ML19347D023

Design to Achieve & Maintain Cold Shutdown, Written Presentation at 810326 Meeting of Util Design Review Board

ML19347D023
Person / Time
Site:	Midland
Issue date:	03/05/1981
From:	CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
Shared Package
ML19347D022	List: ML19347D021 ML19347D023 ML19347D027
References
NUDOCS 8103100558
Download: ML19347D023 (47)

Text

- _

WRITTEN PRESENTATION TO UTILITY DESIGN REVIEW BOARD DESIGN TO ACHIEVE AND MAINTAIN COLD SHUTDOWN Revision 0 February 26, 1981

'810810 0 M@

-s

'6 t*

DESIGN TO ACHIEVE AND MAINTAIN COLD SHUTDOWN TABLE OF CONTENTS Page I. INTRODUCTION 1 A. WELCOME 1 B. PURPOSE OF PRESENTATION 1 C. OUTLINE FORMAT OF TALK 1 II. HISTORY l III. PRECEDING DESIGN - HOT STANDBY CAPABILITY 2 A. REACTIVITY CON".?ROL/ INVENTORY CONTROL 3 B. PRESSURE CONTRC L 4 C.

HEAT REJECTION (TEMPERATURE CONTROL) 4 IV. PRESENT DESIGN - COLD SHUTDOWN CAPABILITY 6 A. REACTIVITY CONTROL / INVENTORY CONTROL 7 B. PRESSURE CONTROL 9 C. HEAT REJECTION (TEMPERATURE CONTROL) 11 V. COLD SHUTDOWN CAPABILITY FOLLOWING CHAPTER 15 14 TYPE EVENTS A. PURPOSE 14 B. DISCUSSION 14 C.

SUMMARY

17 VI. COMPARISON OF PRESENT DESIGN TO APPLICABLE 17 REGULATORY GUIDANCE A. SRP 5.4.7,. RESIDUAL HEAT REMOVAL SYSTEM 18 B. BTP-RSB 5-1 (REVISION 1), DESIGN REQUIRE- 18 MENTS OF THE DECAY llEAT REMOVAL SYSTEM .

i

S 4 Page C. OPEN ITEMS ASSOCIATED WITH STAFF REVIEW 22 OF MIDLAND PLANTS D. SRP 7.4, SYSTEMS REQUIRED FOR SAFE SHUTDOWN 23 E. REGULATORY GUIDE 1.139, GUIDANCE FOR 29 RESIDUAL DUAL HEAT REMOVAL TO ACHIEVE AND MAINTAIN COLD SHUTDOWN LIST OF ABBREVIATIONS 34 TABLES FIGURES ,

APPD: DIX 1

il e .

Midicnd Plant Units 1 cnd 2

", ", Design to Achievo and Maintain Cold Shutdown DESIGN TO ACHIEVE AND MAINTAIN COLD SHUTDOWN I. INTRODUCTION A. Welcome B. Purpose of Presentation C. Outline Format of TelK II. HISTORY The ability to establish a stable condition for a nuclear reactor following a normal or emergency shut-down has always been a consideration in plant design.

However, the design requirements for pertinent systems and the condition to be established have evolved over the years.

A significant emphasis has traditionally been placed on ensuring a stable condition following a large loss-of-coolant accident (LOCA) event. During a large LOCA, the reactor coolant system (RCS) pressure decreases and a safe shutdown condition is established by the emergency core cooling system. Because of the attention previously given to this event, it is not a current concern and will be addressed only peripherally in this review.

For a non-LOCA event in which RCS integrity is maintained, the stable condition to be achieved is the hot standby condition in which the RCS pressure and temperature remain near their normal operating values. This safe hot standby condition could be achieved without offsite power._ The hot standby condition could be maintained

( until offsite power is restored and further cooldown is desired. Subsequently, emphasis was placed on ensuring that systems necessary to maintain hot standby were safety grade.

More recently, a similar emphasis has been placed on ensuring that systems necessary to achieve cold shut-down are safety grade. This situation evolved from a concern that the safe shutdown condition be cold shutdown.

Previously, the safe shutdown condition was considered to be hot standby. Cold shutdown is achieved when rhe-RCS temperature is <200F, and the reactor is at least 1% ak/k subcritica17 assuming the highest worth red 1

1 I Midland Plant Units 1 and 2 Danign to Achieve end Maintain Cold Shutdown stuck out, and no xenon. The event useful for evalua-ting the capability to achieve cold shutdown is the loss of offsite power coincident with a safe shutdown earthquake (SSE). Tais event is used as a basis to address Sections III (Preceding Design - Hot Standby Capability) and IV (Present Design - Cold Shutdown Capability) of this presentation. Other accident scenarios will be addressed in Section V (Cold Shutdown Following Chapter 15 Type Events).

Subsequent to the Three Mile Island (TMI) accident, the Midland project formed a task force to address some open issues that existed prior to TMI or were raised by the accident. One of the subjects addressei was cold shutdown. During this review, a number of design upgrades were recommended to enhance the hot standby and cold shutdown capabil; '. Most of the design upgrades ,that have been im; .amented with respect to shutdown capability have evolved from this ef fort.

The present Midland design basis is that hot standby is a safe shutdown condition. This design basis is appro-priate because hot standby is a safe, stable condition that can be maintained for an extended period of time with a minimal amount of operator action; therefore, it provides additional time to further evaluate the condition of the reactor. In addition, it frequently is preferable to maintain the reactor in this hot stable condition for an extended period of time rather than subjecting the plant to an immediate cooldown transient. The current Midland design provides for the ability to achieve and maintain, by safety-grade means, the hot standby condition following an SSE coincident with loss of offsite power. (Safety-grade systems are seismically designed and capable of being operated with or without offsite power.) Although it is not a design basis, the present Mi61and design incorporates the ability to be taken to the cold shutdown condition using only safety-grade equipment assuming only onsite or offsite power is available and considering a single failure. In addition, the present Midland plant design can achieve and maintain cold shutdown following a tornado by using equipment that is protected from the effects of a tornado.

III. PRECEDING DESIGN - HOT STANDBY CAPABILITY This section briefly addresses previous design capabili-ties of the Midland plant to facilitate an understanding of the design upgrades that have been made. No compari-son to the present design is made, because Section IV 2

• . i Midicnd Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown 12-100% power, the xenon reactivity is above its equilibrium value for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after a reactor trip. The xenon poison transient permits sufficient time to bleed the RCS and inject water from the BWST.

The boron concentration of the reactor is normally increased by using the makeup system to inject boric acid from the boric acid addition tanks of the chemical addition system. In the event of an accident, the borated water from the borated water storage tank (BWST) is available for injection into the RCS. ,

3. Inventory control The makeup system normally controls the RCS inventory. Portions of the makeup system are used for high-pressure injection (HPI) to ensure adequate boron concentration and core cooling. Safety-grade portions of the makeup system are powered by Class lE onsite power.

The makeup water is from the BWST, which is also safety grade.

B. Pressure Control The pressurizer safety valves prevent overpres-surization of the RCS. In the event of loss of offsite power, the thermal inertia of the pressu-rizer allows it to maintain system pressure for some time after power is removed from the heaters.

Thus, sufficient time exists to connect the pressurizer heaters to the emergency diesel generators.

C. Heat Rejection (Temperature Control)

1. Steam generator

a. Main steam isolation valve (MSIV) and main feedwater isolation valve (MPIV) closure Heat transfer from the RCS to the secondary side of the steam generator must be established for cooldown. In the event of a main steam line break (MSLB), MSIV 4

e a

f Midiond Picnt Units 1 and 2 Design to Achieve and Maintain Cold Shutdown and MFIV closure ensure that the heat removal can be controlled. The MSIVs and MFIVs close automatically on low-steam pressure or an e=ergency core cooling actuation signal (ECCAS), or can be manually closed from'the control room.

b. Auxiliary feedwater (AFW) operation The auxiliary Ceedwater. actuation system (AFWAS) initiates the automatic starting of both the turbine-driven and the motor-driven AFW pumps and the automatic positioning of AFW valves. This citigates the consequences of the loss of main feedwater or a loss of offsite power accident, and provides feedwater to allow primary heat removal through the steam generators.

A motor-driven and a turbine-driven AFW pump provide redundancy of AFW supply and diversity of motive pumping power.

Each pump has a rating of 885 gpm.

Discharge piping from both pumps is cross-connected through two normally open valves, permitting each AFW pump to feed both steam generators.

In the safeguards mode, pump suction is normally from the condensate storage tank, with emergency backup provided from the service water system. Steam supply piping to the turbine driver is provided by each of the main steam lines inside the containment. A line from each steam generator, equipped with a normally closed, de motor-operated iso-lation valve, supplies steam to a common header.

c. Main steam relief valves -

The main steam relief valves lift to remove heat from the secondary system.

The hot standby condition can be main-tained by cycling of these relief valves. Cooldown to a temperature that corresponds to a pressure below.the main steam relief valve setpoint could be 5

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown accomplished by opening the modula-ting atmosphtric dump (MAD) valve.

If instrument air were unavailable, the MAD valve could be opened by local manual operation.

2. Natural circulation of reactor coolant Natural circulation characteristics of the i RCS have been calculated by Babcock & Wilcox with conservative values for all resistance and form lose factors, and have been found to provide adequate core cooling.

IV. PRESENT DESIGN - COLD SHUTDOWN CAPABILITY The Midland design provides for the ability tc achieve and maintain, by safety-grade means, the hot standby condition following a SSE coincident with loss of offsite power. Although it is not a design basis, the Midland design incorporates the ability to be taken to the cold shutdown condition using only safety-grade equipment, assuming only onsite or offsite power is available and considering a single failure. Therefore, in the unlikely event that a design basis earthquake occurs which results in the need to achieve cold shut-down expeditiously, desian features exist to accomplish this evaluation. Reactivity control / inventory control, pr(ssure control, and heat rejection are the essential functions that must be maintained.

Detailed treatment of necessary supporting systems and equipment (such as power and control systems, cooling water, and diesel generators) is not addressed in this present2 tion. However, plant design ensures that these systems and equipment fulfill the necessary design requirements to achieve cold shutdown.

The loss of offsite power coincident with an SSE is used as'a basis for evaluating the capability of achieving

[ cold shutdown.

The NRC design guidance and the guidance followed on the Midland plant to meet the functional requirenents necessary to achieve cold shutdown follow.

a. Cold shutdown chall be achieved using safety-grade systems.

6

I

• l Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

b. Systems shall have suitable redundancy in comranents and features to ensure that the system functions can be accom-plished (assuming a single active failure).

c. Systems are capable of being operated from the control room. (Some systems require local manual alignment, but control can be performed from the control room.)

d. The necessary systems can function whether offsite power is available or unavailable.

The essential functions that must be maintained are individually addressed below.

A. Reactivity Control / Inventory Control

1. Control rods The Midland design (per unit) incorporates 61 control rod drive mechanisms (CRDMs), excluding the axial power shaping rod assemblies (APSRAs),

which do not perform a trip function. The CRDMs are the B&W Type C design, which is in use at the Oconee Unit 3 and Davis Besse Unit 1 plants. . Rapid control rod insertion is activated by the reactor protection system (RPS), anticipatory reactor trip system (ARTS),

loss of power to cont.ol rod drive (CRD) motors or a switch in the main control room.

The reactivity control capabilities of the control rods are identical to those descrioed in Section III.

2. Boration l

l For normal shutdown reactivity control, the

design of the Midland plant includes two sources of borated water

BWST and the

. chemical addition system (CAS). With letdown available, either the BWST or the CAS is

'~

capable of maintaining the reactor at 1% Ak/k subcritical at hot _ shutdown or during transition to cold shutdown at any time in core life for the most limiting normal fuel-cycle, assuming xenon-free conditions and the maximum worth rod stuck out of the core. The use of only 7

~o- a m ~ n w

a 9 Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown safety-grade equipment to maintain the reactor at 1% ok/k suberitical at hot standby, and the tranaition to a cold shutdown condition, requires the use of the emergency boration system (EBS).

The EBS is a safety-grade system designed to provide a 6 weight percent boric acid solution

, to the RCS via the makeup and purificat.on system (MU&PS), in the event of a design basis tornado (DBT) or SSE, in conjunction with the maximum worth stuck control rod.

The contents and concentration, in conjunc-tion with the other contraction volume makeup sources, are sized to ensure the ability to maintain a 1% Ak/k subcritical margin during hot standby and during the transition to cold shutdown. Adequate shutdown margin is main-tained during the transition from hot standby to cold shutdown by using borated water from the BWST or the CAS. These borated water sources provide adequate compensation for reactivity changes that result from the change in moderator temperature.

Following any event which results in the loss of letdown capability and a stuck rod, the 6 weight percent boric acid solution from the EBS storage tank (which contains at least 1,800 gallons), and the contraction makeup from the BWST or CAS can be transferred to the RCS via the MU&PS. One of the three makeup HPI pumps is used to inject this 6 j weight percent boric acid into the RCS.

l Contraction volume makeup during cooldown is L provided by the makeup and EBS tanks and either the BWST, which is designed-for an SSE, or the CAS, which is designed to with-stand the DBT.

l 3. Inventory control As coolant is removed'(or let down) from the RCS, this coclant must be replaced (or made l .up) by additional makeup water that is delivered to the RCS by the makeup portion of the MU&PS.

i l 8

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown Even if reactor coolant is not let down, the makeup portion of the MU&PS is still required to ensure a safe shutdown condition. As the RCS cools, the specific volume of water decreases. It is necessary to keep the volume of water in the RCS approximately constant. Therefore, additional water is injected into the RCS via the makeup system.

The safety-grade source of makeup water is the BWST, which contains at least 3C0,000 gallons of 1.3 wt% boric acid solution.

Because the BWST is not required after a design basis tornado, the BWST is not tornado-protected. In addition, three boric acid addition tanks (part of the nonsafety-grade CAS) are also available for makeup addition. These three 10,000 gallon tanks, which contain a total cf at least 16,500 gallons of 3.5 wt% boric acid, can provide the required RCS contraction volume in conjunction with other available water sources. These water sources are tornaco-protected and can be made available following loss of offsite power.

B. Pressure Control

1. Reactor coolant system pressure boundary

[ power-operated relief valve (PORV), PORV block valves, and pressurizer safety valves] ,

The.RCS pressure is controlled by maintaining

( the RCS pressure boundary and keeping a steam l

bubble in the pressurizer.

The PORV is cized to limit the pressure during step load changes, including the i maximum design load rejection, to a value less than the high-pressure trip setpoint.

l While contributing to plant safety by improv-ing-operating efficiency, the valve is not required for safety reasons. It may be isolated either manually or automatically upon a coincident signal that the PORV is not closed and a low'RCS pressure exists. The isolation is accomplished by either of two Class lE motor-operated PORV block valves l installed upstream of the PORV. Both the l- PORV and the PORV block valves are Class A

! 9 t.

I

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown (as defined by Regulatory Guide (RG) 1.26),

and, as such, are designed, fabricated, tested, installed, and certified by the requirements of the ASME Code of Class 1 valves.

The pressurizer safety valves ensure that the RCS is protected against overpressure. They are spring-loaded devices, and open automatically by direct action of the fluid pressure in the pressurizer as a result of forces acting against a spring. They are bellows-sealed to make the setpoint independent of backpressure and are equipped with an auxiliary piston to ensure pressure balance in the event of damage to the bellows. These valves are designed, fabricated, tested, installed, and

' certified in accordance with Article NB-7000,Section III of the ASME Code for Class 1 components. They are Class A components as defined in RG 1.26.

2. Pressurizer heaters To maintain normal. operating RCS pressure for more than a few hours after shutdown, operation of the pressurizer heaters is required.

The pressurizer must be maintained as the hottest point in the RCS to ensure the vapor bubble exists only in the pressurizer.

Power and controls for two banks of pressurizer l

heaters have been upgraded to safety-grade

-Class 1E stariards. In the event-of loss of L offsite power, power to the two banks of heaters is controlled by a manual switch in the control room. One bank is sufficient to control RCS pressure via a steam oubble in the pressurizer when the reactor is shut down

, and the energy input to the RCS is decay l heat.

3. Auxiliary pressurizer spray The auxiliary HPI pressurizer spray is designed to-depressurize the RCS from its normal operating pressure to a pressure l associated with.the emergency DHR system l cut-in temperature, and'is intended for use l

l 10 l

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown only during emergency cold shutdown. The spray system driving head is derived from the HPI pump discharge. Suction for the HPI pump is normally taken from the BWST. The boric acid addition tanks, via the makeup tanks, serve as an alternative suction source. The spray line discharges to the auxiliary DHR pressurizer spray line upstream of parallel, motor-operated globe valves; these valves permit manual control of flow into the pressurizer. The spray system requires local alignment prior to initiation, but is remotely initiated and controlled from the control room. Once initiated, the spray will be operator-controlled to provide the desired depressurization rate that is determined by the cooldown rate and plant status.

C. Heat Rejection (Temperature Control)

1. Steam generator (at high pressures / temperatures)

To remove heat via the steam generators, a

- source of water to the secondary side of the steam generators and a steam vent path for energy removal must be provided. The water is provided by the AFW system and steam is vented via the main steam relief valves or the power-operated atmospheric vent (POAV) valves,

a. Auxiliary feedwater Auxiliary feedwater is automatically supplied at a controlled rate by redun-dant 100% capacity AFW pumps. One pump is an electric motor-driven pump; the other is a steam turbine driven punp with steam provided by the safety-grade portion of the main steam system. Power and contrdis to both pumps are safety-grade and Class 1E.

Normally, the 300,000 gallon non-Seismic Category I condensate storage tank serves as the water source for these pumps. The safety-grade service water system provides an alternate source.

Because of concern for the quality of steam generator feedwattr;, automatic transfer is provided only upon coincident AFW actuation signal (AFWAS) and low AFW pump suction pressure.

11

I .

Midland Plant Units 1 and 2 l Design to Achieve and Maintain I Cold Shutdown l

b. Main steam relief valves These spring-loaded pressure relief valves cycle to relieve steam, enabling the reactor to remain in the hot standby condition.

c. Power-operated atmospheric vent valves Steam can be relieved through the POAV valves to maintain the r'eactor in a hot standby condition without cycling the main steam relief valves, steam can also be relieved to cool the reactor to a temperature where the DHR system can be used.

The POAV valves are safety-grade, motor-operated control valves located upstream of the MSIV. The POAV valves are sized so an inadvertent stuck-open POAV valve will not result in unacceptable consequences to the core.

The POAV valve capacity uill permit the RCS to be cooled to the emergency DHR cut-in temperature of 325F within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> assuming one operational POAV valve for each steam generator. The 325F cut-in temperature is discussed in Item 2

. below.

Each POAV valve can be jog-cor: rolled from a switch in the control room or the auxiliary shutdown panel. The operator will position the POAV valves until an i

acceptable temperature is maintained or until an acceptable cooldown rate is established.

Steam relief can also be accomplished by dumping steam to the condenser or opening the MAD valves. These components are downstream of the MSIVs and are not powered or controlled by safety-grad <e equipment. Thus, to ensure cold sbatdown can be achieved using only onsite i emergency power and safety-grade systems, credit is taken only for components upstream of the MSI7s.

12

0

• Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

2. Decay heat removal system After the RCS pressure and temperature are reduced to approximately 300 psig and 280F (or 325F under emergency conditions),

respectively, the DHR system operation may begin.

The pcevious design directed that the DHR system not be operated until the RCS temperature was 280F. The DHR system was analyzed to determine that operation of the DHR system at 325F is an acceptable, although not normal, mode of operation. The higher DHR cut-in temperature permits operation of the DHR system, within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> assuming operation of one POAV valve on each loop.

Four parallel-series, motor-operated isolation valves are installed on the DHR dropline inside the containment. These are installed so a single failure of a valve to open will not inhibit the flowpath-for DHR cooling.

3. Reactor coolant circulation

a. Natural circulation test The Midland plant has been analyzed to ensure that natural circulation will occur during a cooldown without forced circulation of the reactor coolant. In addition, a natural circulation cooldown test will be referenced if it has been conducted on a plant similar to Midland.

If such a test is unavailable, a test will be conducted to verify that operation of the POAV valves under natural circulation will. satisfactorily remove heat required to cool down the plant. This test will cool the RCS approximately 50F under natural circulation. The data will be-used to verify the adequacy of prior analytical results.

13

l -

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

b. Auxiliary feedwater level control The AFW system will be the subject of another presentation and details of that system operation are not addressed here.

However, the system will include safety-grade, automatic control of the steam generator water level. The steam generator water level is normally maintained at a level of 2 feet when two or more reactor coolant' pumps (RCPs) are operating. If 0 or 1 RCP is operating, the level is automatically increased to 20 feet; this ensures sufficient feedwater is present in the steam generator to promote natural circulation of the reactor coolant.

The automatic transition from the low-water level to the high-water level in the steam generator is made smoothly by ramping the setpoint between the two values at a controlled rate. This orderly transition prevents overcooling of the primary loop.

V. COLD SHUTDOWN CAPABILITY FOLLOWING CHAPTER 15 TYPE EVENTS A. Purpose This section describes the ability of the Midland plant to achieve cold shutdown from the postulated plant conditions and equipment availability that exist following the events addressed in Chapter 15.

Previous sections have provided detailed descriptions of the equipment needed to achieve cold shutdown.

This section addresses the general post-accident conditions that may exist and assesses the ability to proceed to cold shutdown conditions.

B. Discussion All of the transients analyzed in Chapter 15, with the exception of anticipated transients without scram events, result in a reactor tripped, suberiti-cal core condition-with long-term decay heat removal being provided by one or more intact RC/ steam generator loops, or HPI cooling.

i 14

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown The final plant condition and equipment remaining available for use in achieving cold shutdown are

, dependent on the transient and assumed equipment failures. Equipment failures assumed for Chapter 15 events are based on ensuring a bounding transient response with respect to the established acceptance criteria. This failure may not be the worst one with respect to achieving cold shutdown following the event.

For most events analyzed in Chapter 15, the design objective of achieving cold shutdown within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />

.an be met. This is true of all transients where

.to failure of safety-grade instrumentation has been imposed. With the imposition of a single

-failure of one piece of safety-grade instrumentation equipment, the remaining minimum performance level is still sufficient to achieve cold shutdown.

The transient analyses of Chapter 15 demonstrate that the plant can reach a stable plant condition at hot standby with ensured decay heat removal.

An event may rely on an operator action to ensure long-term heat removal or .jequate continuous suberitical margin at hot standby. Sufficient time and indication is available to the operator to take the required action in such instances.

Design basis events, such as steam and feedwater line breaks or a LOCA, may result in the loss of forced RC flow and the loss of the use of one '

steam generator for timely decay heat removal.

The essential control functions that must be naintai ed ~ in order to ensure the capability of achieving cold. shutdown are reactivity / inventory control, primary pressure control, and heat rejection. Any accident event, which, in combi-nation with a single failure, results in.the complete loss of any ene of these functions would preclude cold shutdown with safety-grade equip-ment. However, .the transients analyzed in Chapter 15 do not result in the complete loss of any one of these functions.

1. Reactivity / inventory control Short-term reactivity control is provided by the control rods. Upon reactor trip, a

-1% Ek/k shutdown margin (the control rod assembly of greatest worth is assumed not to 15 j l

l l

t Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown drop into the core) is provided by the rods at hot zero power (532F) temperatures. The EBS providES reactivity control to compensate for the deca, of xenon. Replacement of the primary system contraction volume following reactor trip is provided from the makeup tank oy the HPI system. The EBS water along with the contents of the makeup tank can be injected prior to cooldown below 532F. Reactivity control for long-term maintenance of hot standby is thus ensured.

Primary systen inventory and reactivity control during the cooldown to cold shutdown must be 3 ovided by either the CAS or HPI system.

2. Pressure control Pressure control is provided by auxiliary spray and the safety-grade banks of heaters during the cooldown following non-LOCA events.

Letdown from the RCS is not required.

3. Heat rejection (temperature control)

The design method of primary heat removal for both normal and transient conditions is by use of the steam generators. This method requires a sotcce of fluid (AFW) to the steam generators ann a mode of steam relief (main steam relief or POAV valves), all of which are safety-grade components or systems for the Midland plant. A secondary system transient such as a steam or feedwater line break may result in the loss of controlled heat removal capability from one steam generator. Heat removal is then provided by the intact loop with AFW flow directed to the intact once-through steam generator (OTSG) by the feed i only good generator (FOGG) logic system.

After stabilizing plant conditions, the POAV valves on the intact steam generator may be operated to decrease RCS temperature.

If'the reactor coolant pumps are not operating, reactor cooling will be maintained by natural l circulation. The ability to achieve cold

}

shutdown within a reasonable time frame under the conditions of natural circulation and one l 16 i

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown intact loop remains to be evaluated. The AFW system will be operated to control tha OTSG level to promote natural circulation.

The capability to achieve cold shutdown following the design basis tornado (coincident with loss of offsite power) has also been considered. Reactor trip occurs either by manual trip or automatically by loss of onsite and offsite power. Continued reactivity and inventory control are accomplished by injection of borated water from one or more of the three following sources, depending on availability: BWST (not tornado protected),

EBS (tornado protected), or chemical addition tanks (tornado protected). Heat rejection is maintained by steam generator pressure control using AFW, main steam safety valves, or by manual operation of the POAV valves. Natural circulation is maintained by proper operation of the AFW system to control OTSG level.

Primary pressure control is accomplished by operation of safety-grade heaters or auxiliary pressurizer spray.

Hot standby conditions can be maintained in-definitely unless it becomes desirable to proceed to cold shutdown.

C. Summary The capability of achieving cold shutdown exists for the conditions following the Chapter 15 events.

Various operator actions may be required depending on the transient involved and the assumed equip-ment failure. Times in excess of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> may be required under the conditions of natural circula-tion with only one intact loop. It may be desira-ble to stay at hot standby or cool more slowly if such an action would minimize radiation releases.

Table V-I summarises the capability and limitations relative to achieving cold shutdown for each Chapter 15 event.

'" . COMPARISON OF PRESENT DESIGN TO APPLICABLE REGULATORY GUIDANCE The Midland design has been compared with the NRC concerns and the design guidance related to the issue of cold shutdown. This section cantains the comparison.

17-

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown The design guides examined include the Standard Review Plan (SRP) 5.4.7; Branch Technical Position (BTP)

RSB 5 .; Open Items Associated with NRC Sstaff Review:

RSB-7, ASB-8, PSB-ll, RSB-10, RSB-20; SRP 7.4, and RG 1.139. Table VI-1 is a cross index illustrating the origin of the applicable guidance; it also shows which guidance is incorporated into the Midland design.

A. SRP 5.4.7, Residual Heat Removal System SRP 5.4.7 is primarily directed at. review of the residual heat removal system that operates after the RCS has been initially cooled and depres-surized. However, the SRP also directs that the chemical volume and control system (CVCS), resi-dual heat removal system, atmospheric dump valves, and source of auxiliary feedwater be reviewed to meet the functional requirements of BTP-RSB 5-1.

Therefore, the functional requirements of BTP-RSB 5-1 are examined in more detail. (The SRP and BTP refer to CVCS, residual heat removal (RHR), and atmospheric dump valves. On the Midland plant, the function of these systems is performed by the MU&PS, DHR system, and POAV valves, respectively. Future references are to the latter nomenclature.

B. BTP-RSB 5-1 (Revision 1), Design Requirements of the Decay Heat Removal System This BTP states the functional requirements to

. take a reactor from normal operating conditions to cold shutdown. In addition, further guidance is given for the DHR system design, cold shutdown p operation procedures, and AFW supply requirements.

l l Table VI-2 contains a summary of guidance contained j in BTP-RSB 5-1. In addition, the far right column of this table contains the design being implemented on the Midland project that is associated with the design guidance of the preceding columns.

The individual positions of the BTP are addressed because they ar; the main substance of the cold shutdown issue. Most of the subsequent NRC

~

questions and Open Items refer to the issues addressed in this table. A (G) designates the

! guidance a (D) designates the Midland design.

(Note: Midland is a Class 2 plant because the construction permit (CP) was issued before January 1, 1978.)'

I 18 l

Midland Plent Units 1 and 2 ,

Design to Achieve and Maintain Cold Shutdown

1. Long-term cooling / decay heat removal dropline (C) The i.HR dropline shall be able to acconmo-dste a single active failure or ensure that l manual action is possible to rectify the situation.

(D) Midland has a single DHR dropline. The line divides into two lines inside the containment and each line has two motor-operated isolation valves inside the contain-ment. The lines rejoin and exit the contain-ment. Thus, a single failure can be accommodated and containment access is not required. The power supplies and controls to the valves are arranged to function with a single failure.

2. Safety-grade steam dump valves (G) Previde safety-grade steam dump valves (D) The Midland plant has two safety-grade POAV valves associated with cych steam gen-erator. These motor-operated valves ensure adequate steam removal from the secondary side coincident with a single failure. This steam removal can be accommodated without manual actions at the location of the valve.

These valves are located upstream of the MSIVs.

3. Depressurization (G) Review or upgrade RCS depressurization me had (L) The Midland plant has a safety-grade auxiliary pressurizer spray.

4. Boration for cold shutdown / chemical d volume control system, and boron sa ,ing (G) Revise shutdown reactivity requirements to ensure -required shutdown margin by safety-grade systems at cold condition (D) The Midland plant has the capability to attain a 1% Ak/k shutdown margin, assuming the most reactive rod stuck out of the core, no xenon, no letdown, no offsite. power, and using only safety-grade systems.

19

Midland Plant Units 1 and 2 Design '.o Achieve and Maintain Cold Stutdown A safety-grade EBS is being added to ensure that an adequate shutdown margin can be accommodated without letdown.

The RCS boron concentration is normally measured with a boronometer that takes samples from the letdown system. A sample line is being installed on the letdown line upstream of the letdown valves to permit RCS samples to be taken with normal letdown isolated. Sample lines in the DHR system permit sample taking af ter the DilR operation.

The next two requirements are more specific to DHR design and are not cold stutdown concerns. However, they are included in the comparison for completeness.

5 Decay heat removal isolation

, (G) Provide sufficient DHR system isolation (D) The suction side of the DHR system has two parallel lines with two valves on each

~1ine, as described in long-term cooling /DHR dropline. These valves have interlocks to prevent opening unless RCS pressure is below DHR design pressure. The valves also have interlocks that close ihc valve if RCS pres-sure exceeds approximately 500 psig.

Overpressure protection of DHR system is accomplished by a relief valve that dis-l charges to the reactor building sump.

l The discharge side of the DHR system has two

! check valves in series between the RCS and the DHR system. The system will have provi-sions to permit periodic leak testing of the l

valves.

l Compliance with the BTP is met, with a clarification required for the isolation valve closure interlock. Overpressure protection of the DHR system is ensured by the DhR system relief valve. This valve also prcvides one means of overpressure protection of the RCS at low temperr.+.are. To maintain this means of overpressure protection, the automatic closure interlock is not actuated 20

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown until an RCS pressure of approximately 500 psig is reached; this exceeds the DHR relief valve setpoint (approximately i 360 psig).

6. Decay heat removal pressure relief l

(G) Collect and contain DHR pressure relief f and discharge I (D) Relief valve discharge is routed to the containment sump. This fluid is contained l

and also available for suction from the sump l if sump recirculation is necessary.

l

7. Test requirements l

(G) Develop procedures for cooldown and natural circulation. Meet RG 1.68 and use analysis and testing to confirm adequate nixing and cooldown under natural circu-Jation.

l (D) The Midland plant will reference a I natural circulation test if one has been

! conducted on a plant similar to Midland. If i

such a test has not been completed, Midland will perform a natural circulation cooldown test ~for SOF to verify previous calculations, i A test-to measure mixing is not anticipated. -

With this clarification, Midland will meet the testing requirements as delineated in the

! response to RG 1.68 in Appendix 3A of the FSAR.

8. Operational _ procedures ,

(G) Meet RG 1.33 and develop procedures for j cooldown under natural circulation.

(D) Operating procedures for natural circu-lation cooldown will be written and made available to_the operators before initial criticality.

9. Auxiliary feedwater supply (G)1 Ensure that an adequate alternate Seismic Category I source of water is available.

21

?

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown (D) The AFW system has an automatic switch-over to safety-grade service water. This volume of water (i.e., the ultimate heat sink and the cooling pond) exceeds any inventory requirements for AFW.

C. Open Items Associated with Staff Review of Midland Plants (NRC Letter, 3/30/79; Meetings of 4/10-11/79 and 4/19-20/79)

1. RSB-7 (G) This open item states that the Midland design does not comply with SRP 5.4.7 and BTP-RSB 5-1 for Class 2 plants (NRC letter, 3/30/79).

(D) A revised response to 211.35 has been provided to respond to this issue. The question in 211.35 closely parallels the issues addressed in BTP-RSB 5-1; the response closely parallels the previous discussion of compliance to BTP-RSB 5-1. The questic.i and response to 211.35 are included in the appendix, but are not addressed further here.

2. ASB-8, Manual operation of MAD valves (G) This open item required demonstration of manual operation of the MAD valves (Meeting of 4/10-11/79).

(D) The safety function of the MAD valves has been eliminated. The safety function is now accomplished by redu.Jant POAV valves that are operable from the control room. This obviates the need to demonstrate manual operation.

3. PSB-ll, Decay heat removal letdown valve (G) Midland should have motor-operated DHR letdown isolation valves to preclude the need for containment access (Meeting of 4/19-20/79).

(D) Midland meets this requirement as dis-cussed in BTP-RSB 5-1.

22

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

4. RSB-10, Pressurizer heaters (G) Justify the use of nonsafety-grade pre-ssurizer heaters (NRC letter, 3/30/79).

(D) The plant design has been revised to provide safety-grade power and controls to two banks of pressurizer heaters. The power and controls are backed by onsite erergency power systems in the event of loss of offsite power.

5. RSB-20, Long-term cooling after a main steam line break (NRC letter, 3/30/79)

(G) The effects of possible submergence of the DHR dropline valve motor operators inside containment following a main steam line break were questioned.

(D) The response to Question 211.163 addresses this concern. The isolation valve operators are located at the approximate water elevation that would exist if a MSLB were to occur inside the containment and the entire contents of the BWST were also to be injected into the containment. However, the control room operator has safety-grade ind cation of the reactor containment building water level and has approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to terminate the spray. Thus, operator action will preclude water in the containment from reaching a level to be of a concern with respect to the DHR isolation valve operation.

D. SRP 7.4, Systems Required for Safe Shutdown

1. Purpose This section of the SRP provides review guidelines for instrumentation and control systems associated with parts of the nuclear stear.. supply system used to achieve and maintain a safe shutdown condition of the plant.

2. Controls required to achieve and maintain safe shutdown: The following controls are provided in the Midland ~ design to achieve the necessary safety functions:

23

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

a. Reactivity control / inventory control

1) Control rod drive trip circuitry

2) Safety-grade portion of the MU&PS, BWST, and EBS

b. Heat rejection (temperature control)

1) Auxiliary feedwater controls - Main steam line and main feedwater line isolation valve controls

2) Power-operated atmospheric vent valve controls

3) Necessary service water and compo-nent cooling water (CCW) system controls

4) Control of natural circulation by proper operation of the AFW and POAV valve control systems I

5) During hot shutdown and cold shut-

! down conditions, DHR system con-trols are provided.

c. Pressure reduction and control -

1) Pressurizer heater controls for banks 5 and 6 2). Auxiliary pressurizer spray controls

3. Instrumentation required to achieve and l

maintain safe shutdown The following instrumentation capability exists in the Midland design to monitor the safe shutdown condition:

a. Reactivity control / inventory control

1) Control rod drive trip breaker position indication (at the breaker)

2) Emergency boration systen. tank l level indication

3) Source range neutron power 24

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

b. Heat rejection (temperature control)

1) Reactor coolant system hot and cold leg temperature

2) Decay heat removal heat exchanger outlet temperature (see note below)

3) Auxiliary feedwater flowrate

4) OTSG pressure and level

5) Power-operated atmospheric vent valve position

6) Reactor coolant system flowrate

7) Decay heat removal flowrate (see note below)

c. Pressure reduction and control

1) Reactor coolant system pressure

2) Pressurizer level Note: Safety-grade indication is provided in

-the main control room for accident monitoring purposes and is available for safe shutdown monitoring. However, these indications are not immediately required for safe shutdown monitoring. Sufficient time exists to connect portable instruments to lina-mounted equipment and, therefore, permanent i.7=truments for these parameters are not provided outside the control room.

4. Conformance to SRP 7.4 )

Detailed design and procurement of the controls and instrumentation required for safe shutdown are nearing final stages for most items. The SRP acceptance criteria were considered and are being implemented. These criteria are summarized below.

I

-l 25

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

a. Redundancy (G) All instrumentation and controls essential to achieve and/or maintain the cold shutdown condition are redun-dant to their intended safety function.

(D) The project is implementing this SRP acceptance criterion.

b. Single failure criterion (G) All instrumentation and controls essential to the achievement and/or maintenance of the cold shutdown condi-

'. ion meet the single failure criterion.

(D) The project is implementing this SRP acceptance criterion.

c. Capacity and reliability (G) All instrumentation and controle essential to the achievement and/or maintenance of the cold shutdown condi-tion have the capacity and reliability to perform their intended safety func-tions whenever necessary.

. (D) The project is implementing this SRP acceptance criterion.

d. Qualification (G) All instrumentation and controls essential to the achievement and/or maintenance of the cold shutdown con-dition are qualified to function during and after the design basis events for which their operation is essential, including earthq' Jakes and all FSAR Chapter 15 accidents.

(D) The project is implementing this SRP acceptance criterion with the clarifica-tion provided in RG 1.97 that instrumen-tation should continue to read within the required accuracy following but not necessarily during an SSE.

26

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown

e. Testing (G) All instrumentation and controls essential to the achievement and/or maintenance of the cold shutdown con-dition satisfy applicable criteria for preoperational and periodic testing, quality assurance, and design provisions for indicating system availability.

(D) The project is implementing this SRP acceptance criterion.

f. Remote / local station capability (G) SRP 7.4 states that equipment re-quired for safe shutdown be operable from local control panels and that access to these local control panels should be administratively controlled.

Appropriate readouts (such as steam generator level, steam generator pressure, pressurizer pressure, pressurizer level, and AFW flow) to monitor the status of the shutdown should be provided. This equipment should be designed to accommodate a single failure and should be capable of operating independently of the equip- ,.

ment-in the main control room. The equipment shou./ also be designed to the same standards as the corresponding equipment in the control room.

(D) The Midland design will comply with this SRP acceptance criterion with the following clarifications:

1) The Midland design provides redun-dant controls and indications outside the control room on local control panels. These controls and indications outside the control room are designed to operate without the mutual action of those-in the control room. No single failure will defeat this capability for safe shutdown at either location.

In addition, a study is in progress which responds to fire protection 27

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown guidelines. The study evaluates the feasibility of installation of transfer switches, relocation of signal processing equipment, and improved fire protection of safe shutdown control and instrumentation to ensure that the capability exists outside the control room to shut the plant down after a fire.

2) The Midland design provides instru-mentation capability at the auxi-liary shutdown panel and local control stations beyond the examples provided in SRP 7.4. Instrumenta-tion for monitoring safe shutdown is consistent with the control room capability as described in Sec-tion VII.D.3 except as follows:

a) Source range neutron power for reactivity control monitoring Control room: Safety-grade indication is provided.

Auxiliary shutdown panel:

Computer terminal display of isolated safety-grade inpats to the computer is provided.

I Discussion: Complete safety-grade indication of source

, range neutron power is not available outside the control i room. Analysis indicates that in the worst-case scenario, upon completion of EBS injec-tion, the reactor will remain subcritical. Safety-grade EBS tank level indication is provided on the auxiliary shutdown panel and this, together with valve indications, provides sufficient verification of proper EBS injection. Therefore, this precludes the need to monitor source range neutron power.

28 i

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown E. Regulatory Guide 1.139, Guidance for Residual Heat Removal to Achieve and Maintain Cold shutdown RG 1.139 has been made available to the industry and is intended to apply to cps issued after January 1, 1978; therefore, it is not specifically applicable to Midland. The implementation section of the latest available version (Draft 2, Revision 1 transmitted to A.L. Cahn of Bechtel Power Corp.

by G.A. Arlotto of the NRC on March 21, 1980) states that the guide will be used for plants docketed after January 1, 1980, and this excludes Midland. This section also states applications docketed before this date will be reviewed against this guide on a case-by-case basis.

Nevertheless, the guidance in RG 1.139 will be compared to the Midland design. This comparison will be made with Section C, Regulatory Position, of the regulatory guide.

1. Functional

a. (G) The design shall be such that the reactor can be taken from normal opera-ting conditions to cold shutdown using only safety-grade equipment.

(D) Midland has this capability.

b. (G) The systems utilized are redundant,

, provide function assuming a single failure, and are capable of operation with onsite or offsite power.

(D) The systems used satisfy this guidance.

c. (G) The RCS shall be capable of being cooled and depressurized so DHR ini-tiation can begin in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. ,

(D) The POAV valves that have been added can cool the reactor sufficiently enabling DHR operation to be initiated within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after shutdown.

d. (G) Instrumentation and controls conform to IEEE Std 279-1971, 323, 384, and 344; and RG 1.89, 1.75, and 1.100.

29

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown (D) All necessary instruments and controls will be safety grade.

e. (G) Safety-related systems should be Seismic Category I and meet RG 1.29.

(D) The Midland design is in accordance with this guidance except for the CAS, which is an alternate system that may be used to provide for RCS contraction volume following a tornado. A seismic event is not assumed to occur simulta-neously with a design basis tornado.

2. Reactivity control (G) A safety-related system shall exist to control and monitor the boron concentration.

l (D) Safety-related systems exist to inject sufficient baron to ensure suberiticality.

Operation of these systems ensures sufficient boron concentration. Boron concentration can be measured by sampling or by the nonsafety-grade boronometer when letdown is available.

A safety-related boron measuring device is not installed.

3. Heat removal

a. Auxiliary feedwater (G) A safety-related water source should exist to supply water for sufficient

time.

(D) Refer to response to BTP RSB 5-1.

b. Steam relief (G) Provide safety-related atmospheric vent valves.

I l (D) Refer to response to BTP RSB 5-1.

c. Steam generator inventory (G) Provide safety-related steam genera-tor water level indication and alarm.

l l

30

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown (D) Safety-grade steam generator water level indication is provided. An alarm is provided that is actuated by a Class 1E signal transmitted through an isolation device.

4. Decay heat removal (G) Provide redundant traine for the RHR system with capability to cool core by 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after shutdown.

(D) The DHR system has redundant trains, but operation of DHR system within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after shutdown is not a design basis. However, the system will be capable of operation within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after shutdown.

a. Decay heat removal isolation Refer to response to BTP-RSB 5-1. The requirements of BTP-RSB 5-1 and this regulatory guide are similar on this issue.

b. Decay heat removal system pressure relief Refer to the response to BTP-RSB 5-1.

The requirements of BTP-RSB 5-1 and this l regulatory guide are similar on this issue.

j c. Decay heat removal pump protection (G) Procedures should be such that a single failure or operator error will i not result in loss of RHR function due j to pump damage.

! (D) Operating-procedures for the DHR l system will be written and made avail-l '

able to the operator before initial l criticality. In addition, the present

design includes DHR pump protection by a j nonsafety-grade low-flow trip. This trip is inhibited during ECCAS actuation.

31

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown ,

I l

l

d. Decay heat removal testing Refer to the response to BTP-RSB 5-1.

The requirements of BTP-RSB 5-1 and this regulatory guide are similar on this issue.

e. Decay heat removal system operation and indication DHR isolation valve position (G) Provide isolation valve position indication, system pressure and flow, and pump operating status in control room.

(D) These indications are available in the control room.

f. Residual heat removal system integrity

1) Residual heat removal system leakage (G) Monitor and control DHR system pump and valve leakage.

(D) The DHR pump rooms have floor drains that are normally closed.

Safety-grade redundant water level indicators for those rooms are located in the control room. The valves may be opened locally (nonsafety-grade system) and drained to the auxiliary building sumps. The pump rooms are equipped with an engineered safety features (ESF). filtration system to collect airborne radiation after a postu-lated accident.

l 2) Shielding of personnel and per-sonnel access The present design is adequate for all design base scenarios.

3) Engineered safety features filtra-l tion system l

32

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown (G) Service the DHR system, including leakage collection system, by an ESF filtration system (D) The DHR pump room has an ESF filtration system. Leakage is contained in the pump room by closed drains,

g. Residual heat removal cooling water supply (G) Provide safety-related cooling water to the DHR heat exhangers and monitor the water for radioactivity at the DHR heat exchanger outlet.

(D) The DHR coolers are serviced by a safety-grade CCW systera. Each DHR cooler is serviced by a separate CCW train. Each CCW train is equipped with a nonsafety-grade radiation monitor in the line, but not at the output of the DHR heat exchanger.

5. Natural circulation cooling (G) Provide redundant emergency power and controls to required number of pressurizer heaters, PORV and PORV block valves, and ,

pressurizer level indicator channels.

(D) Safety-grade power and controls are provided for these instruments and components.

6. Reactor coolant system inventory (G) Provide capability of supplying makeup and letdown control to accommodate cooldown

. shrinkage and letdown for boration.

(D) The Midland design can accommodate safety-grade cold shutdown without letdown. Suffi-cient inventory is-available from the BWST.

If.the BWST is unavailable, RCS makeup can be provided by the tornado-protected, non-safety-grade, CAS. The letdown system is nonsafety grade, but the letdown isolation is safety grade.

7. Operational procedures Refer to' response to BTP-RSB 5-1.

33

~

Midland Plant Units 1 and 2 Design to Achieve and Maintain Cold Shutdown LIST OF ABBREVIATIONS AFW Auxiliary feedwater AFWAS Auxiliary feedwater actuation signal APSRA Axial power shaping rod assemblies BTP Branch Technical Position BWST Borated water storage tank CAS Chemical addition system CCW Component cooling water CP Construction permit CR Control room CRD Control rod drive CRDM Control rod drive mechanism CVCS Chemical volume and control system (D) Design DBT Design basis tornado DHR Decay heat removal DHRS Decay heat removal system ECCAS Emergency core cooling actuation system EBS Emergency boration system ESF Engineered safety features (G) Guidance HPI High-pressure injection LOCA Loss-of-coolant accident LPI Low-pressure injection MAD Modulating atmospheric dump MFIV Main feedwater isolation valve MSIV Main steam isolation valve MSLB Main steam line break MU&PS Makeup and purification system OTSG Once-through steam generator POAV . Power-operated atmospheric vent PORV Power-operated relief valve RCS Reactor coolant system RG Regulatory Guide RPS Reactor protection system RHR Residual heat removal SER Safety Evaluation Report SF Single failure SRP Standard Review Plan SSE Safe shutdown earthquake TMI Three Mile Island 34

4 8 9 4

9 8 TAELES r

l l

l t

i i

l 1

k l

l t

t l

I I

I l

a 4

TABLE V-1 COLD SHf1TDOWN CAPABILITY FOLLOWING CHAPTER 15 EVENTS Cold Shutdown Achievable in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> with Safety Crade Event Equipment Assumptions Cold Shutdown Limitations 15.1.1 Decrease in feedwater Yes AFW available none temperature 15.1.2 Increase in feedwater Yes AFW available none flow 15.1.3 Steam pressure mal- Yes AFW available Intermittent use of both steam function resulting in generators may be required d

4 increased steam flow 5 15.1.4 Inadvertent opening of Yes AFW available Intermittent use of both steam an atmospheric pump or generators may be required safety valve 15.1.5 Steam line break No Loop -only one intact loop available Loss of I HP1 Pump -time > 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> required 15.2.1 Steam pressure regulator Yes AFW available none malfunction resulting in decreasing steam flow 15.2.2 Loss of external Yes EBS available even none load (turbine trip) with LOOP I 15.2.3 Turbine trip Yes EBS available none 15.2.4 Inadvertent MSIV Yes AFW available to both none closure steam generators

TABLE V-1 (Continued)

Cold Shutdown Achievable in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> with Safety Crade Event Equipment Assumptions Cold Shutdown Limitations 15.2.5 Loss of condenser Yes AFW available to both none vacuum steam generators 15.2.6 Loss of all nonemer- Yes none gency ac power 15.2.7 Loss of normal feed- Yes AFW flow available none water to both steam genera-tors 4 15.2.8 Main feedwater line No AFW flow available to With LOOP - natural circu-h break only one steam generator lation cooldown may require

> 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> 15.3.1, Decrease in RCS flow Yes AFW flew to both steam none 15.3.3, rate generators follooing 15.3.4 loss of RC fitw up to four pumps 15.4.1, neactivity anomolies Yes none 15.4.2, 15.4.3, l

15.4.4 15.4.6 Chemical addition Yes operator terminates Continued RC inventory in-system malfunction source of dilution crease may result in inabili-ty to borate without re-quiring letdown e

TABLE y-1 (Continued)

Cold Shutdown Achievable in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> with Safety Grade Event Equipment Assumptions Cold Shutdown Limitations 15.4.8 Control rod assembly Small LOCA none sjection 15.5.1 Inadvertent operation Yes none of ECCS 15.6.1 Inadvertent opening Yes HPI maintains primary none of a pressurizer safety pressure control t

or relief valve AFW flow to both steam generators' as 15.6.2 Break in instrument Yes HPI maintains primary none k

0 line or line from pressure control primary system that AFW flow to both steam panetrates containment generators 15.6.3 Steam generator tube Yes HPI maintains primary Choosing to use one unaffec-failure pressure control ted steam generator for cool-down may increase time to cold shutdown and ultimately increase radiation reler. sed 15.6.5 LOCA Yes HPI and LPI available 15.8 Anticipated transient No Time required without scram

)

1 TABLE VI-1 LOCATION OF DESIGN REQUIREMENTS TO ACHIEVE / MAINTAIN SAFE SHUTDOWN Cuidance Document ,

BTP RSB QR Midland Requirement 5-1_ 211.35 ASB-8 PSB-11 RSB-20 RSB-10 RC 1.139 Design bdR drop line Yes Yes Yes Yes Yes that can accommo-date single fail-ure Safety-grade Yes Yes Yes Yes Yes steam dump valves Provide aux. Yes Yes Yes spray or show manual actions are acceptable Provide safety- Yes Yes Yes Yes related boration system without letdown, or pro-vide safety-grade letdown, or show that manual actions are accep-table Provide adequate Yes Yes Yes RHR isolation Discuss collec- Yes Yes Yes Yes tion of RHR sys-tem pressure re- /

lief valve dis-charge Conduct borated Yes Yes No weter mixing _

test Conduct natural Yes- Yes Yes circulation test VI-la

TABLE VI-1 (Continued)

Guidance Document BtP RSB QR Midland Requirement 5-1 211.35 ASB-8 PSB-ll RSB-20 RSB-10 RG 1.139 Design Provide natural Yes Yes Yes Yes circulation pro-cedures Provide Seismic Yes Yes Yes Yes Category I AFW system water sup-Py l

Provide safety- Yes No( }

grade means of monitoring boron concentration Provide safety- Yes Yes )

grade steam gen-erator level in-dication and alarm Provide safety- Yes Yes( )

grade makeup and letdown control Provide necessary Yes Yes Yes safety grade pressurizer heat-ers with Class IE power and control fk}Midlandprovidessafetygradeborationwithoutletdown

( )Nonsafety-grade sampling is provided

( ) Alarms exist but are not safety grade

( }Latdown is safety-grade only for isolation of letdown VI-lb

TABLE VI-2 DESICW GUIDANCE OF BTP RSS 5-1 FOR CLASS 2 PLANTS AND COMPARISON TO HIDLAND DESIGN ( }

Design Requiremente Process and Systes Branch Technical Positira Design Guidance of BTP RSB 5-1 _ ,_,

or Component for Midland Midland Design

1. Functional requirement long-tere cooling (RNR Coop 11ance will not be required if it can be shown that Midland complies.

for taking to cold drop line) correction for single fatture by manual actions inside shutdown os outside of containment, or return to hot standby Midland has a single DHR until manual actions (or repaire) are complete, are dropline that divides into

a. Capability using only f ound to be acceptable for the individual plant. a sortee/ parallel remote safety-grade syntes motor-operated valve arrangement inside

b. Capability with either containments the line only onette or only then reconverges to emit offette power and with containment. Local single fatture manual actions in the (lietted action aust11ery building are outside CR to meet SF) e quired for alignment.

c. Reasonable time for cooldown assuming most g lietting SF and aly e offeite or only onsite y pouer Heat removal and RCS Frovide safety grade dump valves, operators, and power Midland complies.

circulation during supplies, etc so that manual actione should not be cooldown to cold required after en SSE except to meet single fa!!ure. Remote manual safety-grade shutdown POAV valves are provided and are operated by safet y-grade power and controle. The single failure criteria is

. met. Remote manual action is required.

Depressurization Compliance will not be required if a) dependence on Midland complier.

(pressuriser aunillary manual actions inside containment after SSE or eingle apery or power-operated failure, or b) remaining at hot standby untti manual A safety-grade auxiliary rettet valves) actions or repaire are complete are found to be pressuriser spray le acceptable for the individual plant. provided. Local manual action in the musillary building is required for alignment. Control is accomplished from the control roce.

Boration for cold Compilance will not be required if al dependence on Midland rosylles.

shutdown (CVCS and manual actione inside containment after SSE or single baron esopling) failure, or b) reestning at hot standby unt ti manual Midland has the capability ,,

actions or repaire are complete, are found to be to borate wit hout letdown.

acceptable for the individual plant. A safety grade emergency boration systre provides L_________ _ _ _ _ _ _ _ _ _ _ _ _ __

, Iableyl-2_(continued)

Desten Requirements Process and Systes Branch Technical Position Design Cuidance

_ f_ f 4 rr t ,gyj _ or Component for Midland Midland Destan for boration to hot standby.

The BWST or CAS provideo for boration to cold shutdown.

Local manual alignment is required. Doron concentration is normally measured after being let down. Sampling capability will be added on the cold-loop letdown line upstream of the isolation valve.

11. Rait isolation RHR system Comply with one of the allowable arrangement e. Midland complies.

The DNR system suction le isolated by two settee

• motor-operated valves on each of two lines.

d the DHR discharge is isolated h ' r two series check valves on each of two lines.

111. RHR pressure retter

b. Collect and contain DHR system Compliance will not be required if it can be shown Midland complies.

relief discharge that adequate methods of dispa?ing of discharge are available. The DHR relief valve 4

discharge is routed to the containment susp.

V. Test requirement

b. Meet RG 1.M for Ren tests and confirm analysis to meet the requirement. Midland complies with PWRs test plus clarification for boron analyste for mining test.

cooldown under natural circulation Midland will use the results to confirm adequate of a natural circulation mining and cooldown cooldown test on a alm 11er within limita plant to confirm esteting specti f ed in EOP. calculations if a steller plant le tested before Midland. Otherwise, a 50F cooldown test wi!! be performed on Midland. No separate boron mixing test is presently planned.

i Table _VI-2_(Continued }

besten Requiremente Process one System tranch Technical Poettion Deelga Culdence of BTP RSB 5-1 or Component for Midland Midtend Deelan VI. Operational procedure

a. Meet RC 1.33 for Develop procedures and information from teste and Midland util comply.

FWSe, include analysis.

opecific procedures Appropriate procedures will and information for be developed.

cooldown under natural circulation.

VII. Aus111ery feedwater supply

a. Selemic Category I Emergency feedwater Compliance w!11 not be required if it is shown that Midland complies.

supply for AFW for at supply an adequate alternative Seisele Category I source least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> at hot le available. An automatic switchover shutdown (sic) plus to a safety grade source of cooldown to RHR AFW is provided upon low cutin based on longest euction to the AFW pumpe, time for only onette coincident with an or only off-site accident etsnal.

power and assumed single failure.

??

III '

Midland to a Class 2 plant because the construction permit wee teoued before January 1,1978.

,ad '

• e