ML20133E196

Summary of 961220 Telecon W/W to Discuss AP600 Asi Questions.Summary of Actions & Highlights of Questions Discussed Listed.List of Participants Encl

ML20133E196
Person / Time
Site:	05200003
Issue date:	01/08/1997
From:	Huffman W NRC (Affiliation Not Assigned)
To:	NRC (Affiliation Not Assigned)
References
NUDOCS 9701100238
Download: ML20133E196 (30)

Text

- _ _ --

l .

• *% y l g J*, UNITED STATES

" j U

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20656-4001 k.....[f January 8, 1997 i APPLICANT: Westinghouse Electric Corporation PROJECT: AP600

SUMMARY

OF TELEPHONE CONFERENCE TO DISCUSS AP600 ADVERSE SYST INTERACTIONS QUESTIONS (ASI) 1 4

On December 20, 1996, members of the Nuclear Regulatory Commission (NRC) staff and Westinghouse (Attachment 1) conducted a telephone conference (telecon) concerning the AP600 ASI report. NRC questions on the report were provided to Westinghouse via a letter dated October 3,1996. Westinghouse provided responses to a majority of these questions (Attachment 2) via a facsimile sent to the NRC on December 19, 1996.

The following is a summary of actions and highlights of the questions dis- '

cussed:

=

Westinghouse agreed to address the question contained in the introduc-tory statement of the NRC ASI comments.

=

Q#1 - Westinghouse agreed to modify its response to question #1 to include of a discussion draining on how operation of the RNS will affect the timing of the CMTs. The staff also clarified its question on the possibility of operation of the RNS "short circuiting" through a DVI line break while at the same time defeating passive injection or sump recirculation through the other DVI line. Specifically, Westinghouse should consider the scenario where there is a large break in DVI line "A" with the RNS running. Since the RNS takes suction on injection line "B" (by design), it would appear that passive injection from the IRWST or recirculation sump through line "B" would not be possible while the RNS is running. No injection flow is going through DVI line "A" by definition since it has the break. Would it be possible to have insuf-ficient flow from the RNS through the "B" DVI line to maintain adequate core cooling, including short circuiting of injection via RHR suction from the containment sump and out a DVI line break?. Westinghouse agreed to look at this and provide a some discussion in its modification to Qfl.

Q#2 - The staff provided examples (e.g., pages 2-37 and 2-39 of the ASI report) where sensitivity studies were cited without reference.

Westinghouse agreed to provide references in the ASI report were such studies where cited.

=

l Q#4 - Westinghouse stated that the staff's concern regarding operation i

' of the fan coolers in question #4 is being studied and will be revisited for further discussion when the study is complete.

=

Q#6 - The staff found the Westinghouse response satisfactory.

i 9701100238 970108 8 PDR ADOCK 05200003 i A PDR

January 8,1997 l

Q#15 - The staff found the Westinghouse response satisfactory.

1 Q#29 (a) - Westinghouse agreed to revise this response to provide additional

! information on exactly when the operator can override the automatic ADS feature based on the station blackout timer, what minimal- battery condition must exist, and how this action will be controlled. j l (b) - The staff found the Westinghouse response to this question satisfactory.

l Q#30 - The staff'found the Westinghouse response satisfactory.

Q#36 - This question was discussed in terms of what capability the operators would have in detecting and monitoring potential level oscillations and what actions they might take. Westinghouse ststd that it is unlikely that a plant operator would ever be able to detect such an oscillation since there is no flow instrumentation in the DVI lines.

Westinghouse stated that it'would recommend that no action be taken  ;

l should such an oscillation be detected.  !

1 Q#46 .The staff found the Westinghouse response satisfactory.

. Q#50 - The staff asked if Westinghouse had confirmed that the I&C i l cabinet temperatures will remain,below limits under a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> station blackout scenario with the control room occupied by 11 people? It is the staff's understanding that the previous habitability design was performed with only five people present in the control room. Westing-house agreed to. verify that the temperature were calculated with 11 people.

The staff agreed to review the remaining Westinghouse responses and followup with Westinghouse on.any responses which it require additional clarification. Westinghouse also committed to get the responses to the remaining ASI questions to the staff in the early January time frame.

original signed by:

William C. Huffman, Project Manager Standardization Project Directorate Division of Reactor Program Management Office of Nuclear Reactor Regulation Docket No.52-003 DISTRIBUTION: See next page Attachments: As stated I

cc w/ attachments:

See next page DOCUMENT NAME: A:TELECON.ASI (A AP600 DISK) i fa seentue a sepy of this elesessesst, huessee he the ben: "C" = Copy wsthout attachment / enclosure "E' = Copy with attachment / enclosure *N* = No copy 0FFICE PM:PDST:DRPM l D:PDST:DRPM l l l NAME WCHuffmar(:a R -.TRQuay i)'A l DATE 01/7 /97 - 01/y/97 0FFICIAL RECORD COPY

Westinghouse Electric Corporation Docket No.52-003 cc: Mr. Nicholas J. Liparulo, Manager Mr. Frank A. Ross l Nuclear Safety and Regulatory Analysis U.S. Department of Energy, NE-42 i Nuclear and Advanced Technology Division Office of LWR Safety and Technology l Westinghouse Electric Corporation 19901 Germantown Road l P.O. Box 355 Germantown, MD 20874 Pittsburgh, PA 15230 Mr. Ronald Simard, Director

l. Mr. B. A. McIntyre Advanced Reactor Program l Advanced Plant Safety & Licensing Nuclear Energy Institute l Westinghouse Electric Corporation 1776 Eye Street, N.W.

Energy Systems Business Unit Suite 300 i Box 355 Washington, DC 20006-3706 Pittsburgh, PA 15230 l Ms. Lynn Connor Mr. John C. Butler Doc-Search Associates Advanced Plant Safety & Licensing Post Office Box 34 l Westinghouse Electric Corporation Cabin John, MD 20818 I Energy Systems Business Unit l Box 355 Mr. James E. Quinn, Projects Manager l Pittsburgh, PA 15230 LMR and SBWR Programs GE Nuclear Energy Mr. M. D. Beaumont 175 Curtner Avenue, M/C 165 Nuclear and Advanced Technology Division San Jose, CA 95125 l Westinghouse Electric Corporation One Montrose Metro Mr. Robert H. Buchholz

11921 Rockville Pike GE Nuclear Energy Suite 350 175 Curtner Avenue, MC-781 Rockville, MD 20852 San Jose, CA 95125 Mr. Sterling Franks Barton Z. Cowan, Esq.

U.S. Department of Energy Eckert Seamans Cherin & Mellott NE-50 600 Grant Street 42nd Floor 19901 Germantown Road Pittsburgh, PA 15219 Germantown, MD 20874 Mr. Ed Rodwell, Manager Mr. S. M. Modro PWR Design Certification Nuclear Systems Analysis Technologie:: Electric Power Research Institute Lockheed Idaho Technologies Company 3412 Hillview Avenue Post Office Box 1625 Palo Alto, CA 94303 Idaho Falls, ID 83415 Mr. Charles Thompson, Nuclear Engineer AP600 Certification NE-50 19901 Germantown Road Germantown, MD 20874 i

l

WESTINGHOUSE /NRC AP600 ADVERSE SYSTEM INTERACTIONS I

TELECONFERENCE DECEMBER 20, 1996 PAP.f!CIPANTS M8ME ORGANIZATION ROBIN NYDES WESTINGHOUSE l MIKE CORLETTI WESTINGHOUSE I CHUCK BROCK 0FF WESTINGHOUSE l LARRY HOCHREITER WESTINGHOUSE l BILL BROWN WESTINGHOUSE

! RICK WRIGHT WESTINGHOUSE l l ALAN LEVIN NRC  !

AMY CUBBAGE NRC ,

i JIM BONGARRA NRC j NICK SALTOS NRC '

BILL HUFFMAN NRC JIM HIGGINS BNL l

l Attachment I l

bl D Date: December 19,1996 l

Subject:

Preliminary Responses to Questions, Comments, and Discussion items Conceming the AP600 Adverse Systems Intemaction Report To: Bill Huffman I 1 '

l From: Robin Nydes l t 1 l

l Here am the responses we have drafted so far for our telecon tomorrow morning at 10:00 am. I am trying to get another conference room (since it is the cormeetion in our room 322 that is had) and will let you know the phone number tomorrow moming.

l l What is not attached are responses to 33, 38-43,47,49, and 51 but we will be ready to discuss them tomorrow moming.

/ 1

/ l cc: Chuck Brockhofly Mike Corletti " i Mark Wills i Selim Sancaktar Terry Schulz Rick Wright Bill Bmwn Gene Piplica i l

1 l

l l

Attachment 2 TO0g 009dV SCSS t4C Zit IV3 21:91 GH.L 96/61/ZT SEGS t'4E Zit' . ._.

l 2

RESPONSES TO QUESTIONS, COMMENTS, AND DISCUSSION ITEMS CONCERNING TIE WESTINGHOUSE AP600 l ADVERSE SYSTEMS INTERACTION REPORT l

The Adverse Systems interactions report does a reasonably good job in describing interactions between single components and/or systems in the AP600. However, there appears to be relatively little ,

consideration of " integral" effects: for instance, the cumulative impact of operating several non safety '

systems for a period after which the passive systems might be required to operate. The staff l recogruzes that the actual plant response to a transient or accident may depend upon operator (or

! automatic) actuation of the " defense in-depth" (DID) systems. The staff is concemed, however, that j

the integral systems impact of operating several DID systems, either in parallel or serially, may affect l

the plant's thermal hydraulic state sufficiently to compromise the ability of the passive systems to "take over" should they be required at a later time, in the event that an accident or transient worsens, or if some or all of the DlD systems were to fail or be shut off. Has Westinghouse evaluated these l types of integral and time-dependent effects?

l

! Overview Comments 1

1. Section 2.2.10 discusses interactions between the nonnal residual heat removal system (RNS) l and two passive systems the core makeup tank (CMT) and the in-containment refueling water i storage tank (IRWST). 'Ihe possibility of RNS flow delaying CMT drainage is discussed and i stated to be beneficial because it could prevent unnecessary actuadon of the stage-4 ADS valves.

However, there appears to be some " scenario-specific" interactions which are not obviously beneficial, if, for instance, during a small break LOCA, the RCS pressure were to holdup in the

! range of the RNS pump shutoff head (after actuation of ADS 1,2, and 3), the possibility of the l RNS holding the CMT check valvex closed (or at least inhibiting draining) while minimal i

injection flow is occurnng could result in greater than expected RCS inventory depletion before ADS-4 actuates. In a direct vessel injection (DVI) DEG line break, one injection path is open to contaltunent, and it would appear that RNS Injection into the intact DVI line would be shut off by the RCS pressure on that side, but on die broken side, the RNS pumps would provide flow, i

which would be dumped into the sump through the break. This has the dual effect of shutting off the CMT discharge check valves and depicting IRWST inventory. The intact-side CMT would have to drain to actuate the fourth stage ADS, which would requite significant inventory loss through the break. Furthennore, to postulate a possible

• worst case" sequence, suppose the pumps were secured or failed just as the RCS reached a pressure at which the pumm would normally start to mject, in this scenario, a substantial amount ofIRWST water has Wen dumped into the sump reducing the injection head, and the system must still depressurize from around 200 psi down to less that 10 psi (rclative to the containment) to allow IRWST injection. The transition to sump injection (lower head) would be relatively early, with greater decay heat than assumed on the SSAR analysis. In addidon, not only would the RNS rapidly deplete the IRWST inventory during a DVI DEG break, but it also appears that it could continue to operate dmwing suction flow from the recirculation sump as the net positive suction head shined from the IRWST to the recirculation sump. Could this conceivably result in a flow by-pass of the core via the following path. Specifically, RNS suction would take suction on the containment recin:ulation sump and pump it to the two DVI lines; the broken DVI line would spill water hack to the sump; the intact DVI line would retum some water to the reactor vessci downcomer but a percentage of this mjection flow would be short-circuited out the vessel side of the broken 7

DVI line. No passive sump recirculation wuuld bc expected because of the RNS discharge pressure would be holding the sump recirculation check valves closed.

3 Westinghouse should determine if the above scenarios need to be considered and/or analyzed.

The analyses should ascertain: (a) if enough inventory could he lost to uncover the core; (b) the possibility of flow by-pass of the core if RNS contitiued to operate with a DVI DEG break; (c) the worst case effect of the reduction in IRWST injection head and early transition to sump l injection with higher decay heat levels if RNS flow were stopped by an operator after a large l quantity of water from the IRWST has been pumped by the RNS into the recirculation sump.

I It might benefit the staff if more details were pmvided on the specific initiation of RNS as a low i

l head injection, active, defense-in-depth system for LOCAs. The procedures provided in the i ERGS do no: seem to clanfy these questions.

a. When exactly would operators be instructed to align RNS to inject? When would the operators be expected to start the pumps (i.e., after an "S" signal or uther specific time in the event)? When, would the operators be expected to secure the pumps?

b. What happens if the operators make an error in aligning, stopping, or staning the RNS?

The staff would also like more details on what analysis has been donc related to the above described scenarios. For example, are there potential intemlediate break sizes for which the RNS pumps cannot inject sufficient flow to the RCS, but can block enough CMT flow to create a problem? Were these scenanos considered in the PRA?

l Response: '

This comment postulates several scenarios regarding the interaction of the RNS and the passive injection sources (CMTs and IRWST). This response will address each one individually as follows:

"If,for instance, during a small break LOCA, the RCs pressure were to holdup in the range of the RNS pump shutoff head...the possibility of the RNS holding the CMT check valves closed (or at least inhibiting draining) shile minimal injection flow is occurring could result in greater than expected RCS inventory depletion before ADS-4 actuates."

The phenomenon as discussed above cannot occur. The RNS can only prevent the CMTs from draimng if it provides sufficient injection flow via the shared dittct vessel injection (DVI) line, to increase the pressure in the discharge of the CMT line to prevent gravity draining of the CMT. This can only occur if the flow rate in the DVI line due to the RNS is greater than the flow rate that would occur if only the CMTs were draining. If, as postulated above, the RCS pressure held up near the . shutoff head of the RNS, then the RNS pumps would inject very little (or not at all). In this case, the CMTs would drain as designed, since they are at RCS pressure (duc to the cold Ic.g lialasa.e line). See Line attached F1gure 1.

"In a DVI DEG line break...RNS injection ...has the dual effect of shutting off the CMT check valves and depleting IRWST inventory."

In such a break, the RNS if operating, would spill the IRWST to the containment sump. Tius will be bounded by the SSAR long-tenn cooling analysis scheduled for submittal next year.

l However, the ASI of stopping of the CMT injection at an RNS flow rate less than CMT design flow will cannot occur as discussed above. Furthermore, the RNS would not inject a significant amount in this scenario due to thc interconnected RNS system that would preferentially feed the j spilling DVI line.

l l

C00@) 009dV SCSS t1C ZIt IV.d CI:91 i1H.L 96/61/ZT

AM M# kd3 hug 4 Qgy (L-AJ= 4 a,; Rg-el .

Sec G 1.. ,

be = 0 da%4 Gye t _h, t A 3 Jk v <

P/ ~'

CORE COOLING / NORMAL RHR SYSTEM a

Stasus 1 3 1 1 U W 3) yMy TTTT

-a 3'7J coac w o ,

Test (t or ;)

p.= >IC O

• ~

Y M _s- - + sA y M c.A

=

A k-

• - 2y

,V

~. , "

nt,

-r NE L A A a

= y ,,* * .

D O .

. a;]d i) *"

1 3

3

• W Q &%

s . -

l ""

anco CORE

.h A< ...

=~

msa k, .

~

ACCWi. I l

0 0F 2) @

N -iras

• m= y

5 a.

The ERGS provide the guidance for when the operator is instnicted to align the RNS.

(Upon decreasing CMT level). This can he added to the ASI Report for completeness. If die operators are abic to determine that a broken DVI line had occurred (by noncing that one CMT had drained while the other was relatively full, the IRWST injection with RCS l pressures high, and RNS injection with the RCS pressure above the shutoff head of the pumps). For these cases, the operators could decide to stop the RNS pumps. However, the j

SSAR analyses will conservatively bound RNS operation that could adversely effect the l

safety of the plant (i.c. RNS is not credited in design basis LOCAs. and is considered in the

! LTC amdysis where RNS operation can adversely impact the draining of the IRWST.

b.

No additional adverse interactions other than those discussed above can result from operation of die RNS post accident.

2. The report contains no analyses, just descriptive material. Dere are several mentions of

" sensitivity analyscs," but no references to where the results might he found (except where they've been incorporated into the SSAR). There is no indication of what the sensitivity analyses have (or have not) considered as relevant " sensitivities."

Response

This is a general conunent which cannot be addressed without a more specific example.

3. Injection of saturated water due to energy input to IRWST is mentioned several times, as is the beneficial (" quenching") cffect of injecting subcooled water. There are a number of interactions that can cause the IRWST water to beenme saturated pnor to injection to the RCS.

Westinghouse should confinn that in the Chapter 6/15 analyscs, that saturated conditions are assumed in the IRWST to mh11mize the beneficial effect of subcooled injection or explain why the assumption is not necessary.

Response

The range of initial IRWST temperatures assumed in the design basis safety analyses is:

50*F < T < 120*F. ' Of all the Chapters 6 and 15 analyses, IRWST injection only occurs for a LOCA. For the LOCA analyses, the maximum initial IRWST temperature (120*F) is assumed for conservatism. Dunng the course of a LOCA, the IRWST is heate.1 up by PRHR heat transfer and ADS injecdon. Test data shows that there is significant temperature stratification in the IRWST, such that the portion of the IRWST below the PRHR tubes remains subcooled for an extended length of time. This phenomenon is modeled by the LOCA analysis codes

(,W_ Cobra /I'rac and NOTRUMP) for the IRWST injection in the small and large break LOCA analyses of Chapter 15.6. Saturated water injection occurs during long tenn cooling following a LOCA event and is modeled in the Chapter 15.6 long term cooling analysis as appropriate.

Soccific Comments and Ouestions from Detailed Review

4. De discussion on fan coolers (pp. 2 218) appears to be focused on an extreme situation i

without regard for other potential adverse conditions. For example; recent concerns were raised

! regarding operating PWRs via Westinghouse's Nuclear Safety Advisory Letter on contaltunent i fan coolers.

Are there any high heat load conditions (such as during DB A or Severe Accidents) for the AP600 in which the cooling water system supplying non safety related fan coolers l

l S00 % 009dy SCSS t1C Zit IV.-I t1:91 i1H1 96/61/ZI

, l 6

(Chilled Water) might be subject to water hammer or other potentials for contaltunent bypass?

Could operation of the fan coolers with chilled water isolated by a containment isolation signal result in overpressunzation of the chilled water line or flashing / water hammers if the heated chilled water lines from the fan coolers were suddenly unisolated?

The Chapter 9 SSAR description of the fan coolers state that they have two speed motors. The high speed is used for nonnal conditions and the low speed is used during high containment air density condidons - such as those that might be present during DBA or sevem accidents. How is fan speed contmiled during accident conditions. Since this is a non-safety related funcdon, how is operation of the fans in fast speed prevented in a high steam environment. Does the fan contml circuitry automatically shift to low speed in accident condidons? Are there interlocks to prevent operators from manually shifting to high speed when conditions may be inappropnate in containment. Is there any potential for the fans to catastrophically fall if operated at high speed in a dense steam environment thereby creating a possible adverse system interr.: tion which could

{

damage the chil! water cooling coils (Containment bypass scenario)? The emergency response guidelines (ERGS) for reactor trip or safety injecdon, AE 0, step 22, does not specify at what speed the fans should be operating under safety injection conditions.

l

Response

l Westinghouse is currently reviewing the design and operation of the AP600 fan coolers and chilled water system with regant to the recent concems raised about fan coolers for operating  ;

plants. It is expected that this review will conclude that the AP600 fan coolers are not susceptible to damaging water hammer or other potentials for containment bypass. The AP600 fan cooler / chilled water system is not required to function to remove heat trom the containment -

following any DBA or Severe Accident. In addition, the AP600 fan coolers and associated chilled water piping and isolation valves arc designed for 320*F and 200 psig, and therefore cannot be subjected to overpressure /overtemperature conditions as a result of elevated pressure and temperature conditions expected inside the containment.

When this review is completed, Westinghouse will provide addidonal discussion on this fan cooler concem, as it applies in the AP600 design, including the operadon of the fan cooler fans and emergency response guidelines.

5.

The discussion in item 2.2.1 (p. 2-7) refers to events after actuation of an "S" signal. However, there are safety system actuations that occur without immediate generation of an "S" signal--such as CMT actuation due to low pressurizer level. Does this discussion apply to that possibility as well?

Response

Actuation of the CNffs on low pressurizer level can occur prior to an "S" signal. The discussion presented in 2.2.1 would apply regardless.

6.

At the bottom of p. 2-R, Westinghouse states that operation of two RCPs in the loop opposite the PRHR heat exchanger could result in reverse flow through the PRHR heat exchanger and possible degrade its effectiveness. Is this concem also possible with just one RCP operating in the opposite loop from the PRHR HX? Arc there any control interlocks that prevent this condition? ne necessity of avoiding this situation does not appear to be called out in the 900@l 009dV SCSS t4C Ett IV3 tit 9i SH1 96/61/ZI

7 AP600 ERGS (Sec step 10 of AES-0.1 for instance). Are there any common-cause failures (other than loss of an electrical bus, which has been precluded) that could cause the two PRHR-side RCPs to trip and the other two pumps to stay on?

Response

No, this concem only applies to two pumps in the opposite SO. There are no control interincks that address this.

In the steps that specify the RCPs to he restaried, it states to start pump 1 A and IB with a note that these pumps should be run in ptovide pressurizer spray. The potential ASI with PRHR is mentioned in the revised ERG background document (to be provided by the end of the year) under the Knowledge section for these steps.

No other common-cause failures that would result in this scenario were identified.

The AP600 Technical Specifications (3.5.4 and 3.5.5) address this issue, by requiring at least one pump in loop one to be operating. nis prevents the operators from operating in this way at lower modes.

7. On p. 2 9, the pmssurizer heaters are stated to be assumed to trip on "S" signal actuation. Is tids a safety related function? Similarly, what about the isolation valve actuations in the letdown system? Are all actuations initiated by the PLS non safety related? What is the impact of a loss of instrument ac power that would preclude the PLS from actuating these isolation functions?

Another function not specifically indicated as being safety-related or non-safety related is the SFW isolatinn on low RCS CL temperature (p. 2-15). Please confirm which applies.

Response

As discussed in Section 2.2.13, the pressurizer heater block on a CMT actuation signal is performed by the PLS and is credited in the SSAR accident analysis. his is a safety-related function accomplished with nonsafety-related components (breakers for the pressurizer heaters).

Regarding letdown isolation, there are both safety-related and nonsafety related isolation of the letdown line. As the AP600 letdown line is a containment isolation line, it closes on an S signal (PMS) as well as PLS isolation on pressurizer level. In addition, the letdown line and purification line are isolated on low pressunzer water level by the PMS. The following table provides the complete list of PMS and PLS isolation functions associated with pressurizer level.

A version of this table could be included in the ASI report.

l 100 @ _ ____

009dV SCSS PLC. Zit EY4 GT:01 M8 ' SQ/M/M

8

. Nominal Setpoints Pressurizer Level Setpoint IAC System l  % of volume  % of volume l span (ft') span 3 (ft )

i High-3 Reactor Trip PMS 92.0 1360 92.0 1360 l High 2 CVS Makeup Valves Isolation PMS 67.0 1023 67.0 1023 l Maximum Nominal Level 51.2 811 65.8 1008 Letdown Open (Standby)t" PLS 50 794 65 996 Makeup Pump Stop (Standby)(" PLS 45 727 60 929 l Letdown Open (Borate / Dilute)(') PLS 40 660 55 862 Letdown Closet " PLS 35 593 50 794 High-l CVS Makeup valves Isolation PMS 30.0 525 30.0 525 (Posi "S")

Makeup Pump Start (Standby)(0 PLS 30 525 45 727 Minimum Nominal Level 25.3 463 40.0 657 Low l CVS Purification Isolation PMS 20.5 397 20.5 397 Pressurizer Heater Trip Makeup Pump Stop (Post "S") PLS 20.0 391 20.0 391 Makeup Pump Start (Post "S") PLS 10.0 256 10.0 256 l Low-2 CMT Actuation PMS 7.0 215 7.0 216 DAS t') Approximate Serpoints 8.

On p. 210, is them any way that operation of the CVS purification loop could cause a thennally stratified single phase flow, which could result in cyclical thermally induced fatigue stresus?

l Response:

As discussed in SSAR section 3.9, thermal stratification has been evaluated for the AP600. The CVS purification line that connects to the PRHR line that connects to the srcam generator has l

been evaluated and found to be insusceptible to thermal stratification. This analysis is currently

) uixier review by the NRC.

9 On p. 213, interactions due to hydrogen evolution are not considered important due to the concentration and solubility of the gas at RCS operating pressure. What happens when the t

system is cooled and depressurized, especially when proceeding to either hot or cold shutdown?

(

9 Is there any way for turncient hyttrogen to get in'o the PRHR HX to degrade the natural circulation driving force?

l Response:

The operating concentration of hydrogen in the RCS is in the range of 25 to 50 cc/Kg. This conesponds to the saturadon level of hydrogen in the RCS at pressures between -25 to 50 psia.

This means that hydrogen out gassing would not occur at RCS pressure above -50 psia. Prior to ,

l transition to hot or cold shutdown, the RCS hydrogen concentradon is reduced to less than '

5 cc/Kg. Therefore, RCS out gassing could not occur until the RCS is near atmospheric conditions. ' Per the Technical Speci6 cations, PRHR operation is not required once the RCS is depressurized. The final stage of RCS depressurization during shutdown occurs after the RCPs are tripped off. Until then, the RCS pecssure is maintained at or above 300 psia. Therefore, at l the relatively low hydrogen concentrations in the RCS (5 - 50 cc/Kg), out gassing that could jeopardize PRHR opendion at shutdown is not a concem.

{ 10. Have any events been identified in which the operation of the startup feedwater system could l delay the itutiation of the PRHR system in such a way as to be detrimental to safety (e.g., if the I SFW system ran for a while and then failed)?

)

Response: l No. As discussed in the report, if the SFW pumps delayed PRHR operation, and then subsequently stopped, PRHR would be actuated on low SG level and low SFW flow. This  !

would occur later in time, with lower decay heat. *ntis case is bounded by the case where no SFW flow actuates, and PRHR is actuated cartier with higher decay heat levels.  !

i

11. For the Plant Control System (Section 2.2.13), what impact does the loss of offsite power followed by starting and sequential loading of these systems on the non-safety diesels have on j system interactions?

)

l Response:  !

None. As discussed in this report, nonsafety-related systems are assumed to operate following an accident if their operadon can be shown to be detnmental to plant safety. Therefore, for a loss of offsite power coincident with an accident, if operation of a nonsafety system was shown to be detrimental, then it is assumed in the SSAR Chapter 15 analysis.

12. Isolation of the RCDT to prevent overpressurization (p. 2 26) is indicated to be non-safety-related. What are the implications of failure to accomplish this isolation? Is a tank rupture credible 7 If so, what potential systems interactions might occur?

Response

If RCDT isolation was not accomplished, then the tank could be ruprured, and a small amount of ,

ADS flow could he divened from the IRWST to the sump. Due to the sm:dl I" line that connects the ADS header to the RCDT, the amount of bypass would be insignificant. In addition, any steam flow that bypassed the sparger would condense and collect in the containmetu. Since the RCDT is located at the bottom of containment, and will flood anyway due to the LOCA, the effect is negligible.

<mn aMvm R

10

13. Component cooling water (CCS) is discussed in Section 2.2.17. This system has direct interfaces '

with the RCS. Westinghouse should consider a discussion of the system's capability of l withstanding pressurization to RCS pressure as a result of a leak from the RCS into the CCS and how the potential for an intersystem LOCA is mitigated.

Response

Yes. A discussion of this issue will be added to Section 2.2.17. ,

14.  !

Is there any potential for interactions between the spent fuel pool cooling system (Section 2.2.19) and the RNS that could impact IRWST inventory?

Response

l As discussed in the repon, there are several interactions between the RNS and IRWST, and the SFS and IRWST, but there are no interactions between the SFS and the RNS that could affect IRWST water Icycl.

15. CMT/ accumulator interactions are discussed in Section 2.3.1.1. Nitrogen from the accumulators is claimed to have nn impact on CMT operation. This may not be completely accurate if there is some means by which the CMTs could refill late in an event (as observed in the OSU tests -

although this has been regarded as resulting from a scaling distortion in the facility). Also, some ERG instructions permit the operator to isolate the accumulator. Is there any way that the operator could interfere with accumulator injection by incorrectly shutting the isolation MOV while the accumulator still has substantial water in it? Westinghouse should consider addressmg CMT refill la Section 2.3.1.9 on CMT/RCS Interactions as well.

Response

Section 2.3.1.1 does not state that accumulator nitrogen has no impact on CMT operation. The statement is, "The potentially adverse interaction between the accumulator nitrogen and the CMT is insignificant". This is because nitrogen is not discharged until the accumulators are almost fully depressurized, at a pressure of less than ~ 100 psig. Any potential nitrogen discharge will not be important to CMT operation because the CMT will have already discharged most of its injection volume before the accumulators empty. Therefore, any potentially adverse interaction on CMT operation is too late to be significant to CMT operation.

There are no significant adverse interactions expected if the CMTs refill late in an event since the IRWST provides injection flow at that time, once the RCS is depressurized. Therefore.

nitmgen impact on CMT operation is not expected to cause any significant adverse interactions for the plant.

The accumulator discharge isolation valves are kept in a similar condition to those for current plants, with the discharge motor-operated valve open and the breaker racked out once specified plant conditions are established during plant startup (normally above 1000 psig in the reactor coolant system and continuing the startup process). This increases the reliability of accumulator injection following an event by preventing the valves from inadvertently closing.

In addition, the actuation circuity for the accumulator discharge isolation valves has a confirmatory open signal in the event that the circuit breakers for the valves are installed for any 010 @ 009dV SCSS t1C Zit IV.:I 11:91 GH1 96/61/ZT

- .- _ _- .-. = _ _- - .- _ .-__. --

,k 11 reason during plant operation. The confirmatory open signal prevents the operator fmm closing j

the discharge isolation valves until the actuation signal is removed. The actuation signal is a safety injection signal and the safety injection signal can only be cleared following an event once  :

j the Si tennination enteria in EROS /EOPs, which require stable plant conditions following the l event, are satisfied.

{

Therefore, the actuation circuitry design precludes the operator from incorrectly interfering with accumulator injection by shutting the discharge isolation valve when the accumulator has substantial water in it, fullowing an event where safety injection is itquired.

Finally, the Emergency Response Guidelines provide extremely limited cases where the operator is permitted to isolate the accumulators to prevent interfering with accumulator injection. The Emergency Response Guidelines have been revised so that the only time operators are directed to l close the accumulator discharge isolation valves is during a small LOCA when makeup from the nonsafety related chemical and volume control systern is available and the operators are using the post LOCA cooldown and depressurization procedure.

) 16. The discussion of CMT/lRWST interactions in Section 2.3.1.2 appears to be focused on l

j SBLOCAs, in claiming that minimal interactions occur between these two ECC systems. What  !

i about LBLOCAs, where the ADS is not required to depressunze the plant, and IRWST injection ,

i may begin (based on differential pressure) while the Chfrs have considerable inventory

• l l

l Response: ,

! Section 2.3.1.2 states that For most LOCA events, there is not a significant amount of injection I J

overlap between these two injection sources. Flow rates from these sources are relatively low, and interactions between these two sources are not considered significant.

4 This statement was made in the report recognizing that some breaks, such as larger LOCAs, can

result in a period of time with injection overlap between these two sources, due to the plant

response to the event (such as the specific case described above). However, there are no 1

significant adverse interactions that oteur for those LOCA events where there may be parallel

, injection operation of the CMTs and the IRWST.

in addition, the amount of inventory in the ChfTs at the time of parallel injection can vary with the specific LOCA event. By design, the CMTs will not have a " considerable inventory *' when 1RWST injection begins. even for larger LOCAs. This is because of specific actuation interlocks

for the IRWST injection squib discharge isolation valves.

For a large break LOCA, the plant depressurizes quickly with the accumulators providing a large

, initial injection flow to provide vessel refill and core reflooding. The CMTs then provide 1

subsequent injection flow until sometime later in the event, when they reach the Low-2 CMT level and an automatic actuation signal is generated to open the fourth stage ADS valve.d and the IRWST inJccts as the next injection source.

The IRWST cannot provide injection until the CMTs are nearly empty because the IRWST discharge isolation valves are actuated on the same signal that actuates the 4th stage ADS signal

-- a Low 2 CMT level, j

I ITO 009dV SCSS tic git IV311:91 ilH1 96/6T/ZT

12 The difference in IRWST injection timing for a larger LOCA event is diat as soon as the 4th Stage ADS and IRWST actuation signal is generated, the IRWST may begin to inject for this event,in parallel with the final stage of ADS depressurization provided by the 4th Stage valves.

By this time in the event, the first three ADS stages will have already sequenced, but the plant depressurization has already occurred due to leakage and venting out the break. Therefore, IRWST injection initiates somewhat earlier than for smaller LOCAs which would not have fully depressurized the RCS by the time the ADS fourth stage actuation signal is generated.

'Iherefore, for smaller LOCAs, some additional ADS depressurization would have to occur before the IRWST would begin to inject. This would fuither reduce the CMT level when parallel CMT and IRWST injection occurs.

For this larger LOCA event, the relatively small remaining volumes of the CMTs below the Lnw.2 CMT level setpoint will inject through an 8-inch injection line by gravity flow into die direct vessel injection lines. This is in parallel with IRWST injection into the same lines, through parallel 6-inch injection lines. At this time, the IRWST level (pressure compensated by containment pressure) is expected to be at a higher physical elevation than the CMT levels (pressure compensated by RCS pressure). Combined injection flow from both sources in parallel ,

is expected and desired. These two parallcl injection flow paths are complementary, working )

.together to ensure injection flow is maintained in parallel with steam venting from the ADS and l out the break. The specific injection flow contribution fmm cach injection source is not as I important as maintaining the total required injection flow and core cooling, and preventing core l uncovery.

]

i For LOCA events, including larger LOCAs, the parallel injection of the CMT and IRWST j increases the reliability of injection and does not present an adverse interaction. This parallel l injection flow was designed into the AP600 through the use of the direct injection lines for all  ;

tlute safety-related injection sources.  !

17. The discussion on CIWT/PRHR interactions docs not take into account the possibic role of the PRHR in system wide interactions, such as those observed in OSU testing.

Response

The system-wide CMT / PRHR interactions were considered in development of Section 2.3.t.4 CMT recirculation operation cools the RCS and, therefore, impacts PRHR HX effectiveness since the PRHR heat removal capability will decrease with lowering RCS temperatures as the temperature difference between the RCS and IRWST decreases. When the CM'r recirculation and associated RCS cooling slows, the RCS can heat up somewhat because PRHR HX may not be able to match decay heat at lower RCS temperatures. The RCS then subsequently heats up slightly to a temperature where the PRHR can match the core decay heat rate. l

18. Accumulator /IRWST interactions are discussed in Section 2.3.2.1. The implication that diese two systems have litde potential for interaction does not take into account cascading" effects, ,

i.e., depending on break size and location, accumulator injection could interfere with CMT injec.

tion, delaying ADS 4 actuation and opening of the IRWST isolation valves. This " indirect" effect is also not discussed in Section 2.3.2.7, on accumulator /RCS interactions.

310 S 009dY iiCsg t4c Z t t IY3 91 : 91 ilH.I. 96/61/21

13

Response

A difference in break size and location can result in changes in the specific response of the passive core cooling system components and the timing and duration of their various injection flows. Therefore, there can be some indirect effects on IRWST operation due to variations in accumulator injection.

As stated in Section 2.3.2.1, "...there are no intervals of significant injection overlap between these two componcnts so that sharing a common injection line does not result in any significant interactions."

This statement is intended to imply that for the range of events observed and analyzed in the system design, which includes a range of break sizes and locations, that overall there were no significant adverse interactions that prevented these two passive components from successfully providing core cooling and keeping the core covered during these events.

19. Accumulators are stated not to have significant interactions with the steam generators (Section 2.3.2.5). Are there any scenarios in which flow oscillations could occur, due to maintenance of natural circulation flow through the steam generator, at pressures low enough to have accumu-lator injection? If so, what is the potential for interaction between the two systems?

Response

The accumulators do not significantly or directly impact the SGS from the two perspectives considered in the report (integrity of the SGS boundary and SGS heat removal). No significant adverse interactions have been identified.

From the perspective of SGS integrity, the accumulator wiu not have any adverse systems interactions.

For some events where PRHR cooling can result in a reduction in the RCS pressure below the accumulator static gas pressure, a small amount of accumulator injection can occur. However, this injection is provided through the direct vessel injection lines and into the reactor vessel cold leg downcomer plenum, where it is mixed with the flow from the four RCS cold legs. The impact of the this relatively small accumulator injection flow depends on the flow condidons in the core at the time of discharge, but it only provides indirect effects on the SOS conditions and does not have any significant adverse interactions with the SGS. Therefore, no significant adverse interactions are identified in Section 2.3.2.5. At no time does nitrogen inject dunng such events.

This small amount of relatively cool water added to the reactor coolant system from the accumulator can have some oscillatory effect on RCS natural circulation flow conditions, similar to transient effects resulting from other system changes such as varying the SGS feedwater addition rate or steam discharge rate. When these kinds of changes occur under natural circulation flow conditions, the natural circulation flow will vary in proportion to the magnitude of the change and then re-establish a new equilibrium natural circulation flow and heat removal conditions via cither the SOS or the PRHR.

In order to inject a large volume from the accumulators, the RCS pressure would have to decrease sufficiently low that the resulting RCS voiding would unenuple the steam generators C T0 f8 009dV SC99 t4C Zit IV.4 6T:ST GH1 96/6T/Zi

14 from heat removal and core cooling. This amount of voiding in the RCS is not expected without a primary system break, which would prevent any significant adverse interactions between the accumulators and ste:un generators.

Also see the response to question 36.

20. Section 2.3.3.1, on IRWST/ containment interactions, does not address the late phase oscillations observed in OSU testing, and the possible impact of those oscillations on sump injection. In addition, the OSU tests indicated the possibility of tiow from the sump back into the IRWST. It would seem apptopnate for Westinghouse to address these interactions, and show that adverse effects are not expected.

Response

'Ihese effects are discussed in the OSU Test Analysis Report. It was concluded that long tenu cooling is not adversely affected by these oscillations or by the possibility of flow from the sump bacP into the IRWST. Therefore, there are no additional adverse interactions between diese components related to these two concerns.

See the response to question 36.

21. Section 2.3.3.2. on IRWST/PRHR interactions, appears to be inconsistent with the interaction that is discussed in the immediately previous section of the report,i.e., spurious opening of the recirculation isolation valves. In this case, such an event would deprive the PRHR of its cooling water, creating a potential adverse interaction. In addition, at the end of the section, Westinghouse statet that the difference in IRWST temperature has "no significant effect" on gravity injection. However, experimental data indicate that a hot IRWST drains more rapidly.

Response

The impact of containment recirculation on the PRHR is discussed in Section 2.3.4.1 (Containment Recirculation - Passive Residual Heat Removal Heat Exchanger) and is not addressed in Section 2.3.3.2.

Section 2.3.4.1 should include the following paragraph to address the potential interactions of spurious containment recirculation actuation on the PRHR heat exchanger. This additional paragraph essentially repeats the information provided in the last paragraph in Section 2.3.3.1 that discusses the spurious opening of the containment recirculadon valves m relation to IRWST and containment recirculation interactions.

"An adverse interaction can occur due to spurious opening of the containment recirculadon isolation valves. This occurs if the line with the motor operated valve and explosive valve is j opened and the IRWST stans to gravity drain to containment, causing floodup of containment.  ;

This event does not result in any plant transient, but it does have some adverse effects if the l

IRWST is allowed to drain significantly. The spurious opening of these valves is prevented by I the instrumentation and control design. The response to spudous opening of the containment recirculation isolation valves is to confinn that the actuation is spurious and then to take operator actions to close the motor operated valve. This is not a significant interaction since it does not cause a plant transient and there is sufficient time, alarms. and indications to allow the operators to diagnose the problem and take the corrective actions required. In addition,if the 1

1 t10 @ 009dV Sc69 tic Zit I%I 6 T : 91 i1H.l. 96/6T/ZI l

_ _ . - _ . _ ~ _ _ . _ _ . _ . _ _ _ - _ _ _ . _ - _ _ _ _ . - _ _ _ - _ . _ _ _ .

i 1

• 1 15 motor-operated isolation valve spuriously opened to initiate draming, it is expected that it would again function properly to close and terminate the IRWST flow."

Section 2.3.3.2 discusses interactions between the IRWST and the PRHR heat exchanger and, therefore, the last part of this question related to the PRHR impact on IRWST temperature is included in this section.

It is recognized that the PRHR heating of the IRWST water increases the water temperature, which does affect the gravity injection flow rate. However, the expected range of water temperature variations is not expected to provide any significant adverse systems interactions on the gravity injection capability.

The last sentence in the question is not clear in stating that the " experimental data indicate that a hot IRWST drains more rapidly" than when the IRWST water is cold. Given all other identical conditions, this is not expected to be the case.

For a system with the s me injection line piping flow resistance, system pressure, and IRWST overpressure, the gravity injecdon elevation head for cold water is larger than for warm water and, therefore, the gravity injection flow is greater. If the experimental data indicates that the hot IRW3T diains muse sapidly, dien diffbnmi plain condirlem must 6kitt such that some other parameter (s) than only the injection water temperature must have been different.

22. Section 2.3.3.4 (IRWST/PCCS) does not discuss the effect that contaltunent pressure has on IRWST actuation, Since IRWST injection is a function of the difference between RCS and containment pressure, elevated containment pressure will affect the timing ofinception of flow from the IRWST to the RCS. A similar comment applies to Section 2.3.4.3 (containment recirc/PCCS), since containment backpressure will have an impact on timing of IRWST injection I and, subsequently, sump injection, l Response: I

.The containment pressure does affect the timing for the actuation of both IRWST gravity injection and containment gravity recittulation since it affects both the gravity injection overpressurcs and RCS venting backpressures. However, these interactions were implicitly considered in the repon since the system design must accommodate the range of containment pressures that will exist following the Chapter 15 design basis accidents.

As stated in the report, these design interactions have been confirmed as pan of f]w testing and plant analyses. Therefore, no significant adverse interactions have been identified for the IRWST or containment recirculation resulting from the containment pressures maintained by the passive containment cooling following the design basis events.

23. Section 2.3.5.1, PRHR/ ADS, primarily focuses on the impact of IRWST heating on ADS behavior. Consideration should be given to discussing an indisect interaction, via the RCS, in which PRHR cooling reduces RCS temperature, affecting pressurizer inventory and thereby impacting operation of ADS 1/2/3. Another indirect interaction involves ADS-4; again, PRHR operation affects fluid conditions at ADS-4 actuation, which may be more or less important, depending on the scenario.

S10 g 009dV SCgs t1C Zit YY3 02:9T SH1 98/6T/ZT

- -- . .- -.-~. ... . .. - -- - _-. - _-.~ ~ -- . . - _ _

16

! Response:

f "Ihe end of the first paragraph in Section 2.3.5.1 specifically addresses tlus interaction by stating i that "PRHR HX cooling prior to ADS operation can also impact the initial RCS pressure when 2

ADS actuates. These design interactions have been confirmed as pan of the testing and plant i

! analyses." Therefore, no significant adverse interactions have been identified for the ADS (both 1

l Stages 1/2/3 in the pressurizer and Stage 4 in the hot legs) resu; ting from the RCS pressurcs established by the PRHR following the design basis events and prior to ADS actuation.  !

l 24. In Section 2.3.5.2, Westinghouse states there are no direct interactions between the PRHR and l

the PCCS In the case of long tenn cooling using PRHR, is there a possibility that PCCS ' '

operation is needed to keep sufficient water in the IRWST (via condensation retum) to allow the

! PRHR HX to continue to operate? That is,if the PCCS was not pmviding containment cooling,

! could enough water inventory, due to boll off of the IRWST, be entrained or held up in the

] containment to impact continued operation of the PRHR?

Mesponse

i Theit are no direct interactions between these the PRHR and the PCS ay discussed in Section

,j 2.3.5.2.

However, Section 2.3.3.4 discusses the interactions between the IRWST and the PCS once the PRHR actuates and increases the IRWST temperature sufficiently high to initiate steaming to containment. As discussed in this section, the PCS Interacts with the IRWST tn affect both the IRWST temperature by establishing the long term saturation temperature and level being affected by the condensation rate and operation of the PXS condensate retum valves. Long tenn cooling using PRHR would be expected following non-LOCA events.

Without condensare rerum, the IRWST inventory is sufficient to allowed continued PRHR operation for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. However, IRWST level will continue to decrease during this time period, causing more of the PRHR HX tube surface area to become uncovered over time. But at the same time, the core decay heat is decreasing and PRHR operation is adequate to provide core cooling during this time period.

PG actuation is required to function as a heat oink during thia timo ponod to pacycnt an increase in containment pressure, but providing PCS condensate retum to maintain the IRWST level durmg this time period is not required. This more detailed information is discussed in the AP600 SS AR.

25. Section 2.3.5.3 addresses the PRHR and SGS interactions. However, there is no discussion on the eativ phase, system wide oscillations observed in the SPES 2 integral systems tests (during the period in which flow through a SG was inaintained). These oscillations (or oscillations of a similar character) were also observed in the SGTR test in the SPES-2 facility. Westinghouse should consider addressing the impact of these oscillations. A similar comment is relevant to 1

Section 2.3.6.2 (ADS /SGS).

Response

See the response to question 36.

q l

910 3 009dV SCSC PLC Zit IV.:1 TZ:9T GH.I. 96/6T/ZT

17

26. Section 2.3.5.5 (PRHR/RCS) does not consider the effect of the PRHR on RCS inventory and i

thennal hydraulics. Funher, the issue of stratification in the primary system and its possible l Impacts are not addressed. l l

Response

Section 2.3.5.5 does specifically address the PRHR cffect on RCS inventory and highlights some thennal hydraulic effects; however, the specific aspects of interest in the first sentence above.

beyond thermal stratification, need to be clarified.  ;

I Paragraph 2 discusses both forced flow heat removal from reactor coolant pumps and natural circulation flow heat removal, single phase and two phase heat transfer, and the IRWST heatup.

Paragraph 2 continues with the statement that "As the RCS cools down and contracts, RCS voiding may occur, which can eventually change the PRHR HX transfer process to steam condensation heat transfer..." ,

The issue of thermal stratification is not specifically discussed, however, the final statement in I this section is intended to bound the identified design interactions. The last sentence states that "These design interactions have been confirmed as part of the testing and plant analyscs."

The discussions in Sections 2.3.3.4 and 2.3.4.3 will be revised to specifically address this i I

conunent by including infonnation related to thenna! stratification interactions.

27. The last paragraph of Section 2.3.6.1 (ADS /PCCS) states that PCCS performance affects the ADS via containment backpressure. It is not clear that this is true all of the time. If the ADS is in critical flow,it would appear that containment pressure should have little effect on ADS tiow.

In the les ADS 1 phase, containment pressure will affect the transition to suberitical flow, depressurization rate, and ultimately--IRWST injection. These same comments are relevant, as well, to Section 2.3.7.3 (PCCS/RCS), since the ADS flow impacts both RCS inventory and timing of IRWST and sump injection for maintenance of long-term core cooling.

Response

The PCS does affect containment pressure by cooling the containment, which condenses the steam in the atmosphere and helping to reduce the pressures that occur following an event. The focus of this comnients in Section 2.3.6.1 related to containment effects on ADS performance are primarily associated with the very late stages of the depressurization process.

It is clearly recognis.ed that at RCS pressures that are much higher than the expected range of contailunent pressures (carly in an event), that critical flow exists from the ADS stages and containment pressure variations have no significant impact on ADS performance until the transition to subcritical flow is approached as the RCS continues to depressurize.

1.ater in the ADS depressurization sequence when RCS pressure is much lower and decreasing.

approaching about twice the existing containment pressures, the operation of the ADS moves out of a critical flow regime. At this late time in the depressurization, and later, the existing containment pressure, which is significantly affected by PCS operation, has more significant effects on both RCS injection and ADS vent flow.

____.______m..____ _

l la The discussion in Section 2.3.6.1 also briefly discusses the expected transitory response of the RCS to injection and venting process changes, as well as with core decay heat changes.

The discussions for Sections 2.3.6.1 and 2.3.7.3 will be revised to clarify this issue,

28. Section 2.3.7 addresses PCCS/ containment interactions, and discusses only spurious operation of the PCCS. it docs not address at all the failure of the PCCS, e.g., effects on containment if no water cooling were available to augment external containment heat transfer.

i

Response

j The purpose of this report is to evaluate potential adverse systems interactions related to the l design basis licensing analyses identified in Chapter 15 of the AP600 SSAR and the associated l PRA analyses for these events. De scope of this report is to address the design basis operation of the identified systems, including credible single failures that are postulated to occur in the operation and associated safety analyses for these safety related systems.

His report is not intended to address potential adverse systems interactions for cither beyond-design-basis accidents or for severe accident conditions, including beyond-design basis failures of systems and components that would be required for either of these circumstances to occur.

The failure of passive containment cooling to actuate can only occur with beyond design-basis component failurcs due to multiple failures of redundant safety-related valves. The containment interactions that occur for the beyond design basis failure of the passive core cooling system to actuate are outside the scope of this report.

Human Factors

29. In addinon to human factor related concems raised in question 1,4,6, arx! 15 above, several other human reliability issues could be elaborated on in this report.

a. The operator has the capability, in a station blackout, to override the automatic ADS actuation just prior to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. De rationale for including this actuation, as understood by the staff,is to ensure that sufficient battery power is available to open the ADS valves.

Suppose that an operator overrides the actuation at 24 hr (minus), but then finds at some time thereafter (say,36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />) that it is necessary to actuate the ADS. What are the effects of such a scenario? Is sufficient power available? When does power ceasc to be available?

What attematives would the operator have if power were not available? Are there other situations in which delaying an action (either actuating a system or overriding its actuation) could have a significant impact on plant response?

b. At the end of Section 2.3.6.2, Westinghouse states that the AP600 ERGS provide guidance on manual actuation of ADS ! to tenninate an SGTR event. How if this addressed in terms of human reliability? What if the operator makes an error and causcs actuation of the entire ADS system?

Response

a. During a prolonged station blackout event, it is intended that the manual override of the timer driven ADS actuation would he implemented no later than 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> into the event.

giog 009dV SCSS tac Zit IV3 22:91 filil. 96/61/ZT

_ _ _ _ _ _ -_ _ ~ . _ _ _ _ _ _ _ _ __ .__ _ _ __

l 19 1

Loads supplied by the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> battery are de energized at the time of the override decision. 1 T1is would allow battery conservation. Dius, it is expected that these batteries would have l at least a two-hour charge for a later ADS m actuation, if needed.

i If the event continues beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the 72-hour batteries allow the operators to monitor the plant parameters to decide if ADS actuation is needed. Operator action of ADS l re actuation would also include opening of the squib valves for IRWST injection and containment recirculation functinns. Also, there is ample time before the 22nd hour is reached to evaluate the plant conditions and decide whether the manual ADS override is needed or not.

Written procedures would be pmvided for the above described operator actions of oveniding s and re establishing of ADS actuation following a prolonged station blackout event.

Since the batteries are conserved, as described above, sutlicient power is available for re actuation of ADS during the 22-72 hour time frame. The actuation power is available in the 24-hours batteries after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Offsite resources may be invoked to retain the plant monitoring function.

In the spectrum of events studied for AP600, the above-discussed action is the only known case where oveniding a safety related system is envisioned, and it applies to a rare event (e.g. station blackout) which is made even more improbable by considering it be prolonged over 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.

b. If the operator makes an error and actuates the entire ADS system in the above mentioned case, the ADS operation will successfully reduce the RCS pressure. thereby tenninating the primary to secondary leak. This success path is already modeled in the AP600 PRA, in the SGTR event trees, as one of the multiple success paths in a SGTR event.

The operator action of manual ADS 1 actuation Gabeled as ADF-MAN 01 in the PRA) is credited in the PRA only if CVS, SFW, and condenser are available and operator action of pressurizer spray actuation falls. ADF MAN 01 is assigned a failure probabliity of 0.5.

However, the commission error described in the question is not quantified. No adverse conditions that would lead to compoundi g such a commission error have been identified; in the absence of such conditions, the probability of such a commission error is expected to be low (e.g. at the order of 0.0001).

30. Ermis of commission are discussed on pp. 3-15 and 316, and are specifically connected to actions in the EROS. Please address the following questions and comments:

a. What is the impact if the operator falls to start the CVS pump, since starting a pump is "a pan of the expected response to the event'?

b. With regard to SPW pump interactions in an SGTR, are there any consequences if the operator fails to follow the procedure discussed?

c. Conceming spent fuel pool cooling system interacnons (bottom of p. 3-16), Westinghouse states that the effects of SFP accidents " develop slowly" and are thus of insignificant risk.

How fast could such events be diagnosed? What is the impact of these events on shutdown risk?

I l

. 0R(i)O M

20

Response

i

a. In the SGTR event, the aligned CVS pump is expected to start automatically (due to low l

pressurizer water level); credit is given for the manual actuation of the standby pump, if the auto start fails. In that case, if the operator action fails, then the CVS would not be operational. This condition is explicitly modeled in the PRA (by CVN-MANO3 operator action) and is incorporated into the risk profile of the plant,

b. As modeled in PRA,in the SGTR event tree, the SFW system is expected to actuate l automatically due to low SO water level in the faulted SG; the operator action by procedures is credited if the automatic actuation does not take place. If the operator action also falls, then the next success path would be entered; namely the successful isolation of the faulted SO; CMT injection; and passive RHR operation. This success path does not take credit for decay heat removal by the secondary side,

c. SFP level and temperature are monitored in the main control room and are also alarmed. So the SFP accidents due to loss of cooling or water level can be diagnosed immediately.

The impact of these events on shutdown risk is insignificant. If the SFP cooling is lost, it takes several days before the boll-off reduces the SFP level to the point where it necds to be ,

replenished; this allows ample opportunity for response to the event. Even the fastest  !

conceivable water level loss event (inadvertent draining of SFP water to the IRWST dunng  !

refueling when the gate is open) takes 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to reduce the water level to the point whcic it I needs to be replenished. This event is easily diagnosable in the main contrul room and can  !

be tenninated by closing the diversion valves to the IRWST or installing the gate. Thus, the i SFP t. vents are not further analyzed in shutdown PRA. l Miscellaneous General Comments 1

31. Westinghouse should discuss what consideration was given to " indirect" interactions due to instrumentation and controls systems and/or transitory effects (although some credit is taken for the ability of !&C design to " minimize spurious signals" that might cause adverse interactions). l For instance, closure of turbine stop valves could create a level transient (or an indication of a level transient) that could actuate the PRHR system. INEL predicts this could happen. It is not clear what the ultimate effect would be for: LOCAs (initiates PRHR operation before "S" signal would nunu.dly opesate), uuu LOCA unuslents und AOOs (cuuld start PRHR. operatioll cartier than might otherwise he the case, resulting in additional inventory shnnkage -- the ultimate effect is likely to bc scenario dependent); or spurious actuation (spurious actuation of PRHR system)

Il nothing else, the adverse interaction could simply be more actuations over plant lifetime than the PRHR system is designed for.

Response

As stated in this comment, the issue is not a safety concem, but rather one of plant operation following a transient. Westinghouse has selected the PRHR uctuation setpoints to avoid actuation on a turbine trip. Actuation of PRHR for such an event is bounded by the accident analysis provided in SSAR Chapter 15.2.3 for Turbine Trip.

32. The emphasis in the report is on passive passive and passive-active interactions that can direedy affect the passive safety systems. Are there any " active-active" interactions of h,terest, i.e., an interaction between two active systems that could act to impede (or cause spurious actuation of) 0E0@ 009dV S C S S t L e E i t l'Y3 CE : 91 AH.t. 96/6T/EI

1 21 a passive system? This could include secondary or tertiary effects, such a feedback from the turbine / generator system through the steam generator to the primary loop. For exataple; Table 21 does not show any systems beyond the secondary side of the RCS. How about effects deriving from: turbinc/ generator (e.g., closing of stop valves causing level transient in SG that actuates PRNR): other indirect interactions- such as trasients caused by malfunctions of the EHC system; interactions caused by spurious actuation of the reactor protection system or failure l of turbine over-speed protection.

l Response:

l l Spurious actuation of passive systems are evaluated in the SSAR Chapter 15 analysis. Therefore, i j any combination of active sysicms that could cause a spurious actuation of a safety system is bounded by the analysis presented in Chapter 15 of the SSAR. This report identilles interactions that could occur that could degrade the perfonnance of the safety systems once they have been  ;

actuated. Any such interactions identified should then be accounted for in the SSAR Chapter 15 l accident analysis. ,

33. There are interactions noted that involve the spent fuel cooling system. One rationale given for a low level of concem is that " spent fuel pool accidents are not deemed to be of risk significance.

It is not clear that this is consistent with our expressed concern with shutdown risks, or with the recent technical issue on the SFP cooling system, which are still under discussion with Westinghouse.

34.

Many actions desenbed in the report involving valve position changes are noted as " safety-related." Examples include: CVS isolation valves (p.211); main feedwater isolation functions (discussed on p. 214; these are not explicitly stated to be safety related, but are assumed by the reviewer to be so); SG blowdown line isolation functions (discussed on p. 2-17); contailunent sump pump isolation (p. 2-26); primary sampling system (not stated to be safety related but assumed by the reviewer to he p. 2 27 28); spent fuel pool cooling system isolation (also assumed to b: safety related by the reviewer, p. 2-29). Arc they all single failure prooft

Response

Yes, these isolation functions stated are safety-related and are designed to be tolerant of single failurcs.

35. Minor comment: Even if the condensate retum lines (non safety-related) function properly (see

p. 2 37, third paragraph in Section 2.3.1.5), some condensate may end up in the sump rather than the IRWST.

Response

Yes.

l 36-Section 2.3.3.3, on IRWST/ ADS interactions, does not consider any of the oscillatory behavior l noted in the AP600 integral systems tests, including both oscillations at the stan of IRWST I injection, and the late phase oscillations. In both of these cases, the ADS-4 configuration appears to play an important role in the development and characteristics of the oscillations.

Westinghouse should consider including a discussion of this behavior and evaluate the possibility l

l 130 @) 009dV Stsg tit Zit IV,:1 t Z ' 91 011.1, 96/6T/21

22 of adverse effects. Since these oscillations also affect the RCS. the same comments apply to Section 2.3.3.7. These oscillations are also relevant to the Sections 2.3.4.2 (containment

! recirc/ ADS), 2.3.4.6 (containment recirc/RCS), and 2.3.6.4 (ADS /RCS). l

[

Response

'lhe oscillatory behavior noted in the AP600 integral systerns tests was considered in the evaluation of the adverse systems interactions, but were not explicitly discussed in the report.

l Additional comments will be added to the following sections of this report to indicate that the l oscillatory behavior noted during the AP600 testing does not cause any significant adverse systems interactions for these components since satisfactory core cooling can be maintained and core uncovery is prevented. In addition, the observed oscillations during the testing were damped.

2.3.2.5 Accumulator SG 2.3.3.1 IRWST - Containment 2.3.4.2 Containment Recire ADS 2.3.4.6 Contairunent Recirc RCS 2.3.5.3 PRHR - SG 2.3.6.2 ADS SO 2.3.6.4 ADS RCS

37. Loss of instrument air in its entirety or partially can have significant impact on both active and passive systems (CMT, PRHR, Containment isolation of active systems). Although it is l recognized that the air operated valves will fall to their safe position, there could be substantial ]

impact on the overall behavior of the plant due to the shear number of systems affected. Since loss of instrumentation as an initiating event and on a system bases has been examined in die PRA, it would seem appropnate that Westinghouse address the PRA insights on potential adverse i system interactions from the loss of instrument air in this report.

Response

The following insights relate to loss of instrument air from the PRA study:

1. For safety related systems and functions, the valves that need to change position either do not use air, or fait safe after loss of air. An example of fall safe case is the CMT AOVs, which open upon loss of air, signal, or DC power. Such an opering would not create any adverse system intemctions. The same comments apply to the passive RHR valves.

Moreover, the type of AOVs used in these two safety related systems are different to minimize potendal common cause failures.

2. For non-safety related functions, SFW control valves are air operated and would be affected by loss of air. To allow use of these valves after such an event, air bottles are provided.

l Montover, these valves can be manually and locally controlled.

3. For CVS system air operated valves, upon loss of instnament air, the auxiliary spray line isolation valve fails closed; the charging stop valve falls open; the makeup pump suction i header valve fails aligned to the boric acid tank; makeup flow control valve falls open.

l l

C WiVMP7

23 Thcrtfore, CVS is still able to provide flow to the reactor control system via the nonnki system flow path, but the pressurizer auxiliary spray is unavailable.

4. De AP600 PRA models the effects of loss of air on safety related and non safety related systems. The PR A study shows that the instnament air system is not a risk significant system. Also, the contribution of the loss of instrument air initiating event to the plant core damage frequency is very small (0.1%). The fail open design of passive RHR and CMT system air operated valves provides reliable actuation of these systems in loss of offsite power and station blackout events, and contributes to the reduction of risk due to these events.

38. Will spurious operung of the CMT discharge valves (not due to a CMT actuation signal), cause the RCPs to trip? For example, loss of a!r to the CMT discharge valve will result in them failing open - will this cause the RCPs to tnp? If not, what adverse effects would this cause?

39. The adverse effects of cold weather on tin >peration of the PCCS appears to merit some consideration. For instance, under extremely cold temperature conditions, it is conceivable that the annulus floor drains at the bottom of the containment annulus could ice up. Actuation of the PCCS would result in cooling water not evaporated from the containment vessel water accumulating in the lower annulus. Enough water accumulation could eventually affect annulus alt flow and degrade PCCS operation. In addition, icing of the distnbution bucket and weirs could affect distribution of PCCS flow on containment.

40. The stage 1,2, and 3 ADS discharge lines have vacuum breakers to prevent water hammer following ADS actuation. What are the consequences of ADS actuation with the breakers unseated such that ADS discharge is diverted directly into containment rather than quenched in the IRWST7 How is the position of the vacuum breakers determined and monitored?

41, The pressurizer safety relief valve discharge lines appear to have a drain line connection to the ADS valve discharge lines. It would seem that actuation of the ADS valves could pressuri7e the safety relief valves discharge line and blow the rupture disk. What adverse effects would this have on system operations? In addition, if ADS-1 is used manually to depressurize, will the operator have to manually close the drain line isolation valve to the RCDT?

42. In order for the IRWST to function properly, it must directly communicate with the containment atmosphere. Steam and pressure venting capabilities of the IRWST are discussed in the SSAR but there does not appear to be any description of the vacuum relief assurance for the IRWST.

The staff assumes that the IRWST design will have a vacuum relief design sufficiently sized to permit required drain down. However, has the possibility of clogging or obstruc'. ion of the vacuum relief paths been considered along with any adverse effect this would have on IRWST draining? Westinghouse should consider including a discussion on this in the adverse systems interaction report and a description of the venting design in the SSAR. This concern would also be applicable to vacuum venting design and potential for clogging / obstructions for the PCCS tank.

43. Are there any adverse interactions or effects possible from ADS blowdown on the TRWST level instrumentation?

44. The passive autocatalytic recombmers (PARS) are designed to prevent hydrogen buildup from DBA events from exceeding 4 percent. In a severe accident context, the hydrogen concentrations cZo@ @@r%v areRA DAre 990 wva AR mn mmn mennesa

1 ,

t . l

i 24 i in containment could approach 10 percent. Are there any adverse consequences from the PAR operating in diis higher hydrogen concentration environment (such as overheating or flaming of

( the gas discharged from the PARS)?

, Response:

t In the event of a severe accident, hydrogen ignitors would be used for the purpose of buming j hydrogen generated in containment before high concentrations are reached. In the event that the '

PARS contnue operating in a higher hydrogen concentration environment, there would be no I 4

adverse effect due to a postulated elevated exhaust temperature emanating from the PARS i because the PARS are placed in locations for which elevated exhaust temperatures do not effect

other equipment inside containment.

i l

45. The main control room habitability system maintains control room air pressure with pressure

relief dampers. What are the consequences of a failure of one of these dampers?

t j Response:

l A failure of one of the pressure relief dampers is compensated for by closing one of the pressure i

reliefisolation valves upstream of the damper. Two redundant pressure relief flow paths are provided to account for a single failure, such as a damper. One 110w path has sufficient vent i

area to accommodate the air delivery from both trains of emergency air storage tanks.

l 1 46. What controls are provided to ensure the quality of the air in the main control room haNtability j system air storage tanks? Has the possibility of degradation of the air quality in the storage j tanks with time been considered (due to material coatings, grease, other unidentified

! contaminants within the tanks that could gradually sublime :md mix with the air)?

Response

3 l The emergency air storage tanks are steam cleaned by the vendor, dried, anxi filled with dry nitrogen prior to shipment. After arriving on site, the tanks are purged of nitrogen and filled with clean, dry air, which meets the specifications estaNished by the VES system. The quality of air stored in the tanks is ensured by periodically extracting a grab sample hem the system and performing a lab analysis of the sampic. The sample interval will be established by the COL i applicant. '

47. Is it possiNe for a secondary side break or rupture (within containment) to cauw and actuation of the ADS system? Under such circumstances, significant additional water inventory will be added to containment; are there any adverse conditions possible from such a scenario (such as boron dilution)?

44. Section 2.3.6.4 of the adverse systems bieraction report states that a " spurious ADS LOCA is a terminable LOCA event. (althoughl operators are not instructed to terminate ADS." Please explain this statement. Information in Table 31 differs in that it states that " procedures exist to terminate the event" ispurious ADS). How would a spurious ADS be tenninated?

t20g 009dv SCSS t4C Zit YYd 93191.aH.I. 96/6T/ZI

25

Response

The comments above are contained in Section 3.4 and the associated Table 3-1 that refer to a l specific cvent discussed in Section 2.3.6.4 (ADS / RCS) -- spurious ADS during power I

operation. Section 3.4 specifically addresses the evaluation of potential human commission ermrs related to these two passive safety related subsystems.

l For clanfication, there are two potential types of spurious ADS actuations will be addressed by j this response:

i

- A system Icvcl ADS actuation signal that results in the sequencing of ADS Stages 1-3

! - A nonsystem level actuation, such as a single ADS line that spuriously opens l

I For the system level casc, a spurious ADS is an event that can be terminated. But like any l safety-related actuation signal, termination is allowed mly, I under some very specific conditions.

I In general, terminadon of any plant safeguards actuation signal in the Emergency Operating Procedures (EOPs) is perfonned in order to restort the plant after plant conditions have become l stable and subsequent plant recover is anticipated using specific plant procedures.

If a spurious system level ADS occurs, the EOPs would confirm that proper systems responses i occurred and that at some point in the procedures, stable plant conditions exist and are being maintained thai allow the actuation signal to bc reset and the safety related systems to bc I removed from scrylce.

( So the statement in Section 3.4 is conect, meaning that under the specific termination enteria in l the EOPs, the system-level ADS actuation signal could be reset and the plant restort to a stable l condition with the ADS system atmoved from service (hy closing the ADS valves).

{

However, the statement that the operators arc not instructed to tenninate ADS is intended to show that the automatic ADS actuation would not he intenupted so that only panjal actuation

. occurs and that the plant is in an intennediate condition where termination is not allowed - and

! under conditions that would pmbably not meet the associated termination criteria.

In the ADS design, there are two separate actuation signals:

Actuation of the Stage 1 to 3 timing sequence

- Subsequent Stage 4 actuation if CMT level continues to decrease The operators would not be allowed to interfere with the Stage I to 3 sequence until it was completed and conditions to terminate safety related systems were satisfied. If stable conditions existed that did not require the additional Stage 4 actuation on a continually decreasing CMT level, such as through recovery of RCS inventory using the nonsafety related chemical and volume control system makeup pumps, then the operators could terminate ADS operation at this time.

For tbc second casc listed above, where a system level actuation has clearly not been generated and the spurious ADS actuation involves spurious opening (such as the spurious opening of both serics valves in a single ADS line), the operators would be expected to confirm that the system-level actuation signal is not present and then to attempt to manually close at least one of the two spuriously open series ADS valves in the affected line to stop the spurious RCS depressurization.

l l

_ 880fQ __ . _ . _

ou9dV SCSS PLC ZTt IY3 9Z:9i 011.1. 96/6T/ZT

o 26 These operators actions would be equivalent to operator actions in curTently licensed plants to closc a spuriously opened, safety related steam generator atmospheric power-operated relief valvc. that was opened in a condition outside of its normal actuation conditions due to a malfunction in the automatic actuation circuitry, to stop a spurious steam generator depressurization.

49. Extensive effon is being placed on the human factors design of contml room operator controls for the AP600. For example, manual actuation of the ADS requires two separate operator actions. Experience indicates that many human factors related events are a result of ermrs during testing or maintenance of I&C components. In the case of a spurious ADS signal, Westinghouse states in Table 3-1 that the most likely human error may be related to testing or maintenance of instrumentation. Related specifically to the ADS-4 squib valves, what pmtection is pmvided by the design of the ADS-4 actuation circuitry to prevent an inadvertent discharge of a squib valve during surveillance testing, trouble shooting, or repairs being conducted inside the applicable I&C cabinets in the PMS system. For example, what measures would prevent a technician from accidently perfonning a continuity check on the electrical leads to a squib valve explosive charge (assuming that such a check could result in the firing of the charge)? Are there any other systems in which an inadvertent actuation due to maintenance or I&C could have significant adverse effects.

50. Related to the human factors aspects of question 29 above concerning actions following an extended station blackout, there may be a need for operators to take some additional actions if temperature limits are being approached in the I&C cabinets due to lack of normal control ruom cooling. What actions could the operator be expected to take and is there a potential for enors of conunission or omission? What would be the consequences of a such ermrs? 4

Response

As discussed below, there is no need for operator actions for cooling IAC cabinct rooms, or the control room during the 72-hour period following an extended station blackout or loss of ventilation system. Thus, there are no postulated ontission or commission errors.

The temperature in the I&C rooms following a loss of the nuclear island non nuiioactive ventilation system remains below 120*F over a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> period. If cooling is required beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the room doors are opened and cooling is achieved via natural circuladon. Altematively, ponable fans with flexible ducting may be obtained fmm offsite, and used to deliver convection cooling to each of the electrical equipment moms using ambient air, as needed.

The same discussion applies to the main control room.

51. There appears to be the possibility of adverse effects following the termination of an abnormal event. For example, the CMTs could he actuated during an event which is then successfully terminated after a period of CMT recirculation. This would leave the CMTs full of hot water at cicvated pressure. What potential interactions could occur as the Chffs are cooled? How are these interactions prevented or mitigated? In general, have interactions of this type (i.e.,

recovery fmm terminable sequences) been considered?

080g 009dV ScSS tic Zit' IVJ 43:ST SH1 96/61/31

. _ _ _ _ __ . _. - _ _ .- _-. . ~ _ _ - _ _

c -

. DISTRIBUTIDN w/ attachments:

' Docket File i PUBLIC POST R/F

, FMiraglia/AThadani, 0-12 G18 RZimmerman, 0-12 G18 i

BSheron, 0-12 G18 l

' TMartin DMatthews 1 TQuay BHuffman j DTJackson

, TKenyon JSebrosky l EJordan, T-4 D18

, ACRS (11) j JMoore, 0-15 B18 i WDean, 0-17 G21

, Alevin, 0-8 E23

> TCollins, 0-8 E23 NSaltos, 0-10 E4

ACubbage, 0-8 E23 l JBongarra, 0-9 HIS

JLyons, 0-8 D1 HLi, 0-8 H3

JRaval, 0-8 D1 MSnodderly, 0-8 H7

. CLi, 0-8 D1 GHolahan 0-8 E2 T - -

i t i s'-

i I

i s> f

-e e

's

)

100082