapter 18.
6.4.2.2    General Description The main control room emergency habitability system air storage tanks are sized to deliver the required air flow to the main control room and induce sufficient air flow through the passive filtration line to meet the ventilation and pressurization requirements for 72 hours based on the performance requirements of subsection 6.4.1.1. Normal system makeup is provided by a connection to the breathable quality air compressor in the compressed and instrument air system (CAS). See subsection 9.3.1 for a description of the CAS. A connection for refilling operation is provided in the CAS.
Flow from the air storage tanks induces a filtration flow of at least 600 cfm. Testing was conducted to validate that the passive filtration line is capable of inducing a filtration flow of at least 600 cfm greater than the design flow rate from the VES emergency air storage tanks. The testing is documented in TR-SEE-III-09-03 (Reference 12). The filtration flow passes through a series of silencers to maintain acceptable main control room noise levels. The passive filtration portion of the system includes a HEPA filter, a charcoal adsorber, and a downstream postfilter.
The filters are configured to satisfy the guidelines of Regulatory Guide 1.52 (Reference 10). The air intake to the passive filtration ductwork is located near the operations work area. The ductwork is routed behind the main control area through the operations break room to reduce the overall noise level in the main control area. The filtered air supply is then distributed to three supply locations that are sufficiently separated from the air intake to avoid short circuiting of the air flow. Two of the supply locations are located inside the main control area. Flow dampers ensure the filtered air is properly distributed throughout the main control room envelope.
The function of providing passive heat sinks for the main control room, instrumentation and control rooms, and dc equipment rooms is part of the main control room emergency habitability system. The heat sinks for each room are designed to limit the temperature rise inside each room during the 72-hour period following a loss of nuclear island nonradioactive ventilation system operation. The heat sinks consist primarily of the thermal mass of the concrete that makes up the ceilings and walls of these rooms.
To enhance the heat-absorbing capability of the ceilings, a metal form is attached to the interior surface of the concrete at selected locations. Metallic plates are attached perpendicular to the form. These plates extend into the room and act as thermal fins to enhance the heat transfer from Tier 2 Material                                      6.4-3                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          390
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document the room air to the concrete. The specifics of the fin construction for the main control room and I&C room ceilings are described in subsection 3.8.4.1.2.
The normal operating temperatures in the main control room, instrumentation and control rooms, dc equipment rooms, and adjacent rooms are kept within a specified range by the nuclear island nonradioactive ventilation system in order to maintain a design basis initial heat sink capacity of each room. See subsection 9.4.1 for a description of the nuclear island nonradioactive ventilation system.
In the unlikely event that power to the nuclear island nonradioactive ventilation system is unavailable for more than 72 hours, MCR habitability is maintained by operating one of the two MCR ancillary fans to supply outside air to the MCR such that the maximum average Wet Bulb Globe temperature (WBGT) Index for the MCR is less than 90&#xba;F. See subsection 9.4.1 for a description of this cooling mode of operation. Doors and ducts may be opened to provide a supply pathway and an exhaust pathway. Likewise, outside air is supplied to division B and C instrumentation and control rooms in order to maintain the ambient temperature below the qualification temperature of the equipment.
The main control room emergency habitability system piping and instrumentation diagram is shown in Figure 6.4-2.
6.4.2.3    Component Description The main control room emergency habitability system compressed air supply contains a set of storage tanks connected to a main and an alternate air delivery line and equipment to provide electrical load de-energization. Components common to both lines include a manual isolation valve and a pressure regulating valve. Single active failure protection is provided by the use of redundant, remotely operated isolation valves, which are located within the MCR pressure boundary. In the event of insufficient or excessive flow in the main delivery line, the main delivery line is isolated and the alternate delivery line is manually actuated. The alternate delivery line contains the same components as the main delivery line with the exception of the remotely operated isolation valves, and thus is capable of supplying compressed air to the MCR pressure boundary at the required air flowrate. The VES piping and penetrations for the MCR envelope are designated as equipment Class C. Additional details on Class C designation are provided in subsection 3.2.2.5. The classification of VES components is provided in Table 3.2-3, as appropriate.
x    Emergency Air Storage Tanks There are a total of 32 air storage tanks. The air storage tanks are constructed of forged, seamless pipe, with no welds, and conform to Section VIII and Appendix 22 of the ASME Code. The design pressure of the air storage tanks is 4000 psi. The storage tanks collectively contain a minimum storage capacity of 327,574 scf.
x    MCR Load Shed Panels The de-energization of the MCR electrical loads is performed using Class 1E equipment.
Equipment within each of the two electrical panels is actuated from the main control room Tier 2 Material                                      6.4-4                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        391
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document isolation, air supply initiation, and electrical load de-energization engineered safety feature. The de-energization is separated into two stages to provide operators with the maximum available nonsafety-related equipment while maintaining the MCR heat load within the requirements of the VES.
Each electrical panel has redundant relays and timers controlled by both protection and safety monitoring system (PMS) Division A and PMS Division C. Either division is capable of actuating the timers and relays associated with each electrical panel independent of one another. This configuration prevents routine maintenance or single failures of a PMS cabinet from creating a spurious loss of MCR electrical loads while still providing for single failure protection. To accomplish the De-energize MCR Electrical Loads function, one set of Stage 1 and Stage 2 timers in each electrical panel must receive the PMS command.
Relays in both electrical panels must be actuated to carry out the overall function. However, overall actuation may occur via different combinations of Division A and Division C commands.
x  Pressure Regulating Valve Each compressed air supply line contains a pressure regulating valve located downstream of the common header. The pressure at the outlet of the valve is controlled via a two-staged self-contained pressure control operator. A failure of either stage of the pressure regulating valve will not cause the valve to fail completely open. A failure of the second stage of the pressure regulating valve will increase flow from the emergency air storage tanks. There is adequate margin in the emergency air storage tanks such that an operator has time to isolate the line and manually actuate the alternate delivery line.
x  Flow Metering Orifice The flow rate of air delivered to the main control room pressure boundary is limited by an orifice located downstream of the pressure regulating valve in the eductor and in the eductor bypass line. The orifice is sized to provide the required air flow rate to the main control room pressure boundary.
x  Air Delivery Main Isolation Valve The pressure boundary of the compressed air storage tanks is maintained by normally closed remotely operated isolation valves in the main supply line. These valves are located within MCR pressure boundary downstream of the pressure regulating valve and automatically initiate air flow upon receipt of a signal to open (see subsection 6.4.3.2).
x  Pressure Relief Isolation Valve To limit the pressure increase within the main control room, isolation valves are provided, one in each of redundant flowpaths, which open on a time delay after receipt of an emergency habitability system actuation signal. The valves provide a leak tight seal to protect the integrity of the main control room pressure boundary during normal operation, Tier 2 Material                                      6.4-5                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        392
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document x    Penetration sealing materials are designed to withstand at least 1/4-inch water gauge pressure differential in an air pressure barrier. Penetration sealing material is a silicone-based material or equivalent.
x    There is no HVAC duct that penetrates the main control room pressure boundary. The portions of the nuclear island nonradioactive ventilation system (VBS) that penetrate the main control room pressure boundary are safety-related piping that include redundant safety-related seismic Category I isolation valves that are physically located within the main control room envelope.
The piping, conduits, and electrical cable trays penetrating through any combination of main control room pressure boundary are sealed with seal assembly compatible with the materials of penetration commodities. Penetration sealing materials are selected to meet barrier design requirements and are designed to withstand specific area environmental design requirements and remain functional and undamaged during and following an SSE. There are no adverse environmental effects on the MCR sealant materials resulting from postulated spent fuel pool boiling events.
The main control room pressure boundary main entrance is designed with a double-door vestibule, which is purged by the pressure relief damper discharge flow during main control room emergency habitability system operation. The emergency exit door (stairs to elevation 100) is normally closed, and remains closed under design basis source term conditions. Administrative controls prohibit the emergency exit door to the remote shutdown workstation from being used for normal ingress and egress during VES operation.
When the main control room pressure boundary is isolated in an accident situation, there is no direct communication with the outside atmosphere, nor is there communication with the normal ventilation system. Leakage from the main control room pressure boundary is the result of an internal pressure of at least 1/8-inch water gauge provided by emergency habitability system operation.
The exfiltration and infiltration analysis for nuclear island nonradioactive ventilation system operation is discussed in subsection 9.4.1.
6.4.2.5    Interaction with Other Zones and Pressurized Equipment The main control room emergency habitability system is a self-contained system. There is no interaction between other zones and pressurized equipment.
For a discussion of the nuclear island nonradioactive ventilation system, refer to subsection 9.4.1.
6.4.2.6    Shielding Design The design basis loss-of-coolant accident (LOCA) dictates the shielding requirements for the main control room. Main control room shielding design bases are discussed in Section 12.3. In addition to shielding provided by building structural features, consideration is given to shielding provided by the VES filter shielding. Descriptions of the design basis LOCA source terms, main Tier 2 Material                                        6.4-8                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                            393
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document control room shielding parameters, and evaluation of doses to main control room personnel are presented in Section 15.6.
The main control room and its location in the plant are shown in Figure 12.3-1.
6.4.3      System Operation This subsection discusses the operation of the main control room emergency habitability system.
6.4.3.1    Normal Mode The main control room emergency habitability system is not required to operate during normal conditions. The nuclear island nonradioactive ventilation system maintains the air temperature of a number of rooms within a predetermined temperature range. The rooms with this requirement include the rooms with a main control room emergency habitability system passive heat sink design and their adjacent rooms.
6.4.3.2    Emergency Mode Operation of the main control room emergency habitability system is automatically initiated by either of the following conditions:
x    High-2 particulate or iodine radioactivity in the main control room supply air duct x    Loss of ac power for more than 10 minutes x    Low main control room differential pressure for more than 10 minutes Operation can also be initiated by manual actuation.
The nuclear island nonradioactive ventilation system is isolated from the main control room pressure boundary by automatic closure of the isolation devices located in the nuclear island nonradioactive ventilation system ductwork if radiation levels in the main control room supply air duct exceed the High-2 setpoint or if ac power is lost for more than 10 minutes or if main control room differential pressure is below the Low setpoint for more than 10 minutes. At the same time, the main control room emergency habitability system begins to deliver air from the emergency air storage tanks to the main control room by automatically opening the isolation valves located in the supply line. The relief damper isolation valves also open allowing the pressure relief dampers to function and discharge the damper flow to purge the vestibule.
After the main control room emergency habitability system isolation valves are opened, the air supply pressure is regulated by a self-contained regulating valve. This valve maintains a constant downstream pressure regardless of the upstream pressure. A constant air flow rate is maintained by the flow metering orifice downstream of the pressure regulating valve. This flow rate is sufficient to maintain the main control room pressure boundary at least 1/8-inch water gauge positive differential pressure with respect to the surroundings and induce a flow rate of at least 600 cfm into the passive air filtration line. The main control room emergency habitability system air flow rate is also sufficient to maintain the carbon dioxide levels below 0.5 percent Tier 2 Material                                      6.4-9                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      394
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document concentration for 11 occupants and to maintain air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1.
The emergency air storage tanks are sized to provide the required air flow to the main control room pressure boundary for 72 hours. After 72 hours, the main control room is cooled by drawing in outside air and circulating it through the room, as discussed in subsection 6.4.2.2.
The temperature and humidity in the main control room pressure boundary following a loss of the nuclear island nonradioactive ventilation system remain within limits for reliable human performance (Reference 14) over a 72-hour period. The bounding initial values of temperature/relative humidity in the MCR are 75&deg;F/60 percent, the relative humidity in the MCR varies between 5% and 95% with a corresponding dry bulb temperature variance between 75&deg;F to under 95&deg;F. The temperature/relative humidity values calculated during the 72 hours following a design basis accident equate to a maximum average WBGT Index for the MCR of less than 90&deg;F. The 90&deg;F WBGT Index is the design limit for minimizing performance decrements and potential harm, and preserving well-being and effectiveness of the MCR staff for an unlimited duration (Reference 14). Non-Class 1E MCR heat loads are de-energized by PMS automatic actions, and the 24- hour battery heat loads are terminated or exhausted at 24 hours to maintain the occupied zone of the MCR and the zones containing qualified safety-related equipment within the constraints of the heat loads in Table 6.4-3 (to maintain temperature below the WBGT limit) at 72 hours after VES actuation. The occupied zone is considered to be the area between the raised floor and 7 feet above the floor, which encompasses the reactor operator and the senior reactor operator consoles.
Sufficient thermal mass is provided in the walls and ceiling of the main control room to absorb the heat generated by the equipment, lights, and occupants. The temperature in the instrumentation and control rooms and dc equipment rooms following a loss of the nuclear island nonradioactive ventilation system remains below acceptable limits as discussed in subsection 6.4.4. As in the main control room, sufficient thermal mass is provided surrounding these rooms to absorb the heat generated by the equipment. After 72 hours, the instrumentation and control rooms will be cooled by drawing in outside air and circulating it through the room, as discussed in subsection 6.4.2.2.
In the event of a loss of ac power or Low main control room differential pressure for more than 10 minutes, the nuclear island nonradioactive ventilation system isolation valves automatically close and the main control room emergency habitability system isolation valves automatically open. These actions protect the main control room occupants from a potential radiation release.
In instances in which there is no radiological source term present, the compressed air storage tanks are refilled via a connection to the breathable quality air compressor in the compressed and instrument air system (CAS). The compressed air storage tanks can also be refilled from portable supplies by an installed connection in the CAS.
6.4.4      System Safety Evaluation In the event of an accident involving the release of radioactivity to the environment, the nuclear island nonradioactive ventilation system (VBS) is expected to switch from the normal operating mode to the supplemental air filtration mode to protect the main control room personnel.
Although the VBS is not a safety-related system, it is expected to be available to provide the Tier 2 Material                                      6.4-10                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      395
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document necessary protection for realistic events. However, the design basis accident doses reported in Chapter 15 utilize conservative assumptions, and the main control room doses are calculated based on operation of the safety-related emergency habitability system (VES) since this is the system that is relied upon to limit the amount of activity the personnel are exposed to. The analyses assume that the VBS is initially in operation, but fails to enter the supplemental air filtration mode on a High-1 radioactivity indication in the main control room atmosphere. VES operation is then assumed to be initiated once the High-2 level for control room atmosphere iodine or particulate radioactivity is reached.
Doses are also calculated assuming that the VBS does operate in the supplemental air filtration mode as designed, but with no switchover to VES operation. This VBS operating case demonstrates the defense-in-depth that is provided by the system and also shows that, in the event of an accident with realistic assumptions, the VBS is adequate to protect the control room operators without depending on VES operation.
Doses were determined for the following design basis:
VES Operating          VBS Operating Large Break LOCA                                    4.33 rem TEDE          4.84 rem TEDE Fuel Handling Accident                              1.5 rem TEDE            1.1 rem TEDE Steam Generator Tube Rupture (Pre-existing iodine spike)                    3.4 rem TEDE            2.8 rem TEDE (Accident-initiated iodine spike)              1.0 rem TEDE            0.8 rem TEDE Steam Line Break (Pre-existing iodine spike)                    1.1 rem TEDE            0.6 rem TEDE (Accident-initiated iodine spike)              1.3 rem TEDE            1.6 rem TEDE Rod Ejection Accident                                3.6 rem TEDE            2.2 rem TEDE Locked Rotor Accident (Accident without feedwater available)          0.4 rem TEDE            0.5 rem TEDE (Accident with feedwater available)            0.2 rem TEDE            0.6 rem TEDE Small Line Break Outside Containment                0.4 rem TEDE            0.2 rem TEDE For all events the doses are within the dose acceptance limit of 5.0 rem TEDE. The details of analysis assumptions for modeling the doses to the main control room personnel are delineated in the LOCA dose analysis discussion in subsection 15.6.5.3 for VES operating cases. The analysis assumptions are provided in subsection 9.4.1.2.3.1 for the VBS operating case.
No radioactive materials are stored or transported near the main control room pressure boundary (this does not apply to installed equipment, such as radiation monitors described in Section 11.5, nor to portable equipment that is in use, such as calibration equipment, survey instrumentation, tools, and other such transient items).
As discussed and evaluated in subsection 9.5.1, the use of noncombustible construction and heat and flame resistant materials throughout the plant reduces the likelihood of fire and consequential impact on the main control room atmosphere. Operation of the nuclear island nonradioactive ventilation system in the event of a fire is discussed in subsection 9.4.1.
Tier 2 Material                                      6.4-11                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        396
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document The exhaust stacks of the onsite standby power diesel generators are located in excess of 150 feet away from the fresh air intakes of the main control room. The onsite standby power system fuel oil storage tanks are located in excess of 300 feet from the main control room fresh air intakes.
These separation distances reduce the possibility that combustion fumes or smoke from an oil fire would be drawn into the main control room.
The protection of the operators in the main control room from offsite toxic gas releases is discussed in Section 2.2. The sources of onsite chemicals are described in Table 6.4-1, and their locations are shown on Figure 1.2-2. Analysis of these sources is in accordance with Regulatory Guide 1.78 (Reference 5) and the methodology in NUREG-0570, Toxic Vapor Concentrations in the Control Room Following a Postulated Accidental Release (Reference 6), and the analysis shows that these sources do not represent a toxic or flammability hazard to control room personnel.
A supply of protective clothing, respirators, and self-contained breathing apparatus adequate for 11 persons is stored within the main control room pressure boundary.
The main control room emergency habitability system components discussed in subsection 6.4.2.3 are arranged as shown in Figure 6.4-2. The location of components and piping within the main control room pressure boundary provides the required supply of compressed air to the main control room pressure boundary, as shown in Figure 6.4-1.
During emergency operation, the main control room emergency habitability system passive heat sinks are designed to limit the temperature inside the main control room to remain within limits for reliable human performance (Reference 14) over 72 hours. The passive heat sinks limit the air temperature inside the instrumentation and control rooms to 120&deg;F and dc equipment rooms to 120&deg;F. The walls and ceilings that act as the passive heat sinks contain sufficient thermal mass to accommodate the heat sources from equipment, personnel, and lighting for 72 hours.
The main control room emergency habitability system nominally provides 65 scfm of ventilation air to the main control room from the compressed air storage tanks. Sixty scfm of supplied ventilation flow is sufficient to induce a filtration flow of at least 600 cfm into the passive air filtration line located inside the main control room envelope. This ventilation flow is also sufficient to pressurize the control room to at least positive 1/8-inch water gauge differential pressure with respect to the surrounding areas in addition to limiting the carbon dioxide concentration below one-half percent by volume for a maximum occupancy of 11 persons and maintaining air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1.
Automatic transfer of habitability system functions from the main control room/control support area HVAC subsystem of the nuclear island nonradioactive ventilation system to the main control room emergency habitability system is initiated by any the following conditions:
x    High-2 particulate or iodine radioactivity in MCR air supply duct x    Loss of ac power for more than 10 minutes x    Low main control room differential pressure for more than 10 minutes Tier 2 Material                                      6.4-12                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        397
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document The airborne fission product source term in the reactor containment following the postulated LOCA is assumed to leak from the containment and airborne fission products are assumed to result from spent fuel pool steaming. The concentration of radioactivity, which is assumed to surround the main control room, after the postulated accident, is evaluated as a function of the fission product decay constants, the containment leak rate, and the meteorological conditions assumed. The assessment of the amount of radioactivity within the main control room takes into consideration the radiological decay of fission products and the infiltration/exfiltration rates to and from the main control room pressure boundary.
A single active failure of a component of the main control room emergency habitability system or nuclear island nonradioactive ventilation system does not impair the capability of the systems to accomplish their intended functions. The Class 1E components of the main control room emergency habitability system are connected to independent Class 1E power supplies. Both the main control room emergency habitability system and the portions of the nuclear island nonradioactive ventilation system which isolates the main control room are designed to remain functional during an SSE or design-basis tornado.
In accordance with SECY-77-439 (Reference 13), a single passive failure of a component in the passive filtration line in the main control room emergency habitability system does not impair the capability of the system to accomplish its intended function. There is no source that could create line blockage in the VES line from the air bottles to the eductor. Thus potential blockage in the filtration line does not preclude breathable air from the emergency air storage tanks from being delivered to the main control room envelope for 72 hours during VES operation. Passive filtration using the main control room habitability system is not required to maintain operator dose rates below the acceptance limit of 5.0 rem TEDE 24 hours after the initiation of a design basis event. The dose rates for the following limiting cases were determined to demonstrate that passive filtration is not required 24 hours after the initiation of a design basis event. The following cases are evaluated since they involve releases that extend beyond 24 hours after the initiation of the event:
Large Break LOCA                                            4.4 rem TEDE Steam Line Break (Pre-existing iodine spike)                            1.2 rem TEDE (Accident-initiated iodine spike)                      2.0 rem TEDE For all events, the doses are within the dose acceptance limit of 5.0 rem TEDE. The details of analysis assumptions for modeling the doses to the main control room personnel are the same as those delineated in the LOCA dose analysis discussion in subsection 15.6.5.3 assuming a passive failure disables the passive filtration flow path after 24 hours. Potential blockage in the filtration line does not preclude breathable air from the emergency air storage tanks from being delivered to the main control room envelope for 72 hours during VES operation. An eductor bypass line with a flow control orifice provides the operators with the ability to ensure that the breathable air from the emergency air storage tanks is delivered to the MCR.
Tier 2 Material                                        6.4-13                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          398
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document 6.4.5      Inservice Inspection/Inservice Testing A program of preoperational and inservice testing requirements is implemented to confirm initial and continued system capability. The VES system is tested and inspected at appropriate intervals, as defined by the technical specifications. Emphasis is placed on tests and inspections of the safety-related portions of the habitability systems.
6.4.5.1    Preoperational Inspection and Testing Preoperational testing of the main control room emergency habitability system is performed to verify that the air flow rate of 65 +/- 5 scfm is sufficient to induce a flow rate of at least 600 cfm into the passive air filtration line and maintain pressurization of the main control room envelope of at least 1/8-inch water gauge with respect to the adjacent areas. The positive pressure within the main control room is confirmed via the differential pressure transmitters within the control room. The installed flow meters are utilized to verify the system flow rates. The preoperational testing also verifies that the VES pressure regulating valves are capable of maintaining the VES flow rate of 65 +/- 5 scfm over the operating range of expected valve inlet pressures. The pressurization of the control room limits the ingress of radioactivity, and the recirculation through the passive air filtration line maintains operator dose limits below regulatory limits. Air quality within the MCR environment is confirmed to be within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1 by analyzing air samples taken during the pressurization test.
The storage capacity of the compressed air storage tanks is verified to be in excess of 327,574 scf of compressed air. This amount of compressed air will assure 72 hours of air supply to the main control room.
Temperatures within the MCR are verified by analysis and/or testing to remain within the limits for reliable human performance (Reference 14) for a 72-hour period following a bounding scenario with MCR isolation and nonsafety-related ac power available (see Table 6.4-3 for heat loads) and a station blackout (battery-backed loads only). Preoperational testing of the main control room isolation valves in the nuclear island nonradioactive ventilation system is performed to verify the leaktightness of the valves.
Preoperational testing for main control room envelope habitability during VES operation will be conducted in accordance with ASTM E741 (Reference 4). Where possible, inleakage testing is performed in conjunction with the VES system level operability testing since the VES must be in operation to perform the inleakage testing.
Testing and inspection of the radiation monitors is discussed in Section 11.5. The other tests noted above are discussed in Chapter 14.
6.4.5.2    Inservice Testing Inservice testing of the main control room emergency habitability system and nuclear island nonradioactive ventilation system is conducted in accordance with the surveillance requirements specified in the technical specifications in Chapter 16.
Tier 2 Material                                        6.4-14                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          399
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                            AP1000 Design Control Document ASTM E741 testing of the main control room pressure boundary is conducted in accordance with the frequency specified in the technical specifications.
6.4.5.3    Air Quality Testing Connections are provided for sampling the air supplied from the compressed and instrument air system and for periodic sampling of the air stored in the storage tanks. Air samples of the compressed air storage tanks are taken quarterly and analyzed for acceptable air quality within the guidelines of Table 1 and Appendix C, Table C-1, of Reference 1 with a pressure dew point of 40&deg;F or lower at 3,400 psig or greater.
6.4.5.4    Main Control Room Envelope Habitability Testing for main control room envelope habitability during VES operation will be conducted in accordance with ASTM E741 (Reference 4).
The main control room envelope must undergo an analysis of inleakage into the control room envelope to determine the integrity of the control room envelope boundary during a design basis accident, hazardous chemical release, or smoke event. Baseline control room envelope habitability testing will be performed as discussed in subsection 6.4.5.1, followed by a self-assessment at three (3) years after successful baseline testing, and a periodic test at six (6) years in conjunction with other ASME inservice testing requirements. The self-assessment of the ability to maintain main control room habitability includes a review of procedures, boundaries, design changes, maintenance activities, safety analyses, and other related determinations.
If periodic testing is successful, then the assessment/testing cycle continues with a self-assessment three (3) years later and periodic testing three (3) years after the self-assessment.
If a periodic testing is unsuccessful, then a periodic test is required three (3) years after repair and successful re-testing, following the unsuccessful periodic testing, to ensure there is no accelerated degradation of the main control room boundary or discrepancies in control of the main control room habitability.
In addition to periodic tests, control room envelope testing will also be performed when changes are made to structures, systems, and components that could impact control room envelope integrity, including systems internal and external to the control room envelope. The tests must be commensurate with the types and degrees of modifications and repairs and the potential impact upon integrity. Additional control room envelope testing will also be performed if a new limiting condition or alignment arises for which no inleakage data is available. Test failure is considered to be inleakage in excess of the licensing basis value for the particular challenge to control room envelope integrity.
Where possible, inleakage testing is performed in conjunction with the VES system level operability testing since the VES must be in operation to perform the inleakage testing.
Tier 2 Material                                      6.4-15                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                            400
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                          AP1000 Design Control Document 6.4.6      Instrumentation Requirements The indications in the main control room used to monitor the main control room emergency habitability system and nuclear island nonradioactive ventilation system are listed in Table 6.4-2.
Instrumentation required for actuation of the main control room emergency habitability system and nuclear island nonradioactive ventilation system are discussed in subsection 7.3.1.
Details of the radiation monitors used to provide the main control room indication of actuation of the nuclear island nonradioactive ventilation system supplemental filtration mode of operation and actuation of main control room emergency habitability system operation are given in Section 11.5.
A description of initiating circuits, logic, periodic testing requirements, and redundancy of instrumentation relating to the habitability systems is provided in Section 7.3.
6.4.7      Combined License Information Combined License applicants referencing the AP1000 certified design are responsible for the amount and location of possible sources of hazardous chemicals in or near the plant and for seismic Category I Class 1E hazardous chemical monitoring, as required. Regulatory Guide 1.78 (Reference 5) addresses control room protection for hazardous chemicals and evaluation of offsite hazardous chemical releases (including the potential for hazardous chemical releases beyond 72 hours) in order to meet the requirements of TMI Action Plan Item III.D.3.4 and GDC 19.
Combined License applicants referencing the AP1000 certified design are responsible for verifying that procedures and training for control room envelope habitability are consistent with the intent of Generic Issue 83 (see Section 1.9).
The Combined License applicant testing frequency for the main control room envelope habitability is discussed in subsection 6.4.5.4.
6.4.8      References
: 1. Ventilation for Acceptable Indoor Air Quality, ASHRAE Standard 62 - 1989.
: 2. Human Engineering Design Guidelines, MIL-HDBK-759C, 31 July 1995.
: 3. Human Engineering, MIL-STD-1472E, 31 October 1996.
: 4. Standard Test Methods for Determining Air Change in a Single Zone by Means of a Tracer Gas Dilution, ASTM E741, 2000.
: 5. Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, Regulatory Guide 1.78, Revision 1, December 2001.
: 6. NUREG-0570, Toxic Vapor Concentrations in the Control Room Following a Postulated Accidental Release, June 1979.
Tier 2 Material                                      6.4-16                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        401
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document
: 7. Code on Nuclear Air and Gas Treatment, ASME/ANSI AG-1-1997.
: 8. Loss of Charcoal Adsorber Cells, IE Bulletin 80-03, 1980.
: 9. High-Efficiency, Particular, Air-Filter Units, UL-586, 1996.
: 10. Design, Testing, and Maintenance Criteria for Post Accident Engineered-Safety-Feature Atmosphere Cleanup System Air Filtration and Adsorption Units of Light-Water-Cooled Nuclear Power Plants, Regulatory Guide 1.52, Revision 3, 2001.
: 11. Test Performance of Air-Filter Units, UL-900, 1994.
: 12. AP1000 VES Air Filtration System Test Report, TR-SEE-III-09-03.
: 13. Single Failure Criterion, SECY-77-439.
: 14. NUREG-0700, Human-System Interface Design Review Guidelines, Revision 2, 2002.
Tier 2 Material                                  6.4-17                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                              402
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                              AP1000 Design Control Document Table 6.4-2 MAIN CONTROL ROOM HABITABILITY INDICATIONS AND ALARMS VES emergency air storage tank pressure (indication and low and low-low alarms)
VES MCR pressure boundary differential pressure (indication and high and low alarms)
VES air delivery line flowrate (indication and high and low alarms)
VES passive filtration flow rate (indication and high and low alarms)
VBS main control room supply air radiation level (High-1 and High-2 alarms)
VBS outside air intake smoke level (high alarm)
VBS isolation valve position VBS MCR pressure boundary differential pressure Tier 2 Material                                        6.4-19                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    403
 
DCP_NRC_003343                  Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                    AP1000 Design Control Document Table 6.4-3 LOSS OF AC POWER HEAT LOAD LIMITS Heat Load                Heat Load 0 to 24 Hours            24 to 72 Hours Room Name        Room Numbers                      (Btu/sec)                (Btu/sec)
MCR Envelope                12401                                                    3.95 23.5 (Hour 0 to 0.5) 14.5 (Hour 0.5 to 3.5) 4.75 (Hour 3.5 through 24)
I&C Rooms                12301, 12305                      8.854                      0 I&C Rooms                12302, 12304                      13.07                    4.22 dc Equipment Rooms      12201, 12205                      3.792                      0 (Hour 0 through 1) 2.465 (Hour 2 through 24) dc Equipment Rooms      12203, 12207                      5.84                    2.05 (Hour 0 through 1) 4.51 (Hour 2 through 24)
Tier 2 Material                              6.4-20                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                              404
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                        AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR 2.390d Figure 6.4-1 Main Control Room Envelope Tier 2 Material                                  6.4-21                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                405
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 6. Engineered Safety Features                                              AP1000 Design Control Document Figure 6.4-2 (Sheet 2 of 2)
Main Control Room Habitability System Piping and Instrumentation Diagram Tier 2 Material                                                    6.4-25                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                            406
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                            AP1000 Design Control Document Figure 7.2-1 (Sheet 3 of 21)
Functional Diagram Nuclear Startup Protection Tier 2 Material                                                      7.2-31                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                            407
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                            AP1000 Design Control Document Figure 7.2-1 (Sheet 13 of 21)
Functional Diagram Containment and Other Protection Tier 2 Material                                                      7.2-51                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                            408
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Condition 2 results from a coincidence of two of the four divisions of containment pressure above the High-2 setpoint. Manual reset is provided to block this actuation signal for passive containment cooling. Separate momentary controls are provided for resetting each division.
The functional logic relating to actuation of the passive containment cooling system is illustrated in Figure 7.2-1, sheet 13.
7.3.1.2.13 Startup Feedwater Isolation Signals to isolate the startup feedwater supply to the steam generators are generated from either of the following conditions:
: 1. Low cold leg temperature
: 2. High-2 steam generator narrow range water level
: 3. Manual actuation of main feedwater isolation (subsection 7.3.1.2.6)
: 4. High steam generator narrow range water level (coincident with P-4 permissive)
Any of these conditions isolates the startup feedwater supply by tripping the startup feedwater pumps and closing the startup feedwater isolation and control valves.
Condition 1 results from the coincidence of reactor coolant system cold leg temperature below the Low Tcold setpoint in any loop. Startup feedwater isolation on this condition may be manually blocked when the pressurizer pressure is below the P-11 setpoint. This function is automatically unblocked when the pressurizer pressure is above the P-11 setpoint.
Condition 2 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High-2 setpoint for either steam generator.
Condition 3 is discussed in other subsections as noted.
Condition 4 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High setpoint for either steam generator coincident with the P-4 permissive (reactor trip).
The functional logic relating to the isolation of the startup feedwater is illustrated in Figure 7.2-1, sheets 9 and 10.
7.3.1.2.14 Boron Dilution Block Signals to block boron dilution are generated from any of the following conditions:
: 1. Excessive increasing rate of source range flux doubling signal
: 2. Loss of ac power sources (low Class 1E battery charger input voltage)
: 3. Reactor trip (Table 7.3-2, interlock P-4)
In the event of an excessive increasing rate of source range flux doubling signal, the block of boron dilution is accomplished by closing the chemical and volume control system makeup isolation valves and closing the makeup pump suction valves to the demineralized water storage tanks. This signal also provides a non-safety trip of the makeup pumps. These actions Tier 2 Material                                      7.3-14                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                    409
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document terminate the supply of potentially unborated water to the reactor coolant system as quickly as possible.
In the event of a loss of ac power sources or a reactor trip (as indicated by P-4), the block of boron dilution is accomplished by closing the makeup pump suction valves to the demineralized water storage tanks and aligning the boric acid tank to the suction of the makeup pumps. This permits makeup as needed but ensures that it will be from a borated source that will not reduce the available shutdown margin in the reactor core.
Condition 1 is an average of the source range count rate, sampled at least N times over the most recent time period T1, compared to a similar average taken at time period T2 earlier. If the ratio of the current average count rate to the earlier average count rate is greater than a preset value, a partial trip is generated in the division. On a coincidence of excessively increasing source range neutron flux in two of the four divisions, boron dilution is blocked.
The Flux Doubling function is also delayed from actuating each time the source range detectors high voltage power is energized to prevent a spurious dilution block due to the short term instability of the processed source range values. This source range flux doubling signal may be manually blocked to permit plant startup and normal power operation when reactor coolant average temperature is above the P-8 setpoint. It is automatically reinstated when reactor power is decreased below the P-6 power level during shutdown or reactor coolant average temperature decreases below the P-8 setpoint.
Condition 2 results from the loss of ac power. A short, preset time delay is provided to prevent actuation upon momentary power fluctuations; however, actuation occurs before ac power is restored by the onsite diesel generators. The loss of all ac power is detected by undervoltage sensors that are connected to the input of each of the four Class 1E battery chargers. Two sensors are connected to each of the four battery charger inputs. The loss of ac power signal is based on the detection of an undervoltage condition by each of the two sensors connected to two of the four battery chargers. The two-out-of-four logic is based on an undervoltage to the battery chargers for divisions A or C coincident with an undervoltage to the battery chargers for divisions B or D.
The source range flux doubling function can also be manually blocked during shutdown conditions when below the P-8 setpoint. Prior to manually blocking the source range flux doubling function, the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent boron dilution.
Condition 3 results from a reactor trip as indicated by the P-4 interlock.
The functional logic relating to the boron dilution block is illustrated in Figure 7.2-1, sheets 3 and 15.
7.3.1.2.15 Chemical and Volume Control System Isolation A signal to close the isolation valves of the chemical and volume control system is generated from any of the following conditions:
Tier 2 Material                                    7.3-15                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    410
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document
: 1. High-2 pressurizer level
: 2. High-2 steam generator narrow range water level
: 3. Automatic or manual safeguards actuation signal (subsection 7.3.1.1) coincident with High-1 pressurizer level
: 4. High-2 containment radioactivity
: 5. Manual initiation
: 6. High steam generator narrow range water level (coincident with P-4 permissive)
: 7. Excessive increasing rate of source range flux doubling signal Condition 1 results from the coincidence of pressurizer level above the High-2 setpoint in any two of the four divisions. This function can be manually blocked when the reactor coolant system pressure is below the P-19 permissive setpoint to permit pressurizer water solid conditions with the plant cold and to permit pressurizer level makeup during plant cooldowns. This function is automatically unblocked when reactor coolant system pressure is above the P-19 setpoint.
Condition 2 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High-2 setpoint for either steam generator.
Condition 3 results from the coincidence of two of the four divisions of pressurizer level above the High-1 setpoint, coincident with an automatic or manual safeguards actuation.
Condition 4 results from the coincidence of containment radioactivity above the High-2 setpoint in any two of the four divisions.
Condition 5 consists of two momentary controls. This action also initiates auxiliary spray and letdown purification line isolation (subsection 7.3.1.2.18).
Condition 6 results from a coincidence of two of the four divisions of narrow range steam generator water level above the High setpoint for either steam generator coincident with the P-4 permissive (reactor trip).
Condition 7 is an average of the source range count rate, sampled at least N times over the most recent time period T1, compared to a similar average taken at time period T2 earlier. If the ratio of the current average count rate to the earlier average count rate is greater than a preset value, a partial trip is generated in the division. On a coincidence of excessively increasing source range neutron flux in two of the four divisions, chemical and volume control system makeup is isolated. The flux doubling function is also delayed from actuating each time the source range detectors high voltage power is energized to prevent a spurious chemical and volume control system makeup isolation due to the short-term instability of the processed source range values. This source range flux doubling signal may be manually blocked to permit plant startup and normal power operation when reactor coolant average Tier 2 Material                                    7.3-16                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    411
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document temperature is above the P-8 setpoint. It is automatically reinstated when reactor power is decreased below the P-6 power level during shutdown or reactor coolant average temperature decreases below the P-8 setpoint. The source range flux doubling function can also be manually blocked during shutdown conditions when below the P-8 setpoint. Prior to manually blocking the source range flux doubling function, the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution.
The functional logic relating to chemical and volume control system isolation is illustrated in Figure 7.2-1, sheets 6 and 11.
7.3.1.2.16 Steam Dump Block Signals to block steam dump (turbine bypass) are generated from either of the following conditions:
: 1. Low-2 reactor coolant system average temperature
: 2. Manual initiation Condition 1 results from a coincidence of two of the four divisions of reactor loop average temperature (Tavg) below the Low-2 setpoint. This blocks the opening of the steam dump valves. This signal also becomes an input to the steam dump interlock selector switch for unblocking the steam dump valves used for plant cooldown.
Condition 2 consists of three sets of controls. The first set of two controls selects whether the steam dump system has its normal manual and automatic operating modes available or is turned off. The second set of two controls enables or disables the operations of the Stage 1 cooldown steam dump valves if the reactor coolant average temperature (Tavg) is below the Low-2 setpoint. The third set of two controls enables or disables the operation of the Stage 2 cooldown steam dump valves.
The functional logic relating to the steam dump block is illustrated in Figure 7.2-1, sheet 10.
7.3.1.2.17 Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization Signals to initiate isolation of the main control room, to initiate the air supply, to open the main control room pressure relief isolation valves, and to de-energize nonessential main control room electrical loads are generated from any of the following conditions:
: 1. High-2 main control room air supply radioactivity level
: 2. Loss of ac power sources (low Class 1E battery charger input voltage)
: 3. Low main control room differential pressure
: 4. Manual initiation Condition 1 is the occurrence one of two main control room air supply radioactivity monitors detecting the iodine or particulate radioactivity level above the High-2 setpoint.
Tier 2 Material                                      7.3-17                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      412
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Condition 2 results from the loss of normal control room ventilation due to a loss of all ac power sources. A preset time delay is provided to permit the restoration of ventilation and ac power from the offsite sources or from the onsite diesel generators before initiation. The loss of all ac power is detected by undervoltage sensors that are connected to the input of each of the four Class 1E battery chargers. Two sensors are connected to each of the four battery charger inputs. The loss of ac power signal is based on the detection of an undervoltage condition by each of the two sensors connected to two of the four battery chargers. The two-out-of-four logic is based on an undervoltage to the battery chargers for divisions A or C coincident with an undervoltage to the battery chargers for divisions B or D.
Condition 3 results from the loss of main control room differential pressure as detected by the pressure boundary differential sensors. One out of two logic is based on main control room differential pressure below the Low setpoint for greater than 10 minutes.
In addition, the loss of all ac power sources coincident with main control room isolation will de-energize the main control room radiation monitors in order to conserve the battery capacity.
Condition 4 consists of two momentary controls. Manual actuation of either of the two controls will result in main control room isolation, air supply initiation, and electrical load de-energization.
The functional logic relating to main control room isolation, air supply initiation, and electrical load de-energization is illustrated in Figure 7.2-1, Sheet 13.
7.3.1.2.18 Auxiliary Spray and Letdown Purification Line Isolation A signal to isolate the auxiliary spray and letdown purification lines is generated upon the coincidence of pressurizer level below the Low-1 setpoint in any two of four divisions. This helps to maintain reactor coolant system inventory. This function can be manually blocked when the pressurizer water level is below the P-12 setpoint. This function is automatically unblocked when the pressurizer water level is above the P-12 setpoint. The automatic auxiliary spray isolation signal can be reset by the operator, after actuation of the auxiliary spray isolation valve, by using the reset control. This will allow the operators to use the auxiliary spray to rapidly depressurize the reactor coolant system. The operator can also manually initiate auxiliary spray isolation. The functional logic relating to this is illustrated in Figure 7.2-1, sheet 12.
The auxiliary spray and letdown purification line isolation signal is also generated upon manual actuation of chemical and volume control system isolation (subsection 7.3.1.2.15).
7.3.1.2.19 Containment Air Filtration System Isolation A signal to isolate the containment air filtration system is generated from any of the following conditions:
: 1. Automatic or manual safeguards actuation signal (subsection 7.3.1.1)
Tier 2 Material                                      7.3-18                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        413
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document 7.3.1.4    Bypasses of Engineered Safety Features Actuation The channels used in engineered safety features actuation that can be manually bypassed are indicated in Table 7.3-1. A description of this bypass capability is provided in subsection 7.1.2.9. The actuation logic is not bypassed for test. During tests, the actuation logic is fully tested by blocking the actuation logic output before it results in component actuation.
7.3.1.5    Design Basis for Engineered Safety Features Actuation The following subsections provide the design bases information for engineered safety features actuation, including the information required by Section 4 of IEEE 603-1991.
Engineered safety features are initiated by the protection and safety monitoring system. Those design bases relating to the equipment that initiates and accomplishes engineered safety features are given in WCAP-15776 (Reference 1). The design bases presented here concern the variables monitored for engineered safety features actuation and the minimum performance requirements in generating the actuation signals.
7.3.1.5.1  Design Basis: Generating Station Conditions Requiring Engineered Safety Features Actuation (Paragraph 4.1 of IEEE 603-1991)
The generating station conditions requiring protective action are identified in Table 15.0-6, which summarizes the engineered safety features as they relate to the Condition II, III, or IV events analyzed in Chapter 15.
7.3.1.5.2  Design Basis: Variables, Ranges, Accuracies, and Typical Response Times Used in Engineered Safety Features Actuation (Paragraphs 4.1, 4.2, and 4.4 of IEEE 603-1991)
The variables monitored for engineered safety features actuation are:
x    Pressurizer pressure x    Pressurizer water level x    Reactor coolant temperature (Thot and Tcold) in each loop x    Containment pressure x    Containment radioactivity level x    Steam line pressure in each steam line x    Water level in each steam generator (narrow and wide ranges) x    Source range neutron flux x    Core makeup tank level x    Reactor coolant level in each of the two hot legs x    Loss of ac power sources (low Class 1E battery charger input voltage) x    In-containment refueling water storage tank level x    Main control room supply air radioactivity level x    Main control room differential pressure x    Reactor coolant pump bearing water temperature x    Startup feedwater flow x    Spent fuel pool level Tier 2 Material                                    7.3-22                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    414
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Table 7.3-1 (Sheet 6 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Division/          Actuation Actuation Signal              Controls              Logic              Permissives and Interlocks
: 12. Passive Residual Heat Removal (Figure 7.2-1, Sheet 8)
: a. Manual initiation              2 controls        1/2 controls                      None
: b. Low narrow range steam          4/steam          2/4-BYP1 in                      None generator water level          generator        either steam coincident with                                  generator Low startup feedwater flow    2/feedwater        1/2 in either                    None line        feedwater line
: c. Low steam generator wide        4/steam          2/4-BYP1 in                      None range water level              generator        either steam generator
: d. Core makeup tank injection                            (See Items 6a through 6e)
: e. Automatic reactor coolant                              (See items 3a through 3c) system depressurization (first stage)
: f. High-3 pressurizer level            4            2/4-BYP1        Manual block permitted below P-19 Automatically unblocked above P-19
: 13. Block of Boron Dilution (Figure 7.2-1, Sheets 3 and 15)
: a. Flux doubling calculation            4            2/4-BYP1          Manual block permitted above P-8 Automatically unblocked below P-6 or below P-8 Manual block permitted below P-8; demineralized water system isolation valves signaled closed when blocked below P-8
: b. Undervoltage to Class 1E      2/charger      2/2 per charger                    None battery chargers(8)                                and 2/4 chargers5
: c. Reactor trip (P-4)            1/division            2/4                          None
: 14. Chemical Volume Control System Isolation (See Figure 7.2-1, Sheets 6 and 11)
: a. High-2 pressurizer water            4            2/4-BYP1        Automatically unblocked above P-19 level                                                              Manual block permitted below P-19 Tier 2 Material                                      7.3-32                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          415
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                      AP1000 Design Control Document Table 7.3-1 (Sheet 7 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Divisions/        Actuation Actuation Signal          Controls            Logic              Permissives and Interlocks 1
: b. High-2 steam generator        4/steam          2/4-BYP in                        None narrow range level          generator        either steam generator
: c. Automatic or manual                                  (See items 1a through 1e) safeguards actuation signal coincident with High-1 pressurizer water          4            2/4-BYP1                          None level
: d. High-2 containment                4            2/4-BYP1                          None radioactivity
: e. Manual initiation            2 controls        1/2 controls                      None 1
: f. Flux doubling calculation        4            2/4-BYP            Manual block permitted above P- 8 Automatically unblocked below P-6 or below P-8 Manual block permitted below P-8; demineralized water system isolation valves signaled closed when blocked below P-8
: g. High steam generator          4/steam          2/4-BYP1 in                        None narrow range level          generator        either steam coincident with                                generator Reactor trip (P-4)          1/division            2/4                          None (8)
: 15. Steam Dump Block (Figure 7.2-1, Sheet 10)
: a. Low reactor coolant            2/loop          2/4-BYP1                          None temperature (Low-2 Tavg)
: b. Mode control                2 controls        1/division                        None
: c. Manual stage 1 cooldown      2 controls        1/division                        None control
: d. Manual stage 2 cooldown      2 controls        1/division                        None control
: 16. Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization (Figure 7.2-1, Sheet 13)
Tier 2 Material                                    7.3-33                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                        416
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Table 7.3-1 (Sheet 8 of 9)
ENGINEERED SAFETY FEATURES ACTUATION SIGNALS No. of Divisions/        Actuation Actuation Signal              Controls            Logic              Permissives and Interlocks
: a. High-2 main control room            2                1/2                            None supply air iodine or particulate radiation
: b. Extended undervoltage to        2/charger      2/2 per charger                      None Class 1E battery chargers(8)                        and 2/4 chargers5
: c. Extended Low main control          2                1/2                            None room differential pressure
: d. Manual initiation(8)            2 controls      1/2 controls                        None
: 17. Auxiliary Spray and Purification Line Isolation (Figure 7.2-1, Sheet 12)
: a. Low-1 pressurizer level            4              2/4-BYP1          Manual block permitted below P-12 Automatically unblocked above P-12
: b. Manual initiation of                                        (See item 14e) chemical and volume control system isolation
: c. Manual initiation of                1                1/1                            None auxiliary spray isolation
: 18. Containment Air Filtration System Isolation (Figure 7.2-1, Sheets 11 and 13)
: a. Containment isolation                                  (See items 2a through 2c)
: b. High-1 containment                  4              2/4-BYP1                          None radioactivity
: c. N/A                                2                N/A          For containment vacuum relief valves only - close on inside containment purge isolation valve not closed
: 19. Normal Residual Heat Removal System Isolation (Figure 7.2-1, Sheets 13 and 18)
: a. Automatic or manual                                    (See items 1a through 1e) safeguards actuation signal
: b. High-2 containment                  4              2/4-BYP1          Manual block permitted below P-11 radioactivity                                                      Automatically unblocked above P-11
: c. Manual initiation              4 controls      2/4 controls3                      None
: 20. Refueling Cavity Isolation (Figure 7.2-1, Sheet 13)
: a. Low spent fuel pool level          3                2/3                            None
: 21. Open In-Containment Refueling Water Storage Tank (IRWST) Injection Line Valves Tier 2 Material                                      7.3-34                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                            417
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                          AP1000 Design Control Document Table 7.3-2 (Sheet 1 of 4)
INTERLOCKS FOR ENGINEERED SAFETY FEATURES ACTUATION SYSTEM Designation                      Derivation                                          Function P-3        Reactor trip breaker open                        Permits manual reset of safeguards actuation signal to block automatic safeguards actuation P-3        Reactor trip breakers closed                    Automatically resets the manual block of automatic safeguards actuation P-4        Reactor trip initiated or reactor trip          (a) Isolates main feedwater if coincident with breakers open                                        low reactor coolant temperature (b) Trips turbine (c) Blocks boron dilution P-4        No reactor trip initiated and reactor trip      Removes demand for isolation of main breakers closed                                  feedwater, turbine trip and boron dilution block P-6        Intermediate range neutron flux channels        None above setpoint P-6        Intermediate range neutron flux channels        Automatically resets the manual block of flux below setpoint                                  doubling actuation of the boron dilution block P-8        Reactor coolant average temperature above        Permits manual block of flux doubling setpoint                                        actuation of the boron dilution block P-8        Reactor coolant average temperature              (a) Automatically resets the manual block of below setpoint                                        flux doubling actuation of the boron dilution block (b) Permits manual block of flux doubling actuation of the boron dilution block; signals the demineralized water system isolation valves closed if flux doubling actuation of the boron dilution block is blocked below P-8 P-11        Pressurizer pressure below setpoint              (a) Permits manual block of safeguards actuation on low pressurizer pressure, low compensated steam line pressure, or low reactor coolant inlet temperature (b) Permits manual block of steam line isolation on low reactor coolant inlet temperature Tier 2 Material                                        7.3-37                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                              418
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                          AP1000 Design Control Document Table 7.3-3 (Sheet 2 of 2)
SYSTEM-LEVEL MANUAL INPUT TO THE ENGINEERED SAFETY FEATURES ACTUATION SYSTEM To        Figure 7.2-1 Manual Control                                    Divisions      Sheet Manual passive containment cooling actuation #1                              A  B    C  D      13 Manual passive containment cooling actuation #2                              A  B    C  D      13 Manual passive containment isolation actuation #1                            A  B    C  D      13 Manual passive containment isolation actuation #2                            A  B    C  D      13 Manual depressurization system stages 1, 2, and 3 actuation #1 & #2          A  B    C  D      15 Manual depressurization system stages 1, 2, and 3 actuation #3 & #4          A  B    C  D      15 Manual depressurization system stage 4 actuation #1 & #2                    A  B    C  D      15 Manual depressurization system stage 4 actuation #3 & #4                    A  B    C  D      15 Manual IRWST injection actuation #1 & #2                                    A  B    C  D      16 Manual IRWST injection actuation #3 & #4                                    A  B    C  D      16 Manual containment recirculation actuation #1 & #2                          A  B    C  D      16 Manual containment recirculation actuation #3 & #4                          A  B    C  D      16 Manual main control room isolation, air supply initiation, and electrical    A  B    C  D      13 load de-energization #1 Manual main control room isolation, air supply initiation, and electrical    A  B    C  D      13 load de-energization #2 RCS pressure CVS/PRHR block control #1                                      A                    6 RCS pressure CVS/PRHR block control #2                                          B                6 RCS pressure CVS/PRHR block control #3                                                C          6 RCS pressure CVS/PRHR block control #4                                                    D      6 Normal residual heat removal system isolation safeguards block control #1    A                  13 Normal residual heat removal system isolation safeguards block control #2        B              13 Boron dilution block control #1                                              A                    3 Boron dilution block control #2                                                  B                3 Boron dilution block control #3                                                      C          3 Boron dilution block control #4                                                          D      3 Manual RNS isolation #1 & #3                                                A  B        D      18 Manual RNS isolation #2 & #4                                                A  B        D      18 CVS letdown isolation block control #1                                      A                  16 CVS letdown isolation block control #2                                                    D      16 Manual containment vacuum relief actuation #1                                A        C        19 Manual containment vacuum relief actuation #2                                A        C        19 Tier 2 Material                                        7.3-43                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    419
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document Table 7.3-4 (Sheet 2 of 2)
ENGINEERED SAFETY FEATURES ACTUATION, VARIABLES, LIMITS, RANGES, AND ACCURACIES (NOMINAL)
Typical Response Variables                Range of Variables          Typical Accuracy(1)            Time (Sec)(2)
Pressurizer water level                0 to 100% of                +/-10% of span                      1.0 cylindrical portion of pressurizer Startup feedwater flow                  0 to 600 gpm                +/-7% of span                      1.0 Neutron flux (flux doubling            1 to 106 c/sec              +/-30% of span                    1.0(3) calculation)
Control room supply air              10-12 to 10-2  Ci/cc        +/-50% of setpoint                    20 radiation level Control room differential          +1.00 to -1.00 in. w.g.          +3% of span                      1.0 pressure Containment radioactivity              100 to 107 R/hr            +/-50% of setpoint                    20 Notes:
: 1. Measurement uncertainty typical of actual applications. Harsh environments allowance has been included where applicable.
: 2. Delay from the time that the process variable exceeds the setpoint until the time that an output is provided to the actuated device.
: 3. Response time depends on flux doubling calculation.
Tier 2 Material                                        7.3-45                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                              420
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document 7.4        Systems Required for Safe Shutdown Systems to establish safe shutdown conditions perform two basic functions. First, they provide the necessary reactivity control to maintain the core in a subcritical condition. Boration capability is provided to compensate for xenon decay and to maintain the required core shutdown margin.
Second, these systems must provide residual heat removal capability to maintain adequate core cooling.
The designation of systems required for safe shutdown depends on identifying those systems that provide the following capabilities for maintaining a safe shutdown:
x    Decay heat removal x    Reactor coolant system inventory control x    Reactor coolant system pressure control x    Reactivity control There are two different safe shutdown conditions that are expected following a transient or accident condition. Short-term safe shutdown refers to the plant conditions from the start of an event until about 36 hours later. Long-term safe shutdown refers to the plant conditions after this 36-hour period.
The short-term safe shutdown conditions include maintaining the reactor subcritical, the reactor coolant average temperature less than or equal to no load temperature, and adequate coolant inventory and core cooling. These shutdown conditions shall be achieved following any of the design basis events using safety-related equipment. The specific safe shutdown condition achieved is a function of the particular accident sequence.
The long-term safe shutdown conditions are the same as the short-term conditions except that the core average temperature shall be less than 420&deg;F. This long-term condition must be achieved within 36 hours following a non-LOCA event using the passive residual heat removal heat exchanger as shown in Appendix 19E. These safe shutdown conditions can be maintained by the passive residual heat removal heat exchanger for greater than 14 days based on a non-bounding, conservative analysis that only credits using safety-related equipment. In addition, these safe shutdown conditions can be maintained indefinitely using the automatic depressurization system and passive injection/recirculation as discussed in Subsection 7.4.1.1.
There are no systems specifically and solely dedicated as safe shutdown systems. However, there are a number of plant systems that are available to establish and maintain safe shutdown conditions. Normally, in the event of a turbine or reactor trip, nonsafety-related plant systems automatically function to place the plant in short-term safe shutdown, as described in subsection 7.4.1.2. During the short-term safe shutdown condition, an adequate heat sink is provided to remove reactor core residual heat and boration control is available. Redundancy of systems and components is provided to enable continued maintenance of the short-term safe shutdown condition. Additional redundant nonsafety-related systems are normally available to manually perform a plant depressurization and cooldown.
The engineered safety systems are designed to establish and maintain safe shutdown conditions for the plant. Nonsafety-related systems are not required for safe shutdown of the plant.
Tier 2 Material                                      7.4-1                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        421
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document 7.4.1      Safe Shutdown 7.4.1.1    Safe Shutdown Using Safety-Related Systems The following describes the process that establishes safe shutdown conditions for the plant, based on a conservative, non-bounding analysis using the safety-related systems, and no operator action. The reactor coolant system is assumed to be intact for this discussion of safe shutdown.
Since this discussion only considers the use of safety-related systems, offsite electrical power sources are assumed to be lost at the start of the event. This results in a loss of the reactor coolant pumps. Even though the reactor coolant pumps are tripped during the initiation of certain engineered safety system actuation, it is assumed that no engineered safety system actuation signal is generated for this initiating event. With loss of the reactor coolant pumps, reactor coolant system natural circulation flow initiates and transfers core heat to the steam generators.
Since feedwater flow is lost, the existing steam generator water inventory provides initial decay heat removal capability.
The initial loss of main ac power results in the Class 1E dc batteries automatically supplying power to the Class 1E dc power distribution network and the four Class 1E 120 Vac instrumentation divisions via the inverters.
The initial response of the passive safety systems is to actuate the passive residual heat removal heat exchanger due to low steam generator water level. The passive residual heat removal heat exchanger removes decay heat from the core by transferring this heat to the in-containment refueling water storage tank.
The passive residual heat removal heat exchanger removes core decay heat, cooling the reactor coolant system. As reactor coolant system cooldown continues, the reactor coolant system pressure decreases due to contraction of the reactor coolant system inventory since the pressurizer heaters are de-energized. An engineered safety system actuation signal occurs when reactor coolant system pressure decreases below a setpoint. This actuates the core makeup tanks, if they had not been previously actuated due to low pressurizer level. The core makeup tanks provide borated water injection to the reactor coolant system.
The engineered safety system actuation signal generated on low pressurizer pressure also actuates containment isolation. This prevents loss of water inventory from containment and permits operation of the passive residual heat removal heat exchanger and the in-containment refueling water storage tank for greater than 14 days.
The in-containment refueling water storage tank starts to boil about one to two hours after passive residual heat removal operation is initiated. Once boiling occurs, the in-containment refueling water storage tank begins steaming to containment, transferring heat to the air flowing on the outside of the containment shell. As steaming to containment continues, containment pressure slowly increases. As containment pressure slowly increases, an engineered safety system actuation signal is generated on containment high pressure, resulting in the initiation of passive containment cooling. This provides water flow on the outside of the containment shell to improve the heat removal performance from containment through evaporative cooling to the outside air.
Tier 2 Material                                      7.4-3                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                            422
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                          AP1000 Design Control Document A gutter located at the operating deck elevation collects condensate from the inside of the containment shell. Valves located in drain lines from the gutter to the containment waste sump close on a passive residual heat removal heat exchanger actuation signal. This action diverts the condensate to the in-containment refueling water storage tank. The system provides core decay heat removal in this configuration for greater than 14 days with a limited increase in the containment water level.
Once the reactor coolant system and the safety systems are in this configuration, the plant is in a safe, stable shutdown condition. The reactor coolant system temperatures and pressures continue to slowly decrease. The passive residual heat removal heat exchanger has the capacity to maintain a safe, stable reactor coolant system condition during a design basis event for at least 72 hours in a closed-loop mode of operation. A non-bounding, conservative analysis of extended operation in this mode shows the passive residual heat removal heat exchanger cools the reactor coolant system to 420&deg;F in 36 hours.
Operation in this configuration may be limited in time duration by reactor coolant system leakage. The core makeup tanks can only supply a limited amount of makeup in the event there is reactor coolant system leakage. Eventually the volume of the water in the core makeup tanks will decrease to the first stage automatic depressurization setpoint. The time to reach this setpoint depends upon the reactor coolant system leak rate and the reactor coolant cooldown.
The 24-hour Class 1E dc batteries that power the automatic depressurization system valves provide power for at least 24 hours. There is a timer that measures the time that ac power sources are unavailable. This timer provides for automatic actuation of the automatic depressurization system before the 24-hour Class 1E dc batteries are discharged. The emergency response guidelines direct the operator to assess the need for automatic depressurization before the timer completes its count (approximately 22 hours). The operator assessment considers core makeup tank levels, reactor coolant system hot leg level, temperature, and pressure. If automatic depressurization is not needed, the operator is directed to de-energize all loads on the 24-hour Class 1E dc batteries. This action preserves the capability for the operator to initiate automatic depressurization at a later time based on assessment of the same parameters.
The automatic depressurization system can be manually initiated by the operator at any time, but no operator action is needed to provide safe shutdown conditions. Once the automatic depressurization system sequence initiates, the plant automatically transitions to lower pressure and temperature conditions that establish and maintain long-term safe shutdown of the plant.
When the automatic depressurization system is actuated, the first stage depressurization valves open and the reactor coolant system depressurization starts. The second and third stage depressurization valves open in sequence, based on automatic timers that are started upon the actuation of the first stage depressurization valves. As reactor coolant inventory continues to be lost, the core makeup tanks continue to inject. If the volume of the water in the core makeup tanks decrease to the fourth stage automatic depressurization setpoint, the fourth stage depressurization valves open. The water and steam vented from the reactor coolant system initially flows into the in-containment refueling water storage tank and overflows into the refueling canal. Eventually this overflows into the reactor vessel cavity, where any moisture from the fourth stage automatic depressurization system valves also collects from discharge in the loop Tier 2 Material                                      7.4-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        423
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                                  AP1000 Design Control Document Table 7.5-1 (Sheet 11 of 12)
POST-ACCIDENT MONITORING SYSTEM Qualification          Number of            QDPS Range/      Type/                              Instruments  Power  Indication Variable        Status    Category Environmental      Seismic  Required  Supply  (Note 2)  Remarks MCR air delivery      Open/    D2              Mild            Yes      1/valve    1E      Yes isolation valve status Closed                                            (Note 7)
MCR electrical load    Open/    D2              Mild            Yes    1/contactor  1E      Yes status                Closed Instrument air        0-125    F3            None            None        1      Non-1E    No header pressure        psig Service water flow    0-10,000 F3            None            None      1/pump    Non-1E    No gpm Service water pump    On/Off  F3            None            None      1/pump    Non-1E    No status Service water pump    Open/    F3            None            None      1/valve  Non-1E    No discharge valve        Closed status Service water pump    50-      F3            None            None      1/pump    Non-1E    No discharge              150&deg;F temperature Main control room      Note 5  E3, F3          Mild            Yes        2        1E      No supply air radiation                                                    (Note 9)
Plant vent air flow    0-110%  E2              Mild            None        1      Non-1E    No design flow Turbine island vent    10  C2, E2          Mild            None        1      Non-1E    No discharge radiation    10+5 level                  Ci/cc Steam generator        10  C2              Mild            None        1      Non-1E    No blowdown discharge    10-1 radiation              Ci/cc Steam generator        10  C2              Mild            None        1      Non-1E    No blowdown brine        10-1 radiation level        Ci/cc Tier 2 Material                                              7.5-23                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                            424
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                AP1000 Design Control Document Table 7.5-7 (Sheet 4 of 4)
 
==SUMMARY==
OF TYPE D VARIABLES System                                Variable                  Type/Category Containment Cooling                Containment temperature                            D2 PCS water storage tank series isolation valve      D2 status (MOV)
PCS water storage tank isolation valve status      D2 (non-MOV)
Passive containment cooling water flow            D2 PCS storage tank water level                      D2 HVAC System Status                  MCR return air isolation valve status              D2 MCR toilet exhaust isolation valve status          D2 MCR supply air isolation valve status              D2 MCR air delivery isolation valve status            D2 MCR pressure relief isolation valve status        D2 MCR electrical load status                        D2 MCR air storage bottle pressure                    D2 MCR differential pressure                          D2 MCR air delivery flowrate                          D2 Main Steam                          Turbine stop valve status                          D2 Turbine control valve status                      D2 Condenser steam dump valve status                  D2 Tier 2 Material                              7.5-33                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                            425
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document APPENDIX 7A INSTRUMENTATION AND CONTROLS LICENSING BASIS DOCUMENT CHANGES Note: Revised text within the licensing basis documents is identified in this appendix with strikethrough font for deleted text, underlined font for new text, and three asterisks ( * * * )
where text is omitted for clarity.
Proprietary Information is bracketed and labeled with lower case alphabetic code letters outside the brackets to indicate the criteria or basis on which the proprietary determination was made.
7A.1- 7A.3 Not Used 7A.4        WCAP-16438-P and WCAP-16438-NP, FMEA of AP1000TM Protection and Safety Monitoring System The UFSAR incorporates by reference Tier 2 document WCAP-16438-P and WCAP-16438-NP, FMEA of AP1000TM Protection and Safety Monitoring System. See Table 1.6-1. The incorporated by reference material is modified to include the following revisions and additions as indicated by strikethroughs and underlines:
x    Revise Appendix A, Failure Impact on Plant, as per the following directions:
a,c Tier 2 Material                                      7A-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      426
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 7. Instrumentation and Controls                                        AP1000 Design Control Document 7A.5-7A.7 Not Used 7A.8        WCAP-16675-P and WCAP-16675-NP, AP1000 Protection and Safety Monitoring System Architecture Technical Report The UFSAR incorporates by reference Tier 2 document WCAP-16675-P and WCAP-16675-NP, AP1000 Protection and Safety Monitoring System Architecture Technical Report. See Table 1.6-
: 1. The incorporated by reference material is modified to include the following revisions and additions as indicated by strikethroughs and underlines.
x    Revise Section 1.2 Engineered Safety Features Actuation System Functions bullet 18 to say:
: 18. Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization as described in Reference 9.
Tier 2 Material                                    7A-2                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                  427
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document 9.2.5.4    Safety Evaluation The potable water system has no safety-related functions other than to prevent in-leakage into the main control room envelope during VES operation. A loop seal in the safety-related PWS piping that penetrates the main control room envelope boundary prevents in-leakage into the main control room envelope.
9.2.5.5    Tests and Inspections The potable water system is hydrostatically tested for leak-tightness in accordance with the Uniform Plumbing Code. Inspection of the system is in compliance with the Uniform Plumbing Code or governing codes having jurisdiction. The system is then disinfected, flushed with potable water, and placed in service. The presence of residual chlorine can be confirmed through laboratory tests of samples at sampling points as required. Tests for microbiological and bacteria presence in potable water are conducted periodically.
9.2.5.6    Instrumentation Applications Thermostats, high-temperature limit controls, and temperature indication are installed on the potable water system hot water tank. Thermostats and high-temperature limit controls are installed on the inline water heaters. Pressure regulators are employed in those parts of the distribution system where pressure restrictions are imposed.
9.2.6      Sanitary Drainage System The sanitary drainage system (SDS) is designed to collect the site sanitary waste for treatment, dilution and discharge.
9.2.6.1    Design Basis 9.2.6.1.1  Safety Design Basis The sanitary drainage system isolates the SDS vent penetration in the main control room boundary on High-2 particulate or iodine concentrations in the main control room air supply, extended loss of main control room differential pressure, or on extended loss of ac power to support operation of the main control room emergency habitability system as described in Section 6.4. The SDS vent line that penetrates the main control room envelope is safety related and designed as seismic Category I to provide isolation of the main control room envelope from the surrounding areas and outside environment in the event of a design basis accident. An additional penetration from the SDS into the main control room envelope is maintained leak tight using a loop seal in the safety-related seismic Category I piping.
9.2.6.1.2  Power Generation Design Basis The sanitary drainage system within the scope of the plant covered by Design Certification is designed to accommodate 25 gallons/person/day for up to 500 persons during a 24-hour period.
Tier 2 Material                                      9.2-28                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      428
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document 9.3        Process Auxiliaries 9.3.1      Compressed and Instrument Air System The compressed and instrument air system (CAS) consists of three subsystems; instrument air, service air, and high-pressure air. Instrument air supplies compressed air for air-operated valves and dampers. Service air is supplied at outlets throughout the plant to power air-operated tools and is used as a motive force for air-powered pumps. The service air subsystem is also utilized as a supply source for breathing air. Individually packaged air purification equipment is used to produce breathing quality air for protection against airborne contamination. The high-pressure air subsystem supplies air to the main control room emergency habitability system (VES), the generator breaker package, and fire fighting apparatus recharge station. The high-pressure air subsystem also provides a connection for refilling the VES storage tanks from an offsite source.
Major components of the compressed and instrument air system are located in the turbine building.
9.3.1.1    Design Basis 9.3.1.1.1  Safety Design Basis The compressed and instrument air system serves no safety-related function other than containment isolation and therefore has no nuclear safety design basis except for containment isolation. See subsection 6.2.3 for the containment isolation system.
9.3.1.1.2  Power Generation Design Basis The instrument air subsystem provides filtered, dried, and oil-free air for air-operated valves and dampers. The instrument air subsystem consists of two compressors and associated support equipment and controls that are powered from switchgear backed by the nonsafety-related onsite standby diesel generators as an investment protection category load. The subsystem provides high quality instrument air as specified in the ANSI/ISA S7.3 standard (Reference 9.3.8.1).
The service air subsystem provides filtered, dried, and oil-free compressed air for service outlets located throughout the plant. The service air subsystem consists of two compressors and their associated support equipment and controls. Plant breathing air requirements are satisfied by using the service air subsystem as a supply source. Individually packaged air purification equipment is used to improve the service air to Quality Verification Level D breathing air as defined in ANSI/CGA G-7.1.
The high-pressure air subsystem consists of one compressor, its associated air purification system and controls, and a high-pressure receiver. It provides clean, oil-free, high-pressure air to recharge the main control room emergency habitability system cylinders, refill the individual fire fighting breathing air bottles, and recharge the generator breaker reservoir. Quality Verification Level E air as defined in ANSI/CGA G-7.1 , with a pressure dew point of 40&deg;F or lower at 3,400 psig or greater, is produced by this subsystem. See Section 6.4 for a description of the main control room habitability system.
APP-GW-GL-705 Tier 2 MaterialRev. 0                                9.3-1                                            Revision429 19
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document purification flow during normal plant operation and to have a minimum design life of one core cycle.
The construction of the mixed bed demineralizers is identical to that of the cation bed demineralizer.
9.3.6.3.5  Chemical and Volume Control System Filters Makeup Filter One makeup filter is provided to collect particulates in the makeup stream, such as boric acid storage tank sediment. The filter is designed to accept maximum makeup flow. The unit is constructed of austenitic stainless steel with a disposable synthetic cartridge and is designed for reactor coolant system hydrostatic test pressure.
Reactor Coolant Filters Two reactor coolant filters are provided. The filters are designed to collect resin fines and particulate matter from the purification stream. Each filter is designed to accept maximum purification flow.
The units are constructed of austenitic stainless steel with disposable synthetic cartridges and are designed for reactor coolant system pressure.
9.3.6.3.6  Chemical and Volume Control System Letdown Orifice One letdown orifice is provided in the letdown line, where fluid leaves the high-pressure purification loop before it exits containment. The orifice limits the letdown flow to a rate compatible with the chemical and volume control system equipment and also plant heatup and dilution requirements.
The orifice consists of an assembly that provides for permanent pressure loss without recovery and is made of austenitic stainless steel.
A manual bypass line is provided around the orifice to allow shutdown purification and degassing when the reactor coolant system pressure is low.
9.3.6.3.7  Chemical and Volume Control System Valves The chemical and volume control system valves are stainless steel for compatibility with the borated reactor coolant. Isolation valves are provided at connections to the reactor coolant system.
Lines penetrating the reactor containment meet the containment isolation criteria described in subsection 6.2.3.
Purification Stop Valves These normally open, motor-operated valves are located inside containment and close automatically on a low pressurizer level signal from the protection and safety monitoring system to Tier 2 Material                                      9.3-31                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        430
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document boundary. This valve is operated from the main control room and the remote shutdown workstation.
Makeup Line Containment Isolation Valves These normally open, motor-operated globe valves provide containment isolation of the chemical and volume control system makeup line and automatically close on a high-2 pressurizer level, high steam generator level, or high-2 containment radiation signal from the protection and safety monitoring system. The valves close on a source range flux doubling signal to terminate possible unplanned boron dilution events. The valves also close on a safeguards actuation signal coincident with high-1 pressurizer level. This allows the chemical and volume control system to continue providing reactor coolant system makeup flow, if the makeup pumps are operating following a safeguards actuation signal. These valves are also controlled by the reactor makeup control system and close when makeup to other systems is provided. Manual control is provided in the main control room and at the remote shutdown workstation.
Hydrogen Addition Containment Isolation Valve This normally open, fail closed, air-operated globe valve is located outside containment in the hydrogen addition line. The valve automatically closes on a containment isolation signal from the protection and safety monitoring system. Manual control is provided in the main control room and at the remote shutdown workstation.
Demineralized Water System Isolation Valves These normally open, air-operated butterfly valves are located outside containment in the line from the demineralized water storage and transfer system. These valves close on a signal from the protection and safety monitoring system derived by either a reactor trip signal, a source range flux doubling signal, low input voltage (loss of ac power) to the 1E dc and uninterruptable power supply system battery chargers, or a safety injection signal, isolating the demineralized water source to prevent inadvertent boron dilution events. The protection and safety monitoring system also issues a close signal to these valves when below the P-8 setpoint when the source range flux doubling signal is blocked to prevent inadvertent boron dilution. Manual control for these valves is provided from the main control room and at the remote shutdown workstation.
Makeup Pump Suction Header Valve This air-operated, three-way valve is automatically controlled by the makeup control system to provide the desired boric acid concentration of makeup to the reactor coolant system (boric acid, demineralized water, or blend based on the desired reactor coolant system boron concentration).
The valve fails with the pump suction aligned to the boric acid storage tank on a loss of instrument air. This valve will also align to the boric acid storage tank on either a reactor trip, source range flux doubling signal, low input voltage (loss of ac power) to the 1E dc and uninterruptable power supply system battery chargers, or a safety injection signal from the protection and safety monitoring system. This valve also aligns the makeup pump suction to the boric acid storage tank when low pressure is detected in the demineralized water supply line to protect the pump from a loss of suction supply. Manual control for this valve is provided in the main control room and at the remote shutdown workstation.
Tier 2 Material                                      9.3-33                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          431
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                      AP1000 Design Control Document 9.3.6.4.4    Abnormal                Operation 9.3.6.4.4.1 Reactor Coolant System Leak The chemical and volume control system is capable of making up for a small reactor coolant system leak with either makeup pump at reactor coolant system pressures above the low-pressure setpoint.
9.3.6.4.5    Accident Operation The chemical and volume control system can provide borated makeup to the reactor coolant system following accidents such as small loss-of-coolant accidents, steam generator tube rupture events, and small steam line breaks. In addition, pressurizer auxiliary spray can reduce reactor coolant system pressure during certain events such as a steam generator tube rupture.
To protect against steam generator overfill, the makeup function is isolated by closing the makeup line containment isolation valves, if a high steam generator level signal is generated. These valves also close and isolate the system on a high pressurizer level signal.
Some of the valves in the chemical and volume control system are required to operate under accident conditions to effect reactor coolant system pressure boundary and containment isolation, as discussed in subsection 9.3.6.3.7.
9.3.6.4.5.1 Boron Dilution Events The chemical and volume control system is designed to address a boron dilution accident by closing redundant safety-related valves, tripping the makeup pumps and/or aligning the suction of the makeup pumps to the boric acid tank.
For dilution events occurring at power (assuming the operator takes no action), a reactor trip is initiated on either an overpower trip or an overtemperature T trip. Following a reactor trip signal, the line from the demineralized water system is isolated by closing two safety-related, air-operated valves. The three-way pump suction control valve aligns so the makeup pumps take suction from the boric acid tank. If the event occurs while the makeup pumps are operating, the realignment of these valves causes the makeup pumps, if they continue to operate, to borate the plant.
For dilution events during shutdown, the source range flux doubling signal is used to isolate the makeup line to the reactor coolant system by closing the two safety-related, motor-operated valves, isolate the line from the demineralized water system by closing the two safety-related, air-operated valves, and trip the makeup pumps. The source range flux doubling function can be manually blocked during shutdown conditions when below the P-8 setpoint after the operator isolates unborated water source flow paths. When blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution. For refueling operations, administrative controls are used to prevent boron dilutions by verifying the valves in the line from the demineralized water system are closed and secured.
APP-GW-GL-705 Tier 2 MaterialRev. 0                                  9.3-38                                        Revision432 19
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document 9.3.6.6.1.1 Valve Inspection and Testing The inspection requirements of the chemical and volume control system valves that constitute the reactor coolant pressure boundary are consistent with those identified in subsection 5.2.4. The inspection requirements of the chemical and volume control system valves that isolate the lines penetrating containment are consistent with those identified in Section 6.6.
9.3.6.6.1.2 Flow Testing Each chemical and volume control system pump is tested to measure the flow rate from each makeup pump to the reactor coolant system. Testing will be performed with the pump suction aligned to the boric acid storage tank and the discharge aligned to the reactor coolant system.
Testing will also be performed with the pump suction aligned to the boric acid storage tank and the discharge aligned to the pressurizer auxiliary spray. Flow will be measured using instrumentation in the pump discharge line. Testing will confirm that each pump provides at least 100 gallons per minute of makeup flow at normal reactor coolant system operating pressure. This is the minimum flow rate necessary to meet the chemical and volume control system functional requirement of providing makeup and pressurizer spray to support the functions described in subsection 9.3.6.4.4.1. Testing is performed to verify that the maximum makeup flow with both pumps operating is less than 175 gpm, as assumed in the boron dilution analyses presented in subsection 15.4.6. Testing is performed with both pumps operating and taking suction from the demineralized water system. The chemical and volume control system is aligned to the reactor coolant system at a pressure at or near atmospheric pressure.
9.3.6.6.1.3 Boric Acid Storage Tank Inspection Inspection of the boric acid storage tank will be performed to verify that the volume in the tank is sufficient to provide 70,000 gallons of borated makeup to the reactor coolant system. This volume of boric acid is required to meet the functional requirement of providing makeup to the reactor coolant system to support the functions described in subsection 9.3.6.4.4.
9.3.6.7    Instrumentation Requirements Process control instrumentation is provided to acquire data concerning key parameters about the chemical and volume control system. The location of the instrumentation is shown on the chemical and volume control system piping and instrumentation diagram.
The instrumentation furnishes input signals for monitoring and/or alarming. Indications and/or alarms are provided in the main control room for the following parameters:
x    Pressure and differential pressure x    Flow x    Temperature x    Water level Tier 2 Material                                      9.3-40                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        433
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document The instrumentation also supplies input signals for control purposes to maintain proper system operation and to prevent equipment damage. Some specific control functions are listed below:
x    Purification isolation - To preserve the reactor coolant pressure boundary in the event of a break in the chemical and volume control system loop piping. The purification stop valves close automatically on a signal from the protection and safety monitoring system generated by a low-1 pressurizer level signal. This isolation also serves as an equipment protection function to prevent uncovering of the heater elements in the pressurizer. One of these valves also closes on high temperature downstream of the letdown heat exchanger, to protect the resin in the mixed bed and cation demineralizers from being exposed to temperatures that could damage the resins.
x    Containment isolation - To preserve the containment boundary, containment isolation valves are provided in the letdown line to the liquid radwaste system, the chemical and volume control system makeup line, and the hydrogen addition line. These valves are opened or closed manually from the main control room and the remote shutdown workstation.
Interlocks are provided to close these valves automatically upon receipt of a containment isolation signal from the protection and safety monitoring system and require operator action to reopen.
x    Letdown isolation valves - The letdown isolation valves are used to isolate letdown flow to the liquid radwaste system in addition to the containment isolation function described above.
The plant control system provides a signal to automatically open these valves on a high-pressurizer level signal derived from the pressurizer level control system. On a containment isolation signal from the protection and safety monitoring system, a high-high liquid radwaste system degassifier level signal (plant control system), or a low-pressurizer level signal (plant control system), these valves automatically close to provide isolation of the letdown line. The letdown isolation valves also receive a signal from the protection and safety monitoring system to automatically close and isolate letdown during midloop operations based on a low hot leg level. Manual control is provided from the main control room and at the remote shutdown workstation. The letdown flow control valve controls reactor coolant system pressure during startup, as described in subsection 9.3.6.4.1.
x    Demineralized water system isolation valves - To prevent inadvertent boron dilution, the demineralized water system isolation valves close on a signal from the protection and safety monitoring system derived from either a reactor trip signal, a source range flux doubling signal, low input voltage (loss of ac power) to the 1E dc and uninterruptible power supply system battery chargers, or a safety injection signal providing a safety-related method of stopping an inadvertent dilution. The valves are closed to prevent inadvertent boron dilution when the source range flux doubling logic is blocked below P-8. The main control room and remote shutdown workstation provide manual control for these valves.
x    Makeup isolation valves - To isolate the makeup flow to the reactor coolant system, two valves are provided in the chemical and volume control system makeup line. These valves automatically close on a signal from the protection and safety monitoring system derived from source range flux doubling, high-2 pressurizer level, high steam generator level, or a safeguards signal coincident with high-1 pressurizer level to protect against pressurizer or steam generator overfill. Manual control for these valves is provided in the main control Tier 2 Material                                      9.3-41                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          434
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document 9.4        Air-Conditioning, Heating, Cooling, and Ventilation System The air-conditioning, heating, cooling, and ventilation system is comprised of the following systems that serve the various buildings and structures of the plant:
x    Nuclear island nonradioactive ventilation system (subsection 9.4.1) x    Annex/auxiliary buildings nonradioactive HVAC system (subsection 9.4.2) x    Radiologically controlled area ventilation system (subsection 9.4.3) x    Containment recirculation cooling system (subsection 9.4.6) x    Containment air filtration system (subsection 9.4.7) x    Radwaste building HVAC system (subsection 9.4.8) x    Turbine building ventilation system (subsection 9.4.9) x    Diesel generator building heating and ventilation system (subsection 9.4.10) x    Health physics and hot machine shop HVAC system (subsection 9.4.11) 9.4.1      Nuclear Island Nonradioactive Ventilation System The nuclear island nonradioactive ventilation system (VBS) serves the main control room (MCR), control support area (CSA), Class 1E dc equipment rooms, Class 1E instrumentation and control (I&C) rooms, Class 1E electrical penetration rooms, Class 1E battery rooms, remote shutdown room, reactor coolant pump trip switchgear rooms, adjacent corridors, and the passive containment cooling system (PCS) valve room during normal plant operation.
The main control room emergency habitability system provides main control room habitability in the event of a design basis accident (DBA) and is described in Section 6.4.
9.4.1.1    Design Basis 9.4.1.1.1  Safety Design Basis The nuclear island nonradioactive ventilation system provides the following nuclear safety-related design basis functions:
x    Monitors the main control room supply air for radioactive particulate and iodine concentrations x    Isolates the HVAC penetrations in the main control room boundary on High-2 particulate or iodine concentrations in the main control room supply air, extended loss of main control room differential pressure, or on extended loss of ac power to support operation of the main control room emergency habitability system as described in Section 6.4 Those portions of the nuclear island nonradioactive ventilation system which penetrate the main control room envelope are safety-related and designed as seismic Category I to provide isolation of the main control room envelope from the surrounding areas and outside environment in the event of a design basis accident. Other functions of the system are nonsafety-related. HVAC equipment and ductwork whose failure could affect the operability of safety-related systems or components are designed to seismic Category II requirements. The remaining portion of the Tier 2 Material                                    9.4-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      435
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document system is nonsafety-related and nonseismic. The equipment is procured to meet the environmental qualifications used in standard building practice.
The nuclear island nonradioactive ventilation system is designed to control the radiological habitability in the main control room within the guidelines presented in Standard Review Plan (SRP) 6.4 and NUREG 0696 (Reference 1), if the system is operable and ac power is available.
Portions of the system that provide the defense-in-depth function of filtration of main control room/control support area air during conditions of abnormal airborne radioactivity are designed, constructed, and tested to conform with Generic Issue B-36, as described in Section 1.9 and Regulatory Guide 1.140 (Reference 30), as described in Appendix 1A, and the applicable portions of ASME AG-1 (Reference 36), ASME N509 (Reference 2), and ASME N510 (Reference 3).
Power to the ancillary fans to provide post-72-hour ventilation of the control room and I&C rooms is supplied from divisions B and C regulating transformers through two series fuses for isolation. The fuses protect the regulating transformers from failures of the non-1E fan circuits.
When normal ventilation is available the ancillary fan circuits are disconnected from the supply with manual normally-open switches.
The nuclear island nonradioactive ventilation system is designed to provide a reliable source of heating, ventilation, and cooling to the areas served when ac power is available. The system equipment and component functional capabilities are to minimize the potential for actuation of the main control room emergency habitability system or the potential reliance on passive equipment cooling. This is achieved through the use of redundant equipment and components that are connected to standby onsite ac power sources.
9.4.1.1.2  Power Generation Design Basis Main Control Room/Control Support Area (CSA) Areas The nuclear island nonradioactive ventilation system provides the following specific functions:
x    Controls the main control room and control support area relative humidity between 25 to 60 percent x    Maintains the main control room and CSA areas at a slightly positive pressure with respect to the adjacent rooms and outside environment during normal operations to prevent infiltration of unmonitored air into the main control room and CSA areas x    Isolates the main control room and/or CSA area from the normal outdoor air intake and provides filtered outdoor air to pressurize the main control room and CSA areas to a positive pressure of at least 1/8 inch wg when a High-1 radioactivity concentration (gaseous, particulate, or iodine) is detected in the main control room supply air duct x    Isolates the main control room and/or CSA area from the normal outdoor air intake and provides 100 percent recirculation air to the main control room and CSA areas when a high concentration of smoke is detected in the outside air intake Tier 2 Material                                      9.4-2                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      436
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                  AP1000 Design Control Document The system maintains the following room temperatures based on the maximum and minimum outside air safety temperature conditions shown in Chapter 2, Table 2-1:
Temperature Area                                                                                    (qF)
Class 1E battery rooms                                                                67 - 73 Class 1E dc equipment rooms                                                          67 - 73 Class 1E electrical penetration rooms                                                67 - 73 Class 1E instrumentation and control rooms                                            67 - 73 Corridors                                                                            67 - 73 Remote shutdown room                                                                  67 - 73 Reactor coolant pump trip switchgear rooms                                            67 - 73 HVAC equipment rooms                                                                  50 - 85 Passive Containment Cooling System Valve Room The subsystem maintains the following room temperatures based on the maximum and minimum outside air safety temperature conditions shown in Chapter 2, Table 2-1:
Temperature Area                                                                                    (qF)
Passive containment cooling system valve room                                        50 - 120 Post-72-Hour Design Basis Main Control Room The specific function of the nuclear island nonradioactive ventilation system is to maintain the main control room below a maximum average WBGT Index of 90&deg;F based on operation at the site maximum normal temperature.
Divisions B and C Instrumentation and Control Rooms Design Basis The specific function of the nuclear island nonradioactive ventilation system is to maintain the I&C rooms below the qualification temperature of the I&C equipment.
9.4.1.2    System Description The nuclear island nonradioactive ventilation system is shown in Figure 9.4.1-1. The system consists of the following independent subsystems:
x    Main control room/control support area HVAC subsystem x    Class 1E electrical room HVAC subsystem x    Passive containment cooling system valve room heating and ventilation subsystem Tier 2 Material                                    9.4-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      437
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document 9.4.1.2.1  General Description 9.4.1.2.1.1 Main Control Room/Control Support Area HVAC Subsystem The main control room/control support area HVAC subsystem serves the main control room and control support area with two 100 percent capacity supply air handling units, return/exhaust air fans, supplemental air filtration units, associated dampers, instrumentation and controls, and common ductwork. The supply air handling units and return/exhaust air fans are connected to common ductwork which distributes air to the main control room and CSA areas. The main control room envelope consists of the main control room, shift managers office, operation work area, toilet, and operations break room area. The CSA area consists of the main control support area operations area, conference rooms, NRC room, computer rooms, shift turnover room, kitchen/rest area, and restrooms. The main control room and control support area toilets have separate exhaust fans.
Outside supply air is provided to the plant areas served by the main control room/control support area HVAC subsystem through an outside air intake duct that is protected by an intake enclosure located on the roof of the auxiliary building at elevation 153-0. The outside air intake duct is located more than 50 feet below and more than 100 feet laterally away from the plant vent discharge. The supply, return, and toilet exhaust are the only HVAC penetrations in the main control room envelope and include redundant safety-related seismic Category I isolation valves that are physically located within the main control room envelope. Redundant safety-related radiation monitor sample line connections are located upstream of the VBS supply air isolation valves. These monitors initiate operation of the nonsafety-related supplemental air filtration units on High-1 radioactivity concentrations (gaseous, particulate, or iodine) and isolate the main control room from the nuclear island nonradioactive ventilation system on High-2 particulate or iodine radioactivity concentrations. See Section 11.5 for a description of the main control room supply air radiation monitors.
Both redundant trains of supplemental air filtration units and one train of the supply air handling unit are located in the main control room mechanical equipment room at elevation 135-3 in the auxiliary building. The other supply air handling unit subsystem is located in the main control room mechanical equipment room at elevation 135-3 in the annex building. The main control room toilet exhaust fan is located at elevation 135-3 in the auxiliary building. A humidifier is provided for each supply air handling unit. The supply air handling unit cooling coils are provided with chilled water from air-cooled chillers in the central chilled water system. See subsection 9.2.7 for the chilled water system description.
The main control room/control support area HVAC subsystem is designed so that smoke, hot gases, and fire suppressant will not migrate from one fire area to another to the extent that they could adversely affect safe shutdown capabilities, including operator actions. Fire or combination fire and smoke dampers are provided to isolate each fire area from adjacent fire areas during and following a fire in accordance with NFPA 90A (Reference 27) requirements. These combination smoke/fire dampers close in response to smoke detector signals or in response to the heat from a fire. See Appendix 9A for identification of fire areas.
Tier 2 Material                                      9.4-5                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        438
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document supplemental air filtration subsystem dampers are constructed, qualified, and tested in accordance with ANSI/AMCA 500 or ASME AG-1 (Reference 36), Section DA.
Combination Fire/Smoke Dampers Combination fire/smoke dampers are provided at duct penetrations through fire barriers to maintain the fire resistance ratings of the barriers. The combination fire/smoke dampers meet the design, leakage testing, and installation requirements of UL-555S (Reference 25).
Ductwork and Accessories Ductwork, duct supports, and accessories are constructed of galvanized steel. Ductwork subject to fan shutoff pressures is structurally designed to accommodate fan shutoff pressures. Ductwork, supports, and accessories meet the design and construction requirements of SMACNA Industrial Rectangular and Round Duct Construction Standards (References 16 and 34) and SMACNA HVAC Duct Construction Standards - Metal and Flexible (Reference 17). The supplemental air filtration and main control room/control support area HVAC subsystem's ductwork, including the air filtration units and the portion of the ductwork located outside of the main control room envelope, that maintains integrity of the main control room/control support area pressure boundary during conditions of abnormal airborne radioactivity are designed in accordance with ASME AG-1 (Reference 36), Article SA-4500, to provide low leakage components necessary to maintain main control room/control support area habitability.
9.4.1.2.3  System Operation 9.4.1.2.3.1 Main Control Room/Control Support Area HVAC Subsystem Normal Plant Operation During normal plant operation, one of the two 100 percent capacity supply air handling units and return/exhaust air fans operates continuously. Outside makeup air supply to the supply air handling units is provided through an outside air intake duct. The outside airflow rate is automatically controlled to maintain the main control room and CSA areas at a slightly positive pressure with respect to the surrounding areas and the outside environment.
The main control room/control support area supply air handling units are sized to provide cooling air for personnel comfort, equipment cooling, and to maintain the main control room emergency habitability passive heat sink below its initial ambient air design temperature. The temperature of the air supplied by each air handling unit is controlled by temperature sensors located in the main control room return air duct and in the computer room B return air duct to maintain the ambient air design temperature within its normal design temperature range by modulating the electric heat or chilled water cooling. Some spaces have convection heaters for temperature control.
The outside air is continuously monitored by smoke monitors located at the outside air intake plenum and the return air is monitored for smoke upstream of the supply air handling units. The supply air to the main control room is continuously monitored for airborne radioactivity while the supplemental air filtration units remain in a standby operating mode.
Tier 2 Material                                      9.4-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        439
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document The standby supply air handling unit and corresponding return/exhaust fans are started automatically if one of the following conditions shuts down the operating unit:
x    Airflow rate of the operating fan is above or below predetermined setpoints.
x    Return air temperature is above or below predetermined setpoints.
x    Differential pressure between the main control room and the surrounding areas and outside environment is above or below predetermined setpoints.
x    Loss of electrical and/or control power to the operating unit.
Abnormal Plant Operation Control actions are taken at two levels of radioactivity as detected in the main control room supply air duct. The first is High-1 radioactivity based upon radioactivity instrumentation (gaseous, particulate, or iodine). The second is High-2 radioactivity based upon either particulate or iodine radioactivity instruments.
If High-1 radioactivity is detected in the main control room supply air duct and the main control room/control support area HVAC subsystem is operable, both supplemental air filtration units automatically start to pressurize the main control room and CSA areas to at least 1/8 inch wg with respect to the surrounding areas and the outside environment using filtered makeup air.
The normal outside air makeup duct and the main control room and control support area toilet exhaust duct isolation dampers close. The smoke/purge exhaust isolation dampers close, if open.
The main control room/control support area supply air handling unit continues to provide cooling with recirculation air to maintain the main control room passive heat sink below its initial ambient air design temperature and maintains the main control room and CSA areas within their design temperatures. The supplemental air filtration subsystem pressurizes the combined volume of the main control room and control support area concurrently with filtered outside air. A portion of the recirculation air from the main control room and control support area is also filtered for cleanup of airborne radioactivity. The main control room/control support area HVAC equipment and ductwork that form an extension of the main control room/control support area pressure boundary limit the overall infiltration (negative operating pressure) and exfiltration (positive operating pressure). The system is designed to maintain personnel doses within allowable General Design Criteria (GDC) 19 limits during design basis accidents in both the main control room and the control support area.
If ac power is unavailable for more than 10 minutes, or if main control room differential pressure is below the Low setpoint for more than 10 minutes, or if High-2 particulate or iodine radioactivity is detected in the main control room supply air duct, which would lead to exceeding GDC 19 operator dose limits, the protection and safety monitoring system automatically isolates the main control room from the normal main control room/control support area HVAC subsystem by closing the supply, return, and toilet exhaust isolation valves. Main control room habitability is maintained by the main control room emergency habitability system, which is discussed in Section 6.4.
Tier 2 Material                                      9.4-11                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      440
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document The main control room and CSA areas ventilation supply and return/exhaust ducts can be remotely or manually isolated from the main control room.
If a high concentration of smoke is detected in the outside air intake, an alarm is initiated in the main control room and the main control room/control support area HVAC subsystem is manually realigned to the recirculation mode by closing the outside air and toilet exhaust duct isolation valves. The main control room and control support area toilet exhaust fans are tripped upon closure of the isolation valves. The main control room/CSA areas are not pressurized when operating in the recirculation mode. The main control room/control support area HVAC supply air subsystem continues to provide cooling, ventilation, and temperature control to maintain the emergency habitability passive heat sink below its initial ambient air design temperature and maintains the main control room and CSA areas within their design temperatures.
In the event of a fire in the main control room or control support area, in response to heat from the fire or upon receipt of a smoke signal from an area smoke detector, the combination fire/smoke dampers close automatically to isolate the fire area. The subsystem continues to provide ventilation/cooling to the unaffected area and maintains the unaffected areas at a slightly positive pressure. The main control room/control support area HVAC subsystem can be manually realigned to the once-through ventilation mode to supply 100 percent outside air to the unaffected area. Realignment to the once-through ventilation mode minimizes the potential for migration of smoke or hot gas from the fire area to the unaffected area. Smoke and hot gases can be removed from the affected area by reopening the closed combination fire/smoke damper(s) from outside of the affected fire area during the once-through ventilation mode. In the once-through ventilation mode, the outside air intake damper to the air handling unit mixing plenum opens and the return air damper to the air handling unit closes to provide 100 percent outside air to the supply air handling unit. In this mode, the subsystem exhaust air isolation damper opens to exhaust the return air directly to the turbine building vent.
Power is supplied to the main control room/control support area HVAC subsystem by the plant ac electrical system. In the event of a loss of the plant ac electrical system, the main control room/control support area ventilation subsystem can be transferred to the onsite standby diesel generators. The convection heaters and duct heaters are not transferred to the onsite standby diesel generator.
When complete ac power is lost and the outside air is acceptable radiologically and chemically, MCR habitability is maintained by operating one of the two MCR ancillary fans to supply outside air to the MCR. It is expected that outside air will be acceptable within 72 hours following a radiological release. See subsection 6.4.2.2 for details. The outside air pathway to the ancillary fans is provided through the nonradioactive ventilation system air intake opening located on the roof, the mechanical room at floor elevation 135-3, and nonradioactive ventilation system supply duct. Warm air from the MCR is vented to the annex building through stairway S05, into the remote shutdown room and the clean access corridor at elevation 100-0.
The ancillary fan capacity and air flow rate maintain the MCR environment below a maximum average WBGT Index of 90&deg;F based on operation at the site maximum normal temperature. The ancillary fans and flow path are located within the auxiliary building which is a Seismic Category I structure.
Tier 2 Material                                      9.4-12                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        441
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document Power supply to the ancillary fans is from the respective division B or C regulating transformers which receive power from the ancillary diesel generators. For post-72-hour power supply discussion see subsection 8.3.1.1.1.
9.4.1.2.3.2 Class 1E Electrical Room HVAC Subsystem The Class 1E electrical room HVAC equipment that serves electrical division A and C equipment is described in this section. The operation of the Class 1E electrical room HVAC equipment that serves electrical division B and D is similar.
Normal Plant Operation During normal plant operation, one of the redundant supply air handling units, return fans, and battery room exhaust fans operate continuously to provide room temperature control, to maintain the Class 1E electrical room emergency passive heat sink below its initial ambient air temperature, and to purge and prevent build-up of hydrogen gas concentration in the Class 1E Battery Rooms. The temperature of the air supplied by each air handling unit is controlled by temperature sensors located in the return air duct to maintain the room air temperature within the normal design range by modulating electric heating or chilled water cooling. Duct heaters are controlled by temperature sensors located in the space served by the heater.
During normal plant operation, the exhaust airflow from the Class 1E battery rooms is vented directly to the turbine building vent to limit the concentration of hydrogen gas in the rooms to less than 2 percent by volume in accordance with the guidelines of Regulatory Guide 1.128.
The outside makeup air to the supply air handling units is provided through an outside air intake duct. The outside airflow rate is manually balanced during system startup to provide adequate makeup air for the battery room exhaust fans.
The standby supply air handling unit and the corresponding return/exhaust fans are started automatically if one of the following conditions occurs:
x    Airflow rate of the operating fan is above or below predetermined set points x    Return air temperature is above or below predetermined setpoints.
x    Loss of electrical and/or control power to the operating unit.
Abnormal Plant Operation The Class 1E electrical room HVAC divisions A/C subsystem outside air intake/exhaust dampers close on the start of one or both supplemental filtration unit fans. The Class 1E electrical room HVAC divisions B/D subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS). During a design basis accident (DBA), if the plant ac electrical system is unavailable, the Class 1E electrical room passive heat sink provides area temperature control. Refer to Section 6.4 for further details.
If a high concentration of smoke is detected in the outside air intake and an alarm is initiated in the main control room, the Class 1E electrical HVAC subsystem(s) can be manually aligned to Tier 2 Material                                      9.4-13                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                        442
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document Ductwork and Accessories Ductwork, duct supports and accessories are constructed of galvanized steel. Ductwork subject to fan shutoff pressure is structurally designed for fan shutoff pressures. Ductwork, supports and accessories meet the design and construction requirements of SMACNA Rectangular and Round Industrial Duct Construction Standards (References 16 and 34) and SMACNA HVAC Duct Construction Standards - Metal and Flexible (Reference 17).
9.4.2.2.3  System Operation 9.4.2.2.3.1 General Area HVAC Subsystem Normal Plant Operation During normal plant operation, all four supply air handling units and the toilet/shower and rest room exhaust fans operate continuously to maintain suitable temperatures in the areas served.
The temperature of the air supplied by each handling units is controlled by individual temperature controls with their sensors located in the annex building main entrance and in selected spaces. Each temperature sensor sends a signal to a temperature controller which modulates the chilled water control valve and the face and bypass dampers across the supply air heating coil to maintain the area within the design range. The switchover between cooling and heating modes is automatically controlled by the temperature controllers.
Supplemental heating is provided for the men's/women's change room areas by an electric reheat coil located in the supply air duct to the areas served. The reheat coil operates intermittently under the control of its temperature controller with sensor located in the women's change room, which modulates the electric heating elements to maintain the space temperature in the change room areas within the design range.
The supply air is humidified by a common humidifier located in the ductwork downstream of the supply air handling units. Humidistats located in the annex building operate the humidifiers to maintain a minimum space relative humidity of 35 percent in the areas served.
The differential pressure drop across each supply unit filter bank is monitored, and individual alarms are actuated when any pressure drop rises to a predetermined level indicative of the need for filter replacement. To replace the filters on a supply unit, the affected supply fan is stopped and isolated from the duct system by means of isolation dampers. The exhaust fan for the area is also stopped. During filter replacement, the system operates at approximately 50 percent capacity. This mode of operation will maintain a slight positive pressure in the building.
Abnormal Plant Operation The general area HVAC subsystem is not required to operate during any abnormal plant condition. The general area HVAC subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS).
Tier 2 Material                                      9.4-24                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        443
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                      AP1000 Design Control Document 9.4.2.2.3.2 Switchgear Room HVAC Subsystem Normal Plant Operation During normal plant operation, one air handling unit operates continuously to maintain the indoor temperatures in the two switchgear rooms. The temperature of the air supplied by the air handling unit is maintained at 62qF by a temperature controller based on outside ambient temperature conditions. When the outdoor air temperature is below 62qF, the temperature controller modulates the outside air, return air and exhaust air dampers of the air handling unit to mix return air and outside air in the proper proportion, and modulates the face and bypass dampers of the hot water heating coils to maintain a mixed air temperature of 62qF. A minimum amount of outside air is always provided for ventilation requirements. When the outdoor temperature is above 62qF, the outside air, return air and exhaust air dampers automatically reposition for minimum outside air and the temperature controller modulates the chilled water control valves to maintain the supply air at 62qF. The switchover between cooling and heating modes is automatically controlled by the supply air temperature controllers.
The differential pressure drop across each air handling unit filter bank is monitored and individual alarms are actuated when the pressure drop rises to a predetermined level indicative of the need for filter replacement. To replace the filters on an air handling unit, the unit is stopped and isolated from the duct system by means of isolation dampers. During filter replacement, the second air handling unit operates at full system capacity.
Abnormal Plant Operation The switchgear room HVAC subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS). In the event of a loss of the plant ac electrical system, the air handling unit supply and return/exhaust fans are connected to the standby power system to provide ventilation cooling to the diesel bus switchgear. This cooling permits the switchgear to perform its defense in depth functions in support of standby power system operation. In this mode of operation, the switchgear rooms are cooled utilizing once-through ventilation using outdoor air. When in the once-through ventilation mode, the switchgear rooms will be maintained at or below 122qF.
Equipment in these rooms that operate following a loss of the plant ac electrical system are designed for continuous operation at this temperature. To maintain the areas above freezing, the mixing dampers will modulate to maintain a supply air temperature of 62qF for outdoor temperatures below 62qF. For outdoor temperature above 62qF, the outside air, return air, and exhaust air dampers are positioned for a once-through flow.
In the event of a fire in a non-1E electrical switchgear room, the combination fire/smoke dampers close automatically to isolate the affected fire area in response to heat from the fire or upon receipt of a smoke signal from an area smoke detector. The VXS subsystem continues to provide ventilation/cooling to the remaining switchgear room and maintains the remaining areas at a slightly positive pressure.
Tier 2 Material                                        9.4-25                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          444
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document 9.4.2.2.3.3 Equipment Room HVAC Subsystem Normal Plant Operation During normal plant operation, one air handling unit and both battery room exhaust fans operate continuously to maintain the indoor temperatures in the equipment and security access areas served by the system.
The temperature of the air supplied by the air handling unit is maintained at 62qF by a temperature controller based on outside ambient temperature conditions. When the outdoor air temperature is below 62qF, the temperature controller modulates the outside air, return air and exhaust air dampers of the air handling unit to mix return air and outside air in the proper proportion, and modulates the face and bypass dampers of the hot water heating coils to maintain a mixed air temperature of 62qF. A minimum amount of outside air is always provided for ventilation requirements. When the outdoor air temperature is above 62qF, the outside air, return air and exhaust air dampers automatically reposition for minimum outside air and the temperature controller modulates the chilled water control valves to maintain the supply air at 62qF. The switchover between cooling and heating modes is automatically controlled by the supply air temperature controllers.
Electric reheat coils serving security (rooms 40305 and 40306) are controlled by temperature controllers with sensors located in the areas served. The temperature sensor sends a signal to a temperature controller which modulates the electric heating elements to maintain the security access areas at their design temperatures. Hot water unit heaters operate intermittently to provide supplemental heating for the north air handling equipment room to maintain the area temperature above 50qF.
A humidistat located in the security access area intermittently operates the humidifier to maintain the security office area at a minimum space relative humidity of 35 percent.
The differential pressure drop across each air handling unit filter bank is monitored, and individual alarms are actuated when the pressure drop rises to a predetermined level indicative of the need for filter replacement. To replace the filters of an air handling unit, the unit is stopped and isolated from the duct system by means of isolation dampers. During filter replacement, the second air handling unit operates at full system capacity.
A temperature controller opens the outside air intake and starts and stops the elevator machine room exhaust fan as required to maintain room design temperature conditions. A local thermostat controls the electric unit heater.
Abnormal Plant Operation The equipment room HVAC subsystem outside air intake/exhaust dampers close on a High-2 particulate or iodine signal from the MCR radiation package communicated through the plant control system (PLS). In the event of a loss of the plant ac electrical system, the air handling unit supply and return/exhaust fans are connected to the standby power system to provide ventilation cooling to the dc switchgear and inverters. This cooling permits that equipment to perform its defense in depth functions. In this mode of operation, the rooms are cooled utilizing once-Tier 2 Material                                      9.4-26                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          445
 
DCP_NRC_003343                                                Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                                                              AP1000 Design Control Document Table 9.4-1 DESIGN FILTRATION EFFICIENCIES AND NOMINAL AIRFLOW RATES FOR HVAC SYSTEMS (1)
Maximum Design/Test      Ventilation      Recirculation        Humidity          HEPA          Charcoal    Inleakage Areas Served(1)          Standard        Airflow (cfm)      Flow (cfm)          Control        Efficiency    Efficiency(3)    (cfm)
MCR/CSA                        RG 1.140            800              3,200                Yes            99%            90%          60(4)
(Supplemental Air)
Containment                    RG 1.140          4,000(2)            N/A                Yes            99%            90%          N/A Notes:
: 1. Ventilation cfm is shown for each train unless otherwise noted.
: 2. Both trains of the containment purge may be operated at the same time prior to and during cold shutdown.
: 3. Charcoal filters are 4-inch deep Type III adsorber cell.
: 4. This VBS inleakage represents the total inleakage into the combined MCR/CSA HVAC volume, which includes ingress/egress.
Tier 2 Material                                                                9.4-76                                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                            446
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                    AP1000 Design Control Document Table 9.4.1-1 (Sheet 2 of 2)
COMPONENT DATA - NUCLEAR ISLAND NONRADIOACTIVE VENTILATION SYSTEM MCR/CSA HVAC Subsystem (Nominal Values)
Supplemental Air Filtration Subsystem Quantity                                                              2 System capacity per unit (%)                                          100 Fan Requirements Type                                                                  Centrifugal Design airflow (scfm)                                                  4,000 Fan static pressure (in. wg)                                          14 Heating Coil Requirements Type                                                                  Electric Capacity (kw)                                                          20 Filter Requirements High efficiency filter, minimum ASHRAE efficiency (%)                  80 HEPA filter, DOP efficiency (%)                                        99.97 Post filter, DOP efficiency (%)                                        95 Charcoal Adsorber Requirements Bed depth (in.)                                                        4.0 Decontamination efficiency (%)                                        90 Air residence time (sec.)                                              0.5 MCR Envelope and CSA Leakage Rates Inleakage Rate            Outleakage Rate at 1/8 in. wg              at 1/8 in. wg Leakage                                  (scfm)              (scfm) (Note 3)
MCR access doors                                                      --                    Note 1 CSA access doors                                                      --                    Note 2 MCR structure                                                        --                    Note 1 CSA structure                                                        --                    Note 2 MCR/CSA HVAC equipment & ductwork (operating)                        50                        200 Tier 2 Material                                    9.4-78                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          447
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                      AP1000 Design Control Document Note:
: 1. The total outleakage rate from the MCR access doors and the MCR structure is 35 scfm.
: 2. The total outleakage rate from the CSA doors and CSA structure is 120 scfm.
: 3. In cases where the outside air flow rate is greater than the outside air required to pressurize the MCR envelope and CSA, excess air is exhausted to the outside atmosphere.
Tier 2 Material                                        9.4-79                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                              448
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                                                                                          AP1000 Design Control Document Inside Auxiliary Building Figure 9.4.1-1 (Sheet 5 of 7)
Nuclear Island Non-Radioactive Ventilation System Figure represents system functional arrangement. Details internal to the system may                                                            Piping and Instrumentation Diagram differ as a result of implementation factors such as vendor-specific component requirements.                                                                          (REF) VBS 007 Tier 2 Material                                                                                                                                  9.4-105                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                                                                449
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 9. Auxiliary Systems                                                      AP1000 Design Control Document Table 9.5.1-1 (Sheet 11 of 33)
AP1000 FIRE PROTECTION PROGRAM COMPLIANCE WITH BTP CMEB 9.5-1 BTP CMEB 9.5-1 Guideline                    Paragraph        Comp(1)            Remarks Safe Shutdown Capability
: 72. Fire damage should be limited so that one train        C.5.b(1)          C of systems necessary to achieve and maintain hot shutdown conditions from either the main control room or emergency control station is free of fire damage.
: 73. Fire damage should be limited so that systems          C.5.b (1)        AC    Safe shutdown following a necessary to achieve and maintain cold                                        fire is defined for the AP1000 shutdown from either the control room or                                      plant as the ability to achieve emergency control station can be repaired within                              and maintain the reactor 72 hours.                                                                      coolant system (RCS) core average temperature below 215.6&deg;C (420&deg;F) without uncontrolled venting of the primary coolant from the RCS. This is a departure from the criteria applied to the evolutionary plant designs, and the existing plants where safe shutdown for fires applies to both hot and cold shutdown capability.
With expected RCS leakage, the AP1000 plant can maintain safe shutdown conditions for greater than 14 days. Therefore, repairs to systems necessary to reach cold shutdown need not be completed within 72 hours.
: 74. Separation requirements for verifying that one        C.5.b (2)          C train of systems necessary to achieve and maintain hot shutdown is free of fire damage.
Tier 2 Material                                        9.5-42                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                            450
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                        AP1000 Design Control Document Table 11.1-4 PARAMETERS USED TO CALCULATE SECONDARY COOLANT ACTIVITY Total secondary side water mass (lb/steam generator)                                  1.68 x 105 Steam generator steam fraction                                                          0.058 Total steam flow rate (lb/hr)                                                          1.5 x 107 Moisture carryover (percent)                                                              0.1 Total makeup water feed rate (lb/hr)                                                      700 Total blowdown rate (gpm)                                                                186 Total primary-to-secondary leak rate (gpd)                                                300 Iodine partition factor (mass basis)                                                      100 Tier 2 Material                                      11.1-9                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                    451
 
DCP_NRC_003343              Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                              AP1000 Design Control Document Table 11.1-5 DESIGN BASIS STEAM GENERATOR SECONDARY SIDE LIQUID ACTIVITY Activity                                          Activity Nuclide          (Ci/g)                      Nuclide              (Ci/g)
Br-83            1.4E-05                        Y-92                2.8E-07 Br-84            2.4E-06                        Y-93                8.2E-08 Br-85            3.1E-08                        Zr-95              1.5E-07 I-129            1.3E-11                        Nb-95              1.5E-07 I-130            7.9E-06                      Mo-99                1.9E-04 I-131            6.3E-04                      Tc-99m              1.7E-04 I-132            4.2E-04                      Ru-103              1.2E-07 I-133            1.0E-03                      Ru-106              4.1E-08 I-134            4.9E-05                      Rh-103m              1.2E-07 I-135            5.0E-04                      Rh-106              4.1E-08 Rb-86            1.4E-05                      Ag-110m              4.0E-07 Rb-88            1.4E-04                      Te-125m              1.5E-07 Rb-89            5.6E-06                      Te-127m              7.0E-07 Cs-134            1.1E-03                      Te-127              2.2E-06 Cs-136            1.7E-03                      Te-129m              2.4E-06 Cs-137            8.2E-04                      Te-129              2.1E-06 Cs-138            5.9E-05                      Te-131m              5.6E-06 H-3            3.8E-01                      Te-131              1.6E-06 Cr-51            1.3E-06                      Te-132              7.0E-05 Mn-54            6.6E-07                      Te-134              2.0E-06 Mn-56            7.8E-05                      Ba-137m              7.7E-04 Fe-55            5.0E-07                      Ba-140              9.4E-07 Fe-59            1.3E-07                      La-140              3.3E-07 Co-58            1.9E-06                      Ce-141              1.4E-07 Co-60            2.2E-07                      Ce-143              1.2E-07 Sr-89            1.8E-06                      Ce-144              1.1E-07 Sr-90            8.0E-08                      Pr-143              1.4E-07 Sr-91            1.9E-06                      Pr-144              1.1E-07 Sr-92            2.4E-07 Y-90            1.4E-08 Y-91m            1.0E-06 Y-91            1.3E-07 Tier 2 Material                          11.1-10                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                        452
 
DCP_NRC_003343              Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                              AP1000 Design Control Document Table 11.1-6 DESIGN BASIS STEAM GENERATOR SECONDARY SIDE STEAM ACTIVITY Nuclide                                      Activity (Ci/g)
Kr-83m                                          1.10E-06 Kr-85m                                          4.30E-06 Kr-85                                          1.50E-05 Kr-87                                          2.40E-06 Kr-88                                          7.70E-06 Kr-89                                          1.80E-07 Xe-131m                                        6.90E-06 Xe-133m                                        8.70E-06 Xe-133                                        6.40E-04 Xe-135m                                        5.50E-06 Xe-135                                        1.90E-05 Xe-137                                        3.40E-07 Xe-138                                        1.30E-06 I-129                                        1.50E-13 I-130                                        8.70E-08 I-131                                        6.90E-06 I-132                                        4.70E-06 I-133                                        1.10E-05 I-134                                        5.40E-07 I-135                                        5.50E-06 H-3                                          3.80E-01 Tier 2 Material                          11.1-11                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                        453
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                        AP1000 Design Control Document 11.5        Radiation Monitoring The radiation monitoring system (RMS) provides plant effluent monitoring, process fluid monitoring, airborne monitoring, and continuous indication of the radiation environment in plant areas where such information is needed. Radiation monitors that have a safety-related function are qualified environmentally, seismically, or both. Class 1E radiation monitors conform to the separation criteria described in subsection 8.3.2 and to the fire protection criteria described in subsection 9.5.1. Equipment qualification requirements, including seismic qualification requirements, and general location information for radiation monitors are listed in Section 3.11.
Seismic Categories for the buildings housing radiation monitors are listed in Section 3.2.
The radiation monitoring system is installed permanently and operates in conjunction with regular and special radiation survey programs to assist in meeting applicable regulatory requirements. The radiation monitoring system is designed in accordance with ANSI N13.1-1969. The process monitors are designed in accordance with ANSI-N42.18-1980.
The radiation monitoring system is divided functionally into two subsystems:
x    Process, airborne, and effluent radiological monitoring and sampling x    Area radiation monitoring 11.5.1      Design Basis 11.5.1.1    Safety Design Basis While the radiation monitoring system is primarily a surveillance system, certain detector channels perform safety-related functions. The components used in these channels meet the qualification requirements for safety-related equipment as described in subsection 7.1.4.
Channel and equipment redundancy is provided for safety-related monitors to maintain the safety-related function in case of a single failure.
The design objectives of the radiation monitoring system during postulated accidents are:
x    Initiate containment air filtration isolation in the event of abnormally high radiation inside the containment (High-1) x    Initiate normal residual heat removal system suction line containment isolation in the event of abnormally high radiation inside the containment (High-2) x    Initiate main control room supplemental filtration in the event of abnormally high particulate, iodine, or gaseous radioactivity in the main control room supply air (High-1) x    Initiate main control room ventilation isolation and actuate the main control room emergency habitability system in the event of abnormally high particulate or iodine radioactivity in the main control room supply air (High-2)
Tier 2 Material                                      11.5-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        454
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                        AP1000 Design Control Document 11.5.2.3.1 Fluid Process Monitors Steam Generator Blowdown Radiation Monitors The steam generator blowdown radiation monitors (BDS-JE-RE010, RE011) measure the concentration of radioactive material in the blowdown from the steam generators. One measures radiation in the purification process effluent before it is returned to the condensate system. The other measures radioactivity in the blowdown system electrodeionization waste brine before it is discharged to the waste water system. The presence of radioactive material in the steam generator blowdown indicates a leak between the primary side and the secondary side of the steam generator. Refer to subsection 5.2.5 for details of leakage monitoring and to subsections 10.4.8 and 11.2 for process system details. The steam generator blowdown radiation monitors meet the guidelines of Regulatory Guide 1.97 as discussed in Appendix 1A and Section 7.5.
AP1000 has two steam generators, each of which has a blowdown line. Each blowdown line has a heat exchanger upstream of the blowdown flow control valve. The steam generator blowdown radiation detectors are located in the lines downstream of these heat exchangers. Therefore, the radiation monitors do not require a sample cooler.
When its predetermined setpoint is exceeded, each steam generator blowdown radiation monitor initiates an alarm in the main control room, initiates closure of the steam generator blowdown containment isolation valves and the steam generator blowdown flow control valves, and diverts flow to the liquid radwaste system.
The steam generator blowdown radiation monitors use inline gamma-sensitive, thallium-activated, sodium iodide scintillation detectors. The steam generator blowdown radiation monitor detector range and principal isotopes are listed in Table 11.5-1.
The arrangement for the steam generator blowdown radiation monitor is shown in Figure 11.5-1.
Component Cooling Water System Radiation Monitor The component cooling water system radiation monitor (CCS-JE-RE001) measures the concentration of radioactive material in the component cooling water system. Radioactive material in the component cooling water system provides indication of leakage. Refer to subsection 5.2.5 for details of leakage monitoring and to subsection 9.2.2 for process system details.
If the concentration of radioactive materials exceeds a predetermined setpoint, the component cooling water system radiation monitor initiates an alarm in the main control room.
The component cooling water system radiation monitor is an offline monitor that uses a gamma-sensitive, thallium-activated, sodium iodide scintillation detector. The range and principal isotopes are listed in Table 11.5-1.
The arrangement for the component cooling water system radiation monitor is shown in Figure 11.5-7.
Tier 2 Material                                      11.5-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        455
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                                        AP1000 Design Control Document radioactivity of the reactor coolant indicating a possible fuel cladding breach. When a predetermined setpoint is exceeded, the primary sampling system liquid sample radiation monitor isolates the sample flow by closing the outside containment isolation valve and initiates an alarm in the main control room and locally to alert the operator. Refer to subsection 9.3.3 for system details.
The primary sampling system liquid sample radiation monitor utilizes a gamma-sensitive radiation detector that is adjacent to the sampling line immediately downstream of the sample cooler. The range and principal isotopes are listed in Table 11.5-1.
The arrangement for the primary sampling system liquid sample radiation monitor is shown in Figure 11.5-8.
Primary Sampling System Gaseous Sample Radiation Monitor The primary sampling system gaseous sample radiation monitor (PSS-JE-RE052) measures the concentration of radioactive materials in the gaseous samples taken from containment atmosphere. The gaseous sample radiation monitor is used to provide indication of significant radioactivity in the gaseous sample being taken and the need for dilution of the sample to limit operator exposure during sampling and transport for analysis. When a predetermined setpoint is exceeded, the primary sampling system gaseous sample radiation monitor initiates an alarm locally and in the main control room to alert the operator. Refer to subsection 9.3.3 for system details.
The primary sampling system gaseous sample radiation monitor utilizes a gamma-sensitive radiation detector that is adjacent to the sampling line immediately upstream of the sample bottle.
The range and principal isotopes are listed in Table 11.5-1.
The arrangement for the primary sampling system gaseous sample radiation monitor is shown in Figure 11.5-8.
Main Control Room Supply Air Duct Radiation Monitors The main control room supply air duct radiation monitors (particulate detectors VBS-JE-RE001A and VBS-JE-RE001B, iodine detectors VBS-JE-RE002A and VBS-JE-RE002B, and noble gas detectors VBS-JE-RE003A and VBS-JE-RE003B) are offline monitors that continuously measure the concentration of radioactive materials in the air that is supplied to the main control room by the nuclear island nonradioactive ventilation system air handling units. The control support area ventilation is also part of this air supply system. The air supply is partially outside air. Refer to subsection 9.4.1 for system details. The main control room supply air duct radiation monitors receive safety-related power. When predetermined setpoints are exceeded, the monitors provide signals to initiate the supplemental air filtration system on a High-1 gaseous, particulate, or iodine concentration, and to isolate the main control room air intake and exhaust ducts and activate the main control room emergency habitability system on High-2 particulate or iodine concentrations. Alarms are also provided in the main control room for these high concentrations.
Tier 2 Material                                      11.5-6                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        456
 
DCP_NRC_003343              Westinghouse Non-Proprietary Class 3
: 11. Radioactive Waste Management                              AP1000 Design Control Document Figure 11.5-6 Safety-Related Main Control Room Supply Duct Radiation Monitor Tier 2 Material                          11.5-27                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                        457
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                AP1000 Design Control Document For the evaluation of the radiological consequences of the LOCA, it is assumed that major degradation of the core takes place, including melting of the core. The source term used for the LOCA dose analysis assumes no core release for 10 minutes, then there is a gap release from a small number of fuel rods before the onset of core degradation. The first half hour of core release is restricted to releases from the fuel cladding gap; this gap release phase is followed by the in-vessel core melt phase that has a duration of 1.3 hours. After the in-vessel core melt phase, there is assumed to be no further release of activity from the core. This core activity release model is based on the source term model from NUREG-1465 (Reference 1). The source term is described in detail in subsection 15.6.5.3.
12.2.1.3.1 Containment If there is core degradation, core cooling would be provided by the passive core cooling system which is totally inside the containment such that no high activity sump solution would be recirculated outside the containment. The shielding provided for the containment addresses this post-LOCA source term. The source strengths as a function of time are provided in Table 12.2-20 and the integrated source strengths are provided in Table 12.2-21.
12.2.1.3.2 Main Control Room HVAC Filter During operation of the nuclear island nonradioactive ventilation system (VBS) supplemental filtration or the main control room emergency habitability system (VES), filters in the control room HVAC work to remove particulate and iodine from the air. As radioactivity accumulates within the filters, this becomes a potential source of dose. These source strengths as a function of time are provided in Table 12.2-28 and the integrated source strengths are provide in Table 12.2-29.
12.2.2      Airborne Radioactive Material Sources This subsection deals with the models, parameters, and sources required to evaluate airborne concentration of radionuclides during plant operations in various plant radiation areas where personnel occupancy is expected.
12.2.2.1    Containment Atmosphere The main sources of airborne activity in the containment is leakage of primary coolant and activation of naturally occurring argon in the atmosphere. During normal power operation, excessive activity buildup in the containment atmosphere is prevented by periodic purging of the containment (approximately 20 hours per week). When the plant is shut down for refueling or maintenance, additional purging of the containment atmosphere is performed to further reduce the activity levels consistent with the increased level of worker presence in the containment. The assumptions and parameters used to determine the airborne activity levels in the containment are listed in Table 12.2-22. The airborne concentrations are provided in Table 12.2-23.
Three situations are considered: normal power operation without purge, normal power operation with 20 hours of purge operation per week, and shutdown operation.
Tier 2 Material                                      12.2-6                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        458
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                AP1000 Design Control Document Table 12.2-28 (Sheet 1 of 2)
CORE MELT ACCIDENT SOURCE STRENGTHS FROM MCR HVAC FILTERS AS A FUNCTION OF TIME VES Filter(1) Source Strengths after a Loss of Coolant Accident Energy Group (Mev/gamma)                                Source Strength (Mev/sec) 2 hours            8 hours          24 hours      30 days 0.01 - 0.02                1.19E+06          3.11E+06          1.81E+06      1.97E+05 0.03 - 0.0                1.47E+06          5.26E+06          3.89E+06      2.65E+05 0.03 - 0.06                2.87E+06          5.30E+06          5.46E+06      6.47E+05 0.06 - 0.1                3.03E+06          8.13E+06          5.22E+06      5.41E+05 0.1 - 0.2                5.76E+06          1.41E+07          8.76E+06      9.02E+05 0.2 - 0.4                6.14E+07          2.61E+08          2.46E+08      1.87E+07 0.4 - 0.6                1.86E+08          6.02E+08          3.60E+08      1.83E+07 0.6 - 0.7                1.47E+08          2.33E+08          1.47E+08      1.03E+08 0.7 - 0.8                1.09E+08          1.80E+08          1.05E+08      7.30E+07 0.8 - 1.0                1.85E+08          1.67E+08          6.99E+07      7.13E+06 1.0 - 1.5                3.36E+08          6.99E+08          1.85E+08      1.22E+07 1.5 - 2.0                1.21E+08          2.55E+08          4.97E+07      2.69E+04 2.0 - 3.0                3.13E+07          3.87E+07          7.28E+06      9.07E+03 3.0 - 4.0                3.68E+05          5.98E+03          5.56E+02      1.41E+02 4.0 - 5.0                1.42E+04          3.16E+01          8.55E-04      7.80E-04 5.0 - 6.0                3.31E-05          3.12E-04          3.35E-04      3.21E-04 6.0 - 7.0                1.32E-05          1.24E-04          1.33E-04      1.28E-04 7.0 - 8.0                5.11E-06          4.82E-05          5.17E-05      4.96E-05 8.0 - 10.0                2.68E-06          2.53E-05          2.71E-05      2.60E-05 10.0 - 14.0                1.69E-07          1.60E-06          1.71E-06      1.64E-06 Total                  1.19E+09          2.47E+09          1.19E+09      2.35E+08 Tier 2 Material                                      12.2-64                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                  459
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                  AP1000 Design Control Document Table 12.2-28 (Sheet 2 of 2)
CORE MELT ACCIDENT SOURCE STRENGTHS FROM MCR HVAC FILTERS AS A FUNCTION OF TIME VES Filter(2) Source Strengths after a Loss of Coolant Accident Energy Group (Mev/gamma)                                  Source Strength (Mev/sec) 2 hours            8 hours            24 hours            30 days 0.01 - 0.02                6.86E+08            1.00E+09            5.75E+08            6.21E+07 0.03 - 0.0                  9.55E+08            1.76E+09            1.27E+09            8.46E+07 0.03 - 0.06                1.71E+09            2.71E+09            1.75E+09            2.10E+08 0.06 - 0.1                  1.72E+09            2.60E+09            1.63E+09            1.70E+08 0.1 - 0.2                  3.49E+09            4.61E+09            2.81E+09            2.91E+08 0.2 - 0.4                  3.54E+10            8.45E+10            7.59E+10            5.76E+09 0.4 - 0.6                  1.03E+11            1.91E+11            1.10E+11            5.61E+08 0.6 - 0.7                  7.99E+10            7.20E+10            4.39E+10            3.04E+10 0.7 - 0.8                  5.97E+10            5.62E+10            3.17E+10            2.16E+10 0.8 - 1.0                  1.03E+11            5.63E+10            2.13E+10            2.11E+09 1.0 - 1.5                  1.86E+11            2.20E+11            5.64E+10            3.62E+09 1.5 - 2.0                  6.71E+10            8.03E+10            1.53E+10            8.78E+06 2.0 - 3.0                  1.66E+10            1.22E+10            2.24E+09            3.09E+06 3.0 - 4.0                  1.82E+08            1.93E+06            1.89E+05            4.81E+04 4.0 - 5.0                  6.86E+06            7.65E+03            2.91E-01            2.65E-01 5.0 - 6.0                  3.74E-02            1.12E-01            1.14E-01            1.09E-01 6.0 - 7.0                  1.49E-02            4.47E-02            4.54E-02            4.35E-02 7.0 - 8.0                  5.78E-03            1.74E-02            1.76E-02            1.69E-02 8.0 - 10.0                  3.03E-03            9.11E-03            9.24E-03            8.86E-03 10.0 - 14.0                1.92E-04            5.75E-04            5.84E-04            5.60E-04 Total                    6.59E+11            7.82E+11            3.65E+11            7.00E+10 Notes:
: 1. Based upon a particulate filter density of 0.212 g/cc and charcoal filter density of 0.440 g/cc.
: 2. Based upon a particulate filter density of 0.230 g/cc and charcoal filter density of 0.632 g/cc.
Tier 2 Material                                        12.2-65                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                              460
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                  AP1000 Design Control Document Table 12.2-29 CORE MELT ACCIDENT INTEGRATED SOURCE STRENGTHS FROM MCR HVAC FILTERS Energy Group (Mev/gamma)                        30-Day Integrated Source Strength (Mev)
VES(1)                                VBS(2) 0.01 - 0.02                          1.75E+08                              5.65E+10 0.03 - 0.0                          3.81E+08                              1.26E+11 0.03 - 0.06                          5.89E+08                              1.90E+11 0.06 - 0.1                          5.77E+08                              1.84E+11 0.1 - 0.2                          9.03E+08                              2.95E+11 0.2 - 0.4                          3.34E+10                              1.05E+13 0.4 - 0.6                          2.36E+10                              7.44E+12 0.6 - 0.7                          3.81E+10                              1.15E+13 0.7 - 0.8                          2.63E+10                              7.92E+12 0.8 - 1.0                          7.57E+09                              2.39E+12 1.0 - 1.5                          1.77E+10                              5.67E+12 1.5 - 2.0                          4.03E+09                              1.34E+12 2.0 - 3.0                          6.47E+08                              2.18E+11 3.0 - 4.0                          1.20E+06                              4.46E+08 4.0 - 5.0                          4.17E+04                              1.52E+07 5.0 - 6.0                          1.03E-01                              3.51E+01 6.0 - 7.0                          4.08E-02                              1.40E+01 7.0 - 8.0                          1.59E-02                              5.42E+00 8.0 - 10.0                          8.32E-03                              2.84E+00 10.0 - 14.0                          5.25E-04                              1.80E-01 Total                            1.54E+11                              4.79E+13 Notes:
: 1. Based upon a particulate filter density of 0.212 g/cc and charcoal filter density of 0.440 g/cc.
: 2. Based upon a particulate filter density of 0.230 g/cc and charcoal filter density of 0.632 g/cc.
Tier 2 Material                                        12.2-66                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                              461
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                AP1000 Design Control Document the permanent shield walls surrounding the waste accumulation and packaged waste storage rooms inside the radwaste building.
12.3.2.2.6 Turbine Building Shielding Design The steam generator blowdown demineralizers are shielded to meet the radiation zone and access requirements. Radiation shielding is not required for other process equipment located in the turbine building. Space has been provided so that shielding may be added around the condensate polishing demineralizers if they become radioactive.
12.3.2.2.7 Control Room Shielding Design The design basis loss-of-coolant accident dictates the shielding requirements for the control room. The rod ejection accident dictates the shielding requirements for the main control room emergency habitability (VES) filter in the operator break room. Consideration is given to shielding provided by the shield building structure. Shielding combined with other engineered safety features is provided to permit access and occupancy of the control room following a postulated loss-of-coolant accident, so that radiation doses are limited to five rem whole body from contributing modes of exposure for the duration of the accident, in accordance with General Design Criterion 19.
Shielding of the VES filtration unit is accomplished by safety-related metal shielding. This shielding is composed of either tungsten that is 0.25 inches thick or stainless steel shown to provide an equivalent amount of shielding. The length and width of the shielding are designed to match the length and width of the filtration unit being shielded.
12.3.2.2.8 Miscellaneous Plant Areas and Plant Yard Areas Sufficient shielding is provided for plant buildings containing radiation sources so that radiation levels at the outside surfaces of the buildings are maintained below Zone I levels. Plant yard areas that are frequently occupied by plant personnel are fully accessible during normal operation and shutdown. Tanks containing radioactive materials are not located in the yard.
12.3.2.2.9 Spent Fuel Transfer Canal and Tube Shielding The spent fuel transfer tube is shielded to within adjacent area radiation zone limits. This is primarily achieved through the use of concrete and water. The only removable shielding consists of concrete or steel hatches which reduce radiation in accessible areas to within those levels prescribed in the normal operation radiation zone maps (Figure 12.3-1).
The spent fuel transfer tube is completely enclosed in concrete and there is no unshielded portion of the spent fuel transfer tube during the refueling operation. The only potential radiation streaming path associated with the tube shielding configuration is the 2 inch (5.08 cm) seismic gap between the fuel transfer tube shielding and the steel containment wall. Shielding of this gap is provided by a water-filled bladder. This "expansion gap" radiation shield provides effective reduction of the radiation fields during fuel transfer and accommodates relative movement between the containment and the concrete transfer tube shielding with no loss in shield integrity.
A removable hatch in the shield configuration provides access for inspection of the fuel transfer Tier 2 Material                                    12.3-13                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        462
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                                  AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR Figure 12.3-1 (Sheet 6 of 16)
Radiation Zones, Normal Operations/Shutdown Nuclear Island, Elevation 100-0 & 107-2 Tier 2 Material                                                              12.3-33                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            463
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                              AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR Figure 12.3-2 (Sheet 7 of 15)
Radiation Zones, Post-Accident Nuclear Island, Elevation 117-6 Tier 2 Material                                                              12.3-67                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      464
 
DCP_NRC_003343 Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                                              AP1000 Design Control Document Security-Related Information, Withhold Under 10 CFR Figure 12.3-2 (Sheet 8 of 15)
Radiation Zones, Post-Accident Nuclear Island, Elevation 135-3 Tier 2 Material                                                              12.3-69                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                      465
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 12. Radiation Protection                                              AP1000 Design Control Document of advanced technology into the refueling process also reduces doses. Table 12.4-11 lists some of the AP1000 features that reduce doses during refueling operations.
Table 12.4-12 provides dose estimates for the various refueling activities.
12.4.1.7    Overall Plant Doses The estimated annual personnel doses associated with the six activity categories discussed above are summarized below:
Estimated Annual Category                        Percent of Total          (man-rem)
Reactor operations and surveillance                    21.8                  13.8 Routine inspection and maintenance                    19.2                  12.1 Inservice inspection                                  22.7                  14.3 Special maintenance                                    23.7                  15.0 Waste processing                                        8.2                  5.2 Refueling                                                4.4                  2.8 Total                                                100.0                  63.2 These dose estimates are based on operation with an 18-month fuel cycle and are bounding for operation with a 24-month fuel cycle.
12.4.1.8    Post-Accident Actions Requirements of 10 CFR 52.79(b) relative to plant area access and post-accident sampling (10 CFR 50.34 (f) (2)(viii) are included in Section 1.9.3. If procedures are followed, the design prevents radiation exposures to any individual from exceeding 5 rem to the whole body or 50 rem to the extremities. Figure 12.3-2 in Section 12.3 contains radiation zone maps for plant areas including those areas requiring post-accident access. This figure shows projected radiation zones in areas requiring access and access routes or ingress, egress and performance of actions at these locations. The radiation zone maps reflect maximum radiation fields over the course of an accident. The analyses that confirm that the individual personnel exposure limits following an accident are not exceeded reflect the time-dependency of the area dose rates and the required post-accident access times. The analyses include the assumption that the appropriate respiratory protection equipment is used to maintain radiation exposure within the exposure limits. The areas that require post-accident accessibility are:
x    Main control room x    Class 1E regulating transformer areas x    Ventilation control area for MCR and I & C rooms with PAMS equipment x    Valve area to align spent fuel pool makeup x    Ancillary diesel room x    Passive containment water inventory makeup area Tier 2 Material                                    12.4-4                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    466
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                                AP1000 Design Control Document 14.2.9.1.6 Main Control Room Emergency Habitability System Testing Purpose The purpose of the main control room emergency habitability system testing is to verify that the as-installed components properly perform the safety-related functions described in Section 6.4, including the following:
x    Provide sufficient breathable quality air to the main control room x    Maintain the main control room at positive pressure x    Provide passive cooling of designated equipment In addition, the following safety-related functions performed by the nuclear island nonradioactive ventilation system described in subsection 9.4.1 are tested:
x    Provide isolation of the main control room from the surrounding areas and outside environment during a design basis accident if the nuclear island nonradioactive ventilation system becomes inoperable.
x    Monitor the radioactivity in the main control room normal air supply and provide signals to isolate the incoming air and actuate the main control room emergency habitability system.
In addition, the following safety-related functions performed by the potable water system, described in subsection 9.2.5; the sanitary drainage system, described in subsection 9.2.6; and the waste water system, described in subsection 9.2.9, are tested:
x    Provide isolation of the main control room from the surrounding areas and outside environment during a design basis accident.
Prerequisites The construction testing of the main control room habitability system has been successfully completed. The required preoperational testing of the compressed and instrument air system, Class 1E electrical power and uninterruptible power supply systems, normal control room ventilation system, and other interfacing systems required for operation of the above systems is available as needed to support the specified testing and system configurations. The main control room air supply tanks are filled with air acceptable for breathing. The main control room construction is complete and its leak-tight barriers are in place.
General Test Acceptance Criteria and Methods Performance of the main control room habitability system is observed and recorded during a series of individual component and integrated system testing. The following testing demonstrates that the habitability system operates as specified in Section 6.4 and as specified in the appropriate design specifications:
a)    Proper operation of safety-related valves is verified by the performance of baseline in-service tests as described in subsection 3.9.6.
Tier 2 Material                                      14.2-27                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          467
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                                AP1000 Design Control Document b)  Proper calibration and operation of safety-related and system readiness instrumentation, controls, actuation signals and interlocks is verified. This testing includes the following:
x    Air storage tank pressure x    Refill line connection pressure x    Main control room differential pressure x    Air supply line flow rate x    Controls for the main control room pressure relief valves x    Controls for the air supply isolation valves x    Controls for the main control room air inlet isolation valves x    Air intake radiation x    Passive filtration line flow rate x    Filter performance x    Sanitary drainage system vent isolation valves c)  The proper flow rate of emergency air to the main control room is verified, demonstrating proper sizing of each air flow limiting orifice, proper operation of each air supply pressure regulator, and the ability to maintain proper control room air quality. The MCR passive filtration system flow rate and filter performance will also be verified at this time to ensure a filtration flow rate of at least 600 cfm. This testing demonstrates the control room pollutant concentrations during the first 6 hours of operation. To determine the control room air quality at 72 hours, the CO2 concentrations can be predicted based on calculations. The other pollutants described in Table 1 and Appendix C, Table 1 of ASHRAE Standard 62-1989 can be predicted by extrapolating their concentrations for the entire 72-hour period.
d)  The ability of the emergency air supply to maintain the main control room at the proper positive pressure is demonstrated, verifying proper operation of the main control room pressure relief dampers.
e)  The ability of the emergency air supply to limit air inleakage to the main control room is verified by inleakage testing as specified in subsection 6.4.5.4.
f)  The ability to maintain the main control room environment within specified limits for 72 hours (Reference subsection 6.4.3.2) is verified with a test simulating a loss of the nuclear island nonradioactive ventilation system. This testing demonstrates the control room heatup from 0 to 6 hours with the actual heat loads from the battery powered equipment and personnel specified for this time period (for the MCR [room 12401], there is automatic de-energization of specific nonsafety-related MCR heat loads). The control room temperature versus time versus heat load data are used to verify the analysis basis used to assure that the control room conditions remain within specified limits for the 72 hour time period. Periodic grab samples will be taken of the control room air environment to support analyses to confirm that specified limits would not be exceeded for 72 hours.
g)  The ability to maintain temperatures in the protection and safety monitoring system cabinet and emergency switchgear rooms within specified limits for 72 hours (Reference subsection 6.4.3.2) is verified with a test simulating a loss of the nuclear island nonradioactive ventilation system. This testing demonstrates the room heatup from 0 to Tier 2 Material                                      14.2-28                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          468
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-2 (Sheet 7 of 17)
DESIGN BASIS ACCIDENT ANALYSIS Reference                              Design Feature                            Value Section    6.3.6.1.3    The bottom of the in-containment refueling water storage    3.4 tank is located above the direct vessel injection nozzle centerline (ft).
Section    6.3.6.1.3    The pH baskets are located below plant elevation 107 2.
Figure    6.3-1        The passive core cooling system has two direct vessel injection lines.
Table      6.3-2        The passive core cooling system has two core makeup tanks, 2500 each with a minimum required volume (ft3).
Table      6.3-2        The passive core cooling system has two accumulators, each 2,000 with a minimum required volume (ft3)
Table      6.3-2        The passive core cooling system has an in-containment      73,900 refueling water storage tank with a minimum required water volume (ft3)
Section    6.3.2.2.3    The containment floodup volume for a LOCA in PXS          73,500 room B has a maximum volume (ft3) (excluding the IRWST) below a containment elevation of 108 feet.
Table      6.3-2        Each sparger has a minimum discharge flow area (in2).      274 Table      6.3-2        The passive core cooling system has two pH adjustment      280 baskets each with a minimum required volume (ft3).
Section    14.2.9.1.3f  The passive residual heat removal heat exchanger minimum natural circulation heat transfer rate (Btu/hr)
                        - With 520&deg;F hot leg and 80&deg;F IRWST                        1.78 E+08
                        - With 420&deg;F hot leg and 80&deg;F IRWST                        1.11 E+08 Section    6.3.6.1.3    The centerline of the HXs upper channel head is located    26.3 above the HL centerline (ft).
Figure    6.3-1        The CMT level sensors (PXS-11A/B/C/D, -12A/B/C/D,          1 +/- 1
                        -13A/B/C/D, and -14A/B/C/D) upper level tap centerlines are located below the centerline of the upper level tap connection to the CMTs (in).
Figure    6.3-1        The CMT inlet lines (cold leg to high point) have no downward sloping sections.
Figure    6.3-1        The maximum elevation of the CMT injection lines between the connection to the CMT and the reactor vessel is the connection to the CMTs.
Figure    6.3-1        The PRHR inlet line (hot leg to high point) has no downward sloping sections.
Tier 2 Material                                  14.3-23                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                469
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-2 (Sheet 8 of 17)
DESIGN BASIS ACCIDENT ANALYSIS Reference                              Design Feature                          Value Figure    6.3-1        The maximum elevation of the IRWST injection lines (from the connection to the IRWST to the reactor vessel) and the containment recirculation lines (from the containment to the IRWST injection lines) is less than the bottom inside surface of the IRWST.
Figure    6.3-1        The maximum elevation of the PRHR outlet line (from the PRHR to the SG) is less than the PRHR lower channel head top inside surface.
Section    7.1.2.10    Isolation devices are used to maintain the electrical independence of divisions and to see that no interaction occurs between nonsafety-related systems and the safety-related system. Isolation devices serve to prevent credible faults in circuit from propagating to another circuit.
Section    7.1.4.2      The ability of the protection and safety monitoring system to initiate and accomplish protective functions is maintained despite degraded conditions caused by internal events such as fire, flooding, explosions, missiles, electrical faults and pipe whip.
Section    7.1.2        The flexibility of the protection and safety monitoring system enables physical separation of redundant divisions.
Section    7.2.2.2.1    The protection and safety monitoring system initiates a reactor trip whenever a condition monitored by the system reaches a preset level.
Section    7.2.2.2.8    The reactor is tripped by actuating one of two manual reactor trip controls from the main control room.
Section    7.3.1.2.2    The in-containment refueling water storage tank is aligned for injection upon actuation of the fourth stage automatic depressurization system via the protection and safety monitoring system.
Section    7.3.1.2.3    The core makeup tanks are aligned for operation on a safeguards actuation signal or on a low-2 pressurizer level signal via the protection and safety monitoring system.
Section    7.3.1.2.4    The fourth stage valves of the automatic depressurization system receive a signal to open upon the coincidence of a low-2 core makeup tank water level in either core makeup tank and low reactor coolant system pressure following a preset time delay after the third stage depressurization valves receive a signal to open via the protection and safety monitoring system.
Tier 2 Material                                  14.3-24                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                              470
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-7 (Sheet 1 of 3)
RADIOLOGICAL ANALYSIS Reference                              Design Feature                                Value Table      2-1          Plant elevation for maximum flood level (ft)                    100 Section    2.3.4        Atmospheric dispersion factors - X/Q (sec/m3)
                        - Site Boundary X/Q 0 - 2 hour time interval                                    5.1 x 10-4
                        - Low Population Zone Boundary X/Q 0 - 8 hours                                                2.2 x 10-4 8 - 24 hours                                              1.6 x 10-4 24 - 96 hours                                                1.0 x 10-4 96 - 720 hours                                              8.0 x 10-5 Table      6.2.3-1      Containment penetration isolation features are configured as in Table 6.2.3-1 Table      6.2.3-1      Maximum closure time for remotely operated containment          10 purge valves (seconds)
Table      6.2.3-1      Maximum closure time for all other remotely operated            60 containment isolation valves (seconds)
Section    6.4.2.3      The minimum storage capacity of all storage tanks in the        327,574 VES (scf)
Section    6.4.4        The maximum temperature in the instrumentation and              120 control rooms and dc equipment rooms following a loss of the nuclear island nonradioactive ventilation system remains over a 72-hour period (&deg;F).
Section    6.4.4        The main control emergency habitability system nominally      65 +/- 5 provides 65 scfm of ventilation air to the main control room from the compressed air storage tanks.
Section    6.4.4        Sixty-five +/- five scfm of ventilation flow is sufficient to    1/8th pressurize the control room to 1/8th inch water gauge differential pressure (WIC).
Section    6.4.5.1      The maximum temperature in the main control room              95 pressure boundary following a loss of the nuclear island nonradioactive ventilation system over a 72-hour period (&deg;F)
(dry bulb temperature).
Figure    6.4-2        The main control room emergency habitability system consists of two sets of emergency air storage tanks and an air delivery system to the main control room.
Tier 2 Material                                  14.3-49                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                    471
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 14. Initial Test Program                                            AP1000 Design Control Document Table 14.3-7 (Sheet 2 of 3)
RADIOLOGICAL ANALYSIS Reference                              Design Feature                            Value Section    6.5.3        The passive heat removal process and the limited leakage from the containment result in offsite doses less than the regulatory guideline limits.
Section    8.3.1.1.6    Electrical penetrations through the containment can withstand the maximum short-circuit currents available either continuously without exceeding their thermal limit, or at least longer than the field cables of the circuits so that the fault or overload currents are interrupted by the protective devices prior to a potential failure of a penetration.
Section    9.4.1.1.1    The VBS isolates the HVAC ductwork that penetrates the main control room boundary on High-2particulate or iodine concentration in the main control room supply air, extended Low main control room differential pressure, or on extended loss of ac power to support operation of the main control room emergency habitability system.
Section    12.3.2.2.1  During reactor operation, the shield building protects personnel occupying adjacent plant structures and yard areas from radiation originating in the reactor vessel and primary loop components. The concrete shield building wall and the reactor vessel and steam generator compartment shield walls reduce radiation levels outside the shield building to less than 0.25 mrem/hr from sources inside containment. The shield building completely surrounds the reactor components.
Section    12.3.2.2.2  The reactor vessel is shielded by the concrete primary shield and by the concrete secondary shield which also surrounds other primary loop components. The secondary shield is a structural module filled with concrete surrounding the reactor coolant system equipment, including piping, pumps and steam generators. Extensive shielding is provided for areas surrounding the refueling cavity and the fuel transfer canal to limit the radiation levels.
Tier 2 Material                                  14.3-50                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                472
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document than the steady-state fission power shape, reducing the energy deposited in the hot rod at the expense of adjacent colder rods. A conservative estimate of this effect on the hot rod is a reduction of 10 percent of the gamma ray contribution or 3 percent of the total heat. Because the water density is considerably reduced at this time, an average of 98 percent of the available heat is deposited in the fuel rods; the remaining 2 percent is absorbed by water, thimbles, sleeves, and grids. Combining the 3 percent total heat reduction from gamma redistribution with this 2 percent absorption produce as the net effect a factor of 0.95, which exceeds the actual heat production in the hot rod. The actual hot rod heat generation is computed during the AP1000 large-break LOCA transient as a function of core fluid conditions.
15.0.11    Computer Codes Used Summaries of some of the principal computer codes used in transient analyses are given as follows. Other codes - in particular, specialized codes in which the modeling has been developed to simulate one given accident, such as those used in the analysis of the reactor coolant system pipe rupture (see subsection 15.6.5) - are summarized in their respective accident analyses sections. The codes used in the analyses of each transient are listed in Table 15.0-2.
WCAP-15644 (Reference 11) provides the basis for use of analysis codes.
15.0.11.1  FACTRAN Computer Code FACTRAN (Reference 5) calculates the transient temperature distribution in a cross section of a metal-clad UO2 fuel rod and the transient heat flux at the surface of the cladding using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, and density). The code uses a fuel model which simultaneously exhibits the following features:
x    A sufficiently large number of radial space increments to handle fast transients x    Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation x    The necessary calculations to handle post-DNB transients: film boiling heat transfer correlations, zircaloy-water reaction, and partial melting of the materials FACTRAN is further discussed in WCAP-7908-A (Reference 5).
15.0.11.2  LOFTRAN Computer Code The LOFTRAN (Reference 6) program is used for studies of transient response of a pressurized water reactor system to specified perturbations in process parameters. LOFTRAN simulates a multiloop system by a model containing reactor vessel, hot and cold leg piping, steam generator (tube and shell sides), and pressurizer. The pressurizer heaters, spray, and safety valves are also considered in the program. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron, and rods are included. The secondary side of the steam generator uses a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and control. The protection and safety monitoring system is simulated to include reactor trips on high neutron flux, overtemperature T, high and low pressure, low flow, and high pressurizer level. Control systems are also simulated, including rod control, steam dump, Tier 2 Material                                      15.0-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        473
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 15.0.11.5  COAST Computer Program The COAST computer program is used to calculate the reactor coolant flow coastdown transient for any combination of active and inactive pumps and forward or reverse flow in the hot or cold legs. The program is described in Reference 13 and was referenced in Reference 12. The program was approved in Reference 14.
The equations of conservation of momentum are written for each of the flow paths of the COAST model assuming unsteady one-dimensional flow of an incompressible fluid. The equation of conservation of mass is written for the appropriate nodal points. Pressure losses due to friction, and geometric losses are assumed proportional to the flow velocity squared. Pump dynamics are modeled using a head-flow curve for a pump at full speed and using four-quadrant curves, which are parametric diagrams of pump head and torque on coordinates of speed versus flow, for a pump at other than full speed.
15.0.11.6  ANC Computer Code The ANC computer code is used to solve the two-group neutron diffusion equation in three spatial dimensions. ANC can also solve the three-dimensional kinetics equations for six delayed neutron groups.
15.0.12    Component Failures 15.0.12.1  Active Failures SECY-77-439 (Reference 9) provides a description of active failures. An active failure results in the inability of a component to perform its intended function.
An active failure is defined differently for different components. For valves, an active failure is the failure of a component to mechanically complete the movement required to perform its function. This includes the failure of a remotely operated valve to change position on demand.
The spurious, unintended movement of the valve is also considered as an active failure. Failure of a manual valve to change position under local operator action is included.
Spring-loaded safety or relief valves that are designed for and operate under single-phase fluid conditions are not considered for active failures to close when pressure is reduced below the valve set point. However, when valves designed for single-phase flow are challenged with two-phase flow, such as a steam generator or pressurizer safety valve, the failure to reseat is considered as an active failure.
For other active equipment - such as pumps, fans, and rotating mechanical components - an active failure is the failure of the component to start or to remain operating.
For electrical equipment, the loss of power, such as the loss of offsite power or the loss of a diesel generator, is considered as a single failure. In addition, the failure to generate an actuation signal, either for a single component actuation or for a system-level actuation, is also considered as an active failure.
Tier 2 Material                                      15.0-12                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          474
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document A single incorrect or omitted operator action in response to an initiating event is also considered as an active failure; the error is limited to manipulation of safety-related equipment and does not include thought-process errors or similar errors that could potentially lead to common cause or multiple errors.
15.0.12.2  Passive Failures SECY-77-439 also provides a description of passive failures. A passive failure is the structural failure of a static component that limits the effectiveness of the component in carrying out its design function. A passive failure is applied to fluid systems and consists of a breach in the fluid system boundary. Examples include cracking of pipes, sprung flanges, or valve packing leaks.
Passive failures are not assumed to occur until 24 hours after the start of the event. Consequential effects of a pipe leak - such as flooding, jet impingement, and failure of a valve with a packing leak - must be considered.
Where piping is significantly overdesigned or installed in a system where the pressure and temperature conditions are relatively low, passive leakage is not considered a credible failure mechanism. Line blockage is also not considered as a passive failure mechanism.
15.0.12.3  Limiting Single Failures The most limiting single active failure (where one exists), as described in Section 3.1, of safety-related equipment, is identified in each analysis description. The consequences of this failure are described therein. In some instances, because of redundancy in protection equipment, no single failure that could adversely affect the consequences of the transient is identified. The failure assumed in each analysis is listed in Table 15.0-7.
15.0.13    Operator Actions For events where the PRHR heat exchanger is actuated, the plant automatically cools down to a safe, stable condition. Where a stabilized condition is reached automatically following a reactor trip, it is expected that the operator may, following event recognition, take manual control and proceed with orderly shutdown of the reactor in accordance with the normal, abnormal, or emergency operating procedures. The exact actions taken and the time at which these actions occur depend on what systems are available and the plans for further plant operation.
However, for these events, operator actions are not required to maintain the plant in a safe and stable condition for at least 72 hours. Operator actions typical of normal operation are credited for the inadvertent actuations of equipment in response to a Condition II event.
15.0.14    Loss of Offsite ac Power As required in GDC 17 of 10 CFR Part 50, Appendix A, anticipated operational occurrences and postulated accidents are analyzed assuming a loss of offsite ac power. The loss of offsite power is not considered as a single failure, and the analysis is performed without changing the event category. In the analyses, the loss of offsite ac power is considered to be a potential consequence of the event.
Tier 2 Material                                      15.0-13                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        475
 
DCP_NRC_003343                                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                                                          AP1000 Design Control Document Table 15.0-2 (Sheet 4 of 5)
 
==SUMMARY==
OF INITIAL CONDITIONS AND COMPUTER CODES USED Reactivity Coefficients Assumed Computer              Moderator              Moderator                          Initial Thermal Codes                Density            Temperature                          Power Output Section                Faults                    Used              ('k/gm/cm3)              (pcm/&deg;F)            Doppler      Assumed (MWt) 15.4    Chemical and volume control      NA                          NA                      -        NA                    0 and 3415 system malfunction that results in a decrease in the boron concentration in the reactor coolant Inadvertent loading and          ANC                          NA                      -        NA                        3415 operation of a fuel assembly in an improper position Spectrum of RCCA ejection        ANC, VIPRE          Refer to subsection          Refer to    Refer to subsection Refer to subsection accidents                                            15.4.8                      subsection    15.4.8                    15.4.8 15.4.8 15.5    Increase in reactor coolant inventory Inadvertent operation of the      LOFTRAN                      0.0                    -        Upper curve of          3483.3 (a) emergency core cooling system                                                                  Figure 15.04-1 during power operation Chemical and volume control      LOFTRAN                      0.0                    -        Upper curve of          3483.3 (a) system malfunction that increases                                                              Figure 15.04-1 reactor coolant inventory Tier 2 Material                                                      15.0-21                                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                            476
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document water storage tank (IRWST). The PRHR heat exchanger is normally actuated automatically when the steam generator level falls below the low wide-range level. For the main steam line rupture case analyzed, the PRHR exchanger is conservatively actuated at time zero to maximize the cooldown.
15.1.5.2.4 Margin to Critical Heat Flux The case presented in subsection 15.1.5.2.2 conservatively models the expected behavior of the plant during a steam system piping failure. This includes the tripping of the reactor coolant pumps coincident with core makeup tank actuation. A DNB analysis is performed using limiting assumptions that bound those of subsection 15.1.5.2.2.
Under the low flow (natural circulation) conditions present in the AP1000 transient, the return to power is severely limited by the large negative feedback due to flow and power. The minimum DNBR is conservatively calculated and is above the 95/95 limit.
15.1.5.3    Conclusions The analysis shows that the DNB design basis is met for the steam system piping failure event.
DNB and possible cladding perforation following a steam pipe rupture are not precluded by the criteria. The preceding analysis shows that no DNB occurs for the main steam line rupture assuming the most reactive RCCA stuck in its fully withdrawn position.
15.1.5.4    Radiological Consequences The evaluation of the radiological consequences of a postulated main steam line break outside containment assumes that the reactor has been operating with the design basis fuel defect level (0.25 percent of power produced by fuel rods containing cladding defects) and that leaking steam generator tubes have resulted in a buildup of activity in the secondary coolant.
Following the rupture, startup feedwater to the faulted loop is isolated and the steam generator is allowed to steam dry. Any radioiodines carried from the primary coolant into the faulted steam generator via leaking tubes are assumed to be released directly to the environment. It is conservatively assumed that the reactor is cooled by steaming from the intact loop.
15.1.5.4.1 Source Term The only significant radionuclide releases due to the main steam line break are the iodines and alkali metals that become airborne and are released to the environment as a result of the accident.
Noble gases are also released to the environment. Their impact is secondary because any noble gases entering the secondary side during normal operation are rapidly released to the environment.
The analysis considers two different reactor coolant iodine source terms, both of which consider the iodine spiking phenomenon. In one case, the initial iodine concentrations are assumed to be those associated with equilibrium operating limits for primary coolant iodine activity. The iodine spike is assumed to be initiated by the accident with the spike causing an increasing level of iodine in the reactor coolant.
Tier 2 Material                                    15.1-18                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      477
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document The second case assumes that the iodine spike occurs prior to the accident and that the maximum resulting reactor coolant iodine concentration exists at the time the accident occurs.
The reactor coolant noble gas concentrations are assumed to be those associated with equilibrium operating limits for primary coolant noble gas activity. The reactor coolant alkali metal concentrations are assumed to be those associated with the design basis fuel defect level.
The secondary coolant is assumed to have an iodine source term of 0.01 PCi/g dose equivalent I-131. This is 1 percent of the maximum primary coolant activity at equilibrium operating conditions. The secondary coolant alkali metal concentration is also assumed to be 1 percent of the primary concentration.
15.1.5.4.2 Release Pathways There are three components to the accident releases:
x    The secondary coolant in the steam generator of the faulted loop is assumed to be released out the break as steam. Any iodine and alkali metal activity contained in the coolant is assumed to be released.
x    The reactor coolant leaking into the steam generator of the faulted loop is assumed to be released to the environment without any credit for partitioning or plateout onto the interior of the steam generator.
x    The reactor coolant leaking into the steam generator of the intact loop would mix with the secondary coolant and thus raise the activity concentrations in the secondary water. While the steam release from the intact loop would have partitioning of non-gaseous activity, this analysis conservatively assumes that any activity entering the secondary side is released.
Credit is taken for decay of radionuclides until release to the environment. After release to the environment, no consideration is given to radioactive decay or to cloud depletion by ground deposition during transport offsite.
15.1.5.4.3 Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.1.5.4.4 Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.1.5-1.
15.1.5.4.5 Identification of Conservatisms The assumptions and parameters used in the analysis contain a number of significant conservatisms:
x    The reactor coolant activities are based on a fuel defect level of 0.25 percent. The expected fuel defect level is far less than this (see Section 11.1).
Tier 2 Material                                      15.1-19                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      478
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document x    The assumed leakage of 150 gallons of reactor coolant per day into each steam generator is conservative. The leakage is expected to be a small fraction of this during normal operation.
x    The conservatively selected meteorological conditions are present only rarely.
15.1.5.4.6 Doses Using the assumptions from Table 15.1.5-1, the calculated total effective dose equivalent (TEDE) doses for the case with accident-initiated iodine spike are determined to be less than 0.6 rem at the site boundary for the limiting 2-hour interval (4.8 to 6.8 hours) and 1.1 rem at the low population zone outer boundary. These doses are small fractions of the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34. A small fraction is defined, consistent with the Standard Review Plan, as being 10 percent or less. The TEDE doses for the case with pre-existing iodine spike are determined to be less than 0.5 rem at the site boundary for the limiting 2-hour interval (0 to 2 hours) and 0.4 rem at the low population zone outer boundary. These doses are within the dose guidelines of 10 CFR Part 50.34.
At the time the main steam line break occurs, the potential exists for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. The 30-day contribution to the dose at the site boundary and the low population zone boundary is less than 0.01 rem TEDE. When this is added to the dose calculated for the main steam line break, the resulting total dose remains less than the values reported above.
15.1.6      Inadvertent Operation of the PRHR Heat Exchanger 15.1.6.1    Identification of Causes and Accident Description The inadvertent actuation of the PRHR heat exchanger causes an injection of relatively cold water into the reactor coolant system. This produces a reactivity insertion in the presence of a negative moderator temperature coefficient. To prevent this reactivity increase from causing reactor power increase, a reactor trip is initiated when either PRHR discharge valve comes off of its fully shut seat.
The inadvertent actuation of the PRHR heat exchanger could be caused by operator error or a false actuation signal, or by malfunction of a discharge valve. Actuation of the PRHR heat exchanger involves opening one of the isolation valves, which establishes a flow path from one reactor coolant system hot leg, through the PRHR heat exchanger, and back into its associated steam generator cold leg plenum.
The PRHR heat exchanger is located above the core to promote natural circulation flow when the reactor coolant pumps are not operating. With the reactor coolant pumps in operation, flow through the PRHR heat exchanger is enhanced. The heat sink for the PRHR heat exchanger is provided by the IRWST, in which the PRHR heat exchanger is submerged. Because the fluid in the heat exchanger is in thermal equilibrium with water in the tank, the initial flow out of the PRHR heat exchanger is significantly colder than the reactor coolant system fluid. Following this initial insurge, the reduction in cold leg temperature is limited by the cooling capability of the Tier 2 Material                                      15.1-20                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        479
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.1.5-1 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A MAIN STEAM LINE BREAK Reactor coolant iodine activity
      -    Accident-initiated spike              Initial activity equal to the equilibrium operating limit for reactor coolant activity of 1.0 PCi/g dose equivalent I-131 with an assumed iodine spike that increases the rate of iodine release from fuel into the coolant by a factor of 500 (see Appendix 15A).
Duration of spike is 5 hours.
      -    Preaccident spike                    An assumed iodine spike that has resulted in an increase in the reactor coolant activity to 60 PCi/g of dose equivalent I-131 (see Appendix 15A)
Reactor coolant noble gas activity            Equal to the operating limit for reactor coolant activity of 280 PCi/g dose equivalent Xe-133 Reactor coolant alkali metal activity          Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and alkali    1% of reactor coolant concentrations at maximum equilibrium metal activity                                conditions Duration of accident (hr)                      72 Atmospheric dispersion (/Q) factors          See Table 15A-5 in Appendix 15A Steam generator in faulted loop
      -    Initial water mass (lb)              3.32 E+05
      -    Primary to secondary leak rate        52.25(a)
(lb/hr)
      -    Iodine partition coefficient          1.0
      -    Steam released (lb) 0 - 2 hr                              3.321 E+05 2 - 72 hr                            3.66 E+03 Steam generator in intact loop
      -    Primary to secondary leak rate        52.25(a)
(lb/hr)
      -    Iodine partition coefficient          1.0
      -    Steam released (lb) 0 - 2 hr                              3.321 E+05 2 - 72 hr                            3.66 E+03 Nuclide data                                  See Table 15A-4 Note:
: a. Equivalent to 150 gpd cooled liquid at 62.4 lb/ft3.
Tier 2 Material                                        15.1-25                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  480
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.2        Decrease in Heat Removal by the Secondary System A number of transients and accidents that could result in a reduction of the capacity of the secondary system to remove heat generated in the reactor coolant system are postulated.
Analyses are presented in this section for the following events that are identified as more limiting than the others:
x    Steam pressure regulator malfunction or failure that results in decreasing steam flow x    Loss of external electrical load x    Turbine trip x    Inadvertent closure of main steam isolation valves x    Loss of condenser vacuum and other events resulting in turbine trip x    Loss of ac power to the station auxiliaries x    Loss of normal feedwater flow x    Feedwater system pipe break The above items are considered to be Condition II events, with the exception of a feedwater system pipe break, which is considered to be a Condition IV event.
For events in this section where PRHR heat exchanger actuation occurs, transients are presented until the PRHR heat exchanger heat removal matches decay heat generation. After that point in time, PRHR heat exchanger performance is driven by the performance of the passive containment cooling systems to control containment pressure and the ability of the condensate collection features to return condensate to the in-containment refueling water storage tank. The performance of these systems, for extended decay heat removal, is described in Subsection 6.3.1.1.1.
The radiological consequences of the accidents in this section are bounded by the radiological consequences of a main steam line break (see subsection 15.1.5).
15.2.1      Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow There are no steam pressure regulators in the AP1000 whose failure or malfunction causes a steam flow transient.
15.2.2      Loss of External Electrical Load 15.2.2.1    Identification of Causes and Accident Description A major load loss on the plant can result from loss of electrical load due to an electrical system disturbance. The ac power remains available to operate plant components such as the reactor coolant pumps; as a result, the standby onsite diesel generators do not function for this event.
Following the loss of generator load, an immediate fast closure of the turbine control valves occurs. The automatic turbine bypass system accommodates the excess steam generation.
Reactor coolant temperatures and pressure do not significantly increase if the turbine bypass system and pressurizer pressure control system function properly. If the condenser is not available, the excess steam generation is relieved to the atmosphere. Additionally, main Tier 2 Material                                      15.2-1                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        481
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 15.2.4      Inadvertent Closure of Main Steam Isolation Valves Inadvertent closure of the main steam isolation valves results in a turbine trip with no credit taken for the turbine bypass system. Turbine trips are discussed in subsection 15.2.3.
15.2.5      Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in subsection 15.2.3. A loss of condenser vacuum prevents the use of steam dump to the condenser. Because steam dump is assumed to be unavailable in the turbine trip analysis, no additional adverse effects result if the turbine trip is caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in subsection 15.2.3 apply to the loss of the condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, listed in subsection 15.2.3.1, are covered by subsection 15.2.3. Possible overfrequency effects, due to a turbine overspeed condition, are discussed in subsection 15.2.2.1 and are not a concern for this type of event.
15.2.6      Loss of ac Power to the Plant Auxiliaries 15.2.6.1    Identification of Causes and Accident Description The loss of power to the plant auxiliaries is caused by a complete loss of the offsite grid accompanied by a turbine-generator trip. The onsite standby ac power system remains available but is not credited to mitigate the accident.
From the decay heat removal point of view, in the long term this transient is more severe than the turbine trip event analyzed in subsection 15.2.3 because, for this case, the decrease in heat removal by the secondary system is accompanied by a reactor coolant flow coastdown, which further reduces the capacity of the primary coolant to remove heat from the core. The reactor will trip:
x    Upon reaching one of the trip setpoints in the primary or secondary systems as a result of the flow coastdown and decrease in secondary heat removal.
x    Due to the loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.
Following a loss of ac power with turbine and reactor trips, the sequence described below occurs:
x    Plant vital instruments are supplied from the Class 1E and uninterruptable power supply.
x    As the steam system pressure rises following the trip, the steam generator power-operated relief valves may be automatically opened to the atmosphere. The condenser is assumed not to be available for turbine bypass. If the steam flow rate through the power-operated relief valves is not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
Tier 2 Material                                      15.2-9                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          482
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document x    The onsite standby power system, if available, supplies ac power to the selected plant non-safety loads.
x    As the no-load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition if the startup feedwater is available to supply water to the steam generators.
x    If startup feedwater is not available, the PRHR heat exchanger is actuated.
During a plant transient, core decay heat removal is normally accomplished by the startup feedwater system if available, which is started automatically when low levels occur in either steam generator. If that system is not available, emergency core decay heat removal is provided by the PRHR heat exchanger. The PRHR heat exchanger is a C-tube heat exchanger connected, through inlet and outlet headers, to the reactor coolant system. The inlet to the heat exchanger is from the reactor coolant system hot leg, and the return is to the steam generator outlet plenum.
The heat exchanger is located above the core to provide natural circulation flow when the reactor coolant pumps are not operating. The IRWST provides the heat sink for the heat exchanger. The PRHR heat exchanger, in conjunction with the passive containment cooling system, provides core cooling and maintains reactor coolant system conditions to satisfy the evaluation criteria.
After the IRWST water reaches saturation, steam starts to vent to the containment atmosphere.
The condensation that collects on the containment steel shell (cooled by the passive containment cooling system) returns to the IRWST, maintaining fluid level for the PRHR heat exchanger heat sink. The analysis shows that the natural circulation flow in the reactor coolant system following a loss of ac power event is sufficient to remove residual heat from the core.
Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant and PRHR loops.
A loss of ac power to the plant auxiliaries is a Condition II event, a fault of moderate frequency.
This event is more limiting with respect to long-term heat removal than the turbine trip initiated decrease in secondary heat removal without loss of ac power, which is discussed in subsection 15.2.3. A loss of offsite power to the plant auxiliaries will also result in a loss of normal feedwater.
The plant systems and equipment available to mitigate the consequences of a loss of ac power event are discussed in subsection 15.0.8 and listed in Table 15.0-6.
15.2.6.2    Analysis of Effects and Consequences 15.2.6.2.1 Method of Analysis The analysis is performed to demonstrate the adequacy of the protection and safety monitoring system, the PRHR heat exchanger, and the reactor coolant system natural circulation capability in removing long-term (approximately 36,000 seconds) decay heat. This analysis also demonstrates the adequacy of these systems in preventing excessive heatup of the reactor coolant system with possible reactor coolant system overpressurization or loss of reactor coolant system water.
Tier 2 Material                                      15.2-10                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          483
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 2700&deg;F. The cladding temperature is conservatively calculated, assuming that DNB occurs at the initiation of the transient. These results represent the most limiting conditions with respect to the locked rotor event or the pump shaft break.
The calculated sequence of events for the case analyzed is shown in Table 15.3-1. With the reactor tripped, a stable plant condition is eventually attained. Normal plant shutdown may then proceed.
15.3.3.3    Radiological Consequences The evaluation of the radiological consequences of a postulated locked reactor coolant pump rotor accident assumes that the reactor has been operating with the design basis fuel defect level (0.25 percent of power produced by fuel rods containing cladding defects) and that leaking steam generator tubes have resulted in a buildup of activity in the secondary coolant.
As a result of the accident, it is determined that no fuel rods are damaged such that the activity contained in the fuel-cladding gap is released to the reactor coolant. However, a conservative analysis has been performed assuming 10 percent of the rods are damaged. Activity carried over to the secondary side because of primary-to-secondary leakage is available for release to the environment via the steam line safety valves or the power-operated relief valves.
15.3.3.3.1 Source Term The significant radionuclide releases due to the locked rotor accident are the iodines, alkali metals (cesiums, rubidiums) and noble gases. The reactor coolant iodine source term assumes a pre-existing iodine spike. The initial reactor coolant noble gas and alkali metal concentrations are assumed to be those associated with the design basis fuel defect level. These initial reactor coolant activities are of secondary importance compared to the release of the gap inventory of fission products from the portion of the core assumed to fail because of the accident.
Based on NUREG-1465 (Reference 6), the fission product gap fraction is 3 percent of fuel inventory. For this analysis, the gap fraction is increased to 8 percent of the inventory for I-131, 10 percent for Kr-85, 5 percent for other iodines and noble gases and 12 percent for alkali metals.
Also, to address the fact that the failed fuel rods may have been operating at power levels above the core average, the source term is increased by the lead rod radial peaking factor.
The initial secondary coolant activity is assumed to be 1 percent of the maximum equilibrium primary coolant activity for iodines and alkali metals.
15.3.3.3.2 Release Pathways There are two components to the accident releases:
x    The activity initially in the secondary coolant is available for release as long as steam releases continue.
x    The reactor coolant leaking into the steam generators is assumed to mix with the secondary coolant. The activity from the primary coolant mixes with the secondary coolant. As steam Tier 2 Material                                        15.3-8                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          484
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.3-3 (Sheet 1 of 2)
PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A LOCKED ROTOR ACCIDENT Initial reactor coolant iodine activity        An assumed iodine spike that has resulted in an increase in the reactor coolant activity to 60 PCi/gm of dose equivalent I-131 (see Appendix 15A)(a)
Reactor coolant noble gas activity              Equal to the operating limit for reactor coolant activity of 280 PCi/gm dose equivalent Xe-133 Reactor coolant alkali metal activity          Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and alkali    1% of design basis reactor coolant concentrations at maximum metal activity                                  equilibrium conditions Fraction of fuel rods assumed to fail          0.10 Core activity                                  See Table 15A-3 Radial peaking factor (for determination of    1.75 activity in failed fuel rods)
Fission product gap fractions I-131                                      0.08 Kr-85                                      0.10 Other iodines and noble gases              0.05 Alkali metals                              0.12 Reactor coolant mass (lb)                      3.7 E+05 Secondary coolant mass (lb)                    6.04 E+05 Condenser                                      Not available Atmospheric dispersion factors                  See Table 15A-5 Primary to secondary leak rate (lb/hr)          104.5(b)
Partition coefficient in steam generators iodine                                    0.01 alkali metals                              0.0035 Accident scenario in which startup feedwater is not available Duration of accident (hr)                  1.5 hr Steam released (lb) 0-1.5 hours(c)                        6.48 E+05 Leak flashing fraction(d) 0-60 minutes                          0.04
          > 60 minutes                          0 Tier 2 Material                                        15.3-14                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                485
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.4.8.1.1.2 Nuclear Design If a rupture of an RCCA drive mechanism housing is postulated, the operation using chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the power control (or mechanical shim) RCCAs inserted only far enough to permit load follow. The axial offset RCCAs are positioned so that the targeted axial offset can be met throughout core life. Reactivity changes caused by core depletion and xenon transients are normally compensated for by boron changes and the mechanical shim banks, respectively.
Further, the location and grouping of the power control and axial offset RCCAs are selected with consideration for an RCCA ejection accident. Therefore, should an RCCA be ejected from its normal position during full-power operation, a less severe reactivity excursion than analyzed is expected.
It may occasionally be desirable to operate with larger than normal insertions. For this reason, a power control and axial offset rod insertion limit is defined as a function of power level.
Operation with the RCCAs above this limit provides adequate shutdown capability and an acceptable power distribution. The position of the RCCAs is continuously indicated in the main control room. An alarm occurs if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions require boration at the low level alarm and emergency boration at the low-low level alarm.
15.4.8.1.1.3 Reactor Protection The reactor protection in the event of a rod ejection accident is described in WCAP-15806-P-A (Reference 4). The protection for this accident is provided by the high neutron flux trip (high and low setting) and the high rate of neutron flux increase trip. These protection functions are described in Section 7.2.
15.4.8.1.1.4 Effects on Adjacent Housings Failures of an RCCA mechanism housing, due to either longitudinal or circumferential cracking, does not cause damage to adjacent housings. The control rod drive mechanism is described in subsection 3.9.4.1.1.
15.4.8.1.1.5 Not Used 15.4.8.1.1.6 Not Used 15.4.8.1.1.7 Consequences The probability of damage to an adjacent housing is considered remote. If damage is postulated, it is not expected to lead to a more severe transient because RCCAs are inserted in the core in symmetric patterns and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal. This is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.
Tier 2 Material                                    15.4-27                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        486
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 15.4.8.1.1.8 Summary Failure of a control rod housing does not cause damage to adjacent housings that increase the severity of the initial accident.
15.4.8.1.2 Limiting Criteria This event is a Condition IV incident (ANSI N18.2). See subsection 15.0.1 for a discussion of ANS classification. Because of the extremely low probability of an RCCA ejection accident, some fuel damage is considered an acceptable consequence.
NUREG-0800 Standard Review Plan (SRP) 4.2 Revision 3 (Reference 24) interim criteria applicable to new plant design certification are applied to provide confidence that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves.
These criteria are the following:
x    The pellet clad mechanical interaction (PCMI) failure criteria is a change in radial average fuel enthalpy greater than the corrosion-dependent limit depicted in Figure B-1 of SRP 4.2 Revision 3 Appendix B.
x    The high cladding temperature failure criteria for zero power conditions is a peak radial average fuel enthalpy greater than 170 cal/g for fuel rods with an internal rod pressure at or below system pressure and 150 cal/g for fuel rods with an internal rod pressure exceeding system pressure.
x    For intermediate (greater than 5% rated thermal power) and full power conditions, fuel cladding is presumed to fail if local heat flux exceeds thermal design limits (e.g. DNBR).
x  For core coolability, it is conservatively assumed that the average fuel pellet enthalpy at the hot spot remains below 200 cal/g (360 btu/lb) for irradiated fuel. This bounds non-irradiated fuel, which has a slightly higher enthalpy limit.
x  For core coolability, the peak fuel temperature must remain below incipient fuel melting conditions.
x  Mechanical energy generated as a result of (1) non-molten fuel-to-coolant interaction and (2) fuel rod burst must be addressed with respect to reactor pressure boundary, reactor internals, and fuel assembly structural integrity.
x  No loss of coolable geometry due to (1) fuel pellet and cladding fragmentation and dispersal and (2) fuel rod ballooning.
x  Peak reactor coolant system pressure is less than that which could cause stresses to exceed the Service Limit C as defined in the ASME code.
Tier 2 Material                                      15.4-28                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                          487
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.4.8.2    Analysis of Effects and Consequences Method of Analysis The calculation of the RCCA ejection transients is performed in two stages: first, an average core calculation and then, a hot rod calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time, including the various total core feedback effects (Doppler reactivity and moderator reactivity). Enthalpy, fuel temperature and DNB transients are then determined by performing a conservative fuel rod transient heat transfer calculation.
A discussion of the method of analysis appears in WCAP-15806-P-A (Reference 4).
Average Core Analysis The three-dimensional nodal code ANC (References 14, 15, 16, 17, 21, 22 and 27) is used for the average core transient analysis. This code solves the two-group neutron diffusion theory kinetic equation in 3 spatial dimensions (rectangular coordinates) for 6 delayed neutron groups, The core moderator and fuel temperature feedbacks are based on the NRC approved Westinghouse version of the VIPRE-01 code and methods (References 18 and 19).
Hot Rod Analysis The hot fuel rod models are based on the Westinghouse VIPRE models described in WCAP-15806-P-A (Reference 4). The hot rod model represents the hottest fuel rod from any channel in the core. VIPRE performs the hot rod transients for fuel enthalpy, temperature and DNBR using as input the time-dependent nuclear core power and power distribution from the core average analysis. A description of the VIPRE code is provided in Reference 18.
System Overpressure Analysis If the fuel coolability limits are not exceeded, the fuel dispersal into the coolant or a sudden pressure increase from thermal to kinetic energy conversion is not needed to be considered in the overpressure analysis. Therefore, the overpressure condition may be calculated on the basis of conventional fuel rod to coolant heat transfer and the prompt heat generation in the coolant. The system overpressure analysis is conducted by first performing the core power response analysis to obtain the nuclear power transient (versus time) data. The nuclear power data is then used as input to a plant transient computer code to calculate the peak reactor coolant system pressure.
This code calculates the pressure transient, taking into account fluid transport in the reactor coolant system and heat transfer to the steam generators. For conservatism, no credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.
15.4.8.2.1 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected as described in Reference 4.
Tier 2 Material                                    15.4-29                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      488
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 15.4.8.2.1.1 Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using three-dimensional methods. Standard nuclear design codes are used in the analysis. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation.
Appropriate safety analysis allowances are added to the ejected rod worth and hot channel factors to account for calculational uncertainties, including an allowance for nuclear peaking due to densification as discussed in Reference 4.
15.4.8.2.1.2 Not Used 15.4.8.2.1.3 Moderator and Doppler Coefficients The critical boron concentration is adjusted in the nuclear code to obtain a moderator temperature coefficient that is conservative compared to actual design conditions for the plant consistent with Reference 4. The fuel temperature feedback in the neutronics code is reduced consistent with Reference 4 requirements.
15.4.8.2.1.4 Delayed Neutron Fraction, Eeff Calculations of the effective delayed neutron fraction (Eeff) typically yield values no less than 0.50 percent at the end of cycle. The accident is sensitive to Eeff if the ejected rod worth is equal to or greater than Eeff. To allow for future cycles, a pessimistic estimate of Eeff of 0.44 percent is used in the analysis.
15.4.8.2.1.5 Trip Reactivity Insertion The trip reactivity insertion accounts for the effect of the ejected rod and one adjacent stuck rod.
The trip reactivity is simulated by dropping a limited set of rods of the required worth into the core. The start of rod motion occurs 0.9 second after the high neutron flux trip setpoint is reached. This delay is assumed to consist of 0.583 second for the instrument channel to produce a signal, 0.167 second for the trip breakers to open, and 0.15 second for the coil to release the rods.
A curve of trip rod insertion versus time is used, which assumes that insertion to the dashpot does not occur until 2.7 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over 1 second after the trip setpoint is reached before significant shutdown reactivity is inserted into the core. This conservatism is important for the hot full power accidents.
The minimum design shutdown margin available at hot zero power may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Calculations show that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown by about an additional 1-percent 'k.
Tier 2 Material                                      15.4-30                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          489
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 15.4.8.2.1.6 Reactor Protection As discussed in subsection 15.4.8.1.1.3, reactor protection for a rod ejection is provided by the high neutron flux trip (high and low setting) and the high rate of neutron flux increase trip. These protection functions are part of the protection and safety monitoring system. No single failure of the protection and safety monitoring system negates the protection functions required for the rod ejection accident or adversely affects the consequences of the accident.
15.4.8.2.1.7 Results For all cases, the core is preconditioned by assuming a fuel cycle depletion with control rod insertion that is conservative relative to expected baseload operation. All cases assume that the mechanical shim and axial offset control RCCAs are inserted to their insertion limits before the event and xenon is skewed to yield a conservative initial axial power shape. The limiting RCCA ejection cases for a typical cycle are summarized following the criteria outlined in Section 15.4.8.1.2.
x    Pellet-Clad Mechanical Interaction (PCMI) and High Clad Temperature (Hot Zero Power)
The resulting maximum fuel average enthalpy rise and maximum fuel average enthalpy are less than the criteria given in Section 15.4.8.1.2.
x    High Clad Temperature ( 5% Rated Thermal Power)
The fraction of the core calculated to have a DNBR less than the safety analysis limit is less than the amount of failed fuel assumed in the dose analysis described in Section 15.4.8.3.
x    Core Coolability The resulting maximum fuel average enthalpy is less than the criterion given in Section 15.4.8.1.2. Fuel melting is not predicted to occur at the hot spot.
There are no fuel failures due to the fuel enthalpy deposition, i.e., both fuel and cladding enthalpy limits were met. Additionally, the coolability criteria for peak fuel enthalpy and the fuel melting criteria were met. Therefore, the fuel dispersal into the coolant, a sudden pressure increase from thermal to kinetic energy conversion, gross lattice distortion, or severe shock waves are precluded.
The nuclear power transients for the limiting cases are presented in Figures 15.4.8-1 through 15.4.8-3.
The calculated sequence of events for the limiting cases are presented in Table 15.4-1. Reactor trip occurs early in the transients, after which the nuclear power excursion is terminated.
The ejection of an RCCA constitutes a break in the reactor coolant system, located in the reactor pressure vessel head. The effects and consequences of loss-of-coolant accidents (LOCAs) are discussed in subsection 15.6.5. Following the RCCA ejection, the plant response is the same as a LOCA.
Tier 2 Material                                      15.4-31                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          490
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document The consequential loss of offsite power described in subsection 15.0.14 is not limiting for the enthalpy and temperature transients resulting from an RCCA ejection accident. Due to the delay from reactor trip until turbine trip and the rapid power reduction produced by the reactor trip, the peak fuel and cladding temperatures occur before the reactor coolant pumps begin to coast down.
15.4.8.2.1.8 Fission Product Release It is assumed that fission products are released from the gaps of all rods entering DNB. In the cases considered, less than 10 percent of the rods are assumed to enter DNB based on a detailed three-dimensional kinetics and hot rod analysis. The maximum fuel average enthalpy rise of rods predicted to enter DNB will be less than 60 cal/g. Fuel melting does not occur at the hot spot.
The consequential loss of offsite power described in subsection 15.0.14 is not limiting for the calculation of the number of rods assumed to enter DNB for the RCCA ejection accident. Due to the delay from reactor trip until turbine trip and the rapid power reduction produced by the reactor trip, the minimum DNBR, for rods where the DNBR did not fall below the design limit (see Section 4.4) in the cases described, occurs before the reactor coolant pumps begin to coast down.
15.4.8.2.1.9 Peak RCS Pressure Calculations of the peak reactor coolant system pressure demonstrate that the peak pressure does not exceed that which would cause the stress to exceed the Service Level C Limit as described in the ASME Code, Section III. Therefore, the accident for this plant does not result in an excessive pressure rise or further damage to the reactor coolant system.
The consequential loss of offsite power described in subsection 15.0.14 is not limiting for the pressure surge transient resulting from an RCCA ejection accident. Due to the delay from reactor trip until turbine trip and the rapid power reduction produced by the reactor trip, the peak system pressure occurs before the reactor coolant pumps begin to coast down.
15.4.8.2.1.10 Lattice Deformations A large temperature gradient exists in the region of the hot spot. Because the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion, tending to bow the midpoint of the rods toward the hotter side of the rod.
Calculations indicate that this bowing results in a negative reactivity effect at the hot spot because the core is undermoderated, and bowing tends to increase the undermoderation at the hot spot. In practice, no significant bowing is anticipated because the structural rigidity of the core is sufficient to withstand the forces produced.
Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that crossflow is sufficient to produce lattice deformation. Even if massive and rapid boiling, sufficient to distort the lattices, is hypothetically postulated, the large void fraction in the hot spot Tier 2 Material                                        15.4-32                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                              491
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document region produces a reduction in the total core moderator to fuel ratio and a large reduction in this ratio at the hot spot. The net effect is therefore a negative feedback.
In conclusion, no credible mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.
15.4.8.3    Radiological Consequences The evaluation of the radiological consequences of a postulated rod ejection accident assumes that the reactor is operating with a limited number of fuel rods containing cladding defects and that leaking steam generator tubes result in a buildup of activity in the secondary coolant. Refer to section 15.4.8.3.1 and Table 15.4-4.
As a result of the accident, 10 percent of the fuel rods are assumed to be damaged (see subsection 15.4.8.2.1.8) such that the activity contained in the fuel-cladding gap is released to the reactor coolant. No fuel melt is calculated to occur as a result of the rod ejection (see subsection 15.4.8.2.1.8).
Activity released to the containment via the spill from the reactor vessel head is assumed to be available for release to the environment because of containment leakage. Activity carried over to the secondary side due to primary-to-secondary leakage is available for release to the environment through the steam line safety or power-operated relief valves.
15.4.8.3.1 Source Term The significant radionuclide releases due to the rod ejection accident are the iodines, alkali metals, and noble gases. The reactor coolant iodine source term assumes a pre-existing iodine spike. The reactor coolant noble gas concentrations are assumed to be those associated with equilibrium operating limits for primary coolant noble gas activity. The initial reactor coolant alkali metal concentrations are assumed to be those associated with the design fuel defect level.
These initial reactor coolant activities are of secondary importance compared to the release of fission products from the portion of the core assumed to fail.
Based on NUREG-1465 (Reference 12), the fission product gap fraction is 3 percent of fuel inventory. For this analysis, the gap fractions are modified following the guidance of Draft Guide 1199 (Reference 25), which incorporates the effects of enthalpy rise in the fuel following the reactivity insertion, consistent with Appendix B of SRP 4.2, Revision 3 (Reference 24). Draft Guide 1199 included expanded guidance for determining nuclide gap fractions available for release following a rod ejection. Reference 26 was issued as a clarification to the gap fraction guidance in Draft Guide 1199. An enthalpy rise of 60 cal/gm is used to calculate the gap fractions (see subsection 15.4.8.2.1.8). Also, to address the fact that the failed fuel rods may have been operating at power levels above the core average, the source term is increased by the lead rod radial peaking factor. No fuel melt is calculated to occur as a result of the rod ejection (see subsection 15.4.8.2.1.8).
The initial secondary coolant activity is assumed to be 1 percent of the maximum equilibrium primary coolant activity for iodines and alkali metals.
Tier 2 Material                                      15.4-33                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                        492
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.4.8.3.2 Release Pathways There are three components to the accident releases:
x  The activity initially in the secondary coolant is available for release as long as steam releases continue.
x  The reactor coolant leaking into the steam generators is assumed to mix with the secondary coolant. The activity from the primary coolant mixes with the secondary coolant and, as steam is released, a portion of the iodine and alkali metal in the coolant is released. The fraction of activity released is defined by the assumed flashing fraction and the partition coefficient assumed for the steam generator. The noble gas activity entering the secondary side is released to the environment. These releases are terminated when the steam releases stop.
x  The activity from the reactor coolant system and the core is released to the containment atmosphere and is available for leakage to the environment through the assumed design basis containment leakage.
Credit is taken for decay of radionuclides until release to the environment. After release to the environment, no consideration is given to radioactive decay or to cloud depletion by ground deposition during transport offsite.
15.4.8.3.3 Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.4.8.3.4 Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.4-4.
15.4.8.3.5 Identification of Conservatisms The assumptions used in the analysis contain a number of conservatisms:
x  Although fuel damage is assumed to occur as a result of the accident, no fuel damage is anticipated.
x  The reactor coolant activities are based on conservative assumptions (refer to Table 15.4-4);
whereas, the activities based on the expected fuel defect level are far less (see Section 11.1).
x  The leakage of reactor coolant into the secondary system, at 300 gallons per day, is conservative. The leakage is normally a small fraction of this.
x  It is unlikely that the conservatively selected meteorological conditions are present at the time of the accident.
Tier 2 Material                                    15.4-34                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        493
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document x  The leakage from containment is assumed to continue for a full 30 days. It is expected that containment pressure is reduced to the point that leakage is negligible before this time.
15.4.8.3.6 Doses Using the assumptions from Table 15.4-4, the calculated total effective dose equivalent (TEDE) doses are determined to be 4.0 rem at the site boundary for the limiting 2-hour interval (0 to 2 hours) and 5.9 rem at the low population zone outer boundary. These doses are well within the dose guideline of 25 rem total effective dose equivalent identified in 10 CFR Part 50.34. The phrase well within is taken as being 25 percent or less.
At the time the rod ejection accident occurs, the potential exists for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour site boundary dose because the pool boiling would not occur until after the first 2 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE, and when this is added to the dose calculated for the rod ejection accident, the resulting total dose remains less than the value reported above.
15.4.9      Combined License Information This section has no requirement for additional information to be provided in support of the Combined License application.
15.4.10    References
: 1. Barry, R. F., and Risher, D. H., Jr., TWINKLE--A Multi-Dimensional Neutron Kinetics Computer Code, WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Nonproprietary),
January 1975.
: 2. Hargrove, H. G., FACTRAN--A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod, WCAP-7908-A, December 1989.
: 3. Burnett. T. W. T., et al., LOFTRAN Code Description, WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Nonproprietary), April 1984.
: 4. Beard, C. L. et. al, Westinghouse Control Rod Ejection Accident Analysis Methodology Using Multi-Dimensional Kinetics, WCAP-15806-P-A (Proprietary) and WCAP-15807-NP-A (Nonproprietary), November, 2003.
: 5. Taxelius, T. G., ed, Annual Report-SPERT Project, October 1968, September 1969, Idaho Nuclear Corporation, IN-1370, June 1970.
: 6. Liimataninen, R. C., and Testa, F. J., Studies in TREAT of Zircaloy-2-Clad, UO2-Core Simulated Fuel Elements, ANL-7225, January-June 1966, p 177, November 1966.
Tier 2 Material                                    15.4-35                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          494
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document
: 7. Liu, Y.S., et al., ANC - A Westinghouse Advanced Nodal Computer Code, WCAP-10965-P-A (Proprietary) and WCAP-10966-A (Nonproprietary), September 1986..
: 8. Not Used.
: 9. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A (Proprietary) and WCAP-11397-A (Nonproprietary), April 1989.
: 10. American National Standards Institute N18.2, Nuclear Safety Criteria for the Design of Stationary PWR Plants, 1973.
: 11. AP1000 Code Applicability Report, WCAP-15644-P (Proprietary) and WCAP-15644-NP (Nonproprietary), Revision 2, March 2004.
: 12. Soffer, L. et al., Accident Source Terms for Light-Water Nuclear Power Plants, NUREG-1465, February 1995.
: 13. Not Used.
: 14. Nguyen, T. Q., et al., Qualification of the PHOENIX-P/ANC Nuclear Design System for Pressurized Water Reactor Cores, WCAP-11596-P-A (Proprietary) and WCAP-11597-A (Nonproprietary), June 1988.
: 15. Ouisloumen, M., et. al., Qualification of the Two-Dimensional Transport Code PARAGON, WCAP-16045-P-A (Proprietary) and WCAP-16045-NP-A (Nonproprietary),
August, 2004.
: 16. Liu, Y.S., ANC - A Westinghouse Advanced Nodal Computer Code; Enhancements to ANC Rod Power Recovery, WCAP-10965-P-A, Addendum 1 (Proprietary) and WCAP-10966-A Addendum 1 (Nonproprietary), April 1989.
: 17. Letter from Liparulo, N.J. (Westinghouse) to Jones, R. C., (NRC), Notification to the NRC Regarding Improvements to the Nodal Expansion Method Used in the Westinghouse Advanced Nodal Code (ANC), NTD-NRC-95-4533, August 22, 1995.
: 18. Sung, Y.X., Schueren, P. and Meliksetian, A., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A (Proprietary) and WCAP-15306-NP-A (Nonproprietary), October 1999.
: 19. Stewart, C. W., et al., VIPRE-01: A Thermal/Hydraulic Code for Reactor Cores, Volumes 1,2,3 (Revision 3, August 1989), and Volume 4 (April 1987), NP-2511-CCM-A, Electric Power Research Institute, Palo Alto, California.
: 20. Foster, J.P. and Sidener, S., Westinghouse Improved Performance Analysis and Design Model (PAD 4.0), WCAP-15063-P-A, Revision 1 with Errata (Proprietary) and WCAP-15064-NP-A (Nonproprietary), July 2000 Tier 2 Material                                    15.4-36                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                    495
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document
: 21. Zhang, B. et. al., Qualification of the NEXUS Nuclear Data Methodology, WCAP-16045-P-A Addendum 1-A (Proprietary) and WCAP-16045-NP-A Addendum 1-A (Nonproprietary), August, 2007.
: 22. Zhang, B, et. al., Qualification of the New Pin Power Recovery Methodology, WCAP-10965-P-A, Addendum 2-A (Proprietary), September, 2010.
: 23. Smith, L. D., et. al. Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids, WCAP-15025-P-A (Proprietary) and WCAP-15026-NP-A (Nonproprietary), April 1999
: 24. NUREG-0800, Standard Review Plan, Section 4.2, Revision 3, Fuel System Design, Appendix B, Interim Acceptance Criteria and Guidance for the Reactivity Initiated Accidents, March 2007
: 25. Draft Regulatory Guide DG-1199, Proposed Revision 1 of Regulatory Guide 1.183; Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, October 2009. NRC ADAMS Accession Number: ML090960464
: 26. NRC Memorandum from Anthony Mendiola to Travis Tate, Technical Basis for Revised Regulatory Guide 1.183 (DG-1199) Fission Product Fuel-to-Cladding Gap Inventory, July 2011. NRC ADAMS Accession Number: ML111890397
: 27. Letter from Liparulo, N.J. (Westinghouse) to Jones, R. C., (NRC), Process Improvement to the Westinghouse Neutronics Code System, NSD-NRC-96-4679, March 29, 1996 Tier 2 Material                                    15.4-37                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                  496
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document Table 15.4-1 (Sheet 2 of 3)
TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN REACTIVITY AND POWER DISTRIBUTION ANOMALIES Time Accident                                    Event                      (seconds)
Chemical and volume control system malfunction that results in a decrease in the boron concentration in the rector coolant
: 1. Dilution during startup          Power range - low setpoint reactor trip due        0.0 to dilution Dilution automatically terminated by              215.0 demineralized water transfer and storage system isolation
: 2. Dilution during full-power Operation
: a. Automatic reactor control    Operator receives low-low rod insertion            0.0 limit alarm due to dilution Shutdown margin lost                            19,680
: b. Manual reactor control      Initiate dilution                                    0.0 Reactor trip on overtemperature 'T due to        180.0 dilution Dilution automatically terminated by              395.0 demineralized water transfer and storage system isolation RCCA ejection accident
: 1. PCMI Limiting Event              Initiation of rod ejection                        0.00 Peak nuclear power occurs                          0.14 Reactor trip setpoint reached                    < 0.30 Peak cladding temperature occurs                  0.36 Peak enthalpy deposition occurs                    0.44 Rods begin to fall into core                      1.20 Tier 2 Material                                        15.4-39                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    497
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                              AP1000 Design Control Document Table 15.4-1 (Sheet 3 of 3)
TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN REACTIVITY AND POWER DISTRIBUTION ANOMALIES Time Accident                              Event                      (seconds)
: 2. Peak Clad Temperature      Initiation of rod ejection                        0.00 Limiting Event Peak nuclear power occurs                          0.08 Minimum DNBR occurs                                0.11 Peak cladding temperature occurs                  0.11 Reactor trip setpoint reached                    < 0.30 Rods begin to fall into core                      1.20
: 3. Peak enthalpy / Peak Fuel  Initiation of rod ejection                        0.00 Centerline Temperature Event                  Peak nuclear power occurs                          0.06 Reactor trip setpoint reached                    < 0.30 Rods begin to fall into core                      1.20 Peak fuel center temperature occurs                2.50 Peak cladding temperature occurs                  2.80 Tier 2 Material                                  15.4-40                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                              498
 
DCP_NRC_003343        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                  AP1000 Design Control Document Table 15.4-3 Not Used Tier 2 Material                    15.4-42                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                499
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.4-4 (Sheet 1 of 2)
PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A ROD EJECTION ACCIDENT Initial reactor coolant iodine activity                An assumed iodine spike that has resulted in an increase in the reactor coolant activity to 60 PCi/g (22.2E+06 Bq/g) of dose equivalent I-131 (see Appendix 15A)(a)
Reactor coolant noble gas activity                    Equal to the operating limit for reactor coolant activity of 280 PCi/g (1.036E+07 Bq/g) dose equivalent Xe-133 Reactor coolant alkali metal activity                  Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and                  1% of reactor coolant concentrations at maximum equilibrium alkali metal activity                                  conditions Radial peaking factor (for determination              1.75 of activity in damaged fuel)
Fuel cladding failure
    -    Fraction of fuel rods assumed to            0.1 fail
    -    Fuel Enthalpy Increase (cal/gm)              60
    -    Fission product gap fractions Iodine 131                                  0.1238 Iodine 132                                  0.1338 Krypton 85                                  0.5120 Other noble gases                            0.1238 Other halogens                              0.0938 Alkali metals                                0.6860 Iodine chemical form (%)
    -    Elemental                                    4.85
    -    Organic                                      0.15
    -    Particulate                                  95.0 Core activity                                          See Table 15A-3 in Appendix 15A Nuclide data                                          See Table 15A-4 in Appendix 15A Reactor coolant mass (lb)                              3.7 E+05 (1.68E+05 kg)
Note:
: a. The assumption of a pre-existing iodine spike is a conservative assumption for the initial reactor coolant activity.
However, compared to the activity assumed to be released from damaged fuel, it is not significant.
Tier 2 Material                                        15.4-43                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                500
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.4-4 (Sheet 2 of 2)
PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A ROD EJECTION ACCIDENT Condenser                                              Not available Duration of accident (days)                            30 Atmospheric dispersion (/Q) factors                  See Table 15A-5 in Appendix 15A Secondary system release path
    -  Primary to secondary leak rate (lb/hr)        104.5(a) (47.4 kg/hr)
    -  Leak flashing fraction                        0.04(b)
    -  Secondary coolant mass (lb)                    6.06 E+05 (2.75E+05 kg)
    -  Duration of steam release from                1800 secondary system (sec)
    -  Steam released from secondary                  1.08 E+05 (4.90E+04 kg) system (lb)
    -  Partition coefficient in steam generators x Iodine                                      0.01 x Alkali metals                                0.0035 Containment leakage release path
    -  Containment leak rate (% per day) x 0-24 hr                                      0.10 x >24 hr                                      0.05
    -  Airborne activity removal coefficients (hr-1) x Elemental iodine                            1.9(c) x Organic iodine                              0 x Particulate iodine or alkali metals          0.1
    -  Decontamination factor limit for              200 elemental iodine removal
    -  Time to reach the decontamination              2.78 factor limit for elemental iodine (hr)
Notes:
: a. Equivalent to 300 gpd (1.14 m3/day) cooled liquid at 62.4 lb/ft3(999.6 kg/m3).
: b. No credit for iodine partitioning is taken for flashed leakage.
: c. From Appendix 15B.
Tier 2 Material                                        15.4-44                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    501
 
DCP_NRC_003343        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                  AP1000 Design Control Document Figure 15.4.8-1 Nuclear Power Transient Versus Time for the PCMI Rod Ejection Accident Tier 2 Material                    15.4-73                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                    502
 
DCP_NRC_003343        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                  AP1000 Design Control Document Figure 15.4.8-2 Nuclear Power Transient Versus Time for the High Clad Temperature Rod Ejection Tier 2 Material                    15.4-74                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                    503
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                              AP1000 Design Control Document Figure 15.4.8-3 Nuclear Power Transient Versus Time for the Peak Enthalpy and Fuel Centerline Temperature Rod Ejection Accident Tier 2 Material                                15.4-75                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                  504
 
DCP_NRC_003343        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                  AP1000 Design Control Document Figure 15.4.8-4 Not Used Tier 2 Material                    15.4-76                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                505
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document A pressurizer safety valve is assumed to step open at the start of the event. The reactor coolant system then depressurizes until the overtemperature 'T reactor trip setpoint is reached.
Figure 15.6.1-3 shows the pressurizer pressure transient.
In the case where offsite power is lost, ac power is assumed to be lost 3 seconds after a turbine trip signal occurs. At this time, the reactor coolant pumps are assumed to start coasting down and reactor coolant system flow begins decreasing (Figure 15.6.1-5). The availability of offsite power has minimal impact on the pressure transient during the period of interest.
Prior to tripping of the reactor, the core power remains relatively constant (Figure 15.6.1-1). The minimum DNBR during the event occurs shortly after the rods begin to be inserted into the core (Figure 15.6.1-2). In the case where offsite power is lost, reactor trip has already been initiated and core heat flux has started decreasing when the reactor coolant system flow reduction starts.
The DNBR continues to increase when reactor coolant system flow begins to decrease due to the loss of offsite power. Therefore, the minimum DNBR occurs at the same time for cases with and without offsite power available. The DNBR remains above the design limit values as discussed in Section 4.4 throughout the transient.
The system response for inadvertent operation of the ADS is shown in Figures 15.6.1-6 through 15.6.1-10. The figures show the results for cases with and without offsite power available. The sequences of events are provided in Table 15.6.1-1. The responses for inadvertent operation of the ADS are very similar to those obtained for inadvertent opening of a pressurizer safety valve.
15.6.1.3    Conclusion The results of the analysis show that the overtemperature 'T reactor protection system signal provides adequate protection against the reactor coolant system depressurization events. The calculated DNBR remains above the design limit defined in Section 4.4. The long-term plant responses due to a stuck-open ADS valve or pressurizer safety valve, which cannot be isolated, is bounded by the small-break LOCA analysis.
15.6.2      Failure of Small Lines Carrying Primary Coolant Outside Containment The small lines carrying primary coolant outside containment are the reactor coolant system sample line and the discharge line from the chemical and volume control system to the liquid radwaste system. These lines are used only periodically. No instrument lines carry primary coolant outside the containment.
When excess primary coolant is generated because of boron dilution operations, the chemical and volume control system purification flow is diverted out of containment to the liquid radwaste system. Before passing outside containment, the flow stream passes through the chemical and volume control system heat exchangers and mixed bed demineralizer. The flow leaving the containment is at a temperature of less than 140&deg;F and has been cleaned by the demineralizer.
The flow out a postulated break in this line is limited to the chemical and volume control system purification flow rate of 100 gpm. Considering the low temperature of the flow and the reduced iodine activity because of demineralization, this event is not analyzed. The postulated sample line break is more limiting.
Tier 2 Material                                      15.6-4                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        506
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document A continuous sample of the RCS hot legs flows through the normally open isolation valves inside and outside containment. The failure of the sample line is postulated to occur between the isolation valve outside the containment and the sample panel. The loss of sample flow provides indication of the break to plant personnel. In addition, a break in a sample line results in activity release and a resulting actuation of area and air radiation monitors. The loss of coolant tends to reduce the pressurizer level and creates a demand for makeup to the reactor coolant system providing additional indication. Upon indication of a sample line break, the operator would take action to isolate the break.
The sample line includes a flow restrictor at the point of sample to limit the break flow to less than 130 gpm. The liquid sampling lines are 1/4 inch tubing which further restricts the break flow of a sampling line outside containment. Offsite doses are based on a conservative break flow of 130 gpm with isolation after 30 minutes.
15.6.2.1    Source Term The only significant radionuclide releases are the iodines and the noble gases. The analysis assumes that the reactor coolant iodine is at the maximum Technical Specification level for continuous operation. In addition, it is assumed that an iodine spike occurs at the time of the accident. The reactor coolant noble gas activities are assumed to be those associated with the design basis fuel defect level.
15.6.2.2    Release Pathway The reactor coolant that is spilled from the break is assumed to be at high temperature and pressure. A large portion of the flow flashes to steam, and the iodine in the flashed liquid is assumed to become airborne.
The iodine and noble gases are assumed to be released directly to the environment with no credit for depletion, although a large fraction of the airborne iodine is expected to deposit on building surfaces. No credit is assumed for radioactive decay after release.
15.6.2.3    Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.6.2.4    Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.6.2-1.
15.6.2.5    Identification of Conservatisms The assumptions used contain the following significant conservatisms:
x    The reactor coolant activities are based on a fuel defect level of 0.25 percent; whereas, the expected fuel defect level is far less than this (see Section 11.1).
Tier 2 Material                                      15.6-5                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          507
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document x    It is unlikely that the conservatively selected meteorological conditions would be present at the time of the accident.
15.6.2.6    Doses Using the assumptions from Table 15.6.2-1, the calculated total effective dose equivalent (TEDE) doses are determined to be < 1.3 rem at the exclusion area boundary and < 0.6 rem at the low population zone outer boundary. These doses are a small fraction of the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34. The phrase a small fraction is taken as being ten percent or less.
At the time the accident occurs, there is the potential for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour site boundary dose because pool boiling would not occur until after 2 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE and, when this is added to the dose calculated for the small line break outside containment, the resulting total dose remains less than the value reported above.
15.6.3      Steam Generator Tube Rupture 15.6.3.1    Identification of Cause and Accident Description 15.6.3.1.1 Introduction The accident examined is the complete severance of a single steam generator tube. The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited number of defective fuel rods within the allowance of the Technical Specifications. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system. In the event of a coincident loss of offsite power, or a failure of the condenser steam dump, discharge of radioactivity to the atmosphere takes place via the steam generator power-operated relief valves or the safety valves.
The assumption of a complete tube severance is conservative because the steam generator tube material (Alloy 690) is a corrosion-resistant and ductile material. The more probable mode of tube failure is one or more smaller leaks of undetermined origin. Activity in the secondary side is subject to continual surveillance, and an accumulation of such leaks, which exceeds the limits established in the Technical Specifications, is not permitted during operation.
The AP1000 design provides automatic protective actions to mitigate the consequences of an SGTR. The automatic actions include reactor trip, actuation of the passive residual heat removal (PRHR) heat exchanger, initiation of core makeup tank flow, termination of pressurizer heater operation, and isolation of chemical and volume control system flow and startup feedwater flow on high-2 steam generator level or high steam generator level coincident with reactor trip (P-4).
These protective actions result in automatic cooldown and depressurization of the reactor coolant system, termination of the break flow and release of steam to the atmosphere, and long-term Tier 2 Material                                        15.6-6                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                        508
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.6.3.3    Radiological Consequences The evaluation of the radiological consequences of the postulated SGTR assumes that the reactor is operating with the design basis fuel defect level (0.25 percent of power produced by fuel rods containing cladding defects) and that leaking steam generator tubes result in a buildup of activity in the secondary coolant.
Following the rupture, any noble gases carried from the primary coolant into the ruptured steam generator via the break flow are released directly to the environment. The iodine and alkali metal activity entering the secondary side is also available for release, with the amount of release dependent on the flashing fraction of the reactor coolant and on the partition coefficient in the steam generator. In addition to the activity released through the ruptured loop, there is also a small amount of activity released through the intact loop.
15.6.3.3.1 Source Term The significant radionuclide releases from the SGTR are the noble gases, alkali metals and the iodines that become airborne and are released to the environment as a result of the accident.
The analysis considers two different reactor coolant iodine source terms, both of which consider the iodine spiking phenomenon. In one case, the initial iodine concentrations are assumed to be those associated with the equilibrium operating limits for primary coolant iodine activity. The iodine spike is assumed to be initiated by the accident with the spike causing an increasing level of iodine in the reactor coolant.
The second case assumes that the iodine spike occurs before the accident and that the maximum reactor coolant iodine concentration exists at the time the accident occurs.
The reactor coolant noble gas and alkali metal concentrations are assumed to be those associated with the design fuel defect level.
The secondary coolant iodine and alkali metal activity is assumed to be 1 percent of the maximum equilibrium primary coolant activity.
15.6.3.3.2 Release Pathways The noble gas activity contained in the reactor coolant that leaks into the intact steam generator and enters the ruptured steam generator through the break is assumed to be released immediately as long as a pathway to the environment exists. There are three components to the modeling of iodine and alkali metal releases:
x    Intact loop steaming, with credit for partitioning of iodines and alkali metals (includes continued primary-to-secondary leakage at the maximum rate allowable by the Technical Specifications) x    Ruptured loop steaming, with credit for partitioning of iodines and alkali metals (includes modeling of increasing activity in the secondary coolant due to the break flow)
Tier 2 Material                                    15.6-14                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        509
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document x    Release of flashed reactor coolant through the ruptured loop, with no credit for scrubbing (this conservatively assumes that break location is at the top of the tube bundle)
Credit is taken for decay of radionuclides until release to the environment. After release to the environment, no consideration is given to radioactive decay or to cloud depletion of iodines by ground deposition during transport offsite.
15.6.3.3.3 Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
15.6.3.3.4 Analytical Assumptions and Parameters The assumptions and parameters used in the analysis are listed in Table 15.6.3-3.
15.6.3.3.5 Identification of Conservatisms The assumptions used in the analysis contain a number of significant conservatisms, such as:
x    The reactor coolant activities are based on a fuel defect level of 0.25 percent; whereas, the expected fuel defect level is far less (see Section 11.1).
x    It is unlikely that the conservatively selected meteorological conditions are present at the time of the accident.
15.6.3.3.6 Doses Using the assumptions from Table 15.6.3-3, the calculated TEDE doses for the case in which the iodine spike is assumed to be initiated by the accident are determined to be 0.7 rem at the exclusion area boundary for the limiting 2-hour interval (0-2 hours) 0.5 rem at the low population zone outer boundary. These doses are a small fraction of the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34. A small fraction is defined, consistent with the Standard Review Plan, as being ten percent or less.
For the case in which the SGTR is assumed to occur coincident with a pre-existing iodine spike, the TEDE doses are determined to be 1.4 rem at the exclusion area boundary for the limiting 2-hour interval (0 to 2 hours) and 0.7 rem at the low population zone outer boundary. These doses are within the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34.
At the time the accident occurs, there is the potential for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour exclusion area boundary dose because pool boiling would not occur until after 2.0 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE and, when this is added to the doses calculated for the steam generator tube rupture, the resulting total doses remain as reported above.
Tier 2 Material                                      15.6-15                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        510
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 15.6.5.3.1.3 Iodine Form The iodine form is consistent with the NUREG-1465 model. The model shows the iodine to be predominantly in the form of nonvolatile cesium iodide with a small fraction existing as elemental iodine. Additionally, the model assumes that a portion of the elemental iodine reacts with organic materials in the containment to form organic iodine compounds. The resulting iodine species split is as follows:
x    Particulate                      0.95 x    Elemental                        0.0485 x    Organic                          0.0015 If the post-LOCA cooling solution has a pH of less than 6.0, part of the cesium iodide may be converted to the elemental iodine form. The passive core cooling system provides sufficient trisodium phosphate to the post-LOCA cooling solution to maintain the solution pH at 7.0 or greater following a LOCA (see subsection 6.3.2.1.4).
15.6.5.3.2 In-containment Activity Removal Processes The AP1000 does not include active systems for the removal of activity from the containment atmosphere. The containment atmosphere is depleted of elemental iodine and of particulates as a result of natural processes within the containment.
Elemental iodine is removed by deposition onto surfaces. Particulates are removed by sedimentation, diffusiophoresis (deposition driven by steam condensation), and thermophoresis (deposition driven by heat transfer). No removal of organic iodine is assumed. Appendix 15B provides a discussion of the models and assumptions used in calculating the removal coefficients.
Particulates removed from the containment atmosphere to the containment shell are assumed to be washed off the shell by the flow of water resulting from condensing steam (i.e., condensate flow). The particulates may be either washed into the sump, which is controlled to a pH 7 post-accident or into the IRWST, which is not pH controlled post-accident. Due to the conditions in the IRWST, a portion of the particulate iodine washed into the IRWST may chemically convert to an elemental form and re-evolve, subject to partitioning, as airborne. A water-steam partition factor of 10 for elemental iodine is applied. This value bounds the time- dependent partition factors calculated using the NUREG/CR-5950 (Reference 36) models and the calculated IRWST water temperature and pH as a function of time.
The IRWST is a closed tank with weighted louvers, and without boiling, there would be no motive force for the release of re-evolved gaseous iodine from the IRWST gas space to the containment. Thus the assumption of boiling in the IRWST liquid is imposed to force the release of the re-evolved iodine to the containment atmosphere. A portion (3%) of the re- evolved elemental iodine is assumed to convert to an organic form upon its release to containment.
Tier 2 Material                                      15.6-21                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      511
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.6.5.3.3 Release Pathways The release pathways are the containment purge line and containment leakage. The activity releases are assumed to be ground level releases.
During the initial part of the accident, before the containment is isolated, it is assumed that containment purge is in operation and that activity is released through this pathway until the purge valves are closed. No credit is taken for the filters in the purge exhaust line.
The majority of the releases due to the LOCA are the result of containment leakage. The containment is assumed to leak at its design leak rate for the first 24 hours and at half that rate for the remainder of the analysis period.
15.6.5.3.4 Offsite Dose Calculation Models The offsite dose calculation models are provided in Appendix 15A. The models address the determination of the TEDE doses from the combined acute doses and the committed effective dose equivalent doses.
The exclusion area boundary dose is calculated for the 2-hour period over which the highest doses would be accrued by an individual located at the exclusion area boundary. Because of the delays associated with the core damage for this accident, the first 2 hours of the accident are not the worst 2-hour interval for accumulating a dose.
The low population zone boundary dose is calculated for the nominal 30-day duration of the accident.
For both the exclusion area boundary and low population zone dose determinations, the calculated doses are compared to the dose guideline of 25 rem TEDE from 10 CFR Part 50.34.
15.6.5.3.5 Main Control Room Dose Model There are two approaches used for modeling the activity entering the main control room. If power is available, the normal heating, ventilation, and air-conditioning (HVAC) system will switch over to a supplemental filtration mode (Section 9.4). The normal HVAC system is not a safety-class system but provides defense in depth.
Alternatively, if the normal HVAC is inoperable or, if operable, the supplemental filtration train does not function properly resulting in increasing levels of airborne iodine in the main control room, the emergency habitability system (Section 6.4) would be actuated when High-2 iodine or particulate activity is detected. The emergency habitability system provides passive pressurization of the main control room from a bottled air supply to prevent inleakage of contaminated air to the main control room. The bottled air also induces flow through the passive air filtration system which filters contaminated air in the main control room. There is a 72-hour supply of air in the emergency habitability system. After this time, the main control room is assumed to be opened and unfiltered air is drawn into the main control room by way of an ancillary fan. After 7 days, offsite support is assumed to be available to reestablish operability of the control room habitability system by replenishing the compressed air supply. As a defense-in-Tier 2 Material                                    15.6-22                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                            512
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document depth measure, the nonsafety-related normal control room HVAC would be brought back into operation with the supplemental filtration train if power is available.
The main control room is accessed by a vestibule entrance, which restricts the volume of contaminated air that can enter the main control room from ingress and egress. The design of the emergency habitability system (VES) provides 65 scfm +/-5 scfm to the control room and maintains it in a pressurized state. The path for the purge flow out of the main control room is through the vestibule entrance and this should result in a dilution of the activity in the vestibule and a reduction in the amount of activity that might enter the main control room. However, no additional credit is taken for dilution of the vestibule via the purge. The projected inleakage into the main control room through ingress/egress is 5 cfm. An additional 10 cfm of unfiltered inleakage is conservatively assumed from other sources.
Activity entering the main control room is assumed to be uniformly dispersed. With the VES in operation, airborne activity is removed from the main control room atmosphere via the passive recirculation filtration portion of the VES.
The main control room dose calculation models are provided in Appendix 15A for the determination of doses resulting from activity which enters the main control room envelope.
15.6.5.3.6 Analytical Assumptions and Parameters The analytical assumptions and parameters used in the radiological consequences analysis are listed in Table 15.6.5-2.
15.6.5.3.7 Identification of Conservatisms The LOCA radiological consequences analysis assumptions include a number of conservatisms.
Some of these conservatisms are discussed in the following subsections.
15.6.5.3.7.1 Primary Coolant Source Term The source term is based on operation with the design fuel defect level of 0.25 percent; whereas, the expected fuel defect level is far less.
15.6.5.3.7.2 Core Release Source Term The assumed core melt is a major conservatism associated with the analysis. In the event of a postulated LOCA, no major core damage is expected. Release of activity from the core is limited to a fraction of the core gap activity.
15.6.5.3.7.3 Atmospheric Dispersion Factors The atmospheric dispersion factors assumed to be present during the course of the accident are conservatively selected. Actual meteorological conditions are expected to result in significantly higher dispersion of the released activity.
Tier 2 Material                                      15.6-23                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        513
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.6.5.3.8 LOCA Doses 15.6.5.3.8.1 Offsite Doses The doses calculated for the exclusion area boundary and the low population zone boundary are listed in Table 15.6.5-3. The doses are within the 10 CFR 50.34 dose guideline of 25 rem TEDE.
The reported exclusion area boundary doses are for the time period of 1.3 to 3.3 hours. This is the 2-hour interval that has the highest calculated doses. The dose that would be incurred over the first 2 hours of the accident is well below the reported dose.
At the time the LOCA occurs, there is the potential for a coincident loss of spent fuel pool cooling with the result that the pool could reach boiling and a portion of the radioactive iodine in the spent fuel pool could be released to the environment. The loss of spent fuel pool cooling has been evaluated for a duration of 30 days. There is no contribution to the 2-hour site boundary dose because pool boiling would not occur until after the limiting 2 hours. The 30-day contribution to the dose at the low population zone boundary is less than 0.01 rem TEDE and, when this is added to the dose calculated for the LOCA, the resulting total dose remains less than that reported in Table 15.6.5-3.
15.6.5.3.8.2 Doses to Operators in the Main Control Room The doses calculated for the main control room personnel due to airborne activity entering the main control room are listed in Table 15.6.5-3. Also listed on Table 15.6.5-3 are the doses due to direct shine from the activity in the adjacent buildings, shine from radioactivity accumulated on the VES or VBS filters, and sky-shine from the radiation that streams out the top of the containment shield building and is reflected back down by air-scattering. The total of these dose paths is within the dose criteria of 5 rem TEDE as defined in GDC 19.
As discussed above for the offsite doses, there is the potential for a dose to the operators in the main control room due to iodine releases from postulated spent fuel boiling. The calculated dose from this source is less than 0.01 rem TEDE and is reported in Table 15.6.5-3.
15.6.5.4    Core and System Performance Subsection 15.6.5.4A describes the large-break LOCA analysis methodology and results.
Subsections 15.6.5.4B.1.0 through 15.6.5.4B.4.0 describe the small-break LOCA analysis methodology and results.
15.6.5.4A Large-Break LOCA Analysis Methodology and Results Westinghouse applies the WCOBRA/TRAC computer code to perform best-estimate large-break LOCA analyses in compliance with 10 CFR 50 (Reference 5). WCOBRA/TRAC is a thermal-hydraulic computer code that calculates realistic fluid conditions in a PWR during the blowdown and reflood of a postulated large-break LOCA. The methodology used for the AP1000 analysis is documented in WCAP-12945-P-A, WCAP-14171, Revision 2, and WCAP-16009-P-A (References 10, 11, and 32).
Tier 2 Material                                    15.6-24                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        514
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document case was chosen because it reaches sump recirculation at the earliest time (and highest decay heat). A window mode case at the minimum containment water level postulated to occur 2 weeks into long-term cooling was also performed.
The DEDVI small-break LOCA exhibits no core  ncover due to its adequate reactor coolant system mass inventory condition during the long-term cooling phase from initiation into containment recirculation. Adequate flow through the core is provided to maintain a low cladding temperature and to prevent any buildup of boric acid on the fuel rods. The wall-to-wall floodup case using the window mode technique demonstrates that effective core cooling is also provided at the minimum containment water level. The results of these cases demonstrate the capability of the AP1000 passive systems to provide long-term cooling for a limiting LOCA event.
15.6.6      References
: 1. 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors, and Appendix K to 10 CFR 50, ECCS Evaluation Models.
: 2. American Nuclear Society Proposed Standard, ANS 5.1 Decay Energy Release Rates Following Shutdown of Uranium-Cooled Thermal Reactors, October (1971), Revised October (1973).
: 3. Final Safety Evaluation Report Related to Certification of the AP600 Standard Design, NUREG-1512, September 1998.
: 4. Not used.
: 5. Emergency Core Cooling Systems; Revision to Acceptance Criteria, Federal Register, Vol. 53, No. 180, September 16, 1988.
: 6. Not used.
: 7. AP600 Design Control Document, Revision 3, December 1999.
: 8. Letter from R. C. Jones, Jr., (USNRC), to N. J. Liparulo, (W),
 
==Subject:==
Acceptance for Referencing of the Topical Report, WCAP-12945 (P), Westinghouse CQD for Best Estimate LOCA Analysis, June 28, 1996.
: 9. Not used.
: 10. Bajorek, S. M., et al., Code Qualification Document for Best-Estimate LOCA Analysis, WCAP-12945-P-A, Volume 1, Revision 2, and Volumes 2 through 5, Revision 1, and WCAP-14747 (Non-Proprietary), 1998.
: 11. Hochreiter, L. E., et al., WCOBRA/TRAC Applicability to AP600 Large-Break Loss-of-Coolant Accident, WCAP-14171, Revision 2 (Proprietary) and WCAP-14172, Revision 2 (Nonproprietary), March 1998.
Tier 2 Material                                    15.6-54                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      515
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document
: 26. Kemper, R. M., Applicability of the NOTRUMP Computer Code to AP600 SSAR Small-Break LOCA Analyses, WCAP-14206 (Proprietary) and WCAP-14207 (Nonproprietary), November 1994.
: 27. Not used.
: 28. Zuber, et al., The Hydrodynamic Crisis in Pool Boiling of Saturated and Subcooled Liquids, Part II, No. 27, International Developments in Heat Transfer, 1961.
: 29. Griffith, et al., PWR Blowdown Heat Transfer, Thermal and Hydraulic Aspects of Nuclear Reactor Safety, ASME, New York, Volume 1, 1977.
: 30. Chang, S. H. et al. A study of critical heat flux for low flow of water in vertical round tubes under low pressure, Nuclear Engineering and Design, 132, 225-237, 1991.
: 31. Not used.
: 32. Nissley, M. E., et al., 2005, Realistic Large Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM), WCAP-16009-P-A and WCAP-16009-NP-A (Non-proprietary).
: 33. Dederer, S. I., et al., 1999, Application of Best Estimate Large Break LOCA Methodology to Westinghouse PWRs with Upper Plenum Injection, WCAP-14449-P-A, Revision 1 and WCAP-14450 (Non-proprietary).
: 34. APP-GW-GLE-026, Change to ASTRUM Methodology for Best Estimate Large Break Loss of Coolant Accident Analysis, Westinghouse Electric Company LLC.
: 35. Not Used.
: 36. Beahm, E. C. et al., NUREG/CR-5950, Iodine Evolution and pH Control, December 1992.
Tier 2 Material                                      15.6-56                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        516
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.6.2-1 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A SMALL LINE BREAK OUTSIDE CONTAINMENT Reactor coolant iodine activity                        Initial activity equal to the design basis reactor coolant activity of 1.0 PCi/g dose equivalent I-131 with an assumed iodine spike that increases the rate of iodine release from fuel into the coolant by a factor of 500 (see Table 15A-2 in Appendix 15A)(a)
Reactor coolant noble gas activity                      280 PCi/g dose equivalent Xe-133 Break flow rate (gpm)                                  130(b)
Fraction of reactor coolant flashing                    0.47 Duration of accident (hr)                              0.5 Atmospheric dispersion (/Q) factors                    See Table 15A-5 Nuclide data                                            See Table 15A-4 Notes:
: a. Use of accident-initiated iodine spike is consistent with the guidance in the Standard Review Plan.
: b. At density of 62.4 lb/ft3.
Tier 2 Material                                        15.6-58                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                517
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.6.3-3 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A STEAM GENERATOR TUBE RUPTURE Reactor coolant iodine activity
  - Accident initiated spike                              Initial activity equal to the equilibrium operating limit for reactor coolant activity of 1.0 PCi/g dose equivalent I-131 with an assumed iodine spike that increases the rate of iodine release from fuel into the coolant by a factor of 335 (see Appendix 15A). Duration of spike is 8.0 hours.
  - Preaccident spike                                      An assumed iodine spike that results in an increase in the reactor coolant activity to 60 PCi/g of dose equivalent I-131 (see Appendix 15A)
Reactor coolant noble gas activity                      280 PCi/g dose equivalent Xe-133 Reactor coolant alkali metal activity                    Design basis activity (see Table 11.1-2)
Secondary coolant initial iodine and alkali metal        1% of reactor coolant concentrations at maximum equilibrium conditions Reactor coolant mass (lb)                                3.7 E+05 Offsite power                                            Lost on reactor trip Condenser                                                Lost on reactor trip Time of reactor trip                                    Beginning of the accident Duration of steam releases (hr)                          15.94 Atmospheric dispersion factors                          See Appendix 15A Nuclide data                                            See Appendix 15A Steam generator in ruptured loop
  - Initial secondary coolant mass (lb)                    1.16 E+05
  - Primary-to-secondary break flow                        See Figure 15.6.3-5
  - Integrated flashed break flow (lb)                    See Figure 15.6.3-10
  - Steam released (lb)                                    See Table 15.6.3-2
  - Iodine partition coefficient                          1.0 E-02(a)
  - Alkali metals partition coefficient                    3.5 E-03(a)
Steam generator in intact loop
  - Initial secondary coolant mass (lb)                    2.30 E+04
  - Primary-to-secondary leak rate (lb/hr)                  52.16(b)
  - Steam released (lb)                                    See Table 15.6.3-2
  - Iodine partition coefficient                          1.0 E-02(a)
  - Alkali metals partition coefficient                    3.5 E-03(a)
Notes:
: a. Iodine partition coefficient does not apply to flashed break flow.
: b. Equivalent to 150 gpd at psia cooled liquid at 62.4 lb/ft3.
Tier 2 Material                                        15.6-61                                              Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  518
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.6.5-2 (Sheet 1 of 3)
ASSUMPTIONS AND PARAMETERS USED IN CALCULATING RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT Primary coolant source data
-  Noble gas concentration                                                  280 PCi/g dose equivalent Xe-133
-  Iodine concentration                                                      1.0 PCi/g dose equivalent I-131
-  Primary coolant mass (lb)                                                4.39 E+05 Containment purge release data
-  Containment purge flow rate (cfm)                                        16,000
-  Time to isolate purge line (seconds)                                      30
-  Time to blow down the primary coolant system (minutes)                    10
-  Fraction of primary coolant iodine that becomes airborne                  1.0 Core source data
-  Core activity at shutdown                                                See Table 15A-3
-  Release of core activity to containment atmosphere (timing and            See Table 15.6.5-1 fractions)
-  Iodine species distribution (%)
x    Elemental                                                            4.85 x    Organic                                                              0.15 x    Particulate                                                        95 Containment leakage release data
-  Containment volume (ft3)                                                  2.06 E+06
-  Containment leak rate, 0-24 hr (% per day)                                0.10
-  Containment leak rate, > 24 hr (% per day)                                0.05
                                                        -1
-  Elemental iodine deposition removal coefficient (hr )                    1.9
-  Decontamination factor limit for elemental iodine removal                200
-  Removal coefficient for particulates (hr-1)                              See Appendix 15B Main control room model
-  Main control room volume (ft3)                                            3.89 E+04
-  Volume of HVAC, including main control room and control support          1.158 E+05 area (ft3)
-  Normal HVAC operation (prior to switchover to an emergency mode) x    Air intake flow (cfm)                                                1650 x    Filter efficiency                                                    Not applicable
-  Atmospheric dispersion factors (sec/m3)                                  See Table 15A-6 Tier 2 Material                                        15.6-63                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                            519
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.6.5-2 (Sheet 2 of 3)
ASSUMPTIONS AND PARAMETERS USED IN CALCULATING RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT Main control room model (cont.)
-  Occupancy x    0        -  24 hr                                                      1.0 x    24        -  96 hr                                                      0.6 x    96        -  720 hr                                                    0.4
-  Breathing rate (m3/sec)                                                      3.5 E-04 Control room with emergency habitability system credited (VES Credited)
-  Main control room activity level at which the emergency habitability system  2.0 E-07 actuation is actuated (Ci/m3 of dose equivalent I-131)
-  Response time to actuate VES based on radiation monitor response time and    200 VBS isolation (sec)
-  Interval with operation of the emergency habitability system x    Flow from compressed air bottles of the emergency habitability system    60 (cfm) x    Unfiltered inleakage via ingress/egress (scfm)                          5 x    Unfiltered inleakage from other sources (scfm)                          10 x    Recirculation flow through filters (scfm)                                600 x    Filter efficiency (%)
o Elemental iodine                                                          90 o Organic iodine                                                            90 o Particulates                                                              99
-  Time at which the compressed air supply of the emergency habitability        72 system is depleted (hr)
-  After depletion of emergency habitability system bottled air supply (>72 hr) x    Air intake flow (cfm)                                                    1900 x    Intake flow filter efficiency (%)                                        Not applicable x    Recirculation flow (cfm)                                                Not applicable
-  Time at which the compressed air supply is restored and emergency            168 habitability system returns to operation (hr)
Tier 2 Material                                        15.6-64                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                      520
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15.6.5-2 (Sheet 3 of 3)
ASSUMPTIONS AND PARAMETERS USED IN CALCULATING RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT Control room/CSA with credit for continued operation of HVAC (VBS Supplemental Filtration Mode Credited)
-  Time delay to switch from normal operation to the supplemental air        265 filtration mode (sec)
-  Unfiltered inleakage via ingress/egress                                    10
-  Unfiltered inleakage from other sources (cfm)                              50
-  Filtered air intake flow (cfm)                                            800
-  Filtered air recirculation flow (cfm)                                      3200
-  Filter efficiency (%)
o Elemental iodine                                                        99 o Organic iodine                                                          99 o Particulates                                                            99 Miscellaneous assumptions and parameters
-  Offsite power                                                              Not applicable
-  Atmospheric dispersion factors (offsite)                                  See Table 15A-5
-  Nuclide dose conversion factors                                            See Table 15A-4
-  Nuclide decay constants                                                    See Table 15A-4 3
-  Offsite breathing rate (m /sec) 0  - 8 hr                                                          3.5 E-04 8  - 24 hr                                                          1.8 E-04 24 - 720 hr                                                          2.3 E-04 Tier 2 Material                                        15.6-65                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                      521
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.6.5-3 RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT ACCIDENT WITH CORE MELT TEDE Dose (rem)
Exclusion zone boundary dose (1.4 - 3.4 hr)(1)                                            23.5 Low population zone boundary dose (0 - 30 days)                                            22.2 Main control room dose (emergency habitability system in operation)
-  Airborne activity entering the main control room                                      3.70
-  Direct radiation from adjacent structures, including sky shine                        0.30
-  Filter shine                                                                          0.32
-  Spent fuel pooling boiling                                                            0.01
-  Total                                                                                  4.33 Main control room dose (normal HVAC operating in the supplemental filtration mode)
-  Airborne activity entering the main control room                                      4.50
-  Direct radiation from adjacent structures, including sky shine                        0.30
-  Filter shine                                                                          0.03
-  Spent fuel pooling boiling                                                            0.01
-  Total                                                                                  4.84 Note:
: 1. This is the 2-hour period having the highest dose.
Tier 2 Material                                        15.6-66                                  Revision 19 APP-GW-GL-705 Rev. 0                                                                                    522
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document 15.7.4.1.3 Assembly Power Level All fuel assemblies are assumed to be handled inside the containment during the core shuffle so a peak power assembly is considered for the accident. Any fuel assembly can be transferred to the spent fuel pool; during a core off-load, all fuel assemblies are discharged to the spent fuel pool.
To obtain a bounding condition for the fuel handling accident analysis, it is assumed that the accident involves a fuel assembly that operated at the maximum rated fuel rod peaking factor.
This is conservative because the entire fuel assembly does not operate at this level.
15.7.4.1.4 Radiological Decay The fission product decay time experienced prior to the fuel handling accident is at least 48 hours.
15.7.4.2    Release Pathways The spent fuel handling operations take place underwater. Thus, activity releases are first scrubbed by the column of water 23 feet in depth. This has no effect on the releases of noble gases or organic iodine but there is a significant removal of elemental iodine. Consistent with the guidance in Regulatory Guide 1.183, the overall pool scrubbing decontamination factor for iodine is assumed to be 200.
In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, there may be less than 23 feet of water above the top of the fuel bundle and the surface of the water, indicated by the width of the bundle. The fuel handling accident analysis bounds the case of a single bundle lying horizontally on top of the spent fuel racks by demonstrating that the overall decontamination factor of 200 is valid for pool depths of 21.5 feet.
After the activity escapes from the water pool, it is assumed that it is released directly to the environment within a 2-hour period without credit for any additional iodine removal process.
If the fuel handling accident occurs in the containment, the release of activity can be terminated by closure of the containment purge lines on detection of high radioactivity. No credit is taken for this in the analysis. Additionally, no credit is taken for removal of airborne iodine by the filters in the containment purge lines.
For the fuel handling accident postulated to occur in the spent fuel pool, there is assumed to be no filtration in the release pathway. Activity released from the pool is assumed to pass directly to the environment with no credit for holdup or delay of release in the building.
15.7.4.3    Dose Calculation Models The models used to calculate doses are provided in Appendix 15A.
Table 15.7-1 lists the assumptions used in the analysis. The guidance of Regulatory Guide 1.183 is reflected in the analysis assumptions.
Tier 2 Material                                      15.7-3                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                        523
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                  AP1000 Design Control Document 15.7.4.4.8 Time Available for Radioactive Decay The dose analysis assumes that the fuel handling accident involves one of the first fuel assemblies handled. If it were one of the later fuel handling operations, there is additional decay and a reduction in the source term.
The dose evaluation was performed assuming 48 hours decay.
15.7.4.5    Offsite Doses Using the assumptions from Table 15.7-1, the calculated doses from the initial releases are determined to be 2.8 rem TEDE at the site boundary and 1.2 rem TEDE at the low population zone outer boundary. These doses are well within the dose guideline of 25 rem TEDE identified in 10 CFR Part 50.34. The phrase "well within" is taken as meaning 25 percent or less.
15.7.5      Spent Fuel Cask Drop Accident The spent fuel cask handling crane is prevented from travelling over the spent fuel. No radiological consequences analysis is necessary for the dropped cask event.
15.7.6      Combined License Information Combined License applicant referencing the AP1000 certified design will perform an analysis of the consequences of potential release of radioactivity to the environment due to a liquid tank failure as outlined in subsection 15.7.3.
15.7.7      References
: 1. Sofer, L., et al., "Accident Source Terms for Light-Water Nuclear Power Plants,"
NUREG-1465, February 1995.
: 2. U. S. NRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, " July 2000.
Tier 2 Material                                    15.7-5                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                        524
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document Table 15.7-1 ASSUMPTIONS USED TO DETERMINE FUEL HANDLING ACCIDENT RADIOLOGICAL CONSEQUENCES Source term assumptions
    -    Core power (MWt)                                              3434(1)
    -    Decay time (hr)                                                48 Core source term after 48 hours decay (Ci)
I-130                                                          1.28 E+05 I-131                                                          8.18 E+07 I-132                                                          9.10 E+07 I-133                                                          4.06 E+07 I-135                                                          1.17 E+06 Kr-85m                                                        1.52 E+04 Kr-85                                                          1.07 E+06 Kr-88                                                          5.45 E+02 Xe-131m                                                        1.02 E+06 Xe-133m                                                        4.47 E+06 Xe-133                                                        1.70 E+08 Xe-135m                                                        1.91 E+05 Xe-135                                                        1.04 E+07 Number of fuel assemblies in core                                      157 Amount of fuel damage                                                  One assembly Maximum rod radial peaking factor                                      1.75 Percentage of fission products in gap I-131                                                          8 Other iodines                                                  5 Kr-85                                                          10 Other noble gases                                              5 Pool decontamination factor for iodine                                  200 Activity release period (hr)                                            2 Atmospheric dispersion factors                                          See Table 15A-5 in Appendix 15A Breathing rates (m3/sec)                                                3.5 E-4 Nuclide data                                                            See Appendix 15A Note:
: 1. The main feedwater flow measurement supports a 1-percent power uncertainty.
Tier 2 Material                                      15.7-6                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          525
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document accident and for which the peak primary coolant activity is reached at the time the accident is assumed to occur. These isotopic concentrations are also defined as 60 PCi/g dose equivalent I-131. The probability of this adverse timing of the iodine spike and accident is small.
Although it is unlikely for an accident to occur at the same time that an iodine spike is at its maximum reactor coolant concentration, for many accidents it is expected that an iodine spike would be initiated by the accident or by the reactor trip associated with the accident. Table 15A-2 lists the iodine appearance rates (rates at which the various iodine isotopes are transferred from the core to the primary coolant by way of the assumed cladding defects) for normal operation.
The iodine spike appearance rates are assumed to be as much as 500 times the normal appearance rates.
15A.3.1.2 Secondary Coolant Source Term The secondary coolant source term used in the radiological consequences analyses is conservatively assumed to be 1 percent of the primary coolant equilibrium source term. This is more conservative than using the design basis secondary coolant source terms listed in Table 11.1-5.
Because the iodine spiking phenomenon is short-lived and there is a high level of conservatism for the assumed secondary coolant iodine concentrations, the effect of iodine spiking on the secondary coolant iodine source terms is not modeled.
There is assumed to be no secondary coolant noble gas source term because the noble gases entering the secondary side due to primary-to-secondary leakage enter the steam phase and are discharged via the condenser air removal system.
15A.3.1.3 Core Source Term Table 15A-3 lists the core source terms at shutdown for an assumed three-region equilibrium cycle at end of life after continuous operation at 2 percent above full core thermal power. The main feedwater flow measurement supports a 1-percent power uncertainty; use of a 2-percent power uncertainty is conservative. In addition to iodines and noble gases, the source terms listed include nuclides that are identified as potentially significant dose contributors in the event of a degraded core accident. The design basis loss-of-coolant accident analysis is not expected to result in significant core damage, but the radiological consequences analysis assumes severe core degradation.
15A.3.2    Nuclide Parameters The radiological consequence analyses consider radioactive decay of the subject nuclides prior to their release, but no additional decay is assumed after the activity is released to the environment.
Table 15A-4 lists the decay constants for the nuclides of concern.
Table 15A-4 also lists the dose conversion factors for calculation of the CEDE doses due to inhalation of iodines and other nuclides and EDE dose conversion factors for calculation of the dose due to immersion in a cloud of activity. The CEDE dose conversion factors are from EPA Tier 2 Material                                      15A-4                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          526
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15A-6 CONTROL ROOM ATMOSPHERIC DISPERSION FACTORS (/Q)
FOR ACCIDENT DOSE ANALYSIS
                            /Q (s/m3) at HVAC Intake for the Identified Release Points(1)
Ground Level Plant Vent or    Containment        PORV and        Steam Line            Fuel        Condenser PCS Air          Release        Safety Valve        Break          Handling      Air Removal Diffuser(3)        Points(4)        Releases(5)        Releases          Area(6)        Stack(7) 0 - 2 hours        2.53E-03          4.00E-03          1.92E-02        2.13E-02          6.0E-3          6.0E-3 2 - 8 hours        1.98E-03          2.28E-03          1.60E-02        1.76E-02          4.0E-3          4.0E-3 8 - 24 hours        7.96E-04          1.03E-03          6.90E-03        7.50E-03          2.0E-3          2.0E-3 1 - 4 days          6.40E-04          9.03E-04          4.96E-03        5.43E-03          1.5E-3          1.5E-3 4 - 30 days        4.78E-04          7.13E-04          4.16E-03        4.55E-03          1.0E-3          1.0E-3
                        /Q (s/m3) at Annex Building Door for the Identified Release Points(2)
Ground Level Plant Vent or    Containment          PORV and        Steam Line            Fuel        Condenser PCS Air            Release        Safety Valve        Break          Handling      Air Removal Diffuser(3)        Points(4)        Releases(5)      Releases          Area(6)        Stack(7) 0 - 2 hours          1.0E-3            1.0E-3              4.0E-3          4.0E-3          6.0E-3          2.0E-2 2 - 8 hours          7.5E-4            7.5E-4              3.2E-3          3.2E-3          4.0E-3          1.8E-2 8 - 24 hours        3.5E-4            3.5E-4              1.2E-3          1.2E-3          2.0E-3          7.0E-3 1 - 4 days          2.8E-4            2.8E-4              1.0E-3          1.0E-3          1.5E-3          5.0E-3 4 - 30 days          2.5E-4            2.5E-4              8.0E-4          8.0E-4          1.0E-3          4.5E-3 Notes:
: 1. These dispersion factors are to be used 1) for the time period preceding the isolation of the main control room and actuation of the emergency habitability system, 2) for the time after 72 hours when the compressed air supply in the emergency habitability system would be exhausted and outside air would be drawn into the main control room, and 3) for the determination of control room doses when the non-safety ventilation system is assumed to remain operable such that the emergency habitability system is not actuated.
: 2. These dispersion factors are to be used when the emergency habitability system is in operation and the only path for outside air to enter the main control room is that due to ingress/egress.
: 3. These dispersion factors are used for analysis of the doses due to a postulated small line break outside of containment. The plant vent and PCS air diffuser are potential release paths for other postulated events (loss-of-coolant accident, rod ejection accident, and fuel handling accident inside the containment); however, the values are bounded by the dispersion factors for ground level releases.
: 4. The listed values represent modeling the containment shell as a diffuse area source, and are used for evaluating the doses in the main control room for a loss-of-coolant accident, for the containment leakage of activity following a rod ejection accident, and for a fuel handling accident occurring inside the containment.
Tier 2 Material                                          15A-15                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  527
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                      AP1000 Design Control Document Table 15A-7 CONTROL ROOM SOURCE/RECEPTOR DATA FOR DETERMINATION OF ATMOSPHERIC DISPERSION FACTORS Horizontal Straight-Line Distance To Receptor Release          Control Room            Annex Building Elevation          HVAC Intake                  Access Source                    Note 1        (Elevation 19.7 m)        (Elevation 1.5 m)
Description                  (m)                  (1)                    (2)            Comment Plant Vent            ( 1)          55.7                128 ft                  350 ft (39.0m)                (106.6 m)
PCS Air Diffuser      ( 2)          69.8                114 ft                  332 ft (34.7 m)                (101.1 m)
Auxiliary Building Fuel              17.4                201 ft                  416 ft              Note 3 Handling Area                                            (61.2 m)                (126.8 m)
Blowout Panel          ( 3)
Radwaste Building                      1.5                204 ft                  411 ft              Note 3 Truck Staging                                            (62.1 m)                (125.2 m)
Area Door              ( 4)
Steam Vent            ( 5)          17.1                  55 ft                  250 ft (16.7 m)                (76.2 m)
PORV/Safety                          19.2                  58 ft                  235 ft Valves                ( 6)                              (17.6 m)                (71.6 m)
Condenser Air                        49.5                307 ft                  112 ft              Note 3 Removal Stack          ( 7)                              (93.5 m)                (34.1 m)
Containment Shell              Same as Receptor            48 ft                  268 ft              Note 2 (Diffuse Area                      Elevation            (14.6 m)                (81.6 m)
Source)                ( 8)    (19.7 m or 1.5 m)
Notes:
: 1. All elevations relative to grade at 0.0 m.
: 2. For calculating distance, the source is defined as the point on the containment shell closest to receptor.
: 3. Vertical distance traveled is conservatively neglected.
: 4.    - Refer to Symbols on Figure 15A-1.
: 5.  - Refer to Symbols on Figure 15A-1.
Tier 2 Material                                        15A-17                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                              528
 
DCP_NRC_003343        Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                  AP1000 Design Control Document Figure 15A-1 Site Plan with Release and Intake Locations Tier 2 Material                    15A-18                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                    529
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 15. Accident Analyses                                                    AP1000 Design Control Document APPENDIX 15B REMOVAL OF AIRBORNE ACTIVITY FROM THE CONTAINMENT ATMOSPHERE FOLLOWING A LOCA The AP1000 design does not depend on active systems to remove airborne particulates or elemental iodine from the containment atmosphere following a postulated loss-of-coolant accident (LOCA) with core melt. Naturally occurring passive removal processes provide significant removal capability such that airborne elemental iodine is reduced to very low levels within a few hours and the airborne particulates are reduced to extremely low levels within 12 hours.
15B.1      Elemental Iodine Removal Elemental iodine is removed by deposition onto the structural surfaces inside the containment.
The removal of elemental iodine is modeled using the equation from the Standard Review Plan (Reference 1):
KwA Od =
V where:
Od      =  first order removal coefficient by surface deposition Kw      =  mass transfer coefficient (specified in Reference 1 as 4.9 m/hr)
A        =  surface area available for deposition V        =  containment building volume The available deposition surface is 251,000 ft2, and the containment building net free volume is 2.06 x 106 ft3. From these inputs, the elemental iodine removal coefficient is 1.9 hr-1.
Consistent with the guidance of Reference 1, credit for elemental iodine removal is assumed to continue until a decontamination factor (DF) of 200 is reached in the containment atmosphere.
Because the source term for the LOCA (defined in subsection 15.6.5.3) is modeled as a gradual release of activity into the containment, the determination of the time at which the DF of 200 is reached needs to be based on the amount of elemental iodine that enters the containment atmosphere over the duration of core activity release.
15B.2      Aerosol Removal The deposition removal of aerosols from the containment atmosphere is accomplished by a number of processes including sedimentation, diffusiophoresis, and thermophoresis. All three of the deposition processes are significant contributors to the overall removal process in the AP1000. The large contributions from diffusiophoresis and thermophoresis to the total removal Tier 2 Material                                      15B-1                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                      530
 
DCP_NRC_003343                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 ACTIONS (continued)
CONDITION                      REQUIRED ACTION                COMPLETION TIME D. One required division    D.1        Restore required division    6 hours inoperable.                          to OPERABLE status.
E. One switch or switch set E.1        Restore switch and switch    48 hours inoperable.                          set to OPERABLE status.
F. One channel              F.1        Restore channel to          72 hours inoperable.                          OPERABLE status.
OR F.2.1      Verify alternate radiation  72 hours monitors are OPERABLE.
AND F.2.2      Verify main control room    72 hours isolation, air supply initiation, and load de-energization manual controls are OPERABLE.
G. One switch, switch set,  G.1        Restore switch, switch set,  72 hours channel, or division                channel, and division to inoperable.                          OPERABLE status.
H. One channel              H.1        Place channel in trip.      6 hours inoperable.
I. One or two channels      I.1        Place one inoperable        6 hours inoperable.                          channel in bypass or trip.
AND I.2        With two inoperable          6 hours channels, place one channel in bypass and one channel in trip.
J. One or two interlock    J.1        Verify the interlocks are in 1 hour channels inoperable.                the required state for the existing plant conditions.
OR AP1000                                      3.3.2 - 2                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      531
 
DCP_NRC_003343                                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 9 of 13)
Engineered Safeguards Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED                REQUIRED                                  SURVEILLANCE FUNCTION                          CONDITIONS                  CHANNELS            CONDITIONS            REQUIREMENTS
: 15. Boron Dilution Block
: a. Source Range Neutron Flux                2(n),3(n, e),4(e)                4                  B,T                  SR    3.3.2.1 Doubling                                                                                                        SR    3.3.2.4 SR    3.3.2.5 SR    3.3.2.6 5(e)                      4                  B,P                  SR    3.3.2.1 SR    3.3.2.4 SR    3.3.2.5 SR    3.3.2.6
: b. Reactor Trip                            Refer to Function 18.b (ESFAS Interlocks, Reactor Trip, P-4) for all requirements.
: 16. Chemical Volume and Control System Makeup Isolation
: a. SG Narrow Range Water                    1,2,3(e),4(b,e)              4 per SG              B,R                  SR    3.3.2.1 Level - High 2                                                                                                  SR    3.3.2.4 SR    3.3.2.5 SR    3.3.2.6
: b. Pressurizer Water Level -                  1,2,3(e)                      4                  B,Q                  SR    3.3.2.1 High 1                                                                                                          SR    3.3.2.4 SR    3.3.2.5 SR    3.3.2.6 Coincident with Safeguards                1,2,3(e)            Refer to Function 1 (Safeguards Actuation) for initiating functions Actuation                                                      and requirements.
: c. Pressurizer Water Level -              1,2,3,4(b,e,m)                  4                  B,T                  SR    3.3.2.1 High 2                                                                                                          SR    3.3.2.4 SR    3.3.2.5 SR    3.3.2.6
: d. Containment Radioactivity -                1,2,3(e)                      4                  B,Q                  SR    3.3.2.1 High 2                                                                                                          SR    3.3.2.4 SR    3.3.2.5 SR    3.3.2.6
: e. Manual Initiation                        1,2,3(e),4(b,e)            2 switches              E,R                  SR 3.3.2.3
: f. Source Range Neutron Flux Refer to Function 15.a (Boron Dilution Block, Source Range Neutron Flux Doubling) for all Doubling                      requirements.
: g. SG Narrow Range Water                    1,2,3(e),4(b,e)              4 per SG              B,R                  SR    3.3.2.1 Level High                                                                                                      SR    3.3.2.4 SR    3.3.2.5 SR    3.3.2.6 Coincident with Reactor Trip Refer to Function 18.b (ESFAS Interlocks, Reactor Trip, P-4) for all requirements.
(P-4)
(b) With the RCS not being cooled by the Normal Residual Heat Removal System (RNS).
(e) Not applicable for valve isolation Functions whose associated flow path is isolated.
(m) Above the P-19 (RCS Pressure) interlock.
(n) Not applicable when critical or during intentional approach to criticality.
AP1000                                                            3.3.2 - 22                                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                                    532
 
DCP_NRC_003343                              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 10 of 13)
Engineered Safeguards Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED          REQUIRED                                      SURVEILLANCE FUNCTION                      CONDITIONS              CHANNELS            CONDITIONS              REQUIREMENTS
: 17. Normal Residual Heat Removal System Isolation
: a. Containment Radioactivity -            1,2,3(e)                  4                    B,Q                  SR  3.3.2.1 High 2                                                                                                    SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Safeguards Actuation                  1,2,3(e)          Refer to Function 1 (Safeguards Actuation) for all initiating functions and requirements.
: c. Manual Initiation                    1,2,3(e)            2 switch sets              E,Q                  SR 3.3.2.3
: 18. ESFAS Interlocks
: a. Reactor Trip Breaker Open,              1,2,3                3 divisions              D,M                  SR 3.3.2.3 P-3
: b. Reactor Trip, P-4                      1,2,3                3 divisions              D,M                  SR 3.3.2.3
: c. Intermediate Range                      2                      4                    J,L                  SR 3.3.2.1 Neutron Flux, P-6                                                                                          SR 3.3.2.4 SR 3.3.2.5
: d. Reactor Coolant Average              2,3(e),4(e)                4                    J,T                  SR 3.3.2.1 Temperature, P-8                                                                                          SR 3.3.2.4 SR 3.3.2.5 5(e)                    4                    J,P                  SR 3.3.2.1 SR 3.3.2.4 SR 3.3.2.5
: e. Pressurizer Pressure, P-11              1,2,3                    4                    J,M                  SR 3.3.2.1 SR 3.3.2.4 SR 3.3.2.5
: f. Pressurizer Level, P-12              1,2,3                    4                    J,M                  SR 3.3.2.1 SR 3.3.2.4 SR 3.3.2.5 4,5,6                    4                  BB,Y                  SR 3.3.2.1 SR 3.3.2.4 SR 3.3.2.5
: g. RCS Pressure, P-19                    1,2,3,4(b)                  4                    J,N                  SR 3.3.2.1 SR 3.3.2.4 SR 3.3.2.5
: 19. Containment Air Filtration System Isolation
: a. Containment Radioactivity -          1,2,3,4(b)                  4                    B,Z                  SR  3.3.2.1 High 1                                                                                                    SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Containment Isolation              Refer to Function 3 (Containment Isolation) for initiating functions and requirements.
(b) With the RCS not being cooled by the Normal Residual Heat Removal System (RNS).
AP1000                                                    3.3.2 - 23                                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                            533
 
DCP_NRC_003343                                Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 11 of 13)
Engineered Safeguards Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED              REQUIRED                                  SURVEILLANCE FUNCTION                      CONDITIONS                CHANNELS            CONDITIONS            REQUIREMENTS
: 20. Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization
: a. Control Room Air Supply                1,2,3,4                      2                  F,O                SR  3.3.2.1 Radiation - High 2                                                                                          SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 Note (o)                    2                  G,K                SR  3.3.2.1 SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: 21. Auxiliary Spray and Purification Line Isolation
: a. Pressurizer Water Level -                  1,2                      4                  B,L                SR  3.3.2.1 Low 1                                                                                                      SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6
: b. Manual Initiation                          1,2              Refer to Function 16.e (Manual Chemical Volume Control System (Makeup Isolation) for requirements.
: 22. In-Containment Refueling Water Storage Tank (IRWST) Injection Line Valve Actuation
: a. Manual Initiation                      1,2,3,4(b)            2 switch sets              E,N                SR 3.3.2.3 (c) 4 ,5,6                2 switch sets              G,Y                SR 3.3.2.3
: b. ADS 4th Stage Actuation        Refer to Function 10 (ADS 4th Stage Actuation) for initiating functions and requirements.
: 23. IRWST Containment Recirculation Valve Actuation
: a. Manual Initiation                      1,2,3,4(b)            2 switch sets              E,N                SR 3.3.2.3 (c) 4 ,5,6                2 switch sets              G,Y                SR 3.3.2.3
: b. ADS Stage 4 Actuation          Refer to Function 10 (ADS Stage 4 Actuation) for all initiating functions and requirements.
Coincident with IRWST                1,2,3,4(b)                    4                  B,N                SR  3.3.2.1 Level - Low 3                                                                                              SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 4(c),5(j),6(j)                4                    I,Y                SR  3.3.2.1 SR  3.3.2.4 SR  3.3.2.5 SR  3.3.2.6 (b) With the RCS not being cooled by the Normal Residual Heat Removal System (RNS).
(c) With the RCS being cooled by the RNS.
(j) Not applicable when the required ADS valves are open. See LCO 3.4.12 and LCO 3.4.13 for ADS valve and equivalent relief area requirements.
(o) During movement of irradiated fuel assemblies.
AP1000                                                        3.3.2 - 25                                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                              534
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3 PRHR HX - Operating 3.5.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE                                      FREQUENCY SR 3.5.4.1          Verify the outlet manual isolation valve is fully open. 12 hours SR 3.5.4.2          Verify the inlet motor operated isolation valve is open. 12 hours SR 3.5.4.3          Verify the volume of noncondensible gases in the          24 hours PRHR HX inlet line has not caused the high-point water level to drop below the sensor.
SR 3.5.4.4          Verify that power is removed from the inlet motor        31 days operated isolation valve.
SR 3.5.4.5          Verify both PRHR air operated outlet isolation valves    In accordance with and both IRWST gutter isolation valves are                the Inservice OPERABLE by stroking open the valves.                    Testing Program SR 3.5.4.6          Verify PRHR HX heat transfer performance in              10 years accordance with the System Level OPERABILITY Testing Program.
SR 3.5.4.7          Verify by visual inspection that the IRWST gutter and    24 months downspout screens are not restricted by debris.
AP1000                                          3.5.4 - 3                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            535
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3 Secondary Specific Activity 3.7.4 3.7 PLANT SYSTEMS 3.7.4  Secondary Specific Activity LCO 3.7.4              The specific activity of the secondary coolant shall be < 0.01 Ci/gm DOSE EQUIVALENT I-131.
APPLICABILITY:          MODES 1, 2, 3 and 4.
ACTIONS CONDITION                          REQUIRED ACTION                  COMPLETION TIME A. Specific activity not        A.1        Be in MODE 3.                6 hours within limit.
AND A.2        Be in MODE 5.                36 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE                                      FREQUENCY SR 3.7.4.1          Verify the specific activity of the secondary coolant      31 days 0.01 Ci/gm DOSE EQUIVALENT I-131.
AP1000                                          3.7.4 - 1                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            536
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3 VES 3.7.6 3.7 PLANT SYSTEMS 3.7.6  Main Control Room Emergency Habitability System (VES)
LCO 3.7.6              The VES shall be OPERABLE.
                                                                  - NOTE -
The main control room envelope (MCRE) boundary may be opened intermittently under administrative control.
APPLICABILITY:        MODES 1, 2, 3, and 4, During movement of irradiated fuel assemblies.
ACTIONS
                                                    - NOTE -
LCO 3.0.8 is not applicable.
CONDITION                            REQUIRED ACTION                            COMPLETION TIME A. One valve or damper            A.1          Restore valve or damper to            7 days inoperable.                                OPERABLE status.
Restore PMS division in B. One PMS Division              B.1                                                7 days both MCR load shed inoperable in one or panels to OPERABLE more in MCR load shed status.
panel(s).
Thermal mass of one or                      Restore required heat sink C.                                  C.1                                                24 hours more required heat                          air temperatures to within sink(s) not within                          limit(s).
limit(s).                      AND Restore thermal mass of C.2                                                5 days required heat sink(s) to within limit(s).
AP1000                                              3.7.6 - 1                                        Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                                                  537
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3 VES 3.7.6 ACTIONS (continued)
CONDITION                  REQUIRED ACTION                COMPLETION TIME D. VES inoperable due to  D.1        Initiate action to implement Immediately inoperable MCRE                  mitigating actions.
boundary in MODE 1, 2, 3, or 4.              AND D.2        Verify mitigating actions    24 hours ensure MCRE occupant exposures to radiological, chemical, and smoke hazards will not exceed limits.
AND D.3        Restore MCRE boundary        90 days to OPERABLE status.
E. One bank of VES air    E.1        Verify that the OPERABLE    2 hours tanks (8 tanks)                  tanks contain greater than inoperable.                      245,680 scf of compressed    AND air.
Once per 12 hours thereafter AND E.2        Verify VBS MCRE ancillary    24 hours fans and supporting equipment are available.
AND E.3        Restore VES to              7 days OPERABLE status.
F.                          F.1        Be in MODE 3.                6 hours Required Action and associated AND Completion Time of Conditions A, B, C, D, F.2        Be in MODE 5.                36 hours or E not met in MODE 1, 2, 3, or 4.
OR VES inoperable for reasons other than AP1000                                    3.7.6 - 2                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      538
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3 VES 3.7.6 ACTIONS (continued)
CONDITION                          REQUIRED ACTION                COMPLETION TIME Conditions A, B, C, D, or E in MODE 1, 2, 3, or 4.
G. Required Action              G.1        Suspend movement of        Immediately and associated                            irradiated fuel assemblies.
Completion Time of Conditions A, B, C, D, or E not met during movement of irradiated fuel.
OR VES inoperable for reasons other than Conditions A, B, C, D, or E during movement of irradiated fuel.
OR VES inoperable due to inoperable MCRE boundary during movement of irradiated fuel.
SURVEILLANCE REQUIREMENTS SURVEILLANCE                                      FREQUENCY SR 3.7.6.1          Verify that the compressed air storage tanks contain      24 hours greater than 327,574 scf of compressed air.
Verify thermal mass for the following heat sink SR 3.7.6.2                                                                    24 hours locations is within limit:
: a. MCRE;
: b. Each required individual room adjacent to and below MCRE;
: c. Each required room-pair adjacent to and below MCRE; and
: d. Room above MCRE.
AP1000                                            3.7.6 - 3                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            539
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3 VES 3.7.6 SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE                                                                  FREQUENCY Operate VES for  15 minutes.
SR 3.7.6.3                                                                    31 days SR 3.7.6.4          Verify that each VES air header manual isolation        31 days valve is in an open position.
SR 3.7.6.5          Verify that the air quality of the air storage tanks    92 days meets the requirements of Appendix C, Table C-1 of ASHRAE Standard 62 with a pressure dew point of 40&deg;F at  3400 psig.
SR 3.7.6.6          Verify that all MCRE isolation valves are OPERABLE      24 months and will close upon receipt of an actual or simulated actuation signal.
SR 3.7.6.7          Verify that each VES pressure relief isolation valve      In accordance with within the MCRE pressure boundary is OPERABLE.            the Inservice Testing Program SR 3.7.6.8          Verify that each VES pressure relief damper is            24 months OPERABLE.
SR 3.7.6.9          Verify that the self-contained pressure regulating valve  In accordance with in each VES air delivery flow path is OPERABLE.          the Inservice Testing Program SR 3.7.6.10        Perform required MCRE unfiltered air inleakage            In accordance with testing in accordance with the Main Control Room          the Main Control Envelope Habitability Program.                            Room Envelope Habitability Program SR 3.7.6.11        Perform required VES Passive Filtration system filter    In accordance with testing in accordance with the Ventilation Filter Testing the VFTP Program (VFTP).
Verify the MCR load shed function actuates upon SR 3.7.6.12                                                                  24 months receipt of an actual or simulated actuation signal.
Verify each VES main air delivery isolation valve SR 3.7.6.13                                                                  24 months actuates to the correct position upon receipt of an actual or simulated actuation signal.
AP1000                                            3.7.6 - 4                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            540
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued)
A reactor trip is initiated every time a Safeguards Actuation signal is present. Therefore, this trip Function must be OPERABLE in MODES 1 and 2, when the reactor is critical, and must be shutdown in the event of an accident. In MODE 3, 4, 5, or 6, the reactor is not critical.
: 16. Reactor Trip System Interlocks Reactor protection interlocks are provided to ensure reactor trips are in the correct configuration for the current plant status. They back up operator actions to ensure protection system Functions are not blocked during plant conditions under which the safety analysis assumes the Functions are OPERABLE. Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip Functions are outside the applicable MODES.
These are:
: a. Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is actuated when the respective PMS Intermediate Range Neutron Flux channel increases to approximately one decade above the channel lower range limit. The LCO requirement for the P-6 interlock ensures that the following Functions are performed:
(1) on increasing power, the P-6 interlock allows the manual block of the respective PMS Source Range, Neutron Flux reactor trip. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range. When the source range trip is blocked, the high voltage to the detectors is also removed.
(2) on decreasing power, the P-6 interlock automatically energizes the PMS source range detectors and enables the PMS Source Range Neutron Flux reactor trip.
(3) on decreasing power, the P-6 interlock automatically resets the flux doubling block control ensuring the source range neutron flux doubling circuit is enabled. Normally, the source range neutron flux doubling circuit is manually blocked by the main control room operator during the reactor startup.
The LCO requires four channels of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 when below AP1000                                      B 3.3.1 - 23                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          541
 
DCP_NRC_003343                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued)
OPERABLE in MODE 4 if the steam generator blowdown line is isolated.
14.a. PRHR Heat Exchanger Actuation (Function 13)
Steam Generator Blowdown Isolation is also initiated by all Functions that initiate PRHR actuation. The Steam Generator Blowdown Isolation requirements for these Functions are the same as the requirements for the PRHR Actuation. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 13, PRHR HX Actuation, is referenced for all initiating Functions and requirements.
14.b. Steam Generator Narrow Range Level - Low The Steam Generator Blowdown isolation is actuated when the Steam Generator Narrow Range Level reaches its Low Setpoint.
The LCO requires four channels per steam generator to be OPERABLE to satisfy the requirements with a two-out-of-four logic. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function. Setpoint reflects both steady state and adverse environmental instrument uncertainties as the detectors provide protection for an event that results in a harsh environment.
: 15. Boron Dilution Block The block of boron dilution is accomplished by closing the CVS makeup line isolation valves or closing the demineralized water system isolation valve to CVS. This Function is actuated by Source Range Neutron Flux Doubling and Reactor Trip.
15.a. Source Range Neutron Flux Doubling A signal to block boron dilution in MODES 2 or 3, when not critical or during an intentional approach to criticality, and MODES 4 or 5 is derived from source range neutron flow increasing at an excessive rate (source range flux doubling).
This Function is not applicable in MODES 3, 4 and 5 if the demineralized water makeup flow path is isolated. The source AP1000                                    B 3.3.2 - 36                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            542
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) range neutron detectors are used for this Function. The LCO requires four divisions to be OPERABLE. There are four divisions and two-out-of-four logic is used. On a coincidence of excessively increasing source range neutron flux in two of the four divisions, demineralized water is isolated (CVS demineralized water system isolation valves closed) from the makeup pumps and reactor coolant makeup is isolated (CVS makeup line isolation valves closed) from the reactor coolant system to preclude a boron dilution event. In MODE 6, a dilution event is precluded by the requirement in LCO 3.9.2 to close, lock and secure at least one valve in each unborated water source flow path.
15.b. Reactor Trip (Function 18.b)
Demineralized Water Makeup is also isolated CVS demineralized water system isolation valves closed and the boric acid aligned to the CVS makeup pumps) by all the Functions that initiate a Reactor Trip. The isolation requirements for these Functions are the same as the requirements for the Reactor Trip Function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 18.b, (P-4 Reactor Trip Breakers), is referenced for all initiating Functions and requirements. A P-4 signal initiates isolation of RCS makeup from the CVS by closing the demineralized water system isolation valves, and aligning the CVS makeup pump suction to the boric acid tank. Unborated water source makeup isolation is initiated by all the Functions that initiate a Reactor Trip.
: 16. Chemical Volume and Control System Makeup Line Isolation The CVS makeup line is isolated following certain events to prevent overfilling of the RCS. In addition, this line is isolated on High 2 containment radioactivity to provide containment isolation following an accident. This line is not isolated on a containment isolation signal, to allow the CVS makeup pumps to perform their defense-in-depth functions. However, if very high containment radioactivity exists (above the High 2 setpoint) this line is isolated.
A signal to isolate the CVS is derived from two-out-of-four high steam generator levels on either steam generator, two-out-of-four channels of pressurizer level indicating high or two-out-of-four channels of containment radioactivity indicating high. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip AP1000                                      B 3.3.2 - 37                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            543
 
DCP_NRC_003343              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) x    Trip the main turbine x    Block boron dilution x    Isolate main feedwater coincident with low reactor coolant temperature (This function is not assumed in safety analysis therefore, it is not included in the technical specifications.)
The reactor trip breaker position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this Function has no adjustable trip setpoint.
This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality. This Function does not have to be OPERABLE in MODE 4, 5, or 6 to trip the main turbine, because the main turbine is not in operation.
The P-4 Function does not have to be OPERABLE in MODE 4 or 5 to block boron dilution, because Function 15.a, Source Range Neutron Flux Doubling, provides the required block. In MODE 6, the P-4 interlock with the Boron Dilution Block Function is not required, since the unborated water source flow path isolation valves are locked closed in accordance with LCO 3.9.2.
18.c. Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is actuated when the respective NIS intermediate range channel increases to approximately one decade above the channel lower range limit. Above the setpoint, the P-6 interlock allows manual block of the source range neutron flux reactor trip.
Below the setpoint, the P-6 interlock automatically energizes the source range detectors and unblocks the source range neutron flux reactor trip. As intermediate range flux decreases from above the setpoint to below the setpoint P-6 interlock automatically resets the flux doubling block function ensuring the source range neutron flux doubling function is enabled.
Normally, the source range neutron flux doubling Function is blocked by the main control room operator during reactor startup. This Function is required to be OPERABLE in MODE 2.
AP1000                                B 3.3.2 - 42                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                        544
 
DCP_NRC_003343              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) 18.d. Reactor Coolant Average Temperature, P-8 The P-8 interlock is provided to permit a manual block of or to reset a manual block of the automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block (Function 15.a).
The automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block Function may be manually blocked (disabled) to permit plant startup and normal power operation when above the P-8 reactor coolant average temperature setpoint.
The manual block to disable the automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block Function is automatically reset upon decreasing reactor coolant average temperature to below the P-8 setpoint.
Once reactor coolant average temperature is below the P-8 setpoint, the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block Function may also be manually blocked to prevent inadvertent actuation during refueling operations and post-refueling control rod testing.
When the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block is manually blocked below P-8 during shutdown conditions, the CVS demineralized water system isolation valves will automatically close to prevent inadvertent boron dilution.
The P-8 interlock is required to be OPERABLE in MODES 2, 3, 4 and 5. This Function is not applicable in MODES 3, 4 and 5, if the demineralized water makeup flow path is isolated. In MODE 6, a dilution event is precluded by the requirement in LCO 3.9.2 to close, lock and secure at least one valve in each unborated water source flow path.
18.e. Pressurizer Pressure, P-11 The P-11 interlock permits a normal unit cooldown and depressurization without Safeguards Actuation or main steam line and feedwater isolation. With pressurizer pressure channels less than the P-11 setpoint, the operator can manually block the Pressurizer pressure - Low, Steam Line Pressure - Low, and Tcold - Low Safeguards Actuation signals and the Steam Line Pressure - Low and Tcold - Low steam line isolation signals. When the Steam Line Pressure -
AP1000                                B 3.3.2 - 43                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      545
 
DCP_NRC_003343              Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued)
Low is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate - High is enabled. This provides protection for an SLB by closure of the main steam isolation valves. Manual block of feedwater isolation on Tavg - Low 1, Low 2, and Tcold - Low is also permitted below P-11. With pressurizer pressure channels  P-11 setpoint, the Pressurizer Pressure - Low, Steam Line Pressure - Low, and Tcold - Low Safeguards Actuation signals and the Steam Line Pressure Low and Tcold - Low steam line isolation signals are automatically enabled. The feedwater isolation signals on Tcold - Low, Tavg - Low 1 and Low 2 are also automatically enabled above P-11. The operator can also enable these signals by use of the respective manual reset buttons. When the Steam Line Pressure - Low and Tcold - Low steam line isolation signals are enabled, the main steam isolation on Steam Line Pressure-Negative Rate - High is disabled. The Setpoint reflects only steady state instrument uncertainties.
This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the Safeguards Actuation or main steam or feedwater isolation. This Function does not have to be OPERABLE in MODE 4, 5, or 6, because plant pressure must already be below the P-11 setpoint for the requirements of the heatup and cooldown curves to be met.
18.f. Pressurizer Level, P-12 The P-12 interlock is provided to permit midloop operation without core makeup tank actuation, reactor coolant pump trip, CVS letdown isolation, or purification line isolation. With pressurizer level channels less than the P-12 setpoint, the operator can manually block low pressurizer level signal used for these actuations. Concurrent with blocking CMT actuation on low pressurizer level, ADS 4th Stage actuation on Low 2 RCS hot leg level is enabled. Also CVS letdown isolation on Low 1 RCS hot leg level is enabled. When the pressurizer level is above the P-12 setpoint, the pressurizer level signal is automatically enabled and a confirmatory open signal is issued to the isolation valves on the CMT cold leg balance lines. This Function is required to be OPERABLE in MODES 1, 2, 3, 4, 5, and 6.
AP1000                                B 3.3.2 - 44                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      546
 
DCP_NRC_003343                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued) 18.g. RCS Pressure, P-19 The P-19 interlock is provided to permit water solid conditions (i.e., when the pressurizer water level is >92%) in lower MODES without automatic isolation of the CVS makeup pumps. With RCS pressure below the P-19 setpoint, the operator can manually block CVS isolation on High 2 pressurizer water level, and block Passive RHR actuation and Pressurizer Heater Trip on High 3 pressurizer water level.
When RCS pressure is above the P-19 setpoint, these Functions are automatically unblocked. This Function is required to be OPERABLE IN MODES 1, 2, 3, and 4 with the RCS not being cooled by the RNS. When the RNS is cooled by the RNS, the RNS suction relief valve provides the required overpressure protection (LCO 3.4.14).
: 19. Containment Air Filtration System Isolation Some DBAs such as a LOCA may release radioactivity into the containment where the potential would exist for the radioactivity to be released to the atmosphere and exceed the acceptable site dose limits. Isolation of the Containment Air Filtration System provides protection to prevent radioactivity inside containment from being released to the atmosphere.
19.a. Containment Radioactivity - High 1 Three channels of Containment Radioactivity - High 1 are required to be OPERABLE in MODES 1, 2, 3, and 4 with the RCS not being cooled by the RNS, when the potential exists for a LOCA, to protect against radioactivity inside containment being released to the atmosphere. These Functions are not required to be OPERABLE in MODE 4 with the RCS being cooled by the RNS or MODES 5 and 6, because any DBA release of radioactivity into the containment in these MODES would not require containment isolation.
19.b. Containment Isolation (Function 3)
Containment Air Filtration System Isolation is also initiated by all Functions that initiate Containment Isolation. The Containment Air Filtration System Isolation requirements for these Functions are the same as the requirements for the Containment Isolation. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 3, Containment AP1000                                    B 3.3.2 - 45                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          547
 
DCP_NRC_003343                  Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCOs, and APPLICABILITY (continued)
Isolation, is referenced for initiating Functions and requirements.
: 20. Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization Isolation of the main control room and initiation of the VES air supply provides a breathable air supply for the operators following an uncontrolled release of radiation. De-energizing non-essential main control room electrical loads maintains the room temperature within habitable limits. This Function is required to be OPERABLE in MODES 1, 2, 3, and 4, and during movement of irradiated fuel because of the potential for a fission product release following a fuel handling accident, or other DBA.
20.a. Main Control Room Air Supply Radiation - High 2 Two radiation monitors are provided on the main control room air intake. If either monitor exceeds the High 2 setpoint, control room isolation is actuated.
: 21. Auxiliary Spray and Purification Line Isolation The CVS maintains the RCS fluid purity and activity level within acceptable limits. The CVS purification line receives flow from the discharge of the RCPs. The CVS also provides auxiliary spray to the pressurizer. To preserve the reactor coolant pressure in the event of a break in the CVS loop piping, the purification line and the auxiliary spray line are isolated on a pressurizer water level Low 1 setpoint.
This helps maintain reactor coolant system inventory.
21.a. Pressurizer Water Level - Low 1 A signal to isolate the purification line and the auxiliary spray line is generated upon the coincidence of pressurizer level below the Low 1 setpoint in any two-out-of-four divisions. This Function is required to be OPERABLE in MODES 1 and 2 to help maintain RCS inventory. In MODES 3, 4, 5, and 6, this Function is not needed for accident detection and mitigation.
21.b. Manual Chemical Volume Control System Makeup Isolation (Function 16.e)
The Auxiliary Spray and Purification Line Isolation is also initiated by the Manual Chemical Volume Control System Makeup Isolation Function. The requirements for this Function AP1000                                    B 3.3.2 - 46                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            548
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (Continued) x    Steam Line Isolation; x    Main Feedwater Control Valve Isolation; x    Main Feedwater Pump Trip and Valve Isolation; x    ADS Stages 1, 2, & 3 Actuation; x    ADS Stage 4 Actuation; x    Passive Containment Cooling Actuation; x    PRHR Heat Exchanger Actuation; x    CVS Makeup Line Isolation; x    IRWST Injection Line Valve Actuation; x    IRWST Containment Recirculation Valve Actuation; x    Steam Generator PORV Flow Path Isolation.
This Action addresses the inoperability of the system level manual initiation capability for the ESF Functions listed above. With one switch or switch set inoperable for one or more Functions, the system level manual initiation capability is reduced below that required to meet single failure criterion. Required Action E.1 requires the switch or switch set for system level manual initiation to be restored to OPERABLE status within 48 hours. The specified Completion Time is reasonable considering that the remaining switch or switch set is capable of performing the safety function.
F.1, F.2.1, and F.2.2 Condition F is applicable to the main control room isolation, air supply initiation and electrical load de-energization function which has only two channels of the initiating process variable. With one channel inoperable, the logic becomes one-out-of-one and is unable to meet single failure criterion. Restoring all channels to OPERABLE status ensures that a single failure will not prevent the protective Function.
Alternatively, radiation monitor(s) which provide equivalent information and main control room isolation, air supply initiation and electrical load de-energization manual controls may be verified to be OPERABLE. These provisions for operator action can replace one channel of radiation detection and system actuation. The AP1000                                      B 3.3.2 - 56                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            549
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (Continued)
J.1 and J.2 Condition J applies to the P-6, P-8, P-11, P-12, and P-19 interlocks. With one or two required channel(s) inoperable, the associated interlock must be verified to be in its required state for the existing plant condition within 1 hour, or any Function channel associated with the inoperable interlock(s) placed in a bypassed condition within 7 hours. Verifying the interlock state manually accomplishes the interlock role.
If one interlock channel is inoperable, the associated Function(s) must be placed in a bypass or trip condition within 7 hours. If one channel is bypassed, the logic becomes two-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent the protective function.) If one channel is tripped, the logic becomes one-out-of-three, while still meeting the single failure criterion.
(A failure in one of the three remaining channels will not prevent the protective function.)
If two interlock channels are inoperable, one channel of the associated Function(s) must be bypassed and one channel of the associated Function(s) must be tripped. In this state, the logic becomes one-out-of-two, while still meeting the single failure criterion. The 7 hours allowed to place the inoperable channel(s) in the bypassed or tripped condition is justified in Reference 6.
K.1 LCO 3.0.8 is applicable while in MODE 5 or 6. Since irradiated fuel assembly movement can occur in MODE 5 or 6, the ACTIONS have been modified by a Note stating that LCO 3.0.8 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, the fuel movement is independent of shutdown reactor operations. Entering LCO 3.0.8 while in MODE 5 or 6 would require the optimization of plant safety, unnecessarily.
Condition K is applicable to the Main Control Room Isolation Isolation, Air Supply Initiation and Electrical Load De-energization (Function 20), during movement of irradiated fuel assemblies. If the Required Action and associated Completion Time of the first Condition listed in Table 3.3.2-1 is not met, the plant must suspend movement of the irradiated fuel assemblies immediately. The required action suspends activities with potential for releasing radioactivity that might enter the MCR. This action does not preclude the movement of fuel to a safe position.
AP1000                                      B 3.3.2 - 58                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                              550
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 PAM Instrumentation B 3.3.3 BASES LCO (continued)
: 10. Pressurizer Level and Associated Reference Leg Temperature Pressurizer level is provided to monitor the RCS coolant inventory.
During an accident, operation of the safeguards systems can be verified based on coolant inventory indicators.
The reference leg temperature is included in the Technical Specification since it is used to compensate the level signal.
: 11. In-Containment Refueling Water Storage Tank (IRWST) Water Level The IRWST provides a long term heat sink for non-LOCA events and is a source of injection flow for LOCA events. When the IRWST is a heat sink, the level will change due to increased volume associated with the temperature increase. When saturation temperature is reached, the IRWST will begin steaming and initially lose mass to the containment atmosphere until condensation occurs on the steel containment shell which is cooled by the passive containment cooling system. The condensate is returned to the IRWST via a gutter and downspouts.
During a LOCA, the IRWST is available for injection. Depending on the severity of the event, when a fully depressurized RCS has been achieved, the IRWST will inject by gravity flow.
: 12. Passive Residual Heat Removal (PRHR) Flow and PRHR Outlet Temperature PRHR Flow is provided to monitor primary system heat removal during accident conditions when the steam generators are not available. PRHR provides primary protection for non-LOCA events when the normal heat sink is lost.
PRHR outlet temperature is provided to monitor primary system heat removal during accident conditions when the steam generators are not available. PRHR provides primary protection for non-LOCA events when the normal heat sink is lost.
13, 14, 15, 16. Core Exit Temperature Core Exit Temperature is provided for verification and long term surveillance of core cooling.
AP1000                                      B 3.3.3 - 4                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          551
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3 RCS Specific Activity B 3.4.10 BASES APPLICABLE SAFETY ANALYSES (continued) assumed to be the LCO of 280 Ci/gm DOSE EQUIVALENT XE-133.
The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.01 Ci/gm DOSE EQUIVALENT I-131 from LCO 3.7.4, Secondary Specific Activity.
The LCO limits ensure that, in either case, the doses reported in Chapter 15 remain bounding.
The RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                  The specific iodine activity is limited to 1.0 Ci/gm DOSE EQUIVALENT I-131, and the specific noble gas activity is limited to 280 Ci/gm DOSE EQUIVALENT XE-133. These limits ensure that the doses resulting from a DBA will be within the values reported in Chapter 15. Secondary coolant activities are addressed by LCO 3.7.4, Secondary Specific Activity.
The SLB and SGTR accident analyses (Refs. 1 and 2) show that the offsite doses are within acceptance limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR accident, lead to doses that exceed those reported Chapter 15.
APPLICABILITY        In MODES 1 and 2, and in MODE 3 with RCS average temperature 500&deg;F, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 specific activity are necessary to contain the potential consequences of a SGTR to within the calculated site boundary dose values.
For operation in MODE 3 with RCS average temperature < 500&deg;F and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves.
ACTIONS              A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to verify that DOSE EQUIVALENT I-131 is  60 Ci/gm. The Completion Time of 4 hours is required to obtain and analyze a sample. Sampling is to continue to provide a trend.
AP1000                                        B 3.4.10 - 2                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                              552
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 PRHR HX - Operating B 3.5.4 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.4 Passive Residual Heat Removal Heat Exchanger (PRHR HX) - Operating BASES BACKGROUND          The normal heat removal mechanism is the steam generators, which are supplied by the startup feedwater system. However, this path utilizes non-safety related components and systems, so its failure must be considered. In the event the steam generators are not available to remove decay heat for any reason, including loss of startup feedwater, the heat removal path is the PRHR HX (Ref. 1).
The principle component of the PRHR HX is a 100% capacity heat exchanger mounted in the In-containment Refueling Water Storage Tank (IRWST). The heat exchanger is connected to the Reactor Coolant System (RCS) by a inlet line from one RCS hot leg, and an outlet line to the associated steam generator cold leg channel head. The inlet line to the passive heat exchanger contains a normally open, motor operated isolation valve. The outlet line is isolated by two parallel, normally closed air operated valves, which fail open on loss of air pressure or control signal. There is a vertical collection point at the top of the common inlet piping high point which serves as a gas collector. It is provided with level detectors that indicate when noncondensible gases have collected in this area. There are provisions to manually vent these gases to the IRWST.
In order to preserve the IRWST water for long term PRHR HX operation, downspouts and a gutter are provided to collect and return water to the IRWST that has condensed on the inside surface of the containment shell. During normal plant operation, any water collected by the downspouts or gutter is directed to the normal containment sump. During PRHR HX operation, redundant series air operated valves are actuated to block the draining of condensate to the normal sump and to force the condensate into the IRWST. These valves fail closed on loss of air pressure or control signal.
The PRHR HX size and heat removal capability is selected to provide adequate core cooling for the limiting non-LOCA heatup Design Basis Accidents (DBAs) (Ref. 2). The Probability Risk Assessment (PRA)
(Ref. 3) shows that PRHR HX is not required assuming that passive feed and bleed is available. Passive feed and bleed uses the Automatic Depressurization System (ADS) for bleed and the CMTs/accumulators/
IRWST for feed.
AP1000                                      B 3.5.4 - 1                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            553
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 PRHR HX - Operating B 3.5.4 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.5.4.7 This surveillance requires visual inspection of the IRWST gutter and downspout screens to verify that the return flow to the IRWST will not be restricted by debris. A Frequency of 24 months is adequate since there are no known sources of debris with which the gutter or downspout screens could become restricted.
REFERENCES          1. Section 6.3, Passive Core Cooling System.
: 2. Chapter 15, Safety Analysis.
: 3. AP1000 PRA.
AP1000                                      B 3.5.4 - 7                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                        554
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 Secondary Specific Activity B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Secondary Specific Activity BASES BACKGROUND          Activity in the secondary coolant results from steam generator tube LEAKAGE from the Reactor Coolant System (RCS). Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant. While fission products present in the primary coolant, as well as activated corrosion products, enter the secondary coolant system due to the primary to secondary LEAKAGE, only the iodines are of a significant concern relative to airborne release of activity in the event of an accident or abnormal occurrence (radioactive noble gases that enter the secondary side are not retained in the coolant but are released to the environment via the condenser air removal system throughout normal operation).
The limit on secondary coolant radioactive iodines minimizes releases to the environment due to anticipated operational occurrences or postulated accidents.
APPLICABLE          The accident analysis of the main steam line break (SLB) as discussed in SAFETY              Chapter 15 (Ref. 1) assumes the initial secondary coolant specific activity ANALYSES            to have a radioactive isotope concentration of 0.01 Ci/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident.
The accident analysis, based on this and other assumptions, shows that the radiological consequences of a postulated SLB are within the acceptance criteria in SRP Section 15.0.1, and within the exposure guideline values of 10 CFR Part 50.34.
Secondary specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                  As indicated in the Applicable Safety Analyses, the specific activity limit of the secondary coolant is required to be  0.01 Ci/gm DOSE EQUIVALENT I-131 to maintain the validity of the analyses reported in Chapter 15 (Ref. 1).
Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.
AP1000                                      B 3.7.4 - 1                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            555
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Main Control Room Emergency Habitability System (VES)
BASES BACKGROUND          The Main Control Room Emergency Habitability System (VES) provides a protected environment from which operators can control the plant following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. The system is designed to operate following a Design Basis Accident (DBA) which requires protection from the release of radioactivity.
In these events, the Nuclear Island Non-Radioactive Ventilation System (VBS) would continue to function if AC power is available. If AC power is lost for greater than 10 minutes, or Low main control room differential pressure is sensed for greater than 10 minutes, or a High-2 iodine or particulate Main Control Room Envelope (MCRE) radiation signal is received, the VES is actuated. The MCRE radioactivity is measured by detectors in the MCR supply air duct, downstream of the filtration units.
The major functions of the VES are: 1) to provide forced ventilation to deliver an adequate supply of breathable air (Ref. 4) for the MCRE occupants; 2) to provide forced ventilation to maintain the MCRE at a 1/8 inch water gauge positive pressure with respect to the surrounding areas;
: 3) provide passive filtration to filter contaminated air in the MCRE; and
: 4) to limit the temperature increase of the MCRE equipment and facilities that must remain functional during an accident, via de-energizing (load shedding) nonessential, non-safety main control room (MCR) electrical equipment (e.g., wall panel information system displays, office equipment, water heater, kitchen appliances, and non-emergency lighting) andthe heat absorption of passive heat sinks.
The VES consists of compressed air storage tanks, two air delivery flow paths, an eductor, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), associated valves or dampers, piping, and instrumentation. The tanks contain enough breathable air to supply the required air flow to the MCRE for at least 72 hours. The VES system is designed to maintain CO2 concentration less than 0.5% for up to 11 MCRE occupants.
AP1000                                      B 3.7.6 - 1                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          556
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES BACKGROUND (continued)
The MCRE is the area within the confines of the MCRE boundary that contains the spaces that control room operators inhabit to control the unit during normal and accident conditions. This area encompasses the main control area, operations work area, operational break room, shift supervisors office, kitchen, and toilet facilities (Ref. 1). The MCRE is protected during normal operation, natural events, and accident conditions. The MCRE boundary is the combination of walls, floor, roof, electrical and mechanical penetrations, and access doors.                The OPERABILITY of the MCRE boundary must be maintained to ensure that the inleakage of unfiltered air into the MCRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to MCRE occupants. The MCRE and its boundary are defined in the Main Control Room Envelope Habitability Program.
Heat sources inside the MCRE include operator workstations, emergency lighting and occupants. During normal operation, temperatures in the main control room, instrumentation and control rooms, dc equipment rooms, Class 1E electrical penetration rooms, and some adjacent rooms are maintained within a specified range by the VBS. As described in UFSAR Section 9.4.1.2, the VBS consists of independent subsystems, including the main control room / control support area HVAC subsystem and the Class 1E Electrical room HVAC subsystem. The Class 1E Electrical room HVAC subsystem is further divided into two independent subsystems, with one serving the Division A & C Class 1E electrical division rooms and the other serving the Division B & D Class 1E electrical division rooms. Each independent subsystem serves its associated rooms with two redundant, 100 percent capacity equipment trains, maintaining temperatures within the specified range.
To support OPERABILITY of the VES, passive heat sink air temperatures are maintained by VBS in required dc Equipment rooms and required I&C rooms. Certain required room-pairs (i.e., 12201/12301, 12203/12302, 12205/12305, and 12207/12304) require the average temperature of the combined room-pair to be  85&deg;F, as monitored by temperature elements located in the shared return air ducting. Other required individual rooms (i.e., 12202, 12204, 12300, 12313, 12412, and 12501) are each required to be  85&deg;F. Additionally, a maximum air temperature limit of  75&deg;F is also placed on the MCRE. The passive heat sinks limit the temperature rise inside each room and the MCRE during the 72-hour period following VES actuation.
AP1000                                      B 3.7.6 - 2                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          557
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES BACKGROUND (continued)
Access corridors, stairwells, rooms separated by an air gap, and other rooms without significant heat loads are not monitored because these areas do not contain significant heat sources and their temperatures are assumed to match the connected spaces. These unmonitored rooms are identified as: 12211, 12311, 12400, 12405, 12411, 21480, 40400, and Stairwells.
Initial temperatures assumed for remaining rooms are conservatively selected to match the initial 115&deg;F outdoor ambient (12212, 12213, 12306, 12312, 12404, and 12406) or do not have an appreciable impact on the analyses. These unmonitored rooms are identified as: 12212, 12213, 12306, 12312, 12404, 12406, 12504, 12505, 12506, and Level 1 rooms.
Nonessential, non-safety MCR heat loads are de-energized by the Protection and Safety Monitoring System (PMS) VES actuation signal, which is generated by the Main Control Room Isolation, Air Supply Initiation and Electrical Load De-energization ESF actuation signal, to maintain the MCRE within habitable limits for 72 hours.
Upon receipt of a Main Control Room Isolation, Air Supply Initiation and Electrical Load De-energization ESF actuation signal, PMS Divisions A and C energize associated redundant relays in each of the two safety-related electrical panels (VES-EP-01 and VES-EP-02). Energizing one set of relays in each panel disconnects non-safety related electrical power to the non-safety electrical loads in the MCRE. Energizing just one set of relays in one panel deenergizes the non-safety loads associated only with that panel.
De-energized non-safety loads are separated into stage 1 and stage 2 to maximize the availability of the non-safety related wall panel information system which is de-energized with stage 2 loads. Timers and associated relays, which actuate to de-energize the stage 1 and stage 2 non-safety loads, are internal to each safety-related load shed panel. Stage 1 loads are de-energized by both panels immediately after the timers in each panel receive the PMS Main Control Room Isolation, Air Supply Initiation and Electrical Load De-energization ESF actuation signal. Stage 2 loads are de-energized by both panels within 180 minutes after the timers in each panel receive the PMS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization ESF actuation signal.
AP1000                                      B 3.7.6 - 3                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          558
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES BACKGROUND (continued)
OPERABILITY of two redundant divisions of MCR Class 1E load shed relays and timers located in two safety-related panels is required to meet the single failure criterion. Each panel contains redundant load shed relays and timers actuated by the two PMS divisions such that actuation of either division deenergizes the specified loads associated with both panels.
In the unlikely event that power to the VBS is unavailable for more than 72 hours, MCRE habitability is maintained by operating one of the two MCRE ancillary fans to supply outside air to the MCRE.
The compressed air storage tanks are initially filled to contain greater than 327,574 scf of compressed air. The compressed air storage tanks, the tank pressure, and the room temperature are monitored to confirm that the required volume of breathable air is stored. During operation of the VES, a self-contained pressure regulating valve maintains a constant downstream pressure regardless of the upstream pressure. An orifice downstream of the regulating valve is used to control the air flow rate into the MCRE. The MCRE is maintained at a 1/8 inch water gauge positive pressure to minimize the infiltration of airborne contaminants from the surrounding areas. The VES operation in maintaining the MCRE habitable is discussed in Reference 1.
APPLICABLE          The compressed air storage tanks are sized such that the set of tanks SAFETY              has a combined capacity that provides at least 72 hours of VES ANALYSES            operation.
Operation of the VES is automatically initiated by any of the following safety related signals:
x  Main Control Room Air Supply Iodine or Particulate Radiation -
High-2 x  Loss of all AC power for more than 10 minutes; or x  Main Control Room differential pressure - Low (for greater than 10 minutes)
AP1000                                      B 3.7.6 - 4                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          559
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES APPLICABLE SAFETY ANALYSES (continued)
In the event that a High-1 radioactivity setpoint value is reached , the non-safety VBS re-aligns to supplemental filtration mode, providing MCRE pressurization, cooling, and filtration. Upon High-2 particulate or iodine radioactivity setpoint, a safety related signal is generated to isolate the MCRE and to initiate air flow from the VES storage tanks. Isolation of the MCRE consists of closing safety related valves in the lines that penetrate the MCRE pressure boundary. Valves in the VBS supply and exhaust ducts, and the Sanitary Drainage System (SDS) vent lines are automatically isolated. VES air flow is initiated by a safety related signal which opens the isolation valves in the VES supply lines.
The VES provides protection from smoke and hazardous chemicals to the MCRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the MCRE following a hazardous chemical release (Ref. 1). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the MCRE occupants to control the reactor either from the control room or from the remote shutdown room (Ref. 2).
The VES functions to mitigate a DBA or transient that either assumes the failure of or challenges the integrity of the fission product barrier.
The VES satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  The VES limits the MCRE temperature rise and maintains the MCRE at a positive pressure relative to the surrounding environment.
Two air delivery flow paths are required to be OPERABLE to ensure that at least one is available, assuming a single failure.
The VES is considered OPERABLE when the individual components necessary to deliver a supply of breathable air to the MCRE are OPERABLE. In addition, the MCRE pressure boundary must be maintained, including the integrity of the walls, floors, ceilings, electrical and mechanical penetrations, and access doors. The MCRE pressure boundary includes the Potable Water System (PWS) and SDS running (piping drain) traps, which retain a fluid level sufficient to maintain a seal preventing gas flow through the piping. The MCRE pressure boundary also includes the Waste Water System (WWS) drain line, which is isolated by a normally closed isolation valve.
AP1000                                      B 3.7.6 - 5                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                              560
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES LCO (continued)
In order for the VES to be considered OPERABLE, the MCRE boundary must be maintained such that the MCRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analysis for DBAs, and that MCRE occupants are protected from hazardous chemicals and smoke.
The initial MCRE heat sink thermal mass, required individual room heat sink thermal mass, and required room-pair heat sink thermal mass are initial conditions required to limit the maximum MCRE temperature.
Thermal mass is the ability of a material to absorb and store heat energy.
In the context of the MCRE heat-up analysis, the thermal mass of the heat sinks provides inertia against temperature changes. Establishing the passive heat sink nominal conditions is related to the time of exposure and magnitude of relevant heat sources, and is dependent upon material properties such as specific heat capacity and density of concrete. The thermal mass of the required MCRE heat sinks (the MCRE, individual require rooms adjacent to and below the MCRE, required room-pairs adjacent to and below the MCRE, and the room above the MCRE) must be within limits to support VES OPERABILITY and limit the maximum MCRE temperature for 72 hours after VES actuation.
The LCO is modified by a Note allowing the MCRE boundary to be opened intermittently under administrative controls. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the MCRE. This individual will have a method to rapidly close the opening and to restore the MCRE boundary to a condition equivalent to the design condition when a need for MCRE isolation is indicated.
Both PMS Divisions A and C in the two safety-related electrical panels are required to be OPERABLE, so that non-safety stage 1 and stage 2 MCR heat loads can be de-energized by the VES system actuation signal within the required time, assuming a single failure. This maintains the MCR temperature within habitable limits.
AP1000                                      B 3.7.6 - 6                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          561
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 APPLICABILITY        In MODES 1, 2, 3, and 4 and during movement of irradiated fuel assemblies, the VES must be OPERABLE to ensure that the MCRE will remain habitable during and following a DBA.
The VES is not required to be OPERABLE in MODES 5 and 6 when irradiated fuel is not being moved because accidents resulting in fission product release are not postulated.
ACTIONS              LCO 3.0.8 is applicable while in MODE 5 or 6. Since irradiated fuel assembly movement can occur in MODE 5 or 6, the ACTIONS have been modified by a Note stating that LCO 3.0.8 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, the fuel movement is independent of shutdown reactor operations. Entering LCO 3.0.8 while in MODE 5 or 6 would require the optimization of plant safety, unnecessarily.
A.1 When a VES valve, a VES damper, or a main control room boundary isolation valve is inoperable, action is required to restore the component to OPERABLE status. A Completion Time of 7 days is permitted to restore the valve or damper to OPERABLE status before action must be taken to reduce power. The Completion Time of 7 days is based on engineering judgment, considering the low probability of an accident that would result in a significant radiation release from the fuel, the low probability of not containing the radiation, and that the remaining components can provide the required capability.
B.1 If one division of one or more MCR load shed panel(s) is inoperable, all divisions of both MCR load shed panels must be restored to OPERABLE status within 7 days. In this condition, the OPERABLE unaffected division of the panel is capable of providing 100% of the load shed function.
A Completion Time of 7 days is permitted to restore the inoperable division of MCR load shed panel(s) to OPERABLE status before action must be taken to reduce power. The Completion Time of 7 days is based on engineering judgment, considering the low probability of an accident that would require VES actuation, and that the remaining panel division can provide the required load shed function.
AP1000                                      B 3.7.6 - 7                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            562
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES ACTIONS (continued)
As described in Subsection 6.4.2.3 of Ref. 1, any component failure in a PMS division of the load shed panel(s) renders that division inoperable. If this failure affects only one PMS division, leaving the remaining division of PMS unaffected, including the associated power and control circuit, it renders the panel(s) inoperable, while still maintaining the full load shed function. An event or action that impacts both PMS divisions in either panel does not maintain the full load shed function, and Condition F or G of LCO 3.7.6 would apply.
C.1 and C.2 When the thermal mass of one or more of the required MCRE heat sinks (the MCRE, individual required rooms adjacent to and below the MCRE, required room-pairs adjacent to and below the MCRE, and the room above the MCRE) is not within the required limit(s), the heat sink air temperature must be restored to within limit in 24 hours and the thermal mass of the required heat sink(s) must be restored to within limit(s) in 5 days.
The Required Action C.1 Completion Time of 24 hours to initially restore the heat sink air temperature to within limit is based on engineering judgment, considering the low probability of an accident that would require VES actuation under the worst case temperature conditions, and is permitted based upon the availability of temperature indication in the MCRE and individual required rooms, and in the air return ducts to the adjacent required room-pairs. It is judged to be a sufficient amount of time allotted to correct the deficiency in the non-safety VBS ventilation system.
The MCRE heat-up analysis demonstrates that the heat sink thermal mass returns to baseline assumptions after a variable time period depending upon the extent of VBS HVAC system degradation and outage time (i.e., extent and duration of the loss of VBS cooling) and upon heat sink wall thickness. For a total loss of VBS cooling that lasts for 24 hours, maintaining ambient air temperature below the limit for the MCRE (i.e.,
75F), the individual required rooms (i.e.,  85&deg;F), and adjacent required room-pairs (i.e.,  85&deg;F) for 4 days is one method of re-establishing the heat sink thermal mass assumed in the safety analysis. Alternatively, analyses or local measurements can evaluate ambient air temperature excursions for impact on meeting the thermal mass assumed in the main control room heat-up calculations and Condition C can be exited once the thermal mass of the required heat sinks is determined to be within limits.
The Completion Time for Required Action C.2 is 5 days.
AP1000                                      B 3.7.6 - 8                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            563
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES ACTIONS (continued)
The selection of air temperature is an indication of heat sink temperature and heat sink thermal mass. It is recognized that the thermal mass of the passive heat sinks will not be restored to baseline assumptions after air temperature is restored within limits because the heat sinks take longer to be restored to the initial conditions assumed in the MCRE heat-up analysis.
D.1, D.2, and D.3 If the unfiltered inleakage of potentially contaminated air past the MCRE boundary and into the MCRE can result in MCRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of MCRE occupants from hazardous chemicals or smoke, the MCRE boundary is inoperable. Actions must be taken to restore an OPERABLE MCRE boundary within 90 days.
During the period that the MCRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on MCRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that MCRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that MCRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable MCRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of MCRE occupants within analyzed limits while limiting the probability that MCRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the MCRE boundary.
AP1000                                      B 3.7.6 - 9                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            564
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES ACTIONS (continued)
E.1, E.2, and E.3 If one bank of VES air tanks (8 tanks out of 32 total) is inoperable, then the VES is able to supply air to the MCRE for 54 hours (75% of the required 72 hours). If the VES is actuated, the operator must take actions to maintain habitability of the MCRE once the air in the tanks has been exhausted. The VBS supplemental filtration mode or MCRE ancillary fans are both capable of maintaining the habitability of the MCRE after 54 hours.
With one bank of VES air tanks inoperable, action must be taken to restore OPERABLE status within 7 days. In this Condition, the stored amount of compressed air in the remaining OPERABLE VES air tanks must be verified within 2 hours and every 12 hours thereafter to be at least 245,680 scf. The 245,680 scf value is 75 percent of the minimum amount of stored compressed air that must be available in the compressed air storage tanks. The standard volume is determined using the compressed air storage tank room temperature (VAS-TE-080A/B),
compressed air storage tanks pressure (VES-PT-001A/B), and Figure B 3.7.6-2, Compressed Air Storage Tanks Minimum Volume - One Bank of VES Air Tanks (8 Tanks) Inoperable. Values above the 245,680 scf line in the figure meet the Required Action criteria.
Verification that the minimum volume of compressed air is contained in the OPERABLE compressed air storage tanks ensures a 54 hour air supply will be available if needed. Additionally, within 24 hours, the VBS ancillary fans are verified to be OPERABLE so that, if needed, can be put into use once the OPERABLE compressed air storage tanks have been exhausted. The Completion Times associated with these actions and the 7 day Completion Time to restore VES to OPERABLE are based on engineering judgment, considering the low probability of an accident that would result in a significant radiation release from the reactor core, the low probability of radioactivity release, and that the remaining components and compensatory systems can provide the required capability. The 54 hours of air in the remaining OPERABLE compressed air storage tanks, along with compensatory operator actions, are adequate to protect the main control room envelope habitability. Dose calculations verify that the MCRE dose limits will remain within the requirements of GDC 19 with the compensatory actions taken at 54 hours.
AP1000                                      B 3.7.6 - 10                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          565
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES ACTIONS (continued)
F.1 and F.2 In MODE 1, 2, 3, or 4 if the Required Actions and Completion Times of Conditions A, B, C, D, or E are not met, or the VES is inoperable for reasons other than Conditions A, B, C, D, or E the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.
G.1 During movement of irradiated fuel assemblies, if the Required Actions and Completion Times of Conditions A, B, C, or E are not met, or the VES is inoperable for reasons other than Conditions A, B, C, or E, or the VES is inoperable due to an inoperable MCRE boundary, action must be taken immediately to suspend the movement of fuel. This does not preclude the movement of fuel to a safe position.
SURVEILLANCE REQUIREMENTS        SR 3.7.6.1 Verification every 24 hours that compressed air storage tanks contain greater than 327,574 scf of breathable air.
The standard volume is determined using the compressed air storage tank room temperature (VAS-TE-080A/B), compressed air storage tanks pressure (VES-PT-001A/B), and Figure B 3.7.6-1, Compressed Air Storage Tanks Minimum Volume. Values above the 327,574 scf line in the figure meet the surveillance criteria. Verification that the minimum volume of compressed air is contained in the compressed air storage tanks ensures that there will be an adequate supply of breathable air to maintain MCRE habitability for a period of 72 hours. The Frequency of 24 hours is based on the availability of pressure indication in the MCRE.
SR 3.7.6.2 SR 3.7.6.2 verifies that the thermal mass of the required heat sinks is within limit(s) every 24 hours. One method of satisfying SR 3.7.6.2 is maintaining ambient air temperature below the limit for the MCRE (i.e.,
75&deg;F), the individual required rooms (i.e.,  85&deg;F), and adjacent required room-pairs (i.e.,  85&deg;F) for 4 days. Alternatively, analyses or local measurements can satisfy the verification of the heat sink thermal mass assumed in the main control room heat-up calculation.
AP1000                                      B 3.7.6 - 11                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            566
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued)
Satisfying the required heat sink room temperature limits (i.e.,  75&deg;F for the MCRE and  85&deg;F for the individual required rooms and the adjacent required room-pairs) for sufficient duration (i.e., 4 days) establishes the equilibrium initial heat sink thermal mass assumed in the main control room heat-up calculation.
Passive heat sink air temperatures in required dc Equipment Room and required I&C roompairs (12201/12301, 12203/12302, 12205/12305, and 12207/12304) are verified by temperature elements located in the shared return air ducting (alternatively, local measurement of each room may be utilized). Other required individual rooms (12202, 12204, 12300, 12303, 12313, 12412, and 12501) are verified using indication from the temperature elements in each room.
This is done to verify that the VBS is performing as required to maintain the initial conditions assumed in the safety analyses, and to verify the VES heat sinks provide adequate thermal mass to limit the temperature increase in the MCRE, dc Equipment Rooms, and I&C Rooms from exceeding the allowable limits after VES actuation.
The 24 hour Frequency is acceptable based on the availability of automatic VBS temperature controls, alarms, and indication in the MCRE.
Air temperatures may also be verified using local measurement.
SR 3.7.6.3 Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing VES once every month provides an adequate check of the system. The 31 day Frequency is based on the reliability of the equipment and the availability of system redundancy.
SR 3.7.6.4 VES air header isolation valves are required to be verified open at 31 day intervals. This SR is designed to ensure that the pathways for supplying breathable air to the MCRE are available should loss of VBS occur.
These valves should be closed only during required testing or maintenance of downstream components, or to preclude complete depressurization of the system should the VES isolation valves in the air delivery line open inadvertently or begin to leak.
AP1000                                        B 3.7.6 - 12                          Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            567
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.6.5 Verification that the air quality of the air storage tanks meets the requirements of Appendix C, Table C-1 of ASHRAE Standard 62 (Ref. 4) with a pressure dew point of  40&deg;F at  3400 psig is required every 92 days. If air has not been added to the air storage tanks since the previous verification, verification may be accomplished by confirmation of the acceptability of the previous surveillance results along with examination of the documented record of air makeup. The purpose of ASHRAE Standard 62 states: This standard specifies minimum ventilation rates and indoor air quality that will be acceptable to human occupants and are intended to minimize the potential for adverse health effects. Verification of the initial air quality (in combination with the other surveillances) ensures that breathable air is available for 11 MCRE occupants for at least 72 hours. Confirmation of the pressure dew point verifies that water has not formed in the line, eliminating the potential for freezing at the pressure regulating valve during VES operation. In addition, the dry air allows the MCRE to remain below the maximum relative humidity to support the 90&deg;F WBGT required for human factors performance.
SR 3.7.6.6 Verification that the VBS isolation valves and the Sanitary Drainage System (SDS) isolation valves are OPERABLE and will actuate upon demand is required every 24 months to ensure that the MCRE can be isolated upon loss of VBS operation.
SR 3.7.6.7 Verification that each VES pressure relief isolation valve within the MCRE pressure boundary is OPERABLE is required in accordance with the Inservice Testing Program. The SR is used in combination with SR 3.7.6.8 to ensure that adequate vent area is available to mitigate MCRE overpressurization.
SR 3.7.6.8 Verification that the VES pressure relief damper is OPERABLE is required at 24 month intervals. The SR is used in combination with SR 3.7.6.7 to ensure that adequate vent area is available to mitigate MCRE overpressurization.
AP1000                                      B 3.7.6 - 13                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                              568
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.6.9 Verification of the OPERABILITY of the self-contained pressure regulating valve in each VES air delivery flow path is required in accordance with the Inservice Testing Program. This is done to ensure that a sufficient supply of air is provided as required, and that uncontrolled air flow into the MCRE will not occur.
SR 3.7.6.10 This SR verifies the OPERABILITY of the MCRE boundary by testing for unfiltered air inleakage past the MCRE boundary and into the MCRE.
The details of the testing are specified in the Main Control Room Envelope Habitability Program.
The MCRE is considered habitable when the radiological dose to MCRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the MCRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the MCRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences.
When unfiltered air inleakage is greater than the assumed flow rate, Condition D must be entered. Required Action D.3 allows time to restore the MCRE boundary to OPERABLE status provided mitigating actions can ensure that the MCRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3 (Ref. 3) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 5). These compensatory measures may also be used as mitigating AP1000                                      B 3.7.6 - 14                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                            569
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued) actions as required by Required Action D.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 6). Options for restoring the MCRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the MCRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the MCRE boundary has been restored to OPERABLE status.
SR 3.7.6.11 This SR verifies that the required VES testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VES filter tests are in accordance with Regulatory Guide 1.52 (Ref. 7). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and physical properties of the activated charcoal. Specific test frequencies and additional information are discussed in detail in the VFTP.
SR 3.7.6.12 Verification that the MCR load shed function actuates on an actual or simulated signal from each PMS Division is required every 24 months to confirm that the non-safety stage 1 and stage 2 MCR heat loads can be de-energized by the VES actuation signal within the required time. The ACTUATION LOGIC TEST overlaps this Surveillance to provide complete testing of the assumed safety function.The 24-month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage to minimize the potential for adversely affecting MCR operations.
SR 3.7.6.13 Verification that the main VES air delivery isolation valves actuate on an actual or simulated signal to the correct position is required every 24 months to confirm that the VES operates as assumed in the safety analysis. The ACTUATION LOGIC TEST overlaps this Surveillance to provide complete testing of the assumed safety function. The 24-month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage to minimize adversely affecting MCR operations.
AP1000                                      B 3.7.6 - 15                            Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                          570
 
DCP_NRC_003343                  Westinghouse Non-Proprietary Class 3 VES B 3.7.6 BASES REFERENCES          1. Section 6.4, Main Control Room Habitability Systems.
: 2. Section 9.5.1, Fire Protection System.
: 3. Regulatory Guide 1.196, Control Room Habitability at Light-Water Nuclear Power Reactors.
: 4. ASHRAE Standard 62-1989, Ventilation for Acceptable Indoor Air Quality.
: 5. NEI 99-03, Control Room Habitability Assessment, June 2001.
: 6. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability. (ADAMS Accession No. ML040300694).
: 7. Regulatory Guide 1.52, Design, Inspection, and Testing Criteria for Airfiltration and Adsorption Units of Post-Accident Engineered-Safety-Feature Atmosphere Cleanup Systems in Light-Water-Cooled Nuclear Power Plants, Revision 3.
AP1000                                    B 3.7.6 - 16                        Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                      571
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3 VES B 3.7.6 VES Operablity Requirements (Required by Action E.1)
Figure B 3.7.6-2 Compressed Air Storage Tanks Minimum Volume - One Bank of VES Air Tanks (8 Tanks) Inoperable AP1000                                  B 3.7.6 - 18                    Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                572
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3 Refueling Cavity Water Level B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Refueling Cavity Water Level BASES BACKGROUND          The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange.
During refueling, this maintains sufficient water level in containment, refueling cavity, refueling canal, fuel transfer canal, and spent fuel pool to retain iodine fission product activity in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to within the values reported in Chapter 15.
APPLICABLE          During movement of irradiated fuel assemblies, the water level in the SAFETY              refueling cavity and the refueling canal is an initial condition design ANALYSES            parameter in the analysis of a fuel-handling accident in containment, as postulated by Regulatory Guide 1.183 (Ref. 1).
The fuel handling accident analysis inside containment is described in Reference 2. This analysis assumes a minimum water level of 23 feet.
In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, there may be less than 23-feet of water above the top of the fuel bundle and the surface of the water, indicated by the width of the bundle. This slight reduction in water depth does not adversely affect the margin of conservatism associated with the assumed pool scrubbing factor of 200 for iodine.
Refueling Cavity Water Level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                  A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within the values calculated in Reference 2.
APPLICABILITY        Refueling Cavity Water Level is applicable when moving irradiated fuel assemblies in containment. The LCO minimizes the possibility of radioactive release due to a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel assemblies are not being moved in containment, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.5, Spent Fuel Pool Water Level.
AP1000                                      B 3.9.4 - 1                              Amendment 0 Revision 19 APP-GW-GL-705 Rev. 0                                                                              573
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                        AP1000 Design Control Document natural circulation. A diffusion flame can be postulated at the exit of the dead ended compartments in the maintenance floor. The exterior wall of the maintenance floor is the steel containment shell below the passive containment cooling system annulus, the lower-level equipment hatch, and the personnel hatch. Many electrical penetrations pass through the maintenance floor wall to the auxiliary building.
19.41.6.3  Early Hydrogen Combustion Ignition Sources For a burn to be initiated, an ignition source is required. Igniters mitigate the threat to the containment integrity from global deflagration and detonation. If a hydrogen plume can produce a diffusion flame, the igniters provide the ignition source.
19.41.7    Diffusion Flame Analysis Diffusion flames can be postulated to occur at vents or exits from compartments with a hydrogen source that are dead-ended or not well-mixed. Incombustible gas mixtures that include a high concentration of hydrogen may develop in the compartment. When the plume of hydrogen exits the compartment into a room containing oxygen and an ignition source, burning of the plume as a standing flame at the vent may produce locally high temperatures. If the release of hydrogen is sustained, the heat load from the burning may threaten equipment, including the containment shell integrity.
The overall geometry of the AP1000 containment is relatively open. Ninety-seven percent of the containment free volume participates in containment natural circulation and is well-mixed.
However, the IRWST, PXS and CVS compartments are small, confined rooms that may have a hydrogen source, and thus may be postulated to produce a diffusion flame at vents. This section discusses the conditions that may produce a standing diffusion flame in these locations, and presents the quantification of the containment failure probability given the presence of a sustained diffusion flame at a dead-ended compartment vent.
AP1000 Diffusion Flame Mitigation Strategy Hydrogen is a byproduct of a severe accident, and hydrogen pathways to the IRWST, PXS and CVS subcompartments cannot be completely ruled out, particularly in the IRWST, to which the effluent of the first stages of the reactor coolant system automatic depressurization system are directed. The other compartments can only have hydrogen releases in the event that a break occurs there, but some of the highest frequency severe accident sequences have breaks in a DVI line, which traverses a PXS compartment. Therefore, the potential for diffusion flames from these subcompartment locations cannot be excluded from the probabilistic risk assessment.
The AP1000 addresses diffusion flames by adopting a defense-in-depth philosophy in the design.
In the highest frequency severe accidents, sustained hydrogen release is prevented from occurring in the dead-ended compartments. In sequences where diffusion flames at IRWST or PXS/CVS compartment vents may be postulated, design strategies are initiated to mitigate the threat to the containment integrity by locating hydrogen plumes where they do not challenge containment integrity.
Tier 2 Material                                      19.41-8                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                                    574
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document The first level of defense against the threat to containment integrity from diffusion flames is the prevention of sustained hydrogen releases to dead-ended compartments. The highest frequency severe accident sequences have full reactor coolant system depressurization prior to core damage.
Hydrogen is released at low pressure to the containment as it is produced in the core. Stage four of the automatic depressurization system provides a pathway of substantially lower resistance (by approximately one order of magnitude) compared to the maximum break size in the DVI line that relieves to the PXS compartment and to the other three ADS stages that relieve to the IRWST.
Additionally, the ADS spargers in the IRWST generally have a 10-ft static head of water above them, which further increases the resistance to flow of hydrogen to the IRWST.
Hydrogen released from ADS stage 4 is relieved to the loop compartments, which are supplied with oxygen by the containment natural circulation and shielded from the containment shell by high concrete walls. Hydrogen is able to burn in the loop compartments without threatening the containment integrity. Therefore, ADS stage 4 provides the first level of defense against diffusion flames.
In the event that ADS stage 4 fails to adequately direct hydrogen away from confined compartments, the compartment vents are designed to preferentially release the hydrogen at locations where it burns, but does not challenge containment integrity.
Vents from the PXS and CVS compartments to the CMT room are located well away from the containment shell and containment penetrations. Access hatches to the subcompartments that are near the containment shell are covered and secured closed such that they will not open as a result of a pipe break inside the compartment. Therefore, hydrogen releases to the CMT room from the subcompartments have been shown to not challenge the containment integrity.
19.41.8    Early Hydrogen Detonation Hydrogen detonation can be initiated from a high-energy ignition source or by deflagration-to-detonation transition during flame acceleration. A review of potential ignition sources in containment concludes that the maximum source is too small to directly initiate a detonation (Reference 19.41-2: Since AP1000 is very similar to AP600, the phenomenological evaluations are valid for AP1000.). Therefore, the occurrence of detonation is related to the potential for deflagration-to-detonation transition in the AP1000 containment analysis.
The methodology of Sherman and Berman (Reference 19.41-6) is used to evaluate the likelihood of deflagration-to-detonation transition. The analysis considers the hydrogen release rates to the containment, core reflooding, the containment release locations, and in-containment refueling water storage tank and PXS valve/accumulator room water levels to determine the probabilities.
19.41.9    Deflagration in Time Frame 3 The design certification of the AP1000 included consideration by the NRC of the topic referred to in this section.
Tier 2 Material                                    19.41-9                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        575
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                        AP1000 Design Control Document boundary. Reducing the reactor coolant system pressure during a severe accident significantly lowers the likelihood of phenomena that may induce large fission product releases early in the accident sequence.
19.59.9.5.5 In-Vessel Retention of Molten Core Debris The AP1000 reactor vessel and containment configuration have features that enhance the designs ability to maintain molten core debris in the reactor vessel. The AP1000 automatic depressurization system provides reliable pressure reduction in the reactor coolant system to reduce the stresses on the vessel wall. The reactor vessel lower head has no vessel penetrations.
This eliminates penetration failure as a potential vessel failure mode. The containment configuration directs water to the reactor cavity and allows the in-containment refueling water storage tank water to be drained into the cavity to submerge the vessel to cool the external surface of the lower head. Cooling the vessel and reducing the stresses prevent the creep rupture failure of the vessel wall. The reactor vessel reflective insulation has been designed with provisions to allow water inside the insulation panel to cool the vessel surface, and with vents to allow steam to exit the insulation without failing the insulation support structures. The insulation is designed so that it promotes the cooling of the external surface of the vessel.
Preventing the relocation of molten core debris to the containment eliminates the occurrence of several severe accident phenomena, such as ex-vessel fuel-coolant interactions and core-concrete interaction, which may threaten the containment integrity. Through the prevention of core debris relocation to the containment, the AP1000 design significantly reduces the likelihood of containment failure.
19.59.9.5.6 Combustible Gases Generation and Burning In severe accident sequences, high-temperature metal oxidation, particularly zirconium, results in the rapid generation of hydrogen and possibly carbon monoxide. The first combustible gas release occurs in the accident sequence during core uncovery when the oxidation of the zircaloy cladding by passing steam generates hydrogen. A second release may occur if the vessel fails and ex-vessel debris degrades the concrete basemat. Steam and carbon dioxide are liberated from the concrete and are reduced to hydrogen and carbon monoxide as they pass through the molten metal in the debris. These gases are highly combustible and in high concentrations in the containment may lead to detonable mixtures.
The AP1000 uses a nonsafety-related hydrogen igniter system for severe releases of combustible gases. The igniters are powered from ac buses from either of the nonsafety-related diesel generators or from the non-Class 1E batteries. Multiple glow plugs are located in each compartment. The igniters burn the gases at the lower flammability limit. At this low concentration, the containment pressure increase from the burning is small and the likelihood of detonation is negligible. The igniters are spaced such that the distance between them will not allow the burn to transition from deflagration to detonation. The combustible gases are removed with no threat to the containment integrity.
There is little threat of the failure of the system power in the event that it is required to operate.
The igniters are needed only in core damage accidents, and the AP1000 is designed to mitigate Tier 2 Material                                      19.59-33                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                          576
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                        AP1000 Design Control Document loss of power events without the sequence evolving into a severe accident. Loss of ac power is a small contributor to the core damage frequency.
The reliability of reactor coolant system depressurization reduces the threat to the containment from sudden releases of hydrogen from the reactor coolant system. Low pressure release of in-vessel hydrogen enhances the ability of the igniter system to maintain the containment atmosphere at the lower flammability limit.
During a severe accident, hydrogen, which could be injected from the reactor coolant system into the containment through the spargers in the in-containment refueling water storage tank or into the core makeup tank room, has the potential to produce a diffusion flame. A diffusion flame is produced when a combustible gas plume that is too rich to burn enters an oxygen-rich atmosphere and is ignited by a glow plug or a random ignition source. The plume is ignited into a standing flame, which lasts as long as there is a fuel source. Via convection and radiation, the flame can heat the containment wall to high temperatures, increasing the likelihood of creep rupture failure of the containment pressure boundary. The AP1000 uses a defense-in-depth approach to release hydrogen in locations away from the containment shell and penetrations where it burns, but does not challenge containment integrity. Therefore, the potential for containment failure from the formation of a diffusion flame at the in-containment refueling water storage tank vents is considered to be low.
There is little threat to the containment integrity from severe accident hydrogen releases and hydrogen combustion events. The igniter system maintains the hydrogen concentration at the lower flammability limit.
19.59.9.5.7 Intermediate and Long-Term Containment Failure The passive containment cooling system reduces the potential for decay heat pressurization of the containment. However, containment failure can also occur as a result of combustion. Due to the high likelihood of in-vessel retention of core debris, the potential for ex-vessel combustible gas generation from core-concrete interaction is low. The frequency of containment failures due to hydrogen combustion events is low given the high reliability of the hydrogen igniters.
19.59.9.5.8 Fission-Product Removal The AP1000 relies on the passive, natural removal of aerosol fission products from the containment atmosphere, primarily from gravitational settling, diffusiophoresis, and thermophoresis. Natural removal is enhanced by the passive containment cooling system, which provides a large, cold surface area for condensation of steam. This increases the diffusiophoretic and thermophoretic removal processes. Accident offsite doses at the site boundary, which could exist in the first 24 hours after a severe accident, are either less than 25 rem, or for those releases that are greater than 25 rem, have a frequency of much less than 1E-06. Minimal credit is taken for deposition of fission products in the auxiliary building. The site boundary dose and large release frequency are much less than the established goals.
Tier 2 Material                                      19.59-34                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                            577
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                          AP1000 Design Control Document Table 19.59-18 (Sheet 6 of 25)
AP1000 PRA-BASED INSIGHTS Insight                                              Disposition 1e. (cont.)
Long-term cooling of PRHR will result in steaming to the containment. The          6.3.1 & system steam will normally condense on the containment shell and return to the IRWST      drawings by safety-related features. Connections are provided to IRWST from the spent fuel system (SFS) and chemical and volume control system (CVS) to extend PRHR operation. A safety-related makeup connection is also provided from outside the containment through the normal residual heat removal system (RNS) to the IRWST.
Capability exists and guidance is provided for the control room operator to        6.3.3 & 16.1 identify a leak in the PRHR HX of 500 gpd. This limit is based on the assumption that a single crack leaking this amount would not lead to a PRHR HX tube rupture under the stress conditions involving the pressure and temperature gradients expected during design basis accidents, which the PRHR HX is designed to mitigate.
The positions of the inlet and outlet PRHR valves are indicated and alarmed in    6.3.7 the control room.
PRHR air-operated valves are stroke-tested quarterly. The PRHR HX is tested to    3.9.6 detect system performance degradation every 10 years.
PRHR is required by Technical Specifications to be available from Modes 1          16.1 through 5 with RCS pressure boundary intact.
The PRHR HX, in conjunction with the IRWST, the condensate return features,        6.3.2.1.1 & 6.3.7.6 and the PCS, can provide core cooling for greater than 14 days. After the IRWST water reaches its saturation temperature, the process of steaming to the containment initiates. Condensation occurs on the steel containment vessel, and the condensate is collected in a safety-related gutter arrangement, which returns the condensate to the IRWST. The gutter normally drains to the containment sump, but when the PRHR HX actuates, safety-related isolation valves in the gutter drain line shut and the gutter overflow returns directly to the IRWST. The following design features provide proper re-alignment for the gutter system valves to direct water to the IRWST:
          -    IRWST gutter and its drain isolation valves are safety-related
          -    These isolation valves are designed to fail closed on loss of compressed air, loss of Class 1E dc power, or loss of the PMS signal
          -    These isolation valves are actuated automatically by PMS and DAS.            7.3.1.2.7 The PRHR subsystem provides a safety-related means of removing decay heat          16.1 following loss of RNS cooling during shutdown conditions with the RCS intact.
Tier 2 Material                                        19.59-80                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                            578
 
DCP_NRC_003343                            Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                          AP1000 Design Control Document Table 19.59-18 (Sheet 16 of 25)
AP1000 PRA-BASED INSIGHTS Insight                                              Disposition
: 27. The reactor cavity design provides a reasonable balance between the regulatory        19.39 &
requirements for sufficient ex-vessel debris spreading area and the need to quickly    Appendix 19B submerge the reactor vessel for the in-vessel retention of core debris.
: 28. The design can withstand a best-estimate ex-vessel steam explosion without failing    Appendix 19B the containment integrity.
: 29. The containment design incorporates defense-in-depth for mitigating direct            Appendix 19B containment heating by providing no significant direct flow path for the transport of particulated molten debris from the reactor cavity to the upper containment regions.
: 30. The hydrogen control system is comprised of passive autocatalytic recombiners          Tier 1 Information (PARs) and hydrogen igniters to limit the concentration of hydrogen in the containment during accidents and beyond design basis accidents, respectively.
Operability of the hydrogen igniters is addressed by short-term availability controls  16.3 during modes 1, 2, 5 (with RCS pressure boundary open), and 6 (with upper internals in place or cavity levels less than full).
The operator action to activate the igniters is the first step in ERG AFR.C-1 to      Emergency ensure that the igniter activation occurs prior to rapid cladding oxidation.          Response Guidelines
: 31. Mitigation of the effects of a diffusion flames on the containment shell are addressed 1.2, General by the following containment layout features:                                          Arrangement Drawings
      -  Vents from the PXS and CVS compartments (where hydrogen releases can be            3.4.1.2.2.1 &
postulated) to the CMT room are located well away from the containment shell      19.41.7 and containment penetrations. The access hatch to the PXS-B compartment is located near the containment wall and is normally closed to address severe accident considerations. Hydrogen releases to the CMT room from the subcompartments have been shown not to challenge containment integrity. The access hatch to the PXS-B compartment is accessible from Room 11300 on elevation 107-2.
      -  IRWST vents are designed so that those located away from the containment wall      6.2.4.5.1 open to vent hydrogen releases. In this situation IRWST vents located close to the containment wall would not open because flow of hydrogen through the other vents would not result in a IRWST pressure sufficient to open them.
: 32. The containment structure can withstand the pressurization from a LOCA and the        19.41 global combustion of hydrogen released in-vessel (10 CFR 50.44).
Tier 2 Material                                          19.59-90                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                          579
 
DCP_NRC_003343                    Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                  AP1000 Design Control Document Table 19D-7 (Sheet 2 of 3)
SUSTAINED HYDROGEN COMBUSTION SURVIVABILITY ASSESSMENT EQUIPMENT AND                SUSTAINED HYDROGEN COMBUSTION SURVIVABILITY INSTRUMENTATION                                          ASSESSMENT Equipment Containment Shell        As discussed in Section 19.41.7 of this document, hydrogen plumes are located away from the containment shell to mitigate the threat to the containment integrity.
Containment Lower        The lower equipment hatch and seals on the containment vessel may be exposed Equipment Hatch and      to heat transfer from a sustained flame at the vents from the PXS Seals                    valve/accumulator room to the maintenance floor. The equipment hatch and seals have been shown by analysis to be unlikely to fail or leak.
Igniters                Igniters are specified and designed to withstand the effects of sustained burning and, therefore, are considered operable for these events.
Instrumentation RCS Pressure            There are four RCS pressurizer pressure transmitters. Two transmitters are located at a distance greater than 75 feet from the vent from the PXS valve/accumulator room and are therefore beyond the distance that potentially causes operability concerns from a sustained flame. The other two transmitters are located in a different room from the fourth stage ADS valves. This precludes radiative heating, which could potentially cause operability concerns.
Containment Pressure    There are three extended range containment pressure transmitters. The three transmitters are located such that they cannot all be exposed to a sustained flame from either of the vents from the PXS valve/accumulator room into the maintenance floor at the base of the CMTs. Therefore, continued operability of the containment pressure function is provided.
SG 1 Wide Range Level    There are four steam generator wide range levels for SG 1. Two of the transmitters are located at a distance of greater than 20 feet from a CMT and are, therefore, beyond the distance that could potentially cause operability concerns from a sustained flame from the vent from the PXS valve/accumulator room into the maintenance floor at the base of the CMT. The other two transmitters are located over 20 feet below the fourth stage ADS valves. This precludes radiative heating, which could potentially cause operability concerns.
SG 2 Wide Range Level    Based on the layout of the four steam generator wide range levels for SG 2, at least two of the transmitters will not be exposed to a sustained flame from either of the vents from the PXS valve/accumulator room into the maintenance floor at the base of the CMTs. Therefore, continued operability of the SG 2 wide range level indication function is provided.
Tier 2 Material                                  19D-35                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                        580
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document 19E.2.3.2.2 Accumulators The PXS accumulators provide safety injection following a LOCA. In Mode 3, the accumulators must be isolated to prevent their operation when the RCS pressure is reduced to below their set pressure. The accumulator isolation valves are closed when the RCS pressure is reduced to 1000 psig to block their injection when the RCS pressure is reduced to below the normal accumulator pressure.
19E.2.3.2.3 In-containment Refueling Water Storage Tank The IRWST provides long-term RCS makeup. During shutdown, the IRWST is available until Mode 6, when the reactor vessel upper internals are removed and the refueling cavity flooded. At that time, the IRWST is not required, due to the large heat capacity of the water in the refueling cavity.
The IRWST injection paths are actuated on a low-2 CMT water level. This signal is available in shutdown Modes 3, 4, and 5, with the RCS intact. When the RCS is open to transition to reduced inventory operations, the CMT actuation logic on low pressurizer level is removed, and the CMTs can be taken out of service. For these modes, automatic actuation of the IRWST can be initiated (on a two-out-of-two basis) on low hot leg level.
19E.2.3.2.4 Passive Residual Heat Removal Heat Exchanger The PRHR HX provides decay heat removal during power operation and is required to be available in shutdown Modes 3, 4, and 5, until the RCS is open. In these modes, the PRHR HX provides a passive decay heat removal path. It is automatically actuated on a CMT actuation signal, which would eventually be generated on a loss of shutdown decay heat removal, as shown in the analysis provided in Section 19E.4 of this appendix. In modes with the RCS open (portions of Mode 5 and Mode 6), decay heat removal is provided by feeding water from the IRWST and bleeding steam from the ADS.
19E.2.3.2.5 Reduced Challenges to Low-Temperature Overpressure Events Another design feature of the PXS that reduces challenges to shutdown safety is the elimination of high-head safety injection pumps in causing low temperature overpressure events. In current plants, during water solid operations that may be necessary to perform shutdown maintenance, the high-head safety injection pumps are a major source of cold overpressure events. To address this, plants are required to lock out safety injection pumps to prevent them from inadvertently causing a cold overpressure event. This eliminates a potential source of safety injection for a loss of inventory event that could occur at shutdown. With the AP1000 PXS, the CMTs are not pressurized above RCS pressure and are, therefore, not capable of causing a cold overpressure event. Therefore, they are not isolated until the pressurizer is drained for mid-loop.
Low-temperature overpressure events are discussed in subsection 19E.4.10.1.
19E.2.3.2.6 Discussion of Safe Shutdown for AP1000 The functional requirements for the PXS specify that the plant be brought to a safe, stable condition using the PRHR HX for events not involving a loss of coolant. As stated in Subsection Tier 2 Material                                      19E-9                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        581
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document 6.3.1.1.1, the PRHR HX, in conjunction with the passive containment cooling system (PCS),
provides sufficient heat removal to satisfy the post-accident safety evaluation criteria for at least 72 hours. Additionally, the PXS, in conjunction with the PCS, and the ADS, has the capability to establish long-term safe shutdown conditions in the RCS as identified in Subsection 7.4.1.1.
The CMTs automatically provide injection to the RCS after they are actuated on low reactor coolant temperature or low pressurizer pressure or level. The PXS can maintain stable plant conditions for a long time in this mode of operation, depending on the reactor coolant leakage and the availability of ac power sources. For example, with a technical specification leak rate of 10 gpm, stable plant conditions can be maintained for at least 10 hours. With a smaller leak, a longer time is available.
In scenarios when ac power sources are unavailable for approximately 22 hours, the ADS automatically actuates. However, after the initial plant cooldown following a non-LOCA event, operators assess plant conditions and have the option to perform recovery actions to further cool and depressurize the RCS in a closed-loop mode of operation, i.e., without actuation of the ADS.
After verifying the RCS is in an acceptable, stable condition, such that automatic depressurization is not needed, the operators may take action to extend PRHR HX operation by de-energizing the loads on the Class 1E dc batteries powering the protection and safety monitoring system actuation cabinets. After operators have taken action to extend its operation, the PRHR HX, in conjunction with the PCS, has the capability to maintain safe, stable conditions. The ADS remains available to maintain safe shutdown conditions at a later time.
In most sequences, the operators would return the plant to normal system operations and terminate passive system operation within several hours in accordance with the plant emergency operating procedures. For LOCAs and other postulated events, when the core makeup tank level reaches the automatic depressurization actuation setpoint, and other postulated events where the PRHR HX operation is not extended or exhausted, ADS may be initiated. This results in injection from the accumulators and subsequently from the in-containment refueling water storage tank, once the RCS is nearly depressurized. For these conditions, the RCS depressurizes to saturated conditions at about 250&deg;F within 24 hours. The PXS can maintain this safe shutdown condition as identified in Subsection 7.4.1.1.
The primary function of the PXS during a safe shutdown using only safety-related equipment is to provide a means for boration, injection, and core cooling. Analysis is provided in subsection 19E.4.10.2 of this appendix that verifies the ability of the AP1000 passive safety systems to meet the safe shutdown requirements.
19E.2.3.2.7 Containment Recirculation Screens The PXS containment recirculation screens may have to function in the longer-term during a shutdown accident that results in ADS operation. Effective screen design, plant layout, and other factors prevent clogging of these screens by debris during such accident operations.
x    Two very large interconnected screens are provided.
x    A significant delay is provided between the accident/ADS stage opening and the initiation of recirculation (at least 2 hours).
Tier 2 Material                                    19E-10                                          Revision 19 APP-GW-GL-705 Rev. 0                                                                                          582
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document isolatable on at least one side by closure of the flange within containment or the gate valve outside containment.
19E.2.7    Chemical and Volume Control System 19E.2.7.1 System Description The chemical and volume control system (CVS) is described in subsection 9.3.6.
19E.2.7.2 Design Features to Address Shutdown Safety The AP1000 CVS is a nonsafety-related system. However, portions of the system are safety-related and perform safety-related functions, such as containment isolation, termination of inadvertent RCS boron dilution, RCS pressure boundary preservation, and isolation of excessive makeup.
Boron dilution events during low power modes can occur for a number of reasons, including malfunctions of the makeup control system. Regardless of the cause, the protection is the same.
The CVS is designed to avoid and/or terminate boron dilution events by automatically closing either one of two series, safety-related valves in the demineralized water supply line to the makeup pump suction to isolate the dilution source. Additionally, the suction line for the CVS makeup pump is automatically realigned to draw borated water from the boric acid tank. The automatic boron dilution protection signal is safety-related and is generated upon any reactor trip signal, source-range flux multiplication signal, low input voltage to the Class 1E dc and uninterruptible power supply system battery chargers, or a safety injection signal.
The safety analysis of boron dilution accidents is provided in Chapter 15 and is discussed in subsection 19E.4.5 of this appendix. For dilution events that occur during shutdown, the source-range flux-doubling signal closes the safety-related remotely operated CVS makeup line isolation valves to terminate the event. In addition, the signal is used to isolate the line from the demineralized water system to the makeup pump suction by closing the two safety-related remotely operated valves. The three-way pump suction control valve aligns the makeup pumps to take suction from the boric acid tank and, therefore, stops the dilution.
For refueling operations, administrative controls are used to prevent boron dilutions by verifying that the valves in the line from the demineralized water system are closed and locked. These valves block the flow paths that can allow unborated makeup water to reach the RCS. Makeup required during refueling uses borated water supplied from the boric acid tank by the CVS makeup pumps.
During refueling operations (Mode 6), two source-range neutron flux monitors are operable to monitor core reactivity. This is required by the plant Technical Specifications. The two operable source-range neutron flux monitors provide a signal to alert the operator to unexpected changes in core reactivity. The potential for an uncontrolled boron dilution accident is precluded by isolating the unborated water sources. This is also required by the plant Technical Specifications.
The source range flux doubling function can be manually blocked during shutdown conditions when below the P-8 setpoint after the operator isolates unborated water source flow paths. When Tier 2 Material                                    19E-17                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          583
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                        AP1000 Design Control Document blocked during shutdown conditions, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution.
19E.2.8    Spent Fuel Pool Cooling System 19E.2.8.1 System Description The spent fuel pool cooling system (SFS) is discussed in subsection 9.1.3.
19E.2.8.2 Design Features to Address Shutdown Safety The AP1000 has incorporated various design features to improve shutdown safety. The SFS features that have been incorporated to address shutdown safety are described in this subsection.
19E.2.8.2.1 Seismic Design The spent fuel pool, fuel transfer canal (FTC), cask loading pit (CLP), cask washdown pit (CWP), and gates from the spent fuel pool-CLP and FTC-spent fuel pool are all integral with the auxiliary building structure. The auxiliary building is seismic Class I design and is designed to retain its integrity when exposed to a safe shutdown earthquake (SSE). The suction and discharge connections between the spent fuel pool and RNS are safety Class C, which is also seismic Class I. The emergency makeup water line from the PCS water storage tank to the spent fuel pool actually connects with the RNS pump suction line. This emergency makeup line is also safety Class C and seismic Class I. The spent fuel pool level instruments connections to the spent fuel pool are safety Class C, seismic Class I, and have 3/8-inch flow restricting orifices at the pool wall to limit the amount of a leak from the pool if the instrument or its piping develops a leak.
The refueling cavity is integral with the containment internal structure, and as such, is seismic Class I, and is designed to retain its integrity when exposed to an SSE. In addition, the AP1000 has incorporated a permanently welded seal ring to provide the seal between the vessel flange and the refueling cavity floor. This refueling cavity seal is part of the refueling cavity and is seismic Class I. Figure 19E.2-3 is a simplified drawing of the AP1000 permanent reactor cavity seal. The cavity seal is designed to accommodate the thermal transients associated with the reactor vessel flange.
19E.2.9    Control and Protection Systems The AP1000 control and protection systems support the operations necessary for the AP1000 to achieve shutdown. These systems consist of a nonsafety-related plant control system (PLS), a safety-related protection and safety monitoring system (PMS), and a nonsafety-related diverse actuation system (DAS). These systems are discussed in Chapter 7.
19E.3      Shutdown Maintenance Guidelines and Procedures This section presents an overview discussion of AP1000 shutdown maintenance guidelines and procedures captured as part of the AP1000 design and design certification program. Shutdown Tier 2 Material                                      19E-18                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                      584
 
DCP_NRC_003343                          Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                        AP1000 Design Control Document plant shutdown and startup operations. The RNS relief valve is sized to provide LTOP by limiting the RCS and RNS pressure to less than the 10 CFR 50 Appendix G (Reference 13) steady-state pressure limit. Subsection 5.2.2 provides a discussion of the AP1000 low temperature overpressure protection design bases.
19E.4.10.2 Shutdown Temperature Evaluation As discussed in Subsection 6.3.1.1.4, the PRHR HX is required to be able to cool the RCS to a safe, stable condition after shutdown following a non-LOCA event. The following summarizes a non-bounding, conservative analysis, which demonstrates the PRHR HX can meet this criterion and cool the RCS to the specified, safe shutdown condition of 420&deg;F within 36 hours. This analysis demonstrates that the passive systems can bring the plant to a safe, stable condition and maintain this condition so that no transients will result in the specified acceptable fuel design limit and pressure boundary design limit being violated and that no high-energy piping failure being initiated from this condition results in 10 CFR 50.46 (Reference 15) criteria.
As discussed in subsections 6.3.3 and 7.4.1.1, the PRHR HX operates to reduce the RCS core average temperature to the safe shutdown condition following a non- LOCA event. An analysis of the loss of main feedwater with a loss of ac power event demonstrates that the passive systems can bring the plant to a safe, stable condition following postulated transients. A non-bounding, conservative analysis is represented in Figures 19E.4.10-1 through 19E.4.10-4. The progression of this event is outlined in Table 19E.4.10-1. Though some of the assumptions of this evaluation are based on nominal conditions, many of the analysis assumptions are bounding.
The performance of the PRHR HX is affected by the containment pressure. Containment pressure determines the PRHR HX heat sink (the IRWST water) temperature. The WGOTHIC containment response model described in Subsection 6.2.1.1.3 was used to determine the containment pressure response to this transient, which was used as an input to the plant cooldown analysis performed with LOFTRAN. Some changes were made to the WGOTHIC model to provide conservative results for the long-term safe shutdown analysis.
The PRHR HX performance is also affected by the IRWST water level when the level drops below the top of the PRHR HX tubes. The IRWST water level is affected by the heat input from the PRHR HX and by the amount of steam that leaves the IRWST and does not return to the IRWST through the IRWST gutter arrangement. The principal steam condensate losses include steam that stays in the containment atmosphere, steam that condenses on heat sinks inside containment other than the containment vessel, and dripping or splashing losses due to obstructions on the inner containment vessel wall. The WGOTHIC containment response model also provided the mass balance with respect to the steam lost to the containment atmosphere and to condensation on passive heat sinks other than the containment vessel. The WGOTHIC analysis inputs (including the mass of the heat sinks and heat transfer rates) were biased to increase steam condensate losses. The WGOTHIC model provides the time-dependent condensate return rate, which was incorporated into the LOFTRAN computer code described in Subsection 15.0.11.2 to demonstrate that the RCS core average temperature could be cooled to 420&deg;F within 36 hours.
Summarizing this transient, the loss of normal ac power occurs (offsite and onsite), followed by the reactor trip. The PRHR HX is actuated on the low steam generator narrow range level Tier 2 Material                                      19E-43                                        Revision 19 APP-GW-GL-705 Rev. 0                                                                                        585
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document coincident with low startup feed water flow rate signal. Eventually a safeguards actuation signal is actuated on Low cold leg temperature and the CMTs are actuated.
Once actuated, at about 2,700 seconds, the CMTs operate in recirculation mode, injecting cold borated water into the RCS. In the first part of their operation, due to the injection of cold water, the CMTs operate in conjunction with the PRHR HX to reduce RCS temperature. Due to the primary system cooldown, the PRHR heat transfer capability drops below the decay heat and the RCS cooldown is essentially driven by the CMT cold injection flow. However, at about 6,000 seconds, the CMT cooling effect decreases and the RCS starts heating up again (Figure 19.E.4.10-1). The RCS temperature increases until the PRHR HX can match decay heat. At about 46,700 seconds, the PRHR heat transfer matches decay heat and it continues to operate to reduce the RCS temperature to below 420&deg;F within 36 hours. As seen from Figure 19E.4.10-1 the cold leg temperature in the loop with the PRHR is reduced to 420&deg;F at about 52,900 seconds, while the core average temperature reaches 420&deg;F at about 120,900 seconds (approximately 34 hours).
As discussed in subsection 7.4.1.1, a timer is used to automatically actuate the ADS if offsite and onsite power are lost for about 24 hours. This timer automates putting the open loop cooling features into service prior to draining the Class 1E dc 24-hour batteries that operate the ADS valves. Before 22 hours, if the plant conditions indicate that the ADS would not be needed until well after 24 hours, the operators are directed to de-energize all loads on the 24-hour batteries.
This action will block actuation of the ADS and preserves the ability to align open loop cooling at a later time. Operation of the ADS in conjunction with the CMTs, accumulators, and IRWST reduces the RCS pressure and temperature to below 420&deg;F. The ability to actuate ADS and IRWST injection provides a safety-related, backup mode of decay heat removal that is diverse to extended PRHR HX operation.
As discussed in Subsection 6.3.3.2.1.1, the PRHR HX can operate in this mode for at least 72 hours to maintain RCS conditions within the applicable Chapter 15 safety evaluation criteria. In addition, the analysis supporting this section shows the PRHR HX is expected to maintain safe shutdown conditions for greater than 14 days. One important consideration with regard to the duration closed-loop cooling can be maintained is the RCS leak rate. This duration of closed-loop cooling can be achieved with expected RCS leak rates. For abnormal leak rates, it may become necessary to initiate open-loop cooling earlier than 14 days.
19E.5      Technical Specifications While the Technical Specification guidance provided in NUREG-1449 (Reference 2) relates to existing plant shutdown operation concerns, the underlying concerns relating to causes of events and recovery from those events during shutdown operations are applicable to the AP1000.
Section 19E.5.1 summarizes the shutdown Technical Specifications. Section 19E.5.2 summarizes the AP1000s compliance with SECY-93-190 (Reference 16).
19E.5.1    Summary of Shutdown Technical Specifications The content of the AP1000 Technical Specifications meets the requirements of 10 CFR 50.36 (Reference 17) and is consistent with the guidance provided in NUREG-1431 (Reference 18).
For the AP1000, passive systems are used to safely shut down the plant. Because this design feature is different from existing plants, and because NUREG-1449 provides a reasonable basis Tier 2 Material                                    19E-44                                            Revision 19 APP-GW-GL-705 Rev. 0                                                                                          586
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document for creating shutdown Technical Specifications, the AP1000 Technical Specifications are improved to include specifications for these systems in the shutdown modes. These shutdown specifications are summarized in AP1000 Technical Specification Table B 3.0-1 (Section 16.1),
which provides the passive systems shutdown mode matrix of system versus limiting conditions for operation (LCO), mode applicability, and required end state.
19E.6      Shutdown Risk Evaluation The AP1000 Probabilistic Risk Assessment (PRA) (Chapter 19) provides an assessment of the plant risk associated with events at shutdown.
19E.7      Compliance with NUREG-1449 The Diablo Canyon event of April 10, 1987, and the loss of ac power event at the Vogtle plant on March 20, 1990, led the Nuclear Regulatory Commission (NRC) staff to issue NUREG-1449, Shutdown and Low Power Operation at Commercial Nuclear Power Plants in the United States (Reference 2), to provide an evaluation of the shutdown risk issue. The scope of NUREG-1449 includes subjects such as operating experiences as documented in generic letters, operator training, technical specifications, residual heat removal capacity, temporary reactor coolant boundaries, rapid boron dilution, containment capacity, fire protection, outage planning and control, and instrumentation.
The NRC requested Westinghouse to assess the compliance of AP600 with NUREG-1449. It was recognized that some of the issues discussed in NUREG-1449 are the responsibility of the plant owners because they relate to operation, maintenance, and refueling plans, procedures, and risk management. However, the NRC believed that the level of defense-in-depth against shutdown events would be improved if clear guidance is provided to the areas discussed above by the plant designer. The NRC requested that Westinghouse perform a systematic assessment of the shutdown risk issue to address areas identified in NUREG-1449 as they are applicable to the AP1000 design and document the results.
This Appendix provides the systematic assessment of the shutdown risk issue to address areas identified in NUREG-1449. This assessment includes design basis evaluations of events that can occur during shutdown and a probabilistic assessment of plant risk at shutdown. The design of the AP1000 builds on the lessons-learned from the industry with regard to shutdown safety, including the guidance provided in NUREG-1449.
19E.8      Conclusion This AP1000 Shutdown Evaluation provides a systematic evaluation of the AP1000 during shutdown operations. As demonstrated in this appendix, the AP1000 is designed to mitigate events that can occur during shutdown modes. In addition, the risk of core damage as a result of an accident that may occur during shutdown has been demonstrated to be acceptably low.
19E.9      References
: 1. Letter, Westinghouse to NRC, DCP/NRC1385, AP600 Emergency Response Guidelines.
Tier 2 Material                                    19E-45                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    587
 
DCP_NRC_003343                      Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                    AP1000 Design Control Document
: 2. NUREG-1449, Shutdown and Low Power Operations at Commercial Nuclear Power Plants in the United States, September 1993.
: 3. NRC Information Notice 92-54, Level Instrumentation Inaccuracies Caused by Rapid Depressurization, July 24, 1992.
: 4. Letter, Westinghouse to NRC, DCP/NRC0124, APWR-0452, AP600 Vortex Mitigator Development Test for RCS Mid-loop Operation, July 6, 1994.
: 5. NUREG-0897, Rev. 1, Containment Emergency Sump Performance, October 1985.
: 6. Title 10, Code of Federal Regulations, Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Processing Plants.
: 7. NRC Regulatory Guide 1.26, Quality Group Classifications and Standards for Water-,
Steam-, and Radioactive-Waste-Containing Components of Nuclear Power Plants, Revision 3, February 1976.
: 8. American Society of Mechanical Engineers Boiler and Pressure Vessel Code, Section III, 1988 with 1989 Addenda.
: 9. Lewis, R. N., Huang, P., Behnke, D. H., Fittante, R. L., and Gelman, A., WCAP-10698-P-A (Proprietary) and WCAP-10750-A (Non-Proprietary), SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill, August 1987.
: 10. WCAP-14171, Revision 2 (Proprietary) and WCAP-14172, Revision 2 (Non-Proprietary),
WCOBRA/TRAC Applicability to AP600 Large-Break Loss-of-Coolant Accident, March 1998.
: 11. Title 10, Code of Federal Regulations, Part 50, Appendix K, ECCS Evaluation Model.
: 12. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, Revision 1, July 1981.
: 13. Title 10, Code of Federal Regulations, Part 50, Appendix G, Fracture Toughness Requirements.
: 14. Not used.
: 15. Title 10, Code of Federal Regulations, Part 50, (10 CFR 50.46).
: 16. NRC letter, SECY-93-190, Regulatory Approach to Shutdown and Low-Power Operations, July 12, 1993.
: 17. Title 10, Code of Federal Regulations, Part 50.36, Technical Specifications.
: 18. NUREG-1431, Standard Technical Specifications - Westinghouse Plants, April 1995.
Tier 2 Material                                  19E-46                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    588
 
DCP_NRC_003343                        Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                                      AP1000 Design Control Document Table 19E.4.10-1 SEQUENCE OF EVENTS FOLLOWING A LOSS OF AC POWER FLOW WITH CONDENSATE FROM THE CONTAINMENT SHELL BEING RETURNED TO THE IRWST Time Event                                            (seconds)
Feedwater is Lost                                                                            10.0 Low Steam Generator Water Level (Narrow-Range) Reactor Trip Setpoint Reached                  60.6 Rods Begin to Drop                                                                          62.6 Low Steam Generator Water Level (Wide-Range) Reached                                        209.5 PRHR HX Actuation on Low Steam Generator Water Level (Narrow-Range Coincident              221.5 with Low Startup Feedwater Flow)
Low Tcold Setpoint Reached                                                                  2,752 Steam Line Isolation on Low Tcold Signal                                                    2,764 CMTs Actuated on Low Tcold Signal                                                          2,764 IRWST Reaches Saturation Temperature                                                        15,900 Heat Extracted by PRHR HX Matches Core Decay Heat                                          46,700 Cold Leg Temperature Reaches 420&deg;F (loop with PRHR)                                        52,900 Core Average Temperature Reaches 420&deg;F (loop with PRHR)                                    120,900 Tier 2 Material                                    19E-53                                      Revision 19 APP-GW-GL-705 Rev. 0                                                                                    589
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                              AP1000 Design Control Document Figure 19E.4.10-1 Shutdown Temperature Evaluation, RCS Temperature Tier 2 Material                            19E-92                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                          590
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                              AP1000 Design Control Document Figure 19E.4.10-2 Shutdown Temperature Evaluation, PRHR Heat Transfer Tier 2 Material                            19E-93                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                          591
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                              AP1000 Design Control Document Figure 19E.4.10-3 Shutdown Temperature Evaluation, PRHR Flow Rate Tier 2 Material                            19E-94                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                          592
 
DCP_NRC_003343                Westinghouse Non-Proprietary Class 3
: 19. Probabilistic Risk Assessment                              AP1000 Design Control Document Figure 19E.4.10-4 Shutdown Temperature Evaluation, IRWST Heatup Tier 2 Material                            19E-95                                    Revision 19 APP-GW-GL-705 Rev. 0                                                                          593}}

Revision as of 22:25, 8 September 2021

Enclosure 1 - Supplemental Information to Support the AP1000 Design Certification Extension (Non-Proprietary)
ML21081A025
Person / Time
Site: 05200006
Issue date: 03/19/2021
From:
Westinghouse
To:
Office of Nuclear Reactor Regulation
Shared Package
ML21081A023 List:
References
DCP_NRC_003343
Download: ML21081A025 (593)
v • d • e


Text

Retrieved from "https://kanterella.com/w/index.php?title=ML21081A025&oldid=3284627"