ML18044A185

From kanterella
Jump to navigation Jump to search
APR1400 Chapter 10, Steam and Power Conversion System, Final Safety Evaluation Report
ML18044A185
Person / Time
Site: 05200046
Issue date: 09/28/2018
From: George Wunder
NRC/NRO/DNRL/LB2
To:
Wunder G / NRO/ 415-1494
Shared Package
ML18087A364 List:
References
Download: ML18044A185 (109)
v • d • e


Text

10 Steam and Power Conversion System Chapter 10 of this safety evaluation report (SER) describes the review by the staff of the U.S.

Nuclear Regulatory Commission (NRC), hereinafter referred to as the staff, of Chapter 10, Steam and Power Conversion System, of Korea Hydro & Nuclear Power Co., LTD, hereinafter referred to as the applicant, design control document (DCD) for the design certification (DC) of the Advanced Power Reactor 1400 (APR1400).

Thermal energy from the reactor is transferred to the main turbine generator for conversion into electric energy by the steam and power conversion system. The main elements of the steam and power conversion system include the main steam supply, turbine generator, main condensers, circulating water, condensate and feedwater, and emergency feedwater systems.

10.1 Summary Description DCD Tier 2, Revision 3, Section 10.1, Summary Description, provides a general description of the steam and power conversion system and provides summaries of the protective features incorporated in the design of the system. DCD Tier 2 Table 10.1-1, Steam and Power Conversion System Major Design Data, provides data on major system parameters. Figure 10.1-1, Heat Balance Diagram, provides a high level flow diagram for the system.

Detailed descriptions of the main elements of the steam and power conversion system are provided in Sections 10.2 through 10.4.10 of the DCD. The staffs review is documented in Sections 10.2 through 10.4.10 of this report.

10.2 Turbine Generator 10.2.1 Turbine Generator Operation and Speed Control Introduction The turbine-generator (T/G) is a non-safety-related system that converts the energy of the steam produced in the two steam generators (SGs) into mechanical shaft power and then into electrical energy. The flow of steam is directed from the SGs to the turbine through the main steam system (MSS), turbine stop and turbine control valves (CVs). After expanding through a series of turbines, that drive the main generator, exhaust steam is transported to the main conventional surface-type condenser, where the steam is condensed. The condensate from the condenser is returned to the SGs through the condensate and feedwater systems. The T/G system also utilizes two moisture separator reheaters to reheat the extraction/exhaust steam from the high-pressure turbine prior to its supply to the low-pressure turbines.

The T/G has a turbine control and overspeed protection system to control turbine action under all normal and abnormal conditions to ensure that a full load turbine trip will not cause the turbine to overspeed beyond acceptable limits and to minimize the probability of generation of turbine missiles in accordance with the requirements of General Design Criterion (GDC) 4.

Summary of Application DCD Tier 1: Specific design requirements of the T/G system are found in DCD Tier 1 Section 2.7.1, Power Generation Systems. Subsection 2.7.1.1, Turbine Generator, contains two subsections:

10-1

1. Subsection 2.7.1.1.1, Design Description, which describes the system purpose and functions, location and functional arrangement, as well as key design features such as high pressure (HP) and low pressure (LP) turbines, steam inlet valves, missile probability analysis, valve testing and in-service inspection program, and control systems and electrical trip signal initiations.
2. Subsection 2.7.1.1.2, Inspections, Tests, Analyses, and Acceptance Criteria (ITAAC), which describes the ITAAC for the T/G system (in Table 2.7.1.1-1, Turbine Generator ITAAC).

DCD Tier 2: The complete description of the T/G system is provided in DCD Tier 2, Section 10.2, Turbine-Generator. The T/G system performs no safety-related functions and, therefore, has no nuclear safety design bases. Selected T/G principal design features include:

1. The T/G is designed for base load operation
2. The T/G is designed to trip automatically under abnormal conditions and to accept a sudden loss of full load without exceeding design overspeed.

Initial Test Program: Initial plant testing for the T/G system is described in DCD Tier 2, Section 14.2.12.1.62, Main Turbine Systems Test and Section 14.2.12.4.5, Turbine Trip Test.

ITAAC: ITAAC for the T/G system are described in DCD Tier 1 Section 2.7.1.1.2, Table 2.7.1.1-1, Turbine Generator ITAAC, Items 1a, 2a, 2b, 4, and 5.

Technical Specifications (TS): There are no TS requirements associated with the T/G.

Regulatory Basis The relevant regulatory requirements for this area of review and the associated acceptance criteria are given in NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, Section 10.2, Turbine Generator, Revision 3, and are summarized below. Review interfaces with other Standard Review Plan (SRP) sections also can be found in Item I, Areas of Review, of the SRP Section 10.2.

1. GDC 4, Environmental and dynamic effects design bases, as it relates to the protection of structures, systems, and components (SSCs) important to safety from the effects of turbine missiles by providing a turbine overspeed protection system (with suitable redundancy) to minimize the probability of generation of turbine missiles.
2. Title 10 of the Code of Federal Regulations (10 CFR) 52.47, Contents of applications; technical information, Item (b)(1), which requires that a DC application contains the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC has been constructed and will be operated in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRC regulations.

10-2

Technical Evaluation The staffs evaluation of the turbine generator system is based upon the information provided in the applicants DCD, Revision 1, including Tier 1 and Tier 2.

GDC 4, Environmental and dynamic effects design bases Although the T/G system is non-safety-related, missiles generated by turbine failure can adversely affect the integrity of essential SSCs. To satisfy GDC 4, and as discussed in Section 3.5.1.3, Turbine Missiles, of this SER, the main turbine must have a low probability of rotor failure to minimize the likelihood that turbine missiles will affect important to safety SSCs.

The arrangement and the orientation of the T/G system relative to these essential SSCs are also to be considered in the overall minimization of turbine missiles. Also reviewed by the staff is the performance of the turbine rotor itself. Because turbine rotors have large masses and rotate at relatively high speeds during normal reactor operation, failure of a rotor may cause excessive vibration of the turbine rotor assembly and result in the generation of high energy missiles. The staffs evaluation of the rotor required specifications can be found in Section 10.2.3, Turbine Rotor Integrity, of this SER.

Since the likelihood of a turbine missile increases as the rotation of the turbine increases, the T/G system design is expected to be protected from overspeed during all modes of operation.

SRP Section 10.2.III, Item 2 provides guidance to the staff on how to verify the adequacy of the control and overspeed protection systems as follows:

a) For normal speed-load control, an electrohydraulic control system fully cuts off steam and closes all valves, including CVs and intercept valves (IVs), at 103 percent of the turbine rated speed, b) A primary mechanical overspeed trip device will actuate all stop valves (SVs),

CVs, reheat stop valves (RSVs), and intercept valves (IVs) at approximately 111 percent of the rated speed, and c) An independent and redundant backup electrical overspeed trip device will close all steam inlet and CVs at approximately 112 percent of rated speed. This backup emergency trip device may use the same sensing techniques as the normal electro-hydraulic control system; however, the control signals from the two systems will be isolated from and independent of each other.

For the APR1400, turbine generator control and overspeed protection is accomplished by three independent systems (normal turbine generator control, mechanical overspeed trip, and electrical overspeed trip systems), as described in DCD Tier 2, Section 10.2.2.3. During normal operation, turbine speed is controlled by the turbine generator control system (TGCS) which provides automatic control of the turbine speed and acceleration through the entire speed range. The speed control function of the TGCS is designed to fully close all the CVs before reaching 103 percent of the rated speed and thus serves as the first line of defense against turbine overspeed. If the speed control function of the TGCS fails, the T/G overspeed protection system, which consists of mechanical overspeed trip system (MOTS) and the electrical overspeed trip system, is used to trip the turbine.

The mechanical MOTS is activated when the overspeed reaches 110 percent of the rated speed, and brings the turbine to safe shutdown condition. It is described in DCD Tier 2, Section 10-3

10.2.2.3.2, Overspeed Protection, as consisting of an unbalanced weight that is activated by a centrifugal force against a spring when the turbine overspeeds, thus causing an eccentric movement that mechanically opens the emergency trip valve which action causes a depressurization of the emergency trip system (ETS) hydraulic fluid and the common hydraulic safety system. This results in closing all turbine stop and CVs, thus tripping the turbine. If the MOTS trip system fails, the electrical overspeed trip system is automatically activated to trip the turbine at approximately 111.5 percent of the rotor rated speed.

The electrical overspeed trip system is described in DCD Tier 2, Section 10.2.2.3.2. It consists of two speed calculating modules: a primary and a backup. Each module uses the three signals from passive magnetic speed sensors and speed conditioning units to the 2-out-of-3 tripping device. The primary module calculates the trip setpoint from software logic and the backup module calculates the trip setpoint from its module firmware, which is independent of the primary module. These modules trigger hydraulic solenoid valves, and all stop and CVs are then closed. Each setpoint is 111.5 percent of the rated speed. The turbine is not expected to exceed 115 percent of the rated speed.

Based on the above discussion, the staff finds that the APR1400 normal turbine generator control, mechanical overspeed trip, and electrical overspeed trip systems are designed to provide reactor trips consistent with the guidance provided in SRP 10.2, Section 10.2.III, Item 2.

In addition to confirming that the T/G overspeed protection system would initiate turbine trips at the required overspeed condition, the staff, in accordance with the SRP, also considered the capability of the T/G control and overspeed protection systems to detect the turbine overspeed conditions and actuate appropriate valves to preclude such condition as well as the following in its evaluation of the T/G system: (1) diversity, redundancy, and independence; (2) fail safe and single failure protection; (3) common cause and common mode failure protection; (4) manual trip function; and (5) inspection and testing.

Diversity, Redundancy & Independence Turbine overspeed protection is accomplished in the APR1400 using the TGCS, and the mechanical and electrical overspeed trip systems. The use of two different types of overspeed trip system (mechanical and electrical) provides for both independent and diverse means of overspeed protection since the systems do not share common components and use different methods to detect overspeed conditions and close the appropriate valves to preclude the overspeed. Thus the APR1400 design incorporates defense-in-depth, and utilizes diverse protection means to preclude excessive turbine overspeed.

The APR1400 TGCS uses a digital controller that has two modes of operation to protect the turbine against overspeed. The first mode is the normal speed control, which maintains the turbine at the desired speed, whereas the second one is an overspeed protection control mode that operates if the normal speed control fails.

In DCD Tier 2, Section 10.2.1.2, Non-Safety Power Generation Bases, item (f) identifies as a principle design feature that the T/G system is to be designed so that the single failure of any component or subsystem does not disable the turbine overspeed trip function. The TGCS uses three redundant speed inputs and has three redundant control processors with redundant communication paths between processors within the TGCS. It employs three independent speed sensors. For overspeed protection, each module provides an output signal which is normally energized to the 2-out-of-3 tripping devices. For speed control, multiple speed 10-4

feedback signals are derived from redundant sensors. A separate probe is provided for each of the triple redundant electrical governor channels.

In addition, DCD Tier 2, Section 10.2.2.3.1, Normal Control," states that redundancy is built into the overspeed protection system such that the failure of any one component in the overspeed protection system will not prevent a turbine trip. The applicant states that a failure of the overspeed protection system will not propagate to the others because the system will be electrically isolated and physically separated and the components of the systems will be designed to fail in a safe position. Loss of the hydraulic pressure in the emergency overspeed protection systems causes a turbine trip. Therefore, damage to the overspeed protection components results in the closure of the valves and the interruption of steam flow to the turbine.

Based on the T/G system description in the DCD, it appears that sufficient redundancy is designed into the TGCS for speed and overspeed control to protect the turbine during normal plant operation. However, there was no information provided in the DCD on how the overspeed trips are performed, and what components and subsystems are used in implementing these overspeed trip systems. In addition, no information was provided on how the turbine steam inlet valves and associated hydraulic fluid systems and solenoid valves function in tripping the turbine. The staff issued Request for Additional Information (RAI) 8050, Question 10.02-2 (Agencywide Documents Access and Management System (ADAMS) Accession Number ML15226A601), requesting that the applicant provide additional information on how the overspeed trips are performed, including system schematics and information on failure mode consideration. The staff also requested the applicant to explain how the T/G subsystem and components meet the single failure criteria.

In its response to RAI 121-8050, Question 10.02-2 (ML15300A461), the applicant stated that APR1400 does not identify a specific turbine generator design, which it contends will allow the combined license (COL) applicant to select the optimum design from a plant safety and reliability perspective. It further states that providing details such as schematics and detail descriptions is undesirable based on the fact that it might imply or favor pre-approval of a certain turbine generator vendor, and would not address future lessons learned. In response to the staffs RAI, the applicant proposed using COL Item 10.2(2) to have the COL applicant provide schematic(s) of the TGCS and overspeed protection systems that show the entire system end-to-end and all discrete components and interfaces (e.g., sensors, power supplies, control devices, manual emergency trips, the device that eventually drains the hydraulic/air fluid from turbine CVs).

The staff reviewed the applicants response and found it unacceptable since it failed to provide the requested information the staff was seeking to verify design information in the DCD. The resolution of RAI 121-8050, Question 10.02-2 was tracked as Open Item 10.02-1.

To resolve Open Item 10.02-1, the applicant provided additional information (ML16312A534),

which revised its original response to RAI 121-8050. In its revised response the applicant stated that, in lieu of describing an existing design, the APR1400 DCD will be revised to include a description of the control system architecture and specifications of the key functional requirements for the APR1400 TGCS. The applicant also provided a revision to COL Item 10.2(2) to direct the COL applicant to identify how the functional requirements for overspeed protection system described in DCD Section 10.2 will be met, and to provide, as part of its COL application, the schematic(s) for the TGCS and overspeed protection systems that show the entire system end-to-end and all discrete components and interfaces for the turbine generator selected.

10-5

The staff reviewed the revised RAI response to determine if the design information being added to the DCD, in conjunction with the associated interface and functional requirements, will ensure that the APR1400 turbine overspeed protection system with GDC 4. The additional information provided describes how the TGS overspeed protection system design will use two independent emergency overspeed trip systems to provide for diversity and redundancy which is consistent with the guidance and acceptance criteria in SRP 10.2. DCD Tier 1, Table 2.71, Turbine Generator, Items 2a and 2b, requires a trip test to be conducted on the as-built turbine generator to confirm operation of the mechanical and electrical overspeed trip systems.

Therefore, the TGS overspeed trip systems design and operation will be verified by completion and closeout of the ITAAC.

The applicant, as part of its revised RAI response, also provided a markup of DCD Section 10.2.2.3.2, Overspeed Protection, which has been incorporated in Revision 1 of the DCD. The DCD now includes a detailed functional performance description of the TGCS, MOTS and ETS.

Among the requirements specified in the DCD for the hydraulic control system is that failure of hydraulic piping between the trip block and hydraulic fluid tank will result in loss of fluid pressure and closure of the turbine steam valves, and that the hydraulic fluid in the trip and overspeed protection system is to be independent of the bearing lubrication system to minimize the potential for contamination of the fluid and draining of control oil to the hydraulic power unit reservoir through a common drain line. COL Item 10.2(2) was revised and now instructs the COL applicant to identify how functional requirements are met and to provide schematics of the TG overspeed protection system showing all discrete components and interfaces once a turbine is selected. In addition, a simplified schematic of the TGS overspeed protection system, Figure 10.2.2-2, High Level Overspeed Protection Architecture, has been added to Tier 2 of the DCD.

Based on the applicants revised response to RAI 121-8050, and its revision to the APR1400 DCD, the staff finds its concern about the T/G overspeed protection system design and operation has been adequately addressed and Open Item 10.2-1 is closed. The staff also finds the design information in the DCD in conjunction with the associated interface and functional requirements will ensure that the APR1400 turbine overspeed protection system will adhere to the guidance in SRP Section 10.2 and thus comply with GDC 4 with regards to providing suitable diversity, redundancy, and independence to minimize the probability of generation of turbine missiles.

Fail Safe and Single Failure Protection The flow of main steam entering the HP turbine is controlled by four main steam valves (MSVs) and CVs which are open and closed by an electro-hydraulic actuator as indicated in DCD Tier 2, Section 10.2.2.3.1.4, Valve Control. The MSVs shutoff steam flow to the turbine when required, such as for actuation of an electrical overspeed trip. The intermediate stop valves (ISVs) and IVs control steam flow to the LP turbine and completely close on turbine overspeed and turbine trip. The ISVs and IVs are also controlled by hydraulic pressure. Loss of hydraulic pressure in the emergency overspeed protection system results in the closure of the valves and interruption of steam flow to the turbine. Therefore the T/G system valves relied on for overspeed protection are fail safe.

The four turbine stop and four intermediate SVs are redundant from their respective four control and four IVs. The valve arrangements are typical of designs previously approved by the staff.

The valve characteristics and closure times are provided in DCD Tier 2, Table 10.2.2-2, Turbine Valve Closure Times. The valve closure time for the turbine stop and CVs and the reheat stop and IVs is 0.3 seconds and is based on preventing turbine overspeed following a 10-6

loss-of-full load. Based on the design features summarized above the staff finds that the APR1400 steam admission and non-return check valves (NRVs) are designed with adequate provisions to prevent excessive turbine overspeed in the event of a turbine generator system trip signal.

In order to meet the GDC 4 criteria, Item 1.A of the SRP Acceptance Criteria states that the overspeed protection should meet the single failure criteria and should be testable when the turbine in is operation. DCD Tier 2, Section 10.2.1. Non-Safety Power Generation Design Bases states: (T)he T/G system is designed so that the single failure of any component or subsystem does not disable the turbine overspeed trip function. DCD Tier 2, Table 10.2.4-1 Turbine Speed Control System Component Failure Analysis, provides the results of a failure analysis of the APR1400 turbine speed control system and shows how overspeed is prevented when a single component fails or malfunctions.

The turbine trip-block provides an interface between the turbine speed control systems and the turbine valve control fluid systems. In its review of the DCD, the staff could not find any description of the turbine trip-block. Therefore, the staff requested in RAI 121-8050, Question 10.02-4, that the applicant provide adequate details of the turbine trip-block and its configuration. The staff also requested that, if the design used a single trip block, the applicant provide information on single failure criteria for turbine overspeed and justification on how it satisfied requirements for redundancy and diversity.

In its response to RAI 121-8050, Question 10.02-4, the applicant indicated that this question is covered by its response to RAI 121-8050, Question 10.02-4. The staff reviewed the applicants response and found it unacceptable since it failed to provide the requested information the staff was seeking to verify design information in the DCD. The resolution of RAI 121-8050 was tracked as Open Item 10.02-2.

To resolve Open Item 10.02-2, the applicant provided additional information in a letter (ML16312A534), which revised its original response to RAI 121-8050, Questions 10.02-2 through 10.02-5. In its revised response, the applicant added text to the DCD specifying that schematics and descriptive information is to be provided by the COL applicant once a turbine design is selected. The applicant also stated that the information provided by the COL shall be sufficient to allow assessment of the TGCS and overspeed systems' ability to withstand a single failure without loss of function (i.e., redundancy), resistance to common cause failure (i.e.,

diversity as provided by electrical and mechanical overspeed trips), and resistance of propagation of a failure to another trip channel (i.e., independence, separation). Therefore, the information pertaining to the turbine trip block and its interface with the turbine speed control systems and the turbine valve control fluid systems will be provided when a COL application is submitted for NRC review. COL Item 10.2(2) was updated in APR1400 DCD, Revision 1 to identify the information to be addressed in the COL application.

Based on the applicants revised response to RAI 121-8050, Questions 10.02-2 through 10.02-5, and its revision to the APR1400 DCD, the staff determined that its concern regarding the T/G overspeed protection system design meeting single failure criteria discussed in SRP 10.2, has been addressed, and Open Item 10.2-2 is closed. The staff also determined that the design information in the DCD in conjunction with the associated interface and functional requirements will ensure that the APR1400 turbine overspeed protection system will adhere to the guidance in SRP 9.2.6 and thus comply with GDC 4.

10-7

Common Cause and Common Mode Failure Protection In DCD Tier 2, Section 10.2, the applicant did not address any features or testing requirements to minimize or eliminate the common cause failures (CCF) in the hydraulic and air systems associated with the T/G control and protection systems, including the T/G steam admission and extraction non-return valves.

Therefore, the staff issued RAI 121-8050, Question10.2-5 requesting that the applicant address the details of the air/hydraulic systems as they relate to turbine overspeed systems.

Specifically, the staff requested the applicant to address the electrical and fluid flow paths, shared components, failure modes, and CCF vulnerabilities and also to provide a description on reliable operation of the hydraulic/air systems as associated with preventing turbine overspeed conditions. The staff further requested that the description of the turbine overspeed protection systems should clearly indicate what parts are shared. For example, shared air and hydraulic dump lines and components such as trip blocks, dump valves and fluid reservoirs should be described in the DCD. For clarity, the response should include schematic diagrams that show the control fluid flow paths, piping and valves being actuated (i.e., turbine stop, control, reheat stop, intercept, and extraction non-return valves).

In its response to RAI 121-8050, Question 10.02-5 (ML15300A461), the applicant referenced its response to RAI Question 10.02-2 which the staff has reviewed and found unacceptable since it failed to provide the requested information the staff was seeking to verify design information in the DCD. The resolution of RAI 121-8050 was tracked as Open Item 10.02-3.

To resolve Open Item 10.02-3, the applicant provided additional information in a letter (ML16312A534), which revised its original response to RAI 121-8050, questions 10.02.-2 through 10.02-5. In Section 10.2.2.3.1.3, of the DCD the applicant stated that all SVs are hydraulically operated from the common hydraulic safety system equipped with limit switches for stroke testing. In its revised response, the applicant added text to the DCD specifying the requirements to be fulfilled by the hydraulic control oil system provided by the COL applicant.

The DCD indicates that the design will be such that failure of the hydraulic piping between the trip block and the valve actuator, or between the hydraulic fluid tank and the valve actuator will cause a loss of fluid pressure, which closes the turbine steam valves. It also indicates that the hydraulic fluid in the trip and overspeed protection control headers is independent of the bearing lubrication system to minimize the potential for contamination of the fluid. In DCD Revision 1, COL Item 10.2(2) was revised and now specifies that the schematic and descriptive information provided by the COL applicant is to include sufficient detail to allow assessment of the TGCS and ability to resist common cause failure.

Based on the applicants revised response to RAI 121-8050, Questions 10.02-2 through 10.02-5, and its revision to the APR1400 DCD, the staff determined that its concern regarding the T/G overspeed protection system resistance to common cause failure has been adequately addressed since COL Item 10.2(2) will require the specific details to be in the COL application.

Therefore, Open Item 10.2-3 is closed.

Manual Trip Function In DCD Tier 2, Section 10.2.2.3, Control and Protection, the applicant described various T/G control systems for normal and abnormal operating conditions, including normal control and emergency protection systems to protect the turbine from overspeed. The DCD further 10-8

describes the automatic turbine startup and shutdown (ATS) in that it receives commands rather from the operator using the operator interface or from a plant computer through a data link.

However, the DCD did not provide any reference to or description of the Manual Turbine Trip feature for the APR1400 turbine. SRP Section 10.2.III, Review Procedures, Item 2.A describes the inclusion of an in-depth defense and diverse protection means to preclude an unsafe turbine overspeed condition. The staff considers the manual turbine trip system as one of the diverse turbine protection systems under all modes of plant operation.

Therefore, the staff issued RAI 121-8050, Question 10.2-3, requesting the applicant to provide detailed information regarding a manual control and/or manual turbine trip system for the APR1400 T/G system. The staff further requested the applicant to include any hard wiring from the main control room (MCR) to the T/G unit, including a push button at the turbine pedestal.

In its response to RAI 121-8050, Question 10.2-3 (ML15300A461), the applicant indicated that APR1400 DCD Section 10.2, will be revised, and the term emergency trip will be replace with manual emergency trip for clarification purposes. Further, the applicant indicated that additional text would added to DCD Tier 2, Section 10.2.2.3.4, Inspection and Testing, to require that the manual emergency trip be designed to ensure that no single failure would prevent a manual trip. The hard wiring part will be deferred to the COL applicant. However, the applicant did not provide the requested information about the wiring but instead referenced its response to RAI 121-8050, Question 10.2-2.

The staff reviewed the applicants response and found the descriptive information on the manual trip being added to the DCD acceptable but, as for the information requested on the wiring that was not provided, the staff finds the response unacceptable since it failed to provide the requested information the staff was seeking to verify design information in the DCD. The staff has informed the applicant of its review results and the applicant is expected to provide a revised response. The resolution of RAI 121-8050 was tracked as Open Item 10.02-4.

To resolve Open Item 10.02-4, the applicant provided additional information in a letter (ML16312A534), which revised its original response to RAI 121-8050, Questions 10.02-2 through 10.02-5. In its revised response, the applicant added text to the DCD specifying that for the manual overspeed trip system, the manual trip system provided by the COL is to provide manual trip activation at the turbine standard by de-energizing a solenoid that moves the trip linkage, and that emergency manual trip activation must also be available from the control room.

The applicant also proposed to add a statement in DCD Section 10.2.2.3.4 stating that the the manual emergency trip shall be designed such that no single failure will prevent a manual trip and that failure of the ETS to initiate an automatic trip does not prevent a successful manual trip. The DCD now also addresses testability in Section 10.2.2.3.2 and, regarding the manual trip of the turbine, it states that the turbine manual switches and associated linkages are tested during refueling outages prior to turbine start-ups or when maintenance work could have affected functionality. The physical implementation is to be included in the schematics required by COL Item 10.2(2). The additional information provided in the revised RAI response has been incorporated into Revision 1 of the DCD.

The staff reviewed the applicants revised RAI response to determine if the design information being added to the DCD in conjunction with the associated interface and functional requirements will provide reasonable assurance that the manual control and/or manual turbine trip system for the APR1400 T/G system turbine will allow for manual initiation of a turbine trip by operators. Since the proposed DCD revisions will add functional requirements that ensure 10-9

that the T/G design will incorporate the use of an emergency stop push button at the turbine standard and in the control room, and testing of the manual trip will be performed, the staff determined that there is reasonable assurance that the manual trip will be available to provide a way so that a turbine trip can be initiated manually by operators using an emergency stop push button either in the control room or at the turbine standard. Therefore, the staff determined that the design incorporates an in-depth defense and diverse protection means to preclude an unsafe turbine overspeed condition and the staffs concerns regarding the manual trip has been addressed and Open Item 10.2-4 is closed.

Inspection and Testing The guidance of SRP Section 10.2, Subsection II, Acceptance Criteria, Item 1C states that the T/G system should have the capability to permit periodic testing of components important to safety. In DCD Tier 2, Section 10.2.2.3.4, Inspection and Testing, it is stated that the overspeed trip circuits and devices are tested remotely at or above the rated speed by means of controls in the main control room with the turbine not in operation. Also, these overspeed protection devices are checked under controlled speed conditions at startup or after each refueling or major maintenance outage. It is also stated in that section of the DCD that the MSVs, CVs, ISVs, and IVs are tested at a frequency of once in three months inservice testing and functional checks are performed periodically. MSVs, CVs, ISVs, and IVs are exercised at least once within quarterly intervals by closing each valve and observing the remote valve position indicator for fully closed position status.

Based on the above, and a review of the inspection and testing details in DCD Tier 2, Section 10.2.2.3.4, the staff determined that the applicant has adequately addressed the considerations described in SRP Section 10.2.II; specifically, SRP acceptance criteria to meet the requirements of GDC 4.

Initial Test Program Although applicants for DC s are not required to submit plans for an initial test program, RG 1.68, Initial Test Programs for Water-Cooled Nuclear Power Plants, acknowledges that DC applicants have previously submitted these plans to assist a future COL applicant referencing the DC in meeting the requirements of 10 CFR 52.79(a)(28). Preoperational test requirements for the Turbine Generator System are listed in DCD Tier 2, Section 14.2.12.1.62, Main Turbine System Test, and Section 14.2.12.4.5, Turbine Trip Test.

ITAAC Proposed ITAAC for the Turbine Generator are given in DCD Tier 1, Table 2.7.1.1-1 (Turbine Generator ITAAC). Table 2.7.1.1-1 contains test and inspection requirements for the turbine generator. These tests and/or inspections confirm: (1) the T/G orientation and arrangement; (2) the mechanical and electrical overspeed trip system performance; (3) control system sending electrical signal to the MCR for T/G trip; (4) closure of stop, control, and intercept valves upon receipt of a T/G trip signal; (5) completion of Turbine missile probability analysis; (6) inspection of the as-built turbine material properties and (7) the low probability of a turbine missile strike.

Based on a review of the information provided in DCD Tier 1, Table 2.7.1.1-1, the staff concludes that the ITAAC will adequately confirm T/G design capabilities, design features, and systems interfaces. Therefore, if the ITAAC in DCD Tier 1, Table 2.7.1.1-1, are performed and the acceptance criteria met, there is reasonable assurance that the design is built and will 10-10

operate in accordance with the DC, the provisions of the AEA, and NRC regulations, as required by 10 CFR 52.47(b)(1).

A discussion of all APR1400 ITAAC is provided in Section 14.3 of this SER.

Technical Specifications There are no TS requirements associated with the APR1400 T/G system.

Combined License Information Items The following is a list of COL Information Items and descriptions from Table 1.8-2 of the Tier 2 DCD:

Combined License Information Items COL DCD Tier 2 Item No. Description Section 10.2(1) The COL applicant is to identify the turbine vendor 10.2.3.5 and and model. 10.2.5 10.2(2) The COL applicant is to identify how functional 10.2.5 requirements as described in Subsection 10.2.2.3.2 for the overspeed protection system are met and provide a schematic(s) of the TGCS and overspeed protection systems that show the entire system end-to-end and all discrete components and interfaces (e.g., sensors, power supplies, control devices, manual emergency trips, the device that eventually drains the hydraulic/air fluid from turbine control valves). The schematics and descriptive information provided once a turbine design is selected shall be sufficient to allow assessment of the TGCS and overspeed systems' ability to withstand a single failure without loss of function (i.e., redundancy), resistance to common cause failure (i.e., diversity as provided by electrical and mechanical overspeed trips), and resistance of propagation of a failure to another trip channel (i.e., independence, separation) 10-11

Conclusion Based on a review of the information that is provided and as discussed above in the technical evaluation section, the staff determined that the applicant has met the requirements of GDC 4 and 10 CFR 52.47(b)(1) for Section 10.2, Turbine Generator, of the APR1400 DCD.

10.2.2 [Not Used]

10.2.3 Turbine Rotor Integrity Subsection 10.2.3 above was reserved so that the staff review of Turbine Rotor Integrity can be addressed in this Section, consistent with the numbering of the applicants DCD.

Introduction Turbine rotors have large masses and rotate at high speeds during normal operation. Failure of a turbine rotor may result in the generation of high-energy missiles that may affect safety-related equipment and components. Therefore, the staff has reviewed the turbine rotor using the guidelines in SRP Section 10.2.3, Turbine Rotor Integrity, to ensure that the turbine rotor materials have acceptable fracture toughness and mechanical properties to maintain the integrity of the turbine rotor and that the turbine rotor has a low probability of failure.

Summary of Application DCD Tier 1: The applicant describes in Tier 1, Section 2.7.1.1.1 that the LP turbine rotor integrity is ensured by the combination of design, material properties (including fracture toughness), tests, and inspections of the rotor to limit the probability of turbine missile generation. Turbine rotor components and turbine stop and CVs will be in-service tested and inspected at intervals in accordance with industry practice or as specified by the manufacturer to meet turbine missile generation probability requirements.

The turbine and turbine valve in-service test and inspection program includes scope, frequency, methods, acceptance, disposition of reportable indications, corrective actions, and technical basis for inspection frequency. The as-built turbine material properties, turbine rotor and blade designs, preservice inspection and testing results and in-service testing and inspection requirements meet the requirements defined in the Turbine Missile Probability Analysis performed by the COL applicant.

DCD Tier 2: The applicant has provided a Tier 2 system description in final safety analysis report (DCD) Section 10.2.3, summarized here in part, as follows:

Turbine rotor integrity is provided by the integrated combination of material selection, rotor design, fracture toughness requirements, tests, and preservice and in-service inspection. This combination results in a low probability of a condition that would cause a rotor failure.

The COL applicant shall identify the turbine vendor and model. Also, the COL applicant is to provide a description of how the turbine missile probability analysis conforms with DCD Section 10.2.3.6, Turbine Missile Probability Analysis, to ensure that requirements for protection against turbine missiles will be met (COL Item 10.2(3)).

10-12

As part of the turbine missile probability analysis, the COL applicant is to identify which of the methods for determining fracture toughness properties of those allowed in SRP Section 10.2.3 acceptance criteria is used.

The as-built turbine material properties, turbine rotor and blade designs, preservice inspection and testing results and in-service testing and inspection requirements shall be verified by ITAAC to meet the requirements defined in the turbine missile probability analysis.

Material Selection Turbine rotor forgings are made from vacuum-treated or re-melted Ni-Cr-Mo-V alloy steel components using processes that minimize flaw occurrence provide reasonable assurance of uniform strength and also provide adequate fracture toughness. Undesirable elements, such as sulfur and phosphorus, are controlled to the lowest practicable concentrations consistent with good feedstock selection and melting practice, and consistent with obtaining adequate initial and long-life fracture toughness for the environment in which the parts operate. The turbine rotor material conforms to the chemical property limits of American Society for Testing and Materials (ASTM) A-470, Standard Specification for Vacuum-Treated Carbon and Alloy Steel Forgings for Turbine Rotors and Shafts.

Fracture Toughness The 50 percent fracture appearance transition temperature (FATT), as obtained from Charpy tests performed in accordance with ASTM A-370, Standard Test Method and Definitions for Mechanical Testing of Steel Products, is no higher than -18 ºC (0 ºF) for low-pressure turbine wheel (disc) forgings, and the Charpy V-notch energy at the minimum operating temperature is at least 8.3 kg-m (60 ft-lbf) in the tangential direction.

The fracture toughness (KIC) for the actual rotor product is determined using a value of deep-seated FATT based on the measured FATT values from the center bore or trepan specimens from the rotor forging, and a correlation factor obtained from the past manufactured rotor material test data.

Turbine Rotor Design The turbine rotor assembly is designed to withstand normal conditions and anticipated transients, including those resulting in turbine overspeed trips, without loss of structural integrity.

Preservice Inspection Each finished rotor is subjected to 100 percent volumetric (ultrasonic), surface, and visual examinations using procedures and acceptance criteria equivalent to those specified for Class 1 components in the American Society of Mechanical Engineers (ASME) Code, Sections III and V.

After final machining, all surfaces exposed to steam (i.e., all accessible surfaces except for shaft ends) are magnetic particle tested. Special attention is given to the areas of stress risers.

Finish-machined bores, keyways, and drilled holes are subjected to magnetic particle or liquid penetrant examination. No flaw indications in keyway or hole regions are allowed. Either ultrasonic examination of turbine rotor welds or an analysis that demonstrates that defects in the root of the rotor welds will not grow to critical size for the life of the rotor is performed.

10-13

Each fully bucketed turbine rotor assembly is spin tested for 3 minutes at 120 percent of the rated speed. This speed is 5 percent greater than the maximum speed anticipated following a turbine trip from full load.

Inservice Inspection The turbine and turbine valve in-service test and inspection program includes scope, frequency, methods, acceptance, disposition of reportable indications, corrective actions, and technical basis for inspection frequency.

The inspections are performed during refueling outages on an interval consistent with the in-service inspection schedules in ASME Code, Section XI and the inspection intervals from the turbine manufacturers turbine missile analysis provided by the COL applicant as described in DCD Tier 2 Section 3.5.1.3, Turbine Missiles. The COL applicant shall provide the site-specific turbine rotor in-service inspection program and inspection interval consistent with the manufacturers turbine missile analysis.

Turbine Missile Probability Analysis The report provides a calculation of the probability of turbine missile generation using established methods and industry guidance applicable to the fabrication technology employed.

The analysis is a comprehensive report containing a description of turbine fabrication methods, material quality and properties, and required maintenance and inspections ITAAC: The ITAAC associated with this area of review are specified in DC document (DCD)

Tier 1, Section 2.7.1.1, Turbine Generator. The specific ITAAC are given in DCD Tier 1, Table 2.7.1.1-1, Turbine Generator Inspections, Tests, Analyses, and Acceptance Criteria. The design commitments related to turbine generator missiles are as follows:

Design Commitment 8 which states that the Turbine Missile Probability Analysis Report performed by the COL applicant for the as-built T/G exist and concludes that the probability of turbine failure resulting in the ejection of turbine rotor fragments is less than 1x10-5 per year.

Design Commitment 9 which states that the as-built turbine material properties, turbine rotor and blade designs, preservice inspection and testing results and in-service testing and inspection requirements meet the requirements defined in the Turbine Missile Probability Analysis performed by the COL applicant.

TS: There are no TS for this area of review.

Regulatory Basis

1. GDC 4, Environmental and dynamic effects design bases, requires that structures, systems and components (SSCs) important to safety shall be appropriately protected against environmental and dynamic effects, including the effects of missiles that may result from equipment failure. Because turbine rotors have large masses and rotate at relatively high speeds during normal reactor operation, failure of a rotor may result in the generation of high-energy missiles, which may affect the proper function of safety systems. To satisfy GDC 4, turbine rotor integrity must be maintained to minimize the probability of turbine rotor failure.

10-14

2. SRP Section 10.2.3, Revision 2, Turbine Rotor Integrity, provides guidance to achieve integrity of the turbine rotor. Specifically, SRP Section 10.2.3 provides criteria to ensure that the turbine rotor materials have acceptable fracture toughness and elevated temperature properties to minimize the potential for failure. In addition, these criteria will ensure that the rotor is adequately designed and will be receiving preservice inspections and periodic in-service inspections to monitor potential degradation.

Technical Evaluation The APR 1400 DCD does not specify a turbine design. In a letter dated August 4, 2015, (ML15216A447) the applicant stated that the APR1400 DCD does not specify a turbine design in order to provide COL applicants the flexibility to use any of the three principal designs described in that letter, provided the turbine vendors and COL applicants turbine missile probability analysis meets the regulatory and DCD criteria. Therefore, the APR1400 DCD requires that a COL applicant referencing the APR1400 DCD submit their plant-specific turbine missile probability analysis including as-built material properties to the NRC.

Several COL Information Items (i.e., COL Item 10.2(1), COL Item 10.2(3) and COL 10.2(4)) are provided in the APR1400 DCD to ensure the information is provided by the COL applicant, and are evaluated by the staff below.

COL 10.2(1) states that the COL applicant is to identify the turbine vendor and model. Since a turbine is not specified, providing the turbine model and vendor will establish the turbine design so that the appropriate turbine missile analysis can be performed and evaluated by the staff and, therefore, the staff finds COL Information Item 10.2(1) acceptable.

COL Information Item 10.2(3) states that the COL applicant is to provide a description of how the turbine missile probability analysis conforms to DCD Section 10.2.3.6 to ensure that requirements for protection against turbine missiles (e.g., applicable material properties, method of calculating the fracture toughness properties per SRP Section 10.2.3 Acceptance Criteria, preservice inspections) will be met. In its letter dated August 4, 2015, the applicant expanded on this COL Information Item to include the following:

If the turbine vendor has performed a turbine missile analysis that has been reviewed and approved by the NRC for a rotor design relevant to the COL applicant's selected design, then the COL should reference the analysis. If an approved analysis is not available, then the COL applicant shall prepare and reference an analysis that provides confidence that the final analysis performed with as-built properties, when available, will be sufficient to demonstrate assurance of turbine rotor integrity.

This revision to COL Information Item 10.2(3) was included in Revision 1 of the APR1400 DCD.

The staff finds this COL Information Item in Revision 1 of the APR1400 DCD acceptable since COL Information Item 10.2(3) specifies that the COL applicant will provide either an NRC-approved turbine missile analysis or a bounding turbine missile analysis for staff review that demonstrates the turbine rotor meets the requirements of Regulatory Guide (RG) 1.115 and SRP Sections 3.5.1.3 and 10.2.3.

In its letter dated August 4, 2015, the applicant provided a new COL Information Item 10.2(4),

which states:

10-15

The COL applicant shall specify the turbine rotor material properties for the chosen turbine vendor and applicable for the specific rotor designs. The COL applicant shall specify the turbine rotor material properties (in terms of the 50 percent FATT and Charpy V-notch energy tests performed in accordance with ASTM A-370) for the chosen turbine vendor and applicable for the specific rotor designs. Any deviation from material properties in SRP Section 10.2.3, revision in effect on date of regulatory applicability for COL application, shall be identified and justified (COL Information Item 10.2(4)).

The addition of COL Information Item 10.2(4) was included in Revision 1 of the APR1400 DCD.

The staff finds the new COL Information Item 10.2(4) in Revision 1 of the APR1400 DCD acceptable since COL applicant will provide the turbine rotor material properties once a turbine design is chosen, including the fracture toughness and 50 percent FATT, consistent with the guidance in SRP Section 10.2.3.

Material Specifications DCD Tier 2, Section 10.2.3.1, Material Selection, specifies that the turbine rotors are made from vacuum-treated or re-melted Ni-Cr-Mo alloy steel material that conforms to ASTM A-470, and undesirable elements are controlled to the lowest practical concentrations. In addition, DCD Tier 2, Table 10.2.3-1, Chemical Composition for Ni-Cr-Mo-V Alloy Steel Designation, provides the chemical composition of the alloy steel. The staff determined that Table 10.2-3-1 provides sufficient information concerning the material used for the LP turbine rotors in accordance with SRP Section 10.2.3 to assess its acceptability for turbine rotor integrity.

Therefore, the staff finds the turbine rotor will use materials that provide uniform strength and homogeneity; furthermore, the COL applicant will provide the as-built turbine rotor material properties, including the fracture toughness and 50 percent FATT based on COL Information Item 10.2(4).

For the reasons described above, the staff finds that the material specification and associated chemical composition in DCD Tier 2, Table 10.2.3-1, together with the material properties to be provided by the COL applicant, will provide a suitable material for the turbine rotor that will maintain its toughness to resist brittle fracture.

Fracture Toughness DCD Tier 2, Section 10.2.3.2 states that the fracture toughness (KIC) for the actual rotor product is determined using a value of deep-seated FATT based on the measured FATT values from the center bore or trepan specimens from the rotor forging, and a correlation factor obtained from the past manufactured rotor material test data. In addition, DCD Tier 2, Section 10.2.3.2 states that as part of the turbine missile probability analysis, the COL applicant is to identify which of the methods for determining fracture toughness properties of those allowed in SRP Section 10.2.3 acceptance criteria is used. DCD Section 10.2.3.6, which describes the information in the turbine missile analysis to be provided as part of addressing COL Information Item 10.2(3), also specifies that the COL applicant should address methods of determining fracture toughness properties.

The staff finds that the COL applicant will provide the necessary information concerning the fracture toughness properties in the turbine missile probability analysis as described in DCD Section 10.2.3.6 and as part of fulfilling COL Information Item 10.2(3). The staff finds this to be acceptable and consistent with SRP Section 10.2.3.

10-16

Turbine Rotor Design DCD Tier 2, Section 10.2.3.4, Turbine Rotor Design, states that the turbine rotor assembly is designed to withstand normal operating conditions and anticipated transients, including those resulting in turbine overspeed trips, without loss of structural integrity. DCD Section 10.2.3.4 also provides criteria that the turbine assembly should meet, such as designing the turbine rotor to withstand an overspeed level of 120 percent of the rated speed. Since the COL applicant will provide the turbine missile analysis as part of fulfilling COL Information Item 10.2(3), the staff finds that pertinent design information is specified in DCD Section 10.2.3.4, and will be used in preparing the turbine missile probability analysis as detailed in DCD Section 10.2.3.6 in order to meet the guidance in RG 1.115, Protection Against Low-Trajectory Turbine Missiles.

Preservice Inspection The turbine rotor forgings are rough machined prior to heat treatment and a visual, surface, and 100 percent volumetric (ultrasonic) examination will be performed using procedures and acceptance criteria equivalent to those specified for Class 1 components in ASME Code Sections III and V. The preservice inspection description is acceptable to the staff because it includes a 100 percent volumetric inspection and surface inspection (magnetic particle or liquid penetrant) performed using criteria equivalent to Class 1 acceptance criteria in the ASME Code, Sections III and V. The acceptance criteria are considered appropriate to ensure the initial integrity of the turbine rotor and conform to the guidance in SRP Section 10.2.3.

Therefore, the initial turbine rotor condition provides a baseline for future in-service inspections to ensure that flaws will not propagate resulting in the fracture of the turbine rotor and generation of potential missiles.

In-service Inspection DCD Tier 2, Section 10.2.3.5, Inservice Inspection, states that the turbine rotor in-service inspection program uses visual, surface, and volumetric examination to inspect the turbine rotor assembly. It then states that the COL applicant shall provide the site-specific turbine rotor in-service inspection program and inspection interval consistent with the manufacturers turbine missile analysis. However, there is no COL information item for providing this in-service inspection program or the turbine valve in-service test program. Therefore, the staff requested in RAI 288-8328 (ML15307A003), Question 10.02.03-1, that an applicable COL information item be added to the DCD which specifies that the COL applicant shall provide the site-specific turbine rotor in-service inspection program and inspection interval.

In response to RAI 288-8328, (ML15351A155), the applicant revised COL Item 10.2(3) to clarify that the turbine missile probability analysis takes into account in-service inspection and testing.

The applicants response did not, however, specify that the COL applicant will provide the site-specific turbine rotor in-service inspection program and inspection interval. Therefore, in follow-up RAI 414-8531 (ML16053A126), Question 10.02.03-2, the staff requested that an applicable COL information item be added to ensure the COL applicant provides this information. In response to RAI 414-8531, Question 10.02.03-2, (ML16081A358), the applicant added COL Item 10.2(5) to the APR1400 DCD which ensures that the COL applicant will provide the site-specific turbine rotor in-service inspection program and inspection interval, including the turbine valve test and inspection program and test and inspection frequency consistent with the manufacturers turbine missile analysis. The staff finds this additional COL Item 10.2(5) included in Revision 1 of the ARP1400 DCD will ensure that the necessary information will be 10-17

provided by the COL applicant consistent with the guidelines in SRP Section 10.2.3, Paragraphs I.5 and II.5. In addition, implementation of the inspection and test program provided in COL Item 10.2(5) prior to fuel load ensures that this inspection and test program will be in place so that the probability of turbine failure resulting in a turbine missile will continue to be less than 1x10-5 per reactor-year consistent with the guidance of RG1.115.

The staff finds the in-service inspection of the turbine rotor in Revision 1 of the APR1400 DCD is acceptable, since it meets the guidelines of SRP Section 10.2.3 to ensure that the turbine rotor integrity is maintained to preclude the generation of missiles, as required by GDC 4 of 10 CFR Part 50, Appendix A.

Turbine Missile Probability Analysis As previously noted, the APR1400 DCD does not include a specific turbine design or type of rotor (e.g., monoblock). To ensure the COL applicant will have a suitable turbine missile probability analysis, the DCD includes COL Information Items and ITAAC to direct the COL applicant to evaluate the turbine using established methods and industry guidance applicable to the fabrication technology employed. In its letter dated August 4, 2015, the applicant stated that the APR1400 DCD will be revised to require the COL applicant to reference an approved turbine design (i.e., previously reviewed and accepted by the NRC) that is applicable to the APR1400 or, for a design not previously approved, perform an analysis to provide confidence prior to COL approval that the design and associated specifications will ensure acceptable turbine integrity once the as-built analysis can be performed. This pre-as-built analysis would be incorporated by reference in the COL, facilitating NRC review in support of COL approval. Revision 1 of the APR1400 DCD was revised to clarify COL Item 10.2.5(3) as stated above. Final verification of as-built turbine acceptability will still be provided through several ITAAC in Tier 1 Table 2.7.1.1-1.

The APR1400 DCD, Tier 2, Section 10.2.3.6 states that the probability of turbine missile generation is less than 1x10-5 per reactor-year for the APR1400 design. This probability of turbine missile generation is lower than that specified by the guidance in SRP Section 3.5.1.3, Table 3.5.1.3-1 for loading the turbine and bringing the plant on line. This probability is to be confirmed by calculation and/or analysis in the turbine missile probability analysis in accordance with ITAAC. In addition, APR1400 DCD Section 10.2.3.6 provides the information the turbine missile probability analysis will evaluate in order to meet the guidance in RG 1.115 and SRP Sections 3.5.1.3 and 10.2.3. The NRC staff finds that the specified value of less than 1x10-5 per reactor-year for the APR1400 probability of turbine missile generation is acceptable because this value is lower than that specified by the guidance in SRP Section 3.5.1.3; furthermore, the staff finds that COL Information Item 10.2(3) will ensure the COL provides a turbine missile probability analysis.

ITAAC The staff also reviewed DCD Tier 1, Table 2.7.1.1-1, which provides the inspections, tests, analysis, and acceptance criteria regarding the turbine rotor. There are two commitments numbered 8 and 9.

ITAAC Commitment No. 8 states that turbine missile probability analysis performed by the COL applicant for the as-built T/G exists and concludes that the probability of turbine failure resulting in a turbine missile is less than 1 x 10-5 per turbine-year. The staff finds that ITAAC Commitment No. 8 will ensure that an as-built turbine missile probability analysis will be 10-18

performed and meet the guidance in RG 1.115 in minimizing the potential for generating turbine missiles.

The staff finds that ITAAC Commitment No. 9, as described in Section 10.2.3.2 of this report, will ensure that the as-built turbine rotors, with respect to the turbine material property data, rotor and blade design, and preservice and in-service inspection and testing, will conform to the manufacturer's turbine missile probability analysis.

Combined License Information Items The following is a list of COL information items numbers and descriptions from DCD Tier 2, Table 1.8-2:

Combined License Information Items DCD Tier Item No. Description 2 Section 10.2(1) The COL applicant is to identify the turbine vendor 10.2.2.2 and model.

10.2(3) The COL applicant is to provide a description of how 10.2.3 the turbine missile probability analysis conforms to Subsection 10.2.3.6 to ensure that requirements for protection against turbine missiles (e.g., applicable material properties, method of calculating the fracture toughness properties per SRP Section 10.2.3 Acceptance Criteria, preservice inspections) will be met.

If the turbine vendor has performed a turbine missile analysis that has been reviewed and approved by the NRC for a rotor design relevant to the COL applicant's selected design, then the COL should reference the analysis. If an approved analysis is not available, then the COL applicant shall prepare and reference an analysis that provides confidence that the final analysis performed with as-built properties, when available, will be sufficient to demonstrate assurance of turbine rotor integrity.

10.2(4) The COL applicant shall specify the turbine rotor 10.2.3.1 material properties for chosen turbine vendor and applicable for the specific rotor designs. The COL applicant shall specify the turbine rotor material properties (in terms of the 50 percent FATT and Charpy V-notch energy) for the chosen turbine vendor and applicable for the specific rotor designs. Any deviation from material properties in SRP 10.2.3, 10-19

DCD Tier Item No. Description 2 Section revision in effect on date of regulatory applicability for COL application, shall be identified and justified.

10.2(5) The COL applicant shall provide the site-specific 10.2.3.5 turbine rotor in-service inspection program and inspection interval, including the turbine valve test and inspection program and test and inspection frequency consistent with the manufacturers turbine missile analysis.

The staff evaluated, in Section 10.2.3.4 of this SER above, whether sufficient COL information items were identified in Table 1.8-2 of the APR1400 DCD.

Conclusion The staff concludes that the integrity of the turbine rotor will be acceptable, including the information to be provided by the COL applicant based on the applicable COL information items, and will meet the requirements of GDC 4, since the turbine rotor assemblies will be conservatively designed and will use suitable materials with acceptable fracture toughness that will be inspected before and during service. Maintaining rotor integrity provides reasonable assurance that the probability of generating a turbine missile from a turbine rotor failure is low during normal operation, including transients up to design overspeed. The staff also concludes that the applicant has established ITAAC to perform proper inspection and testing of the turbine to ensure the probability of turbine failure resulting in a turbine missile is less than 1 x 10-5 per turbine-year consistent with RG 1.115.

10.3 Main Steam System 10.3.1 Design, Components, and Operation Introduction The main steam system (MSS) transfers steam produced in the steam generators (SGs) to the high pressure turbine. The MSS also provides steam to the second stage steam reheaters, deaerator pegging steam (for startup), and backup auxiliary steam. The MSS extends from the SGs steam outlet nozzles to the turbine SVs and includes safety and nonsafety-related components. The safety-related portion of the MSS is the portion between the SG nozzle outlet to and including the main steam valve house (MSVH) penetration anchor wall. The safety-related components of the MSS consist of main steam isolation valves (MSIVs), main steam safety valves (MSSVs), main steam atmospheric dump valves (MSADVs), and piping and valves in the main steam supply lines up to and including MSVH penetration anchor wall.

Summary of Application DCD Tier 1: The MSS is described in DCD Tier 1, Section 2.7.1.2, Main Steam System, and in Table 2.7.1.2-1, Main Steam System Equipment and Piping Location/Characteristics." The basic configuration of the system is shown in DCD Tier 1 Figure 2.7.1.2-1, Main Steam 10-20

System, and equipment, component, and instrumentation data are listed in Table 2.7.1.2-1, Main Steam System Equipment and Piping Location/Characteristics, Table 2.7.1.2-2, Main Steam Components List, and Table 2.7.1.2-3, Main Steam System Instrumentation List, respectively.

DCD Tier 2: DCD Tier 2, Section 10.3, Main Steam System, provides supplemental system information to Tier 1. DCD Tier 2, Section 10.3.1, Design Basis, indicates the following functions of the MSS include:

1. Under accident conditions, the MSS isolates the steam generators and the safety-related portion of the system from the nonsafety-related downstream piping and components, such as the nonsafety-related main turbine.
2. The MSS provides initial residual heat removal (RHR) under accident conditions by venting steam to the atmosphere.
3. The MSS dissipates heat from the reactor coolant system (RCS) following a turbine and reactor trip, and also when the main condenser is not available.
4. The MSS conforms to applicable design codes.
5. The MSS permits visual inspection.
6. The MSS provides steam for the auxiliary feedwater pumps.
7. The MSS provides adequate overpressure protection for the SGs and MSS.

The safety-related portions of the MSS are designed to perform their required functions during normal conditions, adverse environmental occurrences, and accident conditions, including a loss of offsite power (LOOP) with a single malfunction or failure of an active component.

ITAAC: ITAAC criteria for the MSS are given in DCD Tier 1, Table 2.7.1.2-4, Main Steam System ITAAC.

TS: The TS for the MSS components are identified in DCD Tier 2, Chapter 16, Technical Specifications.

Regulatory Basis NRC regulations for this area of review and the associated acceptance criteria are listed in NUREG-0800, Section 10.3, Main Steam Supply System, and are summarized below. Review interfaces with other SRP sections are also provided in SRP Section 10.3, Item I, Review Interfaces.

1. GDC 2, Design bases for protection against natural phenomena, as it relates to safety-related portions of the system being capable of withstanding the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, and floods.
2. GDC 4,Environmental and dynamic effects design bases, with respect to safety-related portions of the system to withstand the effects of external missiles, internal missiles, pipe whip, and jet impingement forces associated with pipe break.

10-21

3. GDC 5, Sharing of structures, systems and components, as it relates to the capability of shared systems, structures and components (SSCs) important to safety to perform required safety functions.
4. GDC 34, Residual heat removal, as it relates to the system function of transferring residual and sensible heat from the reactor system in indirect-cycle plants.
5. 10 CFR 50.63, Loss of All Alternating Current, as it relates to the ability of a plant to withstand for a specified duration and then recover from a station blackout (SBO).
6. 10 CFR 52.47(b)(1), which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and NRC regulations.

Also considered was:

1. 10 CFR 20.1406 which requires that applicants describe how facility design and procedures shall minimize, to the extent practicable, contamination of the facility and the environment.

Technical Evaluation The staff reviewed the MSS design, described in DCD Tier 1 and Tier 2 sections, in accordance with SRP Section 10.3. As described above in the regulatory basis of this report, the acceptability of the system is based on meeting the requirements of the GDC and the SRP acceptance guidance DCD Tier 1, Section 2.7.1.2.1, Design Description, provides a brief description of the MSS safety-related portion of the system which consists of the main steam piping and valves located between the steam generator outlet nozzles in the containment up to and including the main steam isolation valves (MSIVs) in the main steam valve houses (MSVHs). The MSS has the following safety-related functions:

To supply steam to the auxiliary feedwater pump turbine; to protect the steam generator and pressure boundary components in the MSS from overpressurization; to cooldown the RCS through a controlled discharge of steam to the atmosphere; and to isolate the containment and SGs.

Also, DCD Tier 1, Section 2.7.1.2.1, Design Description, provides a brief description of the functions of nonsafety-related portions of the MSS located downstream of the MSIVs, and within the auxiliary building and the turbine building. Further, DCD Tier 1, Section 2.7.1.2.1 and Table 2.7.1.2-1, Main Steam System Equipment and Piping Location/Characteristics, provides functional descriptions and identifies ASME class and seismic categories of the MSS piping and valves.

A detailed design description of the APR1400 MSS is provided in DCD Tier 2, Section 10.3.2.1, General Description. The primary function of the MSS is to transport high pressure steam 10-22

from the SGs to the HP turbine. The secondary function of the system is to supply steam to the main feedwater pump turbines, auxiliary feedwater pump turbines, second stage of the moisture separator reheater (MSR), deaerator pegging steam (during startup), and auxiliary steam system. This secondary steam supply is provided from the main steam lines upstream of the turbine SVs. The MSS consists of safety-related, as well as nonsafety-related portions. The safety-related portions of the MSS include piping and valves between each SG outlet nozzle and the MSVH penetration wall anchor. The remainder of the system and equipment including main turbine are nonsafety-related. Under accident conditions, the MSS isolates the SGs and the safety-related portion of the system from the nonsafety-related portions.

The MSS consists of two SGs; main T/G, including MSR; and associated piping, valves, and instrumentation. Each of the two SGs has two steam lines connecting to the SG outlet nozzle and terminating in the turbine building at each of four turbine stop valves. Each steam line exits the reactor building, passes into a divisional valve room, and is routed across a pipe bridge into the turbine building. A flow diagram of the system is provided in DCD Tier 2, Figure 10.3.2-1, Main Steam System Flow diagram, and Figure 10.3.2-2, Turbine System Flow Diagram.

Major MSS components include, but are not limited to, the MSSVs, MSADVs, MSIVs, and turbine SVs. Five spring-loaded MSSVs are supplied per steam line and are normally closed during operation. These valves provide overpressure protection for the SGs and main steam piping and discharge directly to the outside atmosphere. The MSSVs are designed to ASME Section III, Class 2, Seismic Category I requirements. One MSADV is installed on each steamline in order to remove heat from the reactor coolant system and is used for emergency cooldown in conjunction with the auxiliary feedwater system. The MSADVs are designed to ASME Section III, Class 2, Seismic Category I requirements and are sized to allow a controlled plant cooldown in the event of a steamline break or steam generator tube rupture. The main turbine stop and CVs and the valves associated with the reheaters are described in DCD Tier 2, Section 10.2, Turbine Generator.

With respect to design standards for MSS piping and components, SRP Section 10.3, Subsection III, Review Procedure, Item 3 indicates that the essential portions of the MSS should be designed to Quality Group B and/or Seismic Category I requirements. The U.S.

APR1400 main steam lines, from the SGs up to and including the MSVH penetration wall anchor, are designed and constructed in accordance with Quality Group B and Seismic Category I, which the staff finds acceptable as the APR1400 proposed design is in accordance with the SRP guidelines and RG 1.29, Seismic Design Classification, regulatory position C1.

Further, the DCD states that the remaining MSS piping up to the turbine stop valve and second stage reheaters will be designed in accordance with ASME Code B31.1, Power Piping Code, which the staff finds acceptable, because this complies with power piping codes and standards (see Section 3.2.2, System Quality Group Classification, of this report). Furthermore, DCD Tier 2, Table 3.2-1 provides the quality group and seismic design classification details of components and equipment of the MSS.

ASME Section III, Class 2 piping is inspected and tested in accordance with ASME Sections III and XI. ANSI/ASME B31.1 piping is inspected and tested in accordance with ANSI/ASME B31.1 Code. A description of periodic inservice inspection and inservice testing of ASME Section III, Class 2 and 3 components is provided in DCD Tier 2, Subsection 3.9.6 and Section 6.6, In-service Inspection of Class 2 and 3 Components. Safety-related active components in the MSS are designed to be tested during plant operation. Provisions are made to allow for inservice inspection of components at times that are consistent with those specified in ASME Section XI.

10-23

MSIVs are located just outside containment in valve rooms. These valves isolate the steam generators in the event of excessive steam flow to prevent reactor over-cooling. The MSIVs, including the main steam isolation valve bypass valves (MSIVBVs), are interlocked to close upon initiation of a main steam isolation signal (MSIS). The parameters that initiate an MSIS are given in DCD Tier 2, Section 7.3, Functional Design, Qualification, and Inservice Testing Programs for Pumps, Valves, and Dynamic Restraints. During normal operation, the MSIVs are held open by hydraulic oil pressure. MSIV pilot solenoid valves are normally closed and only energized to open the MSIV. Therefore, on loss of either hydraulic pressure or electric power, the MSIVs will fail closed. The staff reviewed DCD Tier 2, Section 10.3, but could not verify the valve closure times or whether the MSIVs and shutoff valves in connected piping are capable of closing against maximum steam flow. Therefore, the staff issued RAI 463-8570, Question 10.03-05 (ML16110A018), requesting the applicant to provide a tabulation and descriptive text of all flowpaths that branch off the main steamlines between the MSIVs and turbine SVs as specified by SRP 10.3, Section III.5.E. This was identified as Open Item 10.3-1.

In its response to RAI 463-8570, Question 10.03-5 (ML16175A680), the applicant included a table of branch piping of the MSS. The staff verified that the valves located in the branch piping are capable of closing against the maximum expected steam flow, and the valve closure times are consistent with the Chapter 15 transient analysis assumptions. The staff determined that the applicants response is acceptable because the design of the branch piping and associated valves will preclude the blowdown of more than one steam generator during a main steamline break as discussed in SRP 10.3, Section III.5.E. Therefore, Open Item 10.3-1 is considered resolved and closed. The staff verified that the DCD markups provided in the applicants response to RAI 463-8570, Question 10.03-5, have been incorporated into Revision 1 of the DCD.

Auxiliary steam from the MSS has the non-safety function of supplying turbine gland steam during startup and the second-stage reheater tube side of the MSR. Backup sources of auxiliary steam are used during startup and during low-power operation. Also, DCD Tier 2, Subsections of 10.3 provides details on MSS sampling, and Tables 10.3.5-4, Secondary Sampling/Laboratory Analysis Frequencies During Normal Power Operation, and 10.3.5-5, Secondary Sampling/Laboratory Analysis During Plant Startup and Wet Layup, identify the recommended secondary sampling and laboratory analysis frequencies during normal operation and startup/wet layup, respectively.

The MSS operational aspects are provided in DCD Tier 2, Section 10.3.2.3, System Operation, which includes brief descriptions during plant startup, normal operation, abnormal operations, and shutdown operations. An evaluation of the MSS abnormal and anticipated operational occurrences is described in DCD Tier 2, Chapter 15, Transient and Accident Analyses, of the application where the APR1400 responses to several postulated accidents are considered including an evaluation of a main steamline break, feedwater line break, and SG tube rupture (SGTR). For this reason, this section of the report does not cover these accident analyses.

In the event of a steam line break, feedwater line break, or SGTR, the MSIVs are automatically signaled to close upon receipt of the main steam line isolation signal (MSIS). Monitored variables that provide inputs to the MSIS include containment pressure, SG pressure, and SG level. The staff evaluation of the controls regarding the MSIV isolation is included in Section 7.3, Engineered Safety Features Systems, of this report.

10-24

In DCD Tier 2, Section 10.3.3, Safety Evaluation, the applicant provided its evaluation of the safety-related portions of the MSS and its compliance with the requirements of the GDC identified in the Regulatory Basis for this section. The staff compared the DCD information against these GDC and regulatory requirements in 10 CFR 50.63 regarding SBO and 10 CFR 52.47(b)(1) on ITAAC, and the staff presents its evaluation below.

GDC 2, Design bases for protection against natural phenomena Compliance with GDC 2 is based on meeting the requirements related to the safety-related portions of the MSS being capable of withstanding the effects of natural phenomena. DCD Tier 2, Section 10.3.3 states that safety-related portions of the MSS are located in the reactor containment building and the auxiliary building. The containment and the auxiliary buildings are designed to withstand the effects of natural phenomena, such as hurricanes, floods, tsunamis, earthquakes, and tornadoes, and therefore protect the MSS from these events. The staff reviewed DCD Tier 2, Figure 10.3.2-1 to confirm the locations of the safety-related portions of the MSS as stated by the applicant. However, the staff noted that the discharge piping from the MSADVs and MSSVs are classified as seismic category II, quality group D. Therefore, the staff issued RAI 463-8570, Question 10.03-4 questioning how, with this seismic classification, this section of piping can perform its safety-related function of discharging steam to the atmosphere during a seismic event. This was identified as Open Item 10.3-2 and the staff issued follow-up RAI 530-8714, Question 10.3-7 (ML16326A083).

In its response to RAI 530-8714, Question 10.03-7 (ML17018A375), the applicant specified that KHNP performed a piping analysis on the functional capability of the discharge piping to show that plastic deformation does not occur such that it challenges the safety function of the MSSVs and MSADVs. The general piping system design specification for the APR1400 and NUREG-1367, Functional Capability of Piping Systems, (ML083510056) were applied to the functional capability evaluation. The staff determined the analysis to be reasonable and concludes that the applicant has demonstrated that the functional capability of this piping will be maintained.

For the staffs complete review of APR1400 piping design, including functional capability, see Section 3.12 of this report. In addition, the staff notes the seismic classification of this portion of the MSS is consistent with RG 1.29, Revision 4, Regulatory Position C1, item f. Therefore, Open Item 10.3-2 is considered resolved and closed.

Based on the above information, the staff determined that the APR1400 MSS design is acceptable as related to withstanding the effects of natural phenomena and, therefore, the staff concludes that the MSS design conforms to the requirements of GDC 2 and meets the guidance of RG 1.29, positions C.1 and C.2.

GDC 4, Environmental and dynamic effects design bases With respect to the requirements of GDC 4, the DCD states that the safety-related portions of the MSS are designed to withstand the effects of external missiles, as well as internally-generated missiles, pipe whip, and jet impingement forces from postulated pipe breaks. Also, the safety-related portions of the MSS outside containment are to be protected from internal missiles and other dynamic piping effects by separated valve rooms so that, at most, only one valve room is affected. The T/G is oriented to direct potential turbine missiles away from the MSS such that the MSS is protected against turbine missiles. The DCD describes that the safety-related and nonsafety-related portions of the system are separated by a fixed seismic anchor to ensure that non-seismic piping does not impact the safety system. The staff reviewed the DCD and determined that the fixed anchor points between the nonsafety-related and safety-10-25

related piping, and the appropriate turbine orientation will provide protection against dynamic affects.

Further, regarding the GDC 4 requirements, the applicant addressed consideration of steam and water hammer and relief valve discharge load effects on the MSS and included COL Item 10.3(1) for the COLA to develop operating and maintenance procedures to address the potential for water hammer. However, neither COL Item 10.3(1) nor DCD Tier 2, Section 10.3 include the attributes to be included in the procedure. The staff issued RAI 122-8053 (ML15209A461),

Question 10.03-1, requesting the applicant to list the items to be incorporated into operating and maintenance procedures consistent with NUREG-0927, Evaluation of Water Hammer Occurrence in Nuclear Power Plants (ML071030267). The applicant provided its response to RAI 122-8053, Question 10.03-1 (ML15301A864), and as a result removed existing text from COL Item 10.3(1), and did not include the requested information. The staff found the response to be unacceptable. Therefore, the staff issued RAI 464-8575 (ML16110A019), Question 10.03-6 requesting the applicant to list the items to be incorporated into operating and maintenance procedures consistent with NUREG-0927. This was identified as Open Item 10.3-3.

In its response to RAI 464-8575, Question 10.03-6 (ML16153A487), the applicant provided additional COL information to address potential water (steam) hammer. The staff determined that the applicants response is acceptable because information added to the DCD ensures that the appropriate elements of a procedure to address water (steam) hammer will be incorporated into operating and maintenance procedures, consistent with NUREG-0927. Therefore, Open Item 10.3-3 is considered resolved and closed. The staff verified that the DCD markups provided in the applicants response to RAI 464-8575, Question 10.03-6, have been incorporated into Revision 1 of the DCD.

Based on the above information the staff determined that the MSS design is acceptable and conforms to the requirements of GDC 4 regarding protection from dynamic effects, including water (steam) hammer, and meets the guidance of RG 1.115, position C.1.

GDC 5, Sharing of structures, systems, and components GDC 5 contains provisions restricting the sharing of structures, systems, and components important to safety between nuclear power units. The MSS in the APR1400 design is not shared between or among other nuclear units. Therefore, the requirements of GDC 5 are met.

GDC 34, Residual heat removal The MSS is designed with redundancy to provide sufficient cooldown capacity assuming a single failure. Taking into account a single failure, the MSS is still capable of providing heat sink capability for the reactor, both residual and sensible; providing pressure relief for the shell side of the steam generator and main steam lines upstream of the MSIVs; and providing steam to the steam-driven safety-related auxiliary feedwater pumps necessary for safe shutdown. In response to RAI 122-8053, Question 10.03-2 (ML15301A864), the applicant clarified that there are no isolation valves in the main steam lines between the SGs and the MSSVs. Based on the information above, the staff finds that the MSS design conforms to the requirements of GDC 34 with respect to the system function of transferring residual and sensible heat from the reactor coolant system.

10-26

10 CFR 50.63, Loss of all alternating current power DCD Tier 2, Section 10.3.3 states that the safety-related portions of the MSS are designed to perform their safety functions during a station blackout (SBO) event; however, the application lacked information sufficient to confirm the capability of the MSS to cope with and recover from an SBO event. Therefore, the staff issued RAI 122-8053, Question 10.03-3 (ML15209A461),

requesting the applicant to provide additional design and operating details about the MSS and its components. The applicant stated in response to RAI 122-8053, Question 10.03-3 (ML15301A864) that, during an SBO event, Class 1E onsite DC power is available and an alternate ac (AAC) source will be connected to the shutdown bus within 10 minutes from the onset of the SBO. Further, in the event of total loss of power, each MSADV can be operated locally, either by handwheel or by manual operation of the hydraulic actuator mounted on the valve. The staff finds the applicants response acceptable because the safety-related portions of MSS are designed such that they perform their safety function and the system has sufficient capability to cope with an SBO. Therefore, the portion of SBO mitigation provided by the MSS is adequate, and the staff concludes the requirements of 10 CFR 50.63, as related to the MSS, are met. Therefore, RAI 122-8053, Question 10.03-3 is considered closed. Further staff evaluation of the SBO event is in Section 8.4 of this report.

10 CFR 20.1406, Minimization of contamination Title 10 CFR 20.1406 requires, in part, that each design certificate applicant describe how the facility design and procedures for operation will minimize, to the extent practicable, contamination of the facility and environment, as well as the generation of radioactive waste.

DCD Tier 2, Section 10.3.2.4, Design Features for Minimization of Contamination, states that the MSS includes components that may contain radiologically contaminated fluid resulting from a steam generator tube leakage. The applicant performed a leakage identification evaluation which indicated that the MSS is designed to facilitate early leak detection and the prompt assessment and response to manage collected fluids.

Features for prevention and minimization of unintended contamination, and reduction of cross-contamination, decontamination, and waste generation include the use of radiation monitors on the main steamlines, and steam generator blowdown lines. These monitors will alert operators to the possibility of a steam generator tube rupture. Additional design features include piping that is sloped in the direction of steam flow to avoid water entrenchment and collection of condensate drainage.

The staff reviewed DCD Tier 2 Section 10.3.2.4, as related to prevention and minimization of the contamination. Because the APR1400 DCD design provides adequate measures for early leak detection and controls in the MSS design to minimize contamination as described above, the staff concludes that the system as described in the DCD conforms to 10 CFR 20.1406.

Initial Test Program Although applicants for DC are not required to submit plans for an initial test program, RG 1.68 acknowledges that DC applicants have previously submitted these plans to assist a future COL applicant referencing the DC in meeting the requirements of 10 CFR 52.79(a)(28).

Preoperational test requirements for the MSS are located in DCD Tier 2 Section 14.2.12.1.63, Main Steam Safety Valve Test; Section 14.2.12.1.64, Main Steam Isolation Valves and MSIV Bypass Valves Test; Section 14.2.12.1.65, Main Steam System Test; and Section 14.2.12.4.15, Main Steam Atmospheric Dump and Turbine Bypass Valves Capacity Test.

10-27

The initial test program for the APR1400 is evaluated in Section 14.2 of this SER.

ITAAC The proposed ITAAC for the MSS are given in DCD Tier 1, Table 2.7.1.2-4, Main Steam System ITAAC. The staffs review for the MSS Tier 1 information included review of descriptive information; safety-related functions; arrangement; mechanical, I&C and electric power design features; and environmental qualification as well as system and equipment performance requirements provided in DCD Tier 1, Section 2.7.1.2. The ITAAC for the MSS verify the principal design features and functional capabilities of the system by verifying the system functional arrangements; ASME Code Data report generation; ASME compliant welding; ASME pressure testing; seismic Category I equipment being able to withstand seismic design basis loads; Class 1E equipment qualification for harsh environment; Class 1E power supply; physical separation and electrical isolation of Class 1E divisions in accordance with RG 1.75; valve performance; system alarms, controls and displays; physical separation of mechanical divisions by a fire barrier; and environmental qualification of non-metallic parts, materials, and lubricants in safety-related mechanical equipment. The staff finds that all the necessary MSS equipment has been adequately identified in the applicable tables. Based on its review, the staff finds that the DCD Tier 1 information and ITAAC requirements adequately describe the design certification requirements for the MSS. Further the staff concludes that the ITAAC requirements are sufficient to demonstrate that if the ITAAC are satisfied, the MSS has been constructed and will operate in accordance with the design certification, the provisions of the Atomic Energy Act of 1954, and NRC regulations as required by 10 CFR 52.47(b)(1).

A discussion of all APR1400 ITAAC is provided in Section 14.3 of this SER.

Technical Specifications The staff reviewed DCD Tier 2, Chapter 16, TS 3.7.1, TS 3.7.2, and TS 3.7.4 for applicability to the main steam system. These TS provide limiting conditions for operation and surveillance requirements for the MSSVs, MSIVs, and MSADVs. The staff also reviewed the associated TS bases and found the description to be consistent with the DCD Tier 2 description of the components. The staff concludes that TS 3.7.1, TS 3.7.2, and TS 3.7.4 appropriately address the limiting conditions for operation and surveillance requirements for the MSSVs, MSIVs, and MSADVs. For the staffs complete review of TS and associated bases see Chapter 16 of this report.

Combined License Information Items The following is a list of COL information item numbers and descriptions from DCD Tier 2 Section 10.3.7:

Combined License Information Items DCD Tier Item No. Description 2 Section 10.3(1) The COL applicant is to provide operating and 10.3.2.3.5 maintenance procedures in accordance with NUREG-0927 and a milestone schedule for implementation of the procedure.

10-28

10.3(2) The COL applicant is to establish operational 10.3.6.3 procedures and maintenance programs as related to leak detection and contamination control.

This is Subsection 10.3.6. Due to the numbering convention used by the applicant this is reserved for SER Section 3.6 which is located below.

Conclusion The staff determined that the APR1400 MSS design is acceptable because it meets appropriate regulatory requirements including GDC 2 regarding protection from natural phenomena, GDC 4 regarding protection against missiles and effects of pipe breaks, GDC 5 regarding shared systems, GDC 34 regarding the removal of residual heat, 10 CFR 50.63 regarding the ability of the plant to cope with a station blackout, 10 CFR 20.1406 regarding the minimization of contamination, and 10 CFR 52.47(b)(1) regarding ITAAC.

10.3.2 [See Section 10.3.1.4 of This Report]

10.3.3 [See Section 10.3.1.4 of This Report]

10.3.4 [See Section 10.3.1.4 of This Report]

10.3.5 [See Section 10.3.1.4 of This Report]

10.3.6 Steam and Feedwater System Materials Introduction This section evaluates the material used in the main steam and feedwater systems including aspects of flow accelerated corrosion (FAC).

Summary of Application The main steam and feedwater systems in the APR1400 power plant provide feedwater to the steam generators and direct steam from the SGs to the main turbine. Additionally, the main steam and feedwater systems provide two Engineered Safety Features (ESF) functions: 1) the MSS delivers steam to the auxiliary feedwater pump and 2) both systems have isolation valves which ensure containment integrity in the event of a containment isolation signal. The applicant has provided a Tier 2 description of the main steam and feedwater systems materials in DCD Tier 2 Revision 3, Section 10.3.6, Steam and Feedwater System Materials, which is summarized herein.

System Design and Codes of Construction The main steam and feedwater systems contain safety-related ASME Code Section III, Class 2 and Class 3 components and non-safety-related ASME B31.1, Power Piping, components.

The individual classification of systems, structures, and components is presented in DCD Tier 2, Table 3.2-1. Transitions between codes of construction are shown in DCD Tier 2, Figures 10.3.2-1 and 10.4.7-1. The staffs review of conformance to 10 CFR 50.55a(c)-(e) and the adequacy of system classification is evaluated in SER Section 3.2.

10-29

The applicant commits to meeting all requirements of ASME Code, Section III for safety-related portions of the main steam and feedwater systems. ASME Code, Section III Code Cases are not used for the design of any components in the main steam and feedwater systems. By committing to meeting the requirements of the ASME Code, Section III, components will meet the fracture toughness and non-destructive examination requirements detailed in ASME Code, Section III, Subsections NC and ND. The applicant commits to meeting ASME Section III, Appendix D, Article D-1000 concerning preheat temperatures for welding of ferritic steels.

Material specifications for main steam and feedwater system components are provided in DCD Tier 2, Tables 10.3.2-2, 10.3.2-3, and 10.3.2-4 and are summarized as follows:

Component Materials A/SA-106 Gr. B SA-105 A-672 Gr. B60 A/SA-106 Gr. C SA-234 WP22 A-672 Gr. B70 A/SA-234 WPB SA-333 Gr. 6 A/SA-234 WPC SA-335 Gr. P22 The A/SA designation denotes materials/components procured to identical material specifications but different Quality Assurance (QA) requirements (i.e., ASME NQA-1 Quality Assurance Requirements for Nuclear Facility Applications for ASME Code components/materials, and ASME B31.1, Mandatory Appendix J for ASTM components/materials utilizing ASME B31.1).

Material Degradation The materials selected by the applicant fit into two general categories: chrome-molybdenum (alternately chrome-moly) steels (material specifications SA 335 Gr P22, SA-234 WP22) and carbon steels (remainder of the material specifications).

The entirety of the main steam piping is made from carbon steel. An additional 0.035 inches (0.889cm.) of material is added to the thickness of components as a general corrosion allowance.

The majority of components in the feedwater system is made from carbon steel. The carbon steel portions of the system have an additional 0.06 (0.15 cm.) inches of material added to the thickness of components as a general corrosion allowance. Components in the feedwater system between the main feed isolation valve and the steam generator are fabricated from chrome-moly steels. The chrome-molybdenum steel components do not have a corrosion allowance added to the thickness of the components.

The auxiliary feedwater (AFW) system, which is further described in DCD Tier 2, DCD Section 10.4.7 as a system primarily fabricated from austenitic stainless steel, is connected to feedwater system between the feedwater isolation valve and the SGs.

Prevention and Management of Flow Accelerated Corrosion 10-30

The applicant provides a description of the Flow Accelerated Corrosion (FAC) program for the APR1400 in DCD Tier 2, Section 10.3.6.3. The APR1400 FAC program is based on EPRI NSAC-202L-R3, Recommendations for an Effective Flow-Accelerated Corrosion Program.

Prevention of FAC is integrated in the design of the APR1400 by: selective use of chrome-molybdenum steels in locations where FAC is a significant concern, eliminating high turbulence points, optimizing flow near orifices to reduce the potential for cavitation, using long-radius elbows in piping systems, smoothing transitions of shop and field welds, and selecting pipe diameters which correspond to industry suggested flow velocities. The design of the APR1400 plant integrates FAC operating experience from the OPR1000 nuclear plants located in South Korea.

Regulatory Basis The staff reviewed APR1400 DCD Tier 2, Revision 1, Section 10.3.6, in accordance with NUREG-0800, Section 10.3.6, Revision 3. In the APR1400 DCD, Tier 2, Revision 1, Section 10.3.6, the applicant described the selection, fabrication, and compatibility of materials with the feedwater and MSS environments. The staff based its review of DCD Tier 2, Revision 1, Section 10.3.6 and its acceptance criteria on the relevant requirements in GDC 1 and 35 and on those in Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50.

1. GDC 1, Quality standards and records, and 10 CFR 50.55a(a)(1) require that structures, SSCs important to safety be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions they perform.
2. GDC 35, Emergency core cooling, requires a system to provide abundant emergency core cooling. GDC 35 also requires that, during activation of the system, clad metal-water reaction will be limited to negligible amounts.
3. Appendix B to 10 CFR Part 50 mandates that applicants establish quality assurance (QA) requirements for the design, construction, and prevention or mitigation of the consequences of postulated accidents that could cause undue risk to the health and safety of the public.

Technical Evaluation System Design and Codes of Construction The applicant committed to meeting Regulatory Guide (RG) 1.28, Quality Assurance Program Criteria (Design and Construction), RG 1.50, Control of Preheat Temperature for Welding of Low-Alloy Steel, and RG 1.71, Welder Qualification for Areas of Limited Accessibility.

Conformance with the aforementioned RGs is consistent with NUREG-800, Section 10.3.6, with the caveat that RG 1.28 is not mentioned in the SRP. The use of RG 1.28 in lieu of RG 1.37, Quality Assurance Requirements for Cleaning of Fluid Systems and Associated Components of Water-Cooled Nuclear Power Plants, is consistent with staff guidance because the withdrawal notice for RG 1.28 specifies that the updated guidance is found in RG 1.37. SRP Section 10.3.6 will be updated at a future time to reflect the new staff guidance.

The staff reviewed the ASME classifications of the feedwater and MSSs to verify that DCD Tier 2, DCD Section 10.3.6 is consistent with the codes of construction. Portions of the main steam 10-31

and feedwater system which are classified as ASME Code Class 2 or Class 3 SSCs utilize material specifications that are listed in ASME Code, Section II-D, Table 1A. The selection of weld filler materials for ASME Code Class 2 and 3 systems was not provided in the DCD Tier 2 DCD but COL Action 10.3(6) requires the information to be provided as part of a COL. The selection of material specifications is in conformance with the ASME Code. Additionally, the staff performed a consistency check between DCD Tier 2, DCD Section 3 and DCD Section 10.3.6 and found the information to be complete and accurate.

The staff performed a review of the main steam and feedwater systems constructed to the ASME B31.1 code. The selection of this code of construction is consistent with the recommendations in RG 1.26, Quality Group Classifications and Standards for Water-, Steam, and Radioactive-Waste-Containing Components of Nuclear Power Plants, for Quality Category D components. The staff determined that material specifications selected by the applicant are consistent with rules of ASME B31.1.

The staff concludes that the materials selected for the main feedwater and steam system, meet the codes of construction. The staff concludes that the applicants commitment to meeting RG 1.28, RG 1.50, and RG 1.71; ensures that the QA, pre-heat, and welding qualification will meet the regulatory requirements as described in the GDCs.

Material Selection and Degradation The applicant has chosen to construct the main steam and feedwater systems from carbon steel and chrome-molybdenum steel. The material specifications and grades of components in the main steam and feedwater systems are generally consistent with operating nuclear power plants and other certified designs (appendices to 10 CFR Part 52). As such, the degradation mechanisms described in the SRP and in staff guidance, as well as the mitigating measures endorsed by the staff, describe the scope of material concerns for the APR1400 feedwater and main steam systems.

Carbon steels have extensive history in steam and power conversion systems. Operating experience has shown that the material is suitable for steam and elevated temperature water service when controls are provided to prevent material degradation. The applicant will prevent degradation of the carbon steel by controlling the water chemistry. The secondary water chemistry program is evaluated by the staff in SER Section 10.3.5. Control of the secondary water chemistry is sufficient to prevent general corrosion of the feedwater piping. Corrosion of carbon steel in the MSS is not expected because the steam generator design assures high quality steam which is necessary for protection of the turbine. Chrome-molybdenum steels are used in areas of the feedwater system where the applicant predicts that significant FAC may occur. Chrome-molybdenum steels have significant operating experience in steam and power conversion systems and are more corrosion resistant than carbon steel.

The austenitic stainless steel Auxiliary Feedwater System and the secondary Chemical Injection System connects to the feedwater system downstream of the main feed isolation valves and upstream of the SGs. The connection between the chrome-moly feedwater system and the austenitic stainless steel components is a dissimilar metal weld. The applicant commits to meeting RG 1.31, Control of Ferrite Content in Stainless Steel Weld Metal, and RG 1.44, Control of Processing and Use of Stainless Steel for austenitic stainless steel components that connect to the feedwater system. Conformance with the aforementioned RGs ensure that the dissimilar metal welds will be controlled adequately. Significant operating experience has shown that the material specifications and grades chosen by the applicant are adequate.

10-32

However, because the APR1400 utilizes carbon steel in portions of the main steam and feedwater system the staff conducted a detailed review of the FAC program.

FAC Program In DCD Tier 2, Section 10.3.6.3, Flow -Accelerated Corrosion, the applicant stated that the APR1400 will implement a FAC program generally based on NSAC-202L-Revision 3. SRP Section 10.3.6, item III.3, states that NSAC-202L-Revision 2 is the acceptance criteria for a FAC program. The staff sought clarification to this term in RAI 314-8378, Question 10.03.06-10 (ML15320A353). The use of NSAC-202L-Revison 3 is acceptable because both revisions are endorsed in NUREG-1801, Revision 2, Generic Aging Lessons Learned (GALL) Report, (ML011080726) Section XI.M17.

In DCD Tier 2, Section 10.3.6.3 and in response to the staffs RAI (ML16011A239), the applicant clarified that the term general based on NSAC-202L means committing to the unmodified guidance in NSAC-202L Revision 3. As such, the licensing basis for the FAC monitoring program of the APR1400 plant is the same as the current operating fleet.

An important aspect of a NSAC-202L FAC program is the use of ASME Code Case N-597-2, Requirements for Analytical Evaluation of Pipe Wall Thinning, when the thickness of a component is reduced below the ASME Code, Section III or ASME B31.1 design thickness. As part of COL Item 10.3(5), the COL applicant referencing the APR1400 design to meet the staff conditions for ASME Code Case N-597-2 as is specified in RG 1.147, Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1. By including COL Item 10.3(5) the applicant ensured that a COL applicant referencing the APR1400 plant design will meet the requirements of 10 CFR 50.55a throughout the lifetime of the plant.

Based on the above, the staff concludes that the proposed framework of the APR1400 FAC program is acceptable. Within the framework of its review, the staff evaluated the areas of FAC and the APR1400 plant design, sufficiency of the thickness of components, applicability of the OPR100 FAC data, and APR1400 design as it relates to FAC susceptibility.

FAC and the APR1400 Plant Design A FAC program is the framework which provides confidence that the main steam and feedwater systems will not experience unacceptable degradation due to FAC. The initial FAC predictions are based upon conservative predictions associated with the flow conditions in the piping system. As such, it was necessary to review the assumptions made by the applicant which could impact the FAC program.

The applicant stated that FAC prevention is integrated into the APR1400 design by: reducing high-turbulence areas, designing piping systems to reduce cavitation, selecting long-radius elbows in piping systems when possible, smoothing weld transitions, and choosing pipe sizes to optimize flow velocities. The use of these strategies is consistent with reduction the probability of FAC and the recommendations in NSAC-202L-Revision 3.

In DCD Tier 2, DCD Section 10.3.6.3, the applicant stated that the main steam and feedwater systems will be procured with an additional 0.035 and 0.06 inches, respectively, of material thickness to provide a corrosion allowance. The corrosion allowance is provided in consideration of the 40 years of design life. The staff reviewed CHECWORKS wear data from extended power uprates and stretch power uprates of operating plants in the United States and found that most operating nuclear power plants experience wear rates that would exceed the 10-33

APR1400 corrosion allowance before 40 years of operation.

The discrepancy between the APR1400 corrosion allowance and the CHECWORKS data from the operating fleet in the United States resulted in the staff issuing RAI 314-8378, Question 10.03.06-17 (ML15320A353), which requested a justification on the sufficiency of the corrosion allowance. In their response (ML16034A035) the applicant provided CHECWORKS data from several OPR1000 nuclear power plants whose data was used as the basis for calculating the APR1400 corrosion allowance. The staff reviewed the CHECWORKS data from the OPR1000 and found that the wear rates exceeded those from the United States operating plants and that the corrosion allowance was insufficient for FAC.

The staff concluded that a more detailed and expanded examination of the APR1400 plant design was warranted to determine if the plant design is consistent with the framework of the FAC program. The staff examined three topic areas: 1) how the applicant determined component thicknesses were sufficient, 2) the applicability of the OPR1000 FAC data, and 3) a detailed review of the APR1400 design for FAC susceptible areas.

Sufficiency of the Thickness of Components During a staff audit conducted on May 10, 2016 (ML18131A037) in which the staff reviewed the FAC program for the main feedwater and steam system, the applicant discussed how the corrosion allowance is consistent with the FAC program. The applicant stated that the corrosion allowance is sufficient for the majority of the carbon steel portions of the main steam and feedwater systems where FAC susceptibility is relatively low. For carbon steel areas where significant FAC is predicted to occur, the applicant will utilize the additional thickness margin built into the system. The margin is provided by use of standard piping thicknesses exceeding the required ASME Code, Section III or ASME B31.1 design thicknesses and using ASME Code Case N-597-2 when the piping thickness is below tnominal. The CHECWORKS software has the built-in capability to track the loss of base material and ensures that the performance-based minimum wall thickness (consistent with the ASME Code methodology and staff conditions placed on the Code Case) is not violated.

Applicability of the OPR1000 FAC data The CHECWORKS FAC management program merges the measured thickness of components and FAC wear data to predict component lifetimes. The lifetime predictions provide a reasonable basis that the APR1400 piping system is designed for a 40 year life. This approach is consistent with the current operating fleet.

Because significant FAC data on the APR1400 has not been obtained, the component lifetimes in the APR1400 plant are projected from the OPR1000 FAC data. To determine if the OPR1000 FAC data is applicable to the APR1400 design the staff examined two topics: 1) whether the OPR1000 FAC program would reliably generate data which could be used to predict APR1400 FAC rates and 2) a comparison of the APR1400 and the OPR1000 plant designs to determine if any differences in the designs could result in significantly different FAC rates.

a. Examination of OPR1000 FAC Program In its response to RAI 314-8378, Question 10.03.06-4 (ML16011A239), the applicant stated that there are seven programmatic differences between the FAC programs used at OPR1000 plants and a program like that proposed for the APR1400 which would comply with EPRI NSAC-202L. Two aspects could 10-34

impact the relevance of the OPR1000 wear rate measurements and were reviewed by the staff: the method of wear evaluation and the use of ultrasonic testing (UT) for inspection within the OPR1000 FAC program.

1) Method of Wear Evaluation
2) The applicant described the LSPTP (Least Squares Point-to-Point),

LSSM (Least Squares Slope Method), and Near Area Minimum (NAM) wear evaluations and the statement piping inspected repeatedly over twice during the May 10, 2016 audit. The staff reviewed each of the aspects and determined that they did not introduce non-conservatisms which could affect the relevance of the OPR1000 data for use in establishing the design of the APR1400. Details regarding the staffs conclusion are included in the staffs audit report (ML18241A315).

3) Method of UT inspection During the May 10, 2016 audit, the applicant stated that the OPR1000 data was gathered from UT examinations and RT was not used. NSAC-202L-Revision 3 allows both volumetric examination techniques to be used. The use of RT is suggested for complex geometry components but it is not required. Additionally, the UT inspection procedure was provided during the audit. The staff reviewed the document and found that the grid spacing requirements, the use of encoded UT, the use of high temperature markers, and surface preparation requirements is consistent with NSAC-202L-Revision 3, Section 4.5.

The staffs review of the methodology used for gathering data from the OPR1000 plants via UT resulted in the staffs conclusion that the data could be reliably used as the basis for determining corrosion allowances in the APR1400 design. Details regarding the staffs conclusion are included in the staffs audit report (ML18241A315).

b. Comparison of the OPR1000 and APR1400 plant designs During the audit on May 10, 2016, the applicant provided piping and instrumentation diagrams (P&IDs) and material specifications for the OPR1000 plant. The staff conducted a component-by-component comparison of the P&IDs for the OPR1000 and APR1400 plants and concluded that configuration of components in the both designs was nearly identical with the exceptions that 1) the APR1400 utilized piping of larger diameters and 2) the APR1400 eliminated several flanges and replaced the connections with welds. The staff reviewed the material specifications in the APR1400 and OPR1000 plants and found that the material specifications were similar; in some cases a larger diameter component necessitated a different material specification, but the chemistry of the material was the same.

Based upon the information provided, the staff concludes that the OPR1000 power plant is sufficiently similar to the APR1400 plant that the CHECWORKS data from the OPR1000 plant can represent reasonable FAC predictions. The CHECWORKS data supports the applicants assertion that the feedwater and main steam systems in the APR1400 are designed for 40 years of operation.

10-35

Ultimately, the lifetime of each component (as well as the inspection intervals and repair/replacement activities) will be determined from the FAC data obtained from the operating APR1400 plant.

APR1400 Design as it relates to FAC Susceptibility To assess the FAC susceptibility of the APR1400 plant, the staff reviewed the designs conformance to recommendations in EPRI NSAC-202L-Revision 3 and FAC insights provided by the OPR1000 data.

a. NSAC-202L-Revision 3 Recommendations EPRI NSAC-202L-Revision 3 recommends that a susceptibility analysis should be performed to document the potential for FAC in every piping system. The staff reviewed the APR1400 susceptibility analysis data during the May 10, 2016 audit. The susceptibility analysis correctly determined that portions of the main steam and feedwater systems are not susceptible to FAC based upon the exclusion guidelines described in EPRI NSAC-202L-Revision 3, Section 4.2.2.

The staff concludes that the APR1400 susceptibility analysis is consistent with NSAC-202L-Revision 3 and provides reasonable assurance that each piping system was examined for general FAC susceptibility.

b. OPR1000 FAC data insights The applicant provided a full set of OPR1000 CHECWORKS data during the May 10, 2016 audit. The staff review of the OPR1000 CHECWORKS data focused on components and portions of systems with documented failure or degradation in the Nuclear Energy Agency Piping Failure Data Exchange Project database.

The OPR1000 CHECWORKS data does predict greater wear rates for portions of the main steam and feedwater system where FAC failure or significant degradation has occurred in operating plants.

The staff notes that there is significant uncertainty in OPR1000 CHECWORKS predictions; the OPR1000 data incorporates limited operational experience (the components have 1- 4 years of operating time). The lack of operating time may have temporarily passivated corrosion cells or corrosion cells may not have reached a steady state condition. The OPR1000 wear rates and the corresponding predicted component lifetimes may be under or over predicted.

Additionally, the extended power uprate and stretch power uprate CHECWORKS data from US nuclear power plants reflect aged conditions where materials have relatively steady state corrosion. As the APR1400 plant ages, the staff expects the wear rates will approach wear rates in the currently operating US plants based upon the water chemistry requirements, the flow rates in the systems, and the use of material specifications common to operating plants in the United States.

Combined License Information Items DCD Tier 2, DCD Section 10.3.7, Combined License Information, contains COL items which describe the information that must be submitted to the staff by a COL applicant referencing the APR1400 design. This information is duplicated in DCD Tier 2, Table 1.8-2, Combined License Information Items. Three COL items pertain to the main steam and feedwater materials:

10-36

Combined License Information Items Item No. Description DCD Tier 2 Section COL 10.3(4) The COL applicant is to provide the 10.3.7 description about the material specifications for components between: 1) the HP turbine and the moisture separator reheater and 2) the moisture separator reheater and the LP turbine when the T/G design is selected.

The COL applicant is also to specify that the pipe thickness is adequate for the plant design life in terms of FAC in place of the components between: 1) the high pressure turbine and the moisture separator reheater and 2) the moisture separator reheater and the LP turbine when the T/G design is selected.

COL 10.3(5) The COL applicant is to provide a 10.3.7 description of the FAC monitoring program.

The description is to address consistency with GL 89-08 and NSAC-202L-R3 and provide a milestone schedule for implementation of the program. The program shall incorporate the conditions of 10 CFR 50.55a(b)(5) on ASME Code Case N-597-2.

COL 10.3(6) The COL applicant is to provide material 10.3.7 specifications that will be utilized for ASME Section III components.

The staff concludes that the COL items appropriately describe design information that is site specific. The COL items are appropriate in scope and would not result in a significant reduction in standardization of the APR1400 design.

Conclusion The staff concludes that the steam and feedwater system for the APR1400 design appropriately utilizes consensus codes and standards that are sufficient for the safety significance of structures, systems, and components and that the material selection appropriately considers degradation mechanisms including flow accelerated conclusion. The staff concludes that the APR1400 design satisfies the relevant requirements of 10 CFR 50.55a, GDCs 1 and 35, and Appendix B to 10 CFR Part 50.

10-37

10.4 Other Features of the Steam and Power Conversion System 10.4.1 Main Condensers Introduction The APR1400 main condenser (MC) functions as the steam cycle heat sink which condenses and deaerates the exhaust steam from the low-pressure main turbine. It is designed to accept full load exhaust steam from the main turbine and up to 55 percent of the full power steam flow via the turbine bypass system (TBS). The main condenser is not safety-related and does not perform any safety-related functions.

Summary of Application DCD Tier 1: There are no Tier 1 requirements specific to the main condensers.

DCD Tier 2: DCD Tier 2, Section 10.4.1, Main Condensers, provides the MC system design.

Table 10.4.1-1, Main Condenser Design Data, provides design parameters for the MC.

DCD Tier 2, Section 10.4.1 discusses the MC system design basis; system and component description; safety evaluation; inspection and testing requirements; and instrumentation requirements.

DCD Subsection 10.4.1.1, Design Bases, and 10.4.1.2, System Description, describe the design and functions of the MC. The portions of the MC that are outside the scope of the DC are presented as conceptual design information in DCD Tier 2, delineated by double brackets (((

))). The MC is a single-pressure, three-shell and single-pass surface condenser designed to condense the low-pressure turbine exhaust steam so condensate can be efficiently pumped through the steam cycle. The condensate is drawn from the hotwell of each condenser to a single header which provides suction to the condensate pumps of the condensate and feedwater system (CFS) as depicted in DCD Tier 2 Figure 10.4.7-1, Condensate and Feedwater System Flow Diagram. Therefore, all three condenser shells operate at the same pressure and temperature. The condenser hotwells serve as storage reservoirs for the CFS with sufficient volume to supply maximum condensate flow for five minutes. In support of the turbine bypass function, the MC can condense up to 55 percent of total full power steam. It also serves as a collection point for feedwater heater drains and vents, miscellaneous equipment drains and vents, and feedwater pump turbine exhaust steam. Heat is removed from the MC by the circulating water system (CWS).

DCD Subsection 10.4.1.3, Safety Evaluation, provides an evaluation of the operation.

In DCD Tier 2, Subsection 10.4.1.4, Inspection and Testing Requirements, the applicant described the operational testing and inspections as well as the design features to allow such inspections and testing to occur.

DCD Tier 2, Subsection 10.4.1.5, Instrumentation Requirements, describes the instrumentation and protection devices for the condenser. All instrumentation is for normal power operation and not required for safe shutdown.

DCD Tier 2, Table 3.2-1, Classification of Structures, Systems, and Components, (Item 10.b) identifies the MC as non-nuclear safety system, seismic category III, designed to American 10-38

Society of Mechanical Engineers (ASME) B31.1-2010, and not applicable to the quality assurance requirements of 10 CFR Part 50, Appendix B.

Initial Test Program: Preoperational testing for the MC is described under DCD Tier 2, Subsection 14.2.12.1.67, Main Condenser and Condenser Vacuum Systems Test.

ITAAC: There are no ITAAC specific to the MC system.

TS: There are no TS associated with the MC system.

Regulatory Basis Conformance with the applicable requirements of 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants, and the provisions of the following additional requirement constitutes an acceptable basis for a satisfactory MC design.

1. GDC 2, Design bases for protection against natural phenomena, as it relates to the failure of non-safety-related systems or components due to natural phenomena such as earthquakes, tornadoes, hurricanes, and floods not to adversely affect the safety-related SSCs.
2. GDC 4, Environmental and dynamic effects design bases, as it relates to a failure of the system or component that results in environmental conditions such as discharging fluids (i.e., flooding) that could adversely affect safety-related SSCs.
3. GDC 60, Control of releases of radioactive materials to the environment, as it relates to provisions being included in the nuclear power unit design to control suitably the release of radioactive materials in gaseous and liquid effluents during normal reactor operation, including anticipated operational occurrences (AOOs).

GDC 60 is applicable to the design of the MC system because in PWRs radioactive materials may be deposited in the main condensers if there is a primary-to-secondary steam generator tube leak.

4. GDC 64, Monitoring radioactivity releases, as it relates to provisions being included in the nuclear power unit design for monitoring the effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including AOOs, and from postulated accidents.
5. Title 10 CFR 52.47(b)(1), which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRCs regulations.

In addition to the above GDCs, the SRP, Section 10.4.1, Main Condenser, Subsection II, Acceptance Criteria; SRP Acceptance Criteria, Item 1.B, states that acceptance of GDC 60 is based on meeting the following:

If there is a potential for explosive mixtures to exist, the MC is designed to withstand the effects of an explosion and instrumentation is provided to detect and annunciate the 10-39

buildup of potentially explosive mixtures, dual instrumentation is provided to detect, annunciate, and effect control measures to prevent the buildup of potentially explosive mixtures, as outlined in SRP Section 11.3, Subsection II, Acceptance Criteria, SRP Acceptance Criteria, Item 6.

Technical Evaluation The staff reviewed the design of the APR1400 MC system in accordance with SRP, Section 10.4.1, Revision 3.

GDC2, Design bases for protection against natural phenomena, and GDC 4, Environmental and dynamic effects design bases The staff reviewed the design of the main condenser for compliance against the requirements of GDC 2 which requires that SSCs important to safety be designed to withstand the effects of postulated local natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of the capability to perform their safety functions. DCD Section 10.4.1.3, Safety Evaluation, states that the condenser does not perform any safety-related functions. Therefore, acceptance of GDC 2 is based on the guidance provided by regulatory position C.2 of RG 1.29 which specifies that failure of non- safety-related systems should not have an adverse effect on safety-related systems.

The staff also reviewed the design of the MC for compliance with the requirements of GDC 4.

The staffs review was performed to verify that the system was protected against environmental and dynamic effects and that a failure of the MC and the resulting discharging fluid (i.e.,

flooding) would not adversely affect safety-related SSCs. In DCD Section 10.4.1.3, the applicant states that flooding due to failure of a condenser hotwell does not prevent safe shutdown of the reactor. The flooding water cannot reach safety-related equipment located in auxiliary building because the opening or access door between the turbine and auxiliary buildings is located higher than the basic grade of the turbine building. The flooding in the turbine building that results from a failure of the main condenser is bounded by that of a circulating water system line break in the turbine building. Further staff evaluation of the circulating water system can be found in Section 10.4.5 of this SE.

Based on the above review, the staff determined that the main condenser design is in compliance with GDC 2, and 4, because regulatory position C.2 of RG 1.29 is met and the potential flooding due to a failure to the MC does not result in SSCs important to safety being adversely effected.

GDC 60, Control of releases of radioactive materials to the environment, and GDC 64, Monitoring radioactivity releases The staff reviewed the design of the MC for compliance with the requirements of GDC 60 with respect to control of release of radioactive materials and GDC 64 with respect to the monitoring of radioactive releases. Compliance with GDC 60 and GDC 64 requires provisions be included in the nuclear power unit design to monitor and control suitably the release of radioactive materials during normal operation, including AOOs.

Meeting these requirements provides a level of assurance that the release of radioactive materials in gaseous and liquid effluents from the main condensers during normal operation, including AOOs, is kept as low as is reasonably achievable, in accordance with 10 CFR Part 50, Appendix I.

10-40

DCD Subsection 10.4.1.3 states that during normal operation and shutdown, the MC does not have radioactive contaminants. The DCD states that radioactive contaminants are only through primary-to-secondary system leakage due to SG tube leaks. A discussion of these leaks is included in DCD Tier 2, Subsection 11.1.1.3, Secondary System Activity.

Regarding potential buildup of explosive mixtures, the DCD states that no hydrogen buildup in the MC is anticipated, including in the form of non-condensable gas constituents. The condenser vacuum system in the main condenser is designed to remove leaked air and non-condensable gases from condensing steam using mechanical vacuum pumps. See DCD Subsection 10.4.2 for further information on the condenser vacuum system. However, conformance to GDC 60, as stipulated in SRP Section 10.4.1, Section II, Acceptance Criteria, Item 1, requires that the design of the MC is acceptable if the integrated design of the system meets the requirements of GDC 60 as related to failures in the design of the system which do not result in excessive releases of radioactivity to the environment. Item 1.B, SRP Acceptance Criteria, of the above SRP Acceptance Criteria states, in part, that the requirements of GDC 60 are met if instrumentation is provided to detect and annunciate the buildup of potentially explosive mixtures. Although control measures were described in the form of the condenser vacuum system, the DCD did not describe any instrumentation to detect any explosive mixtures within the MC and did not describe whether there was annunciation in the main control room to alert operators of any potential explosive mixtures within the MC. Therefore, the staff requested in RAI 99-7836, Question 10.04.01-1 (ML15204A914), the applicant to provide additional information, in the DCD, in regards to monitoring the condenser for the buildup of combustible gas conducted, including information on the instrumentation used, and how the control room operators are alerted of potential explosive mixtures within the MC.

In its response to RAI 99-7836, Question 10.04.01-1 (ML15275A323), the applicant pointed to DCD Subsection 10.4.2.2.2, System Description, which states, in part, that thermal decomposition of hydrazine can be considered as a source for hydrogen within the condenser shells. However, the potential for hydrogen buildup within the condenser shells does not exist because three vacuum pumps operate continuously during normal operation with another pump in standby. The DCD goes on to state that the vapor content is maintained above 58 percent by volume in non-condensable gases in accordance with SRP Section 10.4.2. Further evaluation of DCD Section 10.4.2, Condenser Vacuum System, is provided in Section 10.4.2 of this SER.

Therefore the applicant concludes that there is no potential for a build-up of explosive mixtures within the condenser shells and, as a result, the detection of potential explosive mixtures and the main control room annunciation is not required. In addition, the applicant provided proposed related revisions to DCD Tier 2, Subsection 10.4.1.3. The staff verified that Revision 1 of DCD Tier 2, Subsection 10.4.1.3 incorporates the related revisions as presented in the RAI response.

The staff has reviewed the applicants RAI response and finds it acceptable because the applicant has demonstrated that potential explosive mixtures will not exist and if there is no potential then the requirements to detect and annunciate do not apply. Because the unacceptable buildup of combustible gases cannot occur, the staff finds that MC meets the SRP guidance provided in Item 1 of the SRP acceptance criteria and Item 3.B of the SRP review procedures as relates to instrumentation provided to detect and annunciate the buildup of potentially explosive mixtures and provision for control measures to prevent the buildup of potentially explosive mixtures.

Regarding controlling and collecting cooling water leakage into the condensate, the DCD states that the tube leak detection system is provided to permit sampling of the condensate in the condenser hotwell as described in Subsection 9.3.2. The tube leak detection system identifies which tube bundle has sustained leakage if circulating water in-leakage occurs. The affected 10-41

condenser hotwell and CWS are designed to permit manual isolation of the tubes by closing the motor-operated hotwell discharge valve when condenser tube leakage exceeds the design value for the condensate polishing system (CPS). Plant power is reduced as necessary. The waterbox is then drained and the affected tubes are either repaired or plugged. Upon review of the information in the DCD, the staff was unable to find specific details on provisions taken for the controlled collection of waterbox drainage which may contain radioactive contaminants. The SRP guidance provided in Item 2.A of the SRP review procedure requires a means for controlling and collecting cooling water leakage into the condensate. The requirements of GDC 60 require provisions to prevent excessive releases of radioactivity to the environment as a result of a failure within the MC. Therefore, the staff issued RAI 99-7836 , Question 10.04.01-2 (ML15204A914), requesting that the applicant provide additional information in the DCD as related to provisions to determine which MC bundles is affected by leakage and how water containing radioactive effluents drained from the waterbox is processed.

In its response to RAI 99-7836, Question 10.04.01-2 (ML15275A323), the applicant stated that the secondary sampling system continuously samples and analyzes the condensate water.

This secondary sampling system is capable of identifying which condenser hotwell and tube bundle is leaking by any in-leakage. In addition, the applicants response stated that when a MC tube bundle is affected by in-leakage, alarms will be annunciated in the MCR and remote shutdown room (RSR). In addition, the applicant provided proposed revisions to DCD Tier 2, Subsection 10.4.1.2, to provide the discussion in the DCD. The staff verified that Revision 1 of DCD Tier 2, Subsection 10.4.1.2 incorporates the related information from the RAI response.

The staff has reviewed the applicants RAI response and, because of the continuous sampling and control room annunciators for tube bundle in-leakage, finds the portion related to in-leakage detection acceptable. However, the RAI response remainder is unacceptable because the response did not provide information on the controlled collection of the waterbox drainage that may contain radioactive contaminants. The staff issued supplemental RAI 402-8477 (ML16041A092), Question 10.04.01-5 requesting the applicant provide this information and revise the DCD accordingly. In its response letter (ML16081A207), the applicant explains that the waterbox drains are connected to the condenser pit sumps. From there, fluids travel to the condensate polishing area sump and then onto the waste water treatment facility or, if radiation is detected in either sump location, to the liquid waste management system. These sumps are part of the equipment and floor drainage system and are further evaluated in Section 9.3.3 of this SER. The staff has reviewed the applicants RAI response and finds it acceptable because the applicants design for the collection of waterbox drainage will be controlled and monitored, and contaminated water will be transferred to the appropriate system via a system designed to handle contaminated liquids. Based on the above review, the staff finds the requirements of GDC 60, as it relates to controlling and collecting cooling water leakage into the condensate, is satisfied. In addition, the applicant provided proposed related revisions to DCD Tier 2, Section 10.4.1. The staff verified that Revision 1 of DCD Tier 2, Subsection 10.4.1 incorporates the related information from the RAI response.

The APR1400 MC system is designed with titanium tubes and titanium-clad carbon steel, or equivalent material, tube sheets to maintain good corrosion and erosion resisting properties.

DCD Table 10.4.1-1 describes the material specifications for the MC. The staff finds this acceptable since it meets the SRP guidance provided in Item 2.B of the SRP review procedure, as it relates to compatibility of materials of construction used to reduce the corrosion and/or erosion of MC tubes and components.

In the event of high condenser pressure, the DCD states the condenser shells are protected from the high internal pressure by using the relief diaphragm on the top of the low-pressure (LP) 10-42

hood. If the pressure inside the LP hood exceeds atmospheric pressure, the relief diaphragm will rupture, and the steam inside the LP turbine is released to the atmosphere. An expansion connection between the condenser neck and the turbine exhaust is provided which also serves to protect the MC from high internal pressure. The condenser shells have pressure transmitters to detect loss of the condenser vacuum. When the pressure from the pressure transmitters exceeds the set point, a turbine trip signal is generated. The staff finds this acceptable since it meets the SRP, Section 10.4.1, Subsection III, Review Procedures, Item 3.C, as it relates to detecting loss of condenser vacuum and isolating the steam source.

The DCD indicates that tube support plates are designed to protect the condenser tubes by minimizing tube vibrations due to steam impingement forces. These steam impingement forces come from normal operation and from the turbine bypass valve quick-opening events. The staff finds that these design provisions conform to SRP, Section 10.4.1, Subsection III, Review Procedures, Item 3.D as it relates to incorporating provisions into the MC design that will preclude component or tube failures due to steam blowdown from the turbine bypass system (TBS). The staffs review of the TBS can be found in Section 10.4.4 of this SER.

Regarding conformance to GDC 64, which requires in part that effluent discharge paths shall be provided with a means to monitor for radioactivity that may be released during anticipated operational occurrences such as steam generator tube leakage, DCD Tier 2, Section 10.4.1 states that during normal operation and shutdown the MC does not have radioactive contaminants. Typically, MCs would only be expected to receive radioactive contaminants through a steam generator tube leak. A discussion of the radiological aspects of these leaks is included in DCD Tier 2, Subsection 11.1.1.3. While reviewing the DCD, the staff did not find adequate details to justify the requirements of GDC 64, as it relates to the detection and MCR annunciation of radioactive contaminants found in the MC. Therefore, the staff issued RAI 99-7836, Question 10.04.01-4 (ML15275A323), requesting the applicant provide additional information and justification in the DCD to conform to the criteria in GDC 64 described above.

In the response to RAI 99-7836, Question 10.04.01-4 (ML15275A323), the applicant indicated that DCD Section 10.4.2, Condenser Vacuum System, addresses the conformance to GDC 64 for effluents in the main condenser. DCD Subsection 10.4.2.2.2 states, in part, that the non-condensable gases in MC are not radioactively contaminated during normal operation. The radioactive materials are processed in condenser vacuum system only if there is a primary-to-secondary steam generator (SG) tube leak due to a SG tube rupture (SGTR). If radioactivity in the exhaust flow exceeds acceptable level, the condenser vacuum pump vent effluent monitor actuates an alarm in the MCR and automatically diverts the exhaust flow from vacuum pumps to the containment drain sump area in reactor containment building, and then adequate operating procedures are implemented to preclude significant release to the environment. The effluent monitor design and configuration, and its associated parameters are addressed in Subsections 11.5.2.1 and 11.5.2.2, respectively. The location of radiation detector is shown in Figure 11.5-1.

Further staff evaluations related to gaseous effluent monitoring can be found in Sections 11.3 and 11.5 of this SER. The staff has reviewed the applicants RAI response and finds it acceptable because the applicants design for the MC effluents, including during anticipated operational occurrences such as steam generator tube leakage, will be monitored for radioactivity. Based on the above review, the staff finds GDC 64, as it relates to monitoring of effluent discharge paths is satisfied.

10-43

Inspection and Testing DCD Tier 2, Subsection 10.4.1.4, Inspection and Testing Requirements, states in part that the condenser is designed to be capable of being filled with water for hydrostatic tests.

Provisions are made to allow draining and cleaning of the hotwell. The condenser shells, hotwells, and waterboxes are provided with access openings to permit inspection and repairs.

The DCD also states that periodic visual inspections and preventive maintenance on the condenser components are conducted per normal industry practice. The staff finds these operational inspection and testing requirements acceptable for this non-safety-related system.

Instrumentation DCD Tier 2, Subsection 10.4.1.5, Instrumentation Requirements, describes the instrumentation and protection devices for the condenser. All instrumentation is for normal power operation and not required for safe shutdown. Condensate temperature, condenser pressure, circulating water temperature and pressure, and differential pressure waterbox-to-waterbox are indicators provided for verifying condenser performance. The MC hotwell level and pressure are indicated locally and in the MCR for each condenser shell. The MC hotwell levels are maintained automatically by transferring to and from the condensate storage system.

A turbine trip is activated when condenser pressure reaches or exceeds the setpoint ((0.26 kg/cm2A (7.5 in HgA))) indicating a loss of condenser vacuum. DCD Section 7.7.1.1, Control Systems, describes the process controls and monitoring from the MCR. The staff finds these instrumentation requirements acceptable, as they are consistent with SRP 10.4.1, Subsection III, Review Procedures, Item 3.C guidance for detection of loss of condenser vacuum.

Initial Test Program Although applicants for DC are not required to submit plans for an initial test program, RG 1.68 acknowledges that DC applicants have previously submitted these plans to assist a future COL applicant referencing the DC in meeting the requirements of 10 CFR 52.79(a)(28).

Preoperational test requirements for the main condenser are described in DCD Tier 2 Section 10.4.5.4, Inspection and Testing Requirements, and Section 14.2.12.1.67. The initial test program for the APR1400 is evaluated in Section 14.2 of this SER.

The staff finds that test performed as part of the initial plant test program will verify the operability of the lights and system alarms associated with the main condenser.

ITAAC There are no ITAAC required for this system. The system is not safety-related and is not required for safe shutdown. Therefore the staff finds this acceptable in accordance with 10 CFR 52.47(b)(1).

Technical Specifications There are no APR1400 TS sections for the main condenser system. The system is not safety-related and is not required for safe shutdown; therefore the staff finds this acceptable.

10-44

Combined License Information Items The staff reviewed the COL information items as listed in Tier 2 of the DCD, Section 1.8, Interfaces with Standard Design, and Table 1.8-2, Combined License Information Items, and found that there are no items relevant to the MC system. The staff concluded that this is appropriate and that no COL information items are needed for the APR1400 MC system.

Conclusion The staff evaluated the MC for the APR1400 standard plant design in accordance with guidance that is referred to in the technical evaluation section of this SER. Based on its review of the information that was provided in the DCD, the staff has concluded that sufficient information has been provided by the applicant in APR1400 DCD Tier 2, Section 10.4.1. In addition, the staff has compared the design information in the DC application to the relevant NRC regulations acceptance criteria defined in NUREG-0800 SRP Section 10.4.1, and other NRC RGs. In conclusion, the APR1400 design for the MC system is acceptable and meets the requirements of 10 CFR 52.47 (b)(1), GDC 2, GDC 4, GDC 60, GDC 64, and the guidelines of SRP Section 10.4.1 for protection against natural phenomena, dynamic effects, and control and monitoring of releases of radioactive materials to the environment.

10.4.2 Condenser Vacuum System Introduction The condenser vacuum system is designed to remove air and non-condensable gases from the main condenser in order to establish and maintain a vacuum during startup and normal operation. The condenser vacuum system is designed as non-safety class with the exception of the containment isolation portion which is designed as Safety Class 2. The condenser vacuum system is not required for safe shutdown of the plant.

Summary of Application Tier 1: DCD Tier 1, Section 2.7.1.6,Condenser Vacuum System, states that there are no entries for the condenser vacuum system.

Tier 2: DCD Tier 2, Section 10.4.2 provides information on the condenser vacuum system. The system performs no safety-related function and is designed to meet the following functional criteria:

Remove air and non-condensable gases from the condenser during startup, cooldown, and normal operations.

Maintain adequate condenser vacuum for proper turbine operation during startup and normal operations.

Prevent an uncontrolled release of radioactive material to the environment.

DCD Tier 2, Table 10.4.2-1, Condenser Vacuum Pump Design Parameters, provides parameters for the vacuum pumps used in the condenser vacuum system.

ITAAC: There are no ITAAC related to the condenser vacuum system.

10-45

TS: There are no TS requirements associated with the main condensers or the main condenser evacuation system.

Initial Plant Test Program: Inspection and testing of the condenser vacuum system is performed prior to plant operation as described in DCD Tier 2, Section 14.2.12.1.67, Main Condenser and Condenser Vacuum Systems Test.

Regulatory Basis The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are given in NUREG-0800, SRP Section 10.4.2, Main Condenser Evacuation System, and are summarized below. Review interfaces with other SRP sections also can be found in SRP Section 10.4.2, Item I.

1. GDC 60, Control of releases of radioactive materials to the environment, as it relates to provisions being included in the nuclear power unit design to suitably control the releases of radioactive materials in gaseous and liquid effluents during normal operation, including anticipated operational occurrences. GDC 60 is applicable to the design of the condenser vacuum system because, in PWRs, radioactive materials may be deposited in the main condensers if there is a primary-to-secondary steam generator (SG) tube leak.
2. GDC 64, Monitoring radioactivity releases, as it relates to the condenser vacuum system design for monitoring of releases of radioactive materials to the environment during normal operation, including anticipated operational occurrences.

Title 10 CFR 52.47(b)(1), as it relates to the requirement that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and NRC regulations. Technical Evaluation The staff reviewed the condenser vacuum system in accordance with SRP Section 10.4.2.

Also, the staff reviewed the condenser vacuum system in accordance with the guidelines contained in RG 1.26 and RG 1.33, Quality Assurance Program Requirements (Operation), as it relates to QA programs for components that may contain radioactive materials. Acceptability of the condenser vacuum system, described in the DCD, is based on meeting the requirements of GDC 60 for controlling the releases of radioactive materials to the environment and the requirements of GDC 64 for monitoring the releases of radioactive materials to the environment.

The staff reviewed the applicants design description, system flow diagrams, and design criteria for the components of the condenser vacuum system. The staff finds that the condenser vacuum system is appropriately classified as non-safety-related in accordance with the guidance in RG 1.26 and designed to Heat Exchange Institute (HEI) Standards for Steam Surface Condensers, 9th Edition, 2006. The condenser vacuum system includes equipment and instruments to establish and maintain condenser vacuum and to prevent uncontrolled releases of radioactive materials to the environment.

10-46

The condenser vacuum system performs no safety-related function and has no safety-related design basis. The condenser vacuum system is designed to remove air and non-condensable gases from the main condenser shells and connected steam systems and to establish and maintain a vacuum during startup, shutdown, and normal operation. The condenser vacuum system is also designed to remove non-condensable gases when the turbine bypass system is in operation, such as during hot shutdown. The steam and air mixture extracted from each condenser shell is routed to one of three 33.3 percent capacity vacuum pumps. A standby vacuum pump is automatically activated in the event of excessive air in-leakage that results in a rise of condenser backpressure. The vacuum pumps capacity meets or exceeds the capacity recommended in HEI Standards for Steam Surface Condensers, 9th Edition, 2006. The vacuum pumps remove the non-condensable gases from the condenser shells by hogging operation during startup, and by holding evacuation during normal plant operation. The vacuum pumps discharge the steam air mixture to moisture separators, where the steam condenses while the air is exhausted through the turbine generator buildings ventilation system. The exhausted air is monitored for radiological activity.

A high condenser pressure alarm annunciates in the MCR if the condenser pressure reaches the high-pressure set-point and the turbine trips if the condenser vacuum system cannot maintain condenser operating pressure. In the event that the condenser vacuum system malfunctions and the condenser becomes unavailable, the RCS heat rejection is accommodated by the main steam atmospheric dump valves.

The requirements of GDC 60 are met when the evacuation system design includes provisions to prevent excessive releases of radioactivity to the environment which may result from the failure of a structure, system, or component. Such releases may result from potential explosive mixtures. If there is a potential for explosive mixtures to exist, the evacuation system should be designed to withstand the effect of an explosion and instrumentation should be provided to detect and annunciate the buildup of potentially explosive mixtures in the condenser. Such potential does not exist where systems are designed to maintain steam content above 58 percent by volume in hydrogen-air mixtures or nitrogen content above 92 percent by volume in hydrogen-air mixtures in all components of the condenser vacuum system.

In PWRs, radioactive materials may be deposited in the main condensers if there is a primary-to-secondary SG tube leak. In DCD Tier 2, Section 10.4.2.2.2, the applicant stated that the thermal decomposition of hydrazine can be considered as a source of hydrogen within condenser shells. However, a potential for hydrogen buildup within condenser shells does not exist because three vacuum pumps operate continuously during normal operation, and a standby vacuum starts when one vacuum pump fails. Additionally, condenser shells are considered to maintain the water vapor content above 58 percent by volume in non-condensable gases in conformance with SRP Section 10.4.2, Acceptance Criteria 1.A. The trace amounts of oxygen dissolved in the condensate and condenser hotwell inventory are considered negligible compared to the amounts of air evacuated by the vacuum pumps.

Therefore, a potential for explosive mixtures within the condenser shells does not exist and the condenser vacuum system is not required to be designed to withstand the effects of an explosion.

Since the water vapor content in the condenser vacuum system will remain above 58 percent by volume of the total mixture and there is no potential for explosive mixtures within the condenser vacuum system in accordance with SRP Section 10.4.2, the staff concludes that the design of the condenser vacuum system satisfies GDC 60.

10-47

The requirements of GDC 64 are met when the condenser evacuation system is provided with a means of monitoring the effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences, and from postulated accidents. Mixtures of non-condensable gases and vapor that are discharged to the environment from the main condenser are not normally radioactive during normal plant operation. However, as described above, it is possible for the mixture to become contaminated in the event of primary-to-secondary system leakage resulting from SG tube leaks. Should this occur, radioactivity would be detected by a radiation monitor provided for in the vent system for air removal as described in DCD Tier 2, Section 11.5.2.2 (g) Condenser vacuum pump vent effluent monitor (RE-063), and Table 11.5-1, Gaseous Process and Effluent Radiation Monitors, Sheet 2 of 3. If radioactivity in the exhaust flow exceeds acceptable level, the radiation monitor actuates an alarm in the MCR and automatically diverts the exhaust flow from the vacuum pumps to the containment drain sump area in the reactor containment building.

The effluent monitor design and configuration, and its associated parameters are addressed in DCD Tier 2, Sections 11.5.2.1, Monitor Design and Configuration, and 11.5.2.2, Gaseous Process and Effluent Radiation Monitoring and Sampling System (PERMSS).

DCD Tier 2, Figure 10.4.2-1, Condenser Vacuum System Flow Diagram, Sheets 1 and 2, depict the condenser vacuum system. DCD Tier 2, Figure 11.5-1, Radiation Monitoring System (PR), sheet 2 of 3, depicts the radiation monitoring equipment in the discharge vent of the condenser vacuum system which is located in the turbine generator building.

Since the condenser vacuum system is provided with a means to monitor the effluent discharge path for radioactivity, and if the exhaust flow exceeds acceptable radiation levels there is an alarm provided in the MCR and the discharge flow is automatically diverted to the containment drain sump, the staff concludes that the design of the condenser vacuum system satisfies GDC 64.

DCD Tier 2, Table 3.2-1, Classification of Structures, Systems, and Components, provides the quality group and seismic design classification of components and equipment of the condenser vacuum system. System components in the turbine building are non-seismic and designed in accordance with Quality Group D standards. System components in the auxiliary building and-reactor containment building are seismic Category II and Quality Group D, except for the containment isolation portion, which is designed as seismic Category I and Quality Group B.

Piping and valves (Quality Group B and D) are designed in accordance with ASME Section III, Class 2, and ASME B31.1 respectively.

The condenser vacuum system is designed with specific features to meet the requirements of 10 CFR 20.1406, Minimization of contamination, and Regulatory Guide 4.21 Minimization of Contamination and Radioactive Waste Generation: Life-Cycle Planning. The basic principles of NRC RG 4.21, and the methods of control suggested in the regulations, are described in DCD Tier 2 Section 12.4.2, Minimization of Contamination and Radioactive Waste Generation.

The condenser vacuum system has no direct impact on the reactor system. The loss of condenser vacuum results in a turbine trip. The loss of condenser vacuum event is evaluated and addressed in DCD Tier 2, Section 15.2.3, Loss of Condenser Vacuum.

The condenser vacuum system is tested during the initial plant testing program along with the main condenser (DCD Tier 2, at 14.2.12.1.67.) The objective of this testing is to demonstrate the ability of the main condenser and vacuum systems to provide a continuous heat sink for normal as well as a sink for the turbine bypass system under certain condition.

10-48

Combined License Information Items The following is a list of COL information item numbers and descriptions from DCD Tier 2, Table 1.8-2 pertaining to the condenser vacuum system:

Combined License Information Items Item No. DCD Tier 2 Description Section COL 10.4 (1) The COL applicant is to establish 10.4.11 operational procedures and maintenance programs for leak detection and contamination control COL 10.4 (2) The COL applicant is to maintain the 10.4.11 complete documentation of system design, construction, design modifications, field changes, and operations The staff finds the above listing to be complete. Also, the list adequately describes actions necessary for the COL applicant. No additional COL information items need to be included in DCD Tier 2, Table 1.8-2 for condenser vacuum system considerations.

Conclusion The staff has concluded that sufficient information has been provided by the applicant in DCD Tier 2, Section 10.4.2. In addition, the staff has compared the design information and the COL information items in the DCD to the relevant NRC regulations, acceptance criteria defined in NUREG-0800, SRP Section 10.4.2, and other NRC regulatory guides. In conclusion, for the reasons set forth above, the design for the condenser vacuum system is acceptable and meets the guidelines of SRP Section 10.4.2 and the requirements of GDC 60 and GDC 64 for controlling and monitoring releases of radioactive material to the environment.

10.4.3 Turbine Steam Seal System Introduction The turbine steam seal system (TSSS), more commonly referred to in the industry as the turbine gland sealing system (TGSS), is designed to provide a source of sealing steam to the annulus space where the turbine and large steam valve shafts penetrate their casings to prevent air leakage into and steam leakage out of these components. This includes the equipment to collect and route the system effluents to the appropriate destination. Review of the TSSS is focused on the system features incorporated to monitor and control releases of radioactive materials in the effluents.

Summary of Application Tier 1: There is no Tier 1 information associated with this section.

10-49

Tier 2: DCD Tier 2, Section 10.4.3, Turbine Steam Seal System, includes the TSSS system description, as well as relevant information on the TSSS design, including the design basis, instrumentation, and the inspection and testing program.

In Section 10.4.3, the DCD states that the TSSS performs no safety function and has no nuclear safety-related design basis. The system is designed to meet the following functional criteria:

Prevent air leakage into and steam leakage out of the casings of the turbine generator.

Return condensed steam to the condenser and exhaust non-condensable gases into the atmosphere.

Prevent uncontrolled release of radioactive materials to the environment in accordance with GDC 60, Control of releases of radioactive materials to the environment, and GDC 64, Monitoring radioactivity releases.

The TSSS is shown in DCD Tier 2, Figure 10.4.3-1, Turbine Steam Seal System Flow Diagram.

ITAAC: There are no ITAAC for the TSSS in DCD Tier 1.

TS: There are no TS requirements associated with the TSSS.

Regulatory Basis The relevant requirements of the Commission regulations for this area of review, and the associated acceptance criteria, are given in Section 10.4.3, Turbine Gland Sealing System, of NUREG-0800, Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants, and are summarized below. Review interfaces with other SRP sections are also indicated in SRP Section 10.4.3.

1. GDC 60, Control of releases of radioactive materials to the environment, as related to the TSSS design for the control of releases of radioactive materials to the environment.
2. GDC 64, Monitoring radioactivity, as related to the TSSS design for monitoring of releases of radioactive materials to the environment during normal operation, including anticipated operational occurrences.
3. Title 10 CFR 52.47(b)(1) as related to requiring that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRCs regulations.

Technical Evaluation During its review of DCD Section 10.4.3 the staff noticed that the applicant sometimes makes reference to a turbine gland sealing system, and at other times makes reference to a turbine steam seal system. Since it was not clear whether the applicant was referring to a single 10-50

turbine sealing single system using two different names or whether there was actually two separate systems, the staff issued RAI 153-8070, Question 10.04.03-1 (ML15225A100),

requesting that the applicant clarify the difference (if any) between the TGSS and TSSS.

In its response to RAI 153-8070, Question 10.04.03-1, (L15264B143), the applicant stated that the turbine gland sealing system and turbine steam seal system are the same system. The applicant also proposed to revise the DCD so that the system would be referred to only as the turbine steam seal system, and include a markup to the DCD as part of its RAI response.

The staff reviewed the applicants RAI response and found it to be acceptable since it clarified that turbine gland sealing system and turbine steam seal system are the same system, and revised the DCD to remove the use of the turbine gland sealing system name. The RAI is therefore considered closed, and the incorporation of DCD markup provided with the RAI response was being tracked as a Confirmatory Item 10.04.03-1. The staff confirmed that the RAI response markup has been incorporated into Revision 1 of the DCD. Therefore, the staff considers RAI 153-8070, Question 10.04.03-1 and Confirmatory Item 10.04.03-1, to be resolved and closed.

GDC 60, Control of releases of radioactive materials to the environment and GDC 64, Monitoring radioactivity releases The staff reviewed the design of the TSSS for compliance with the requirements of GDC 60 with respect to control of release of radioactive materials and GDC 64 with respect to the monitoring of radioactive releases. Compliance with GDC 60 and GDC 64 requires that provisions be included in the nuclear power unit design to monitor and control the releases of radioactive materials to the environment.

In Section 10.4.3.2, System Description, the DCD states that the mixture of non-condensable gases discharged from the gland steam condenser is not normally radioactive. However, in the event of a steam generator tube leak due to a steam generator tube rupture, it is possible to discharge radioactively contaminated gases. According to the DCD, the TSSS effluents are monitored by a radiation detector installed downstream of the TSSS in the condenser vacuum system discharge line. In Section 10.4.3.2 the DCD also states that a radiation detector with an alarm is provided for monitoring. This alarm actuates in the main control room (MCR). The design and configuration of the effluent monitor is provided in Section 11.5, Process and Effluent Radiation Monitoring and Sampling Systems, of the DCD. The applicant also indicates in DCD Tier 2, Section 10.4.3.2, that if radioactivity in the exhaust flow exceeds an acceptable level, the condenser vacuum pump vent effluent monitor actuates an alarm in the main control room, and then operating procedures are implemented to preclude significant release to the environment.

The staff reviewed the information in the DCD on the TSSS including the system description, system flow diagram and information in DCD Sections 11.3, Gaseous Waste Monitoring System, and 11.5 on radiation effluent monitoring of the condenser vacuum system. The staff confirmed, via DCD Table 11.5-1, Gaseous Process and Effluent Radiation Monitors, that the condenser vacuum pump vent effluents are monitored and alarmed in the main control room as described in DCD Section 10.4.3.2. Based on the above discussion, the staff found that the TSSS conforms to the requirements of GDC 64, as related to the detection and monitoring of the radioactive materials in TSSS effluents. However, in order to conform to GDC 60 as related to control of the releases of radioactive effluents to the environment, the DCD did not provide adequate details regarding the operating procedures that are to be used to instruct operators on 10-51

performing needed action if/or when an alarm level is reached. Therefore, the staff issued RAI 153-8070, Question 10.04.03-2 (ML15225A100), requesting that the applicant provide information on the applicable procedures including information on what the procedures are to address, and how they are to be implemented.

In its response to RAI 153-8070, Question 10.04.03-2 (ML15264B143), the applicant stated that air and non-condensable gases from the steam packing exhauster blower are generally discharged to the atmosphere. It also states that the discharged gases are monitored by a radiation monitor installed inside the discharge line and if radioactivity exceeds a predetermined setpoint, alarms activate in the control room and operator action is taken. The operating procedures are to be implemented in accordance with the radioactive effluents controls program described in TS 5.5.4. The applicant also provided a markup of the DCD to clarify this point.

The staff reviewed the applicants RAI response and found it to be acceptable since the system design provides means to monitor the system discharges for radiation and operating procedures are to be implemented in accordance with the radioactive effluents controls program. Thus, design features are in place to control and monitor releases of radioactive materials in the effluents of the TSSS; accordingly, the staff finds these sampling and monitoring provisions for the TSSS to meet the requirements of GDC 60 and GDC 64, respectively, as they relate to control and monitoring of the releases of the radioactive materials to the environment. The incorporation of DCD markup provided with the RAI response was tracked as Confirmatory Item 10.04.03-2. The staff confirmed that the RAI response markup has been incorporated into Revision 1 of the DCD. Therefore, the staff considers RAI 153-8070, Question 10.04.03-2 and Confirmatory Item 10.04.03-2, to be resolved and closed.

Initial Test Program In DCD Tier 2, Section 10.4.3.4, Inspection and Testing Requirements, the applicant described the TSSS inspection and testing program, which includes the performance of hydrostatic test for piping and valves. The TSSS components are also inspected during construction and functionally tested during unit startup. TSSS related preoperational and startup testing is performed as described in DCD Tier 2, Section 14.2.12.1.70, Turbine Steam Seal System Test.

The staff finds that test performed as part of the initial plant test program will verify the TSSS ability to provide adequate sealing to the turbine shaft, to prevent air leakage into, and steam leakage out of the casings.

ITAAC Tier 1 of the APR 1400 DCD provides the design descriptions and associated ITAAC for systems which require such under 10 CFR 52.47(b)(1). There are no ITAACs for the TSSS shown in Tier 1. The staff agrees that no ITAAC is required for the TSSS under 10 CFR 52.47(b)(1).

Technical Specifications There are no TS requirements associated with the TSSS. The staff finds this acceptable because the TSSS was not addressed by the standard TS.

10-52

Combined License Information Items There are no COL information items for the TSSS.

Conclusion The staff finds the APR1400 turbine steam seal system acceptable because it meets appropriate regulatory requirements including GDC 60 with respect to control of release of radioactive materials and GDC 64 with respect to the monitoring of radioactive releases.

10.4.4 Turbine Bypass System Introduction The turbine bypass system (TBS) is located in the turbine building and is designed to transport up to 55 percent of the total main steam flow at normal full power steam generator (SG) pressure from the SGs directly to the main condenser, bypassing the main turbine. This process, which is accomplished in a controlled manner, enables the plant to take step-load reductions up to the TBS capacity without the reactor or turbine tripping. This process also minimizes transient effects on the RCS during plant startup, hot standby, cooldown, generator step-load reductions, and following turbine and reactor trips.

Summary of Application Tier 1: The APR1400 DCD Tier 1, Section 2.7.1.3, Turbine Bypass System, states that there are no Tier 1 entries for the turbine bypass system.

Tier 2: The APR1400 DCD Tier 2, Section 10.4.4, Turbine Bypass System, indicates that the TBS performs no safety function and has no nuclear safety-related design basis. The TBS is designed to accomplish the following functions:

Regulate steam flow in order to dissipate excess energy from the nuclear steam supply system (NSSS) following load rejections of any magnitude without tripping the reactor or lifting primary or secondary safety valves.

Bypass 55 percent of the total saturated steam flow at normal full-power SG pressure to the main condenser.

Maintain NSSS thermal conditions at no-load conditions.

Provide a means for manual control of RCS temperature during NSSS heatup or cooldown.

Section 10.4.4 of the APR1400 DCD contains the TBS design bases, system and component description, system operation, safety evaluation, inspection and testing requirements, and instrumentation requirements.

ITAAC: There are no ITAACs for the TBS as indicated in Tier 1, Section 2.7.1.3, Turbine Bypass System, of the APR 1400 DCD.

TS: There are no TS requirements associated with the TBS.

10-53

Regulatory Basis The relevant requirements of the Commission regulations for this area of review, and the associated acceptance criteria, are given in Section 10.4.4, Turbine Bypass System, of NUREG-0800, Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants, and are summarized below. Review interfaces with other SRP sections are also indicated in SRP Section 10.4.4.

1. GDC 4, Environmental and dynamic effects design bases, as related to the dynamic effects associated with possible failure of the TBS due to a pipe break or malfunction of the TBS not adversely affecting systems or components necessary for safe shutdown or accident prevention or mitigation.
2. GDC 34, Residual heat removal, as related to the ability to use the system for shutting down the plant during normal operations. The operation of the TBS eliminates the need to rely solely on safety systems.
3. Title 10 CFR 52.47(b)(1), which requires that a DC application contain the proposed inspections, tests, analyses, and acceptance criteria (ITAAC) that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRCs regulations.

Technical Evaluation The staff reviewed the APR1400 TBS design as described in the APR1400 DCD. The review, which was performed in accordance with SRP Section 10.4.4, was based on the Tier 1 and Tier 2 information contained in Revision 1 of the APR1400 DCD. The results and conclusions of the staffs review of the TBS are discussed below.

In Tier 2, Section 10.4.4.1, Design Bases, the DCD provides the safety and power design bases for the TBS. The system has no safety design basis, since it performs no safety-related function. The section describes the TBS of the APR 1400 as designed to bypass 55 percent of the total steam to the main condenser at full power operation. Also, the DCD states that the system is designed to sustain a load rejection of any magnitude, without generating a reactor trip, and without actuating pilot operated safety relief valves (POSRVs) or main steam safety valves (MSSVs). The TBS is also designed to maintain no-load thermal conditions. Further, the APR1400 TBS is designed to bypass steam to the main condenser during plant startup and also to permit a normal cooldown. These design features minimize transient effects on the RCS during plant startup, hot shutdown and cooldown, step load reductions in generator load, and following a reactor trip.

In Tier 2, Section 10.4.4.2, System Description, the DCD provides a general and component description of the APR 1400 TBS. The TBS includes all components and piping from the branch connection at the MSS to the main condenser. The system consists of two turbine bypass valve (TBV) headers tapped off of the MSS piping after the main steam isolation valves and upstream of the main turbine stop valves. A total of 8 TBVs are provided to discharge to the three shells of the main condenser. DCD Tier 2, Figures 10.3.2-1, Main Steam System Flow Diagram, depicts the TBS, and is shown as part of the main steam system (MSS).

10-54

The staff reviewed the information presented in the DCD as described above and evaluated the TBS against the GDC 4, and GDC 34 criteria as follows:

GDC 4, Environmental and dynamic effects design basis The staff reviewed the TBS for compliance with the requirements of GDC 4, Environmental and dynamic effects design bases. Conformance to GDC 4 requires that failure of the TBS due to a pipe break or malfunction of the system should not adversely affect essential systems or components that are necessary for safe shutdown or accident prevention or mitigation.

Section 10.4.4.3, Safety Evaluation, of the DCD states that the TBS has no safety function and there is no safety-related equipment or components that exist in the vicinity of the TBS components. The DCD also states that all high-energy lines of the TBS are located in the TB and that failure of TBS high-energy lines will not affect any safety-related equipment. The staff verified that the TBS is located in the non-seismic TB, and that there are no safety-related SSCs in the TB or nearby the TBS.

Based on the above discussion, the staff finds that the TBS meets the GDC 4 criteria as it relates to the adverse effects of a pipe break or malfunction on those components of the system necessary for safe shutdown or accident prevention or mitigation since the TB does not contain such components.

GDC 34, Residual heat removal The staff reviewed the TBS for compliance with the requirements of GDC 34 as related to the ability to use the system for shutting down the plant during normal operations by removing residual heat without using the turbine generator. The operation of the TBS eliminates the need to rely solely on safety systems which are required to meet the redundancy and power source requirements of this criterion. DCD Tier 2, Section 10.4.1.3, Safety Evaluation, states that the condenser is normally used to remove residual heat from the RCS during the initial cooling period after shutdown, when main steam is bypassed to the condenser through the TBS. It also states that the condenser is also used to condense the main steam bypassed to the condenser in the event of sudden loads rejection by the turbine generator (T/G) or a turbine trip. In Section 10.4.4, Inspection and Testing Requirements, of the DCD it is indicated that the TBS is designed to bypass steam to the main condenser during a plant shutdown to facilitate a manually controlled cooldown of the nuclear steam supply system (NSSS). Also, the DCD states that the TBS has the capacity to bypass 55 percent of the main steam flow to the main condenser at full power, and is designed to sustain a load rejection, without generating a reactor trip and without actuating POSRVs, or MSSVs. The DCD further states that the TBS is designed to follow a rapid turbine load reduction. A rapid reduction of reactor power is produced through the reactor power cutback system (RPCS) if the magnitude of the load rejection exceeds steam bypass control system (SBCS) turbine bypass capacity.

Information concerning the instrumentation used for the TBS is discussed in Section 10.4.4.5, Instrumentation Requirements, of the DCD. When the staff reviewed DCD section 10.4.4.5 it found that specific information on the instrumentation used by TBS had not been addressed in the section. Therefore the staff issued RAI 118-8072 Question 10.04.04-1 (ML15208A585),

requesting that the applicant provide information on the TBS instrumentation.

In its response to RAI 118-8072, Question 10.04.04-1 (ML15233A439), the applicant stated that TBVs are normally controlled by the SBCS but are capable of main control room/remote shutdown room (MCR/RSR) or local manual operation. The response also stated that TBV 10-55

instrumentation and SBCS instrumentation constitutes that valve position indication, valve inoperable alarms and valve leakage alarms for the TBVs are monitored in the MCR and the RSR. A DCD markup revising the text in DCD section 10.4.4.5, Instrumentation Requirements, was also included as part of the RAI response.

The staff reviewed the applicants response and determine it to be acceptable since the requested information was provided in the DCD markups. The RAI is therefore closed. The incorporation of the DCD markups, provide as part of the RAI response, into the DCD were tracked as Confirmatory Item 10.4.4-1. The staff confirmed that the RAI response markup was incorporated into Revision 1 of the DCD. Therefore, the staff considers RAI 118-8072, Question 10.04-1 and Confirmatory Item 10.04.04-1 to be resolved and closed.

Based on its review, the staff finds that the APR 1400 TBS conforms to the GDC 34 requirements because adequate controls are provided to support reliable TBS operation and because the TBS, along with the main condenser, provides for the initial residual heat removal from the RCS function immediately following plant shutdown without use of the T/G.

Initial Test Program Inspecting and testing of the TBS is performed prior to plant operation as indicated in DCD Section 10.4.4.4, Inspection and Testing Requirements. The DCD states that testing will be conducted to verify opening of the TBVs in response to a signal simulating bypass from the SBCS. The applicant will include preoperational and startup tests in accordance with Regulatory Guide 1.68. DCD Section 14.2.12.1.29, Steam Bypass Control System Test, describes the test to demonstrate proper operation of the steam bypass control system. DCD Section 14.2.12.1.15, Main Steam Atmospheric Dump and Turbine Bypass Valves Capacity Test, verifies the steam flow capacity of the turbine bypass valves. As indicated in DCD Section 14.2.12.1.29, the dynamic operation of the turbine bypass valves is demonstrated during hot functional testing, and capacity testing of the turbine bypass valves is demonstrated during power ascension testing. Based on the staffs review of the information in the DCD it was unclear whether hydrostatic testing would be performed on the TBS; therefore, the staff issued RAI 118-8072, Question 10.04.04-3 (ML15208A585), asking the applicant to clarify whether hydrostatic testing will be performed on the TBS.

In its response to RAI 118-8072, Question 10.04.04-3 (ML15269A013), the applicant stated that the TBS will be hydrostatically tested after installation, and that functional testing will be performed in accordance with the initial test program during startup of the plant.

The staff finds that a test performed as part of the initial plant test program will verify proper opening of the turbine bypass valves in response to a signal simulating bypass from the SBCS.

The staff also finds these test practices acceptable since they demonstrate proper operation of the TBS and are commensurate with the TBS safety classification.

ITAAC Tier 1 of the APR1400 DCD provides the design descriptions and associated ITAAC for systems which require such under 10 CFR 52.47(b)(1). In Tier 1, Section 2.7.1.3, Turbine Bypass System, the applicant indicated that there is no entry for the TBS. Since 10 CFR 52.47 (B)(1) requires the application to contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the ITAAC are performed and acceptance criteria met, a facility that incorporates the DC has been constructed and operated in conformity with the DC, 10-56

the staff issued RAI 118-8072, Question 10.04.04-2 (ML15208A585), requesting that the applicant provide justification for the lack of entry for an ITTAAC for the TBS.

In its response to RAI 118-8072, Question 10.04.04-2 (ML15208A585), the applicant stated that the TBS is part of the MSS and a specific ITAAC entry for the TBS was not necessary. The staff reviewed the Tier1 Section 2.7.1.2, Main Steam System, and confirmed that the functional arrangement of the MSS, which is shown in DCD Tier 1 Figure 2.7.1.2-1, did include the TBS. The MSS ITAAC in Table 2.7.1.2-4 requires inspection of the as-built MSS, which includes the TBS, to be performed in order to confirm that the as-built system conforms to the functional arrangement in figure 2.7.1.2-1. Therefore, essential features of the TBS will be confirmed by such ITAAC.

The staff reviewed the applicants response and determined it to be acceptable since the TBS system configuration and major SSCs are covered by the MSS ITAAC in Tier 1, Table 2.7.1.2-4.

The RAI is therefore closed.

Technical Specifications There are no TS requirements associated with the TBS. The staff finds this acceptable because the TBS was not addressed by the standard TS.

Combined License Information Items No COL items are identified for the TBS in the DCD. The staff finds this acceptable because the proposed MSS ITAAC and the initial plant test program assure that the TBS will be constructed in accordance with the certified design.

Conclusion The staff finds the APR1400 turbine bypass system design acceptable because it meets appropriate regulatory requirements including GDC 4 with respect to the system being designed such that a TBS failure due to a pipe break or malfunction will have no adverse effect on the essential systems or components that are necessary for safe shutdown or accident prevention or mitigation, GDC 34 with respect to the ability of the TBS for shutting down the plant during normal operations by removing residual heat without using the TG, and 10 CFR 52.47(b)(1) regarding ITAAC.

10.4.5 Circulating Water System Introduction The circulating water system (CWS) is designed to provide a continuous supply of cooling water to the main condensers and the turbine generator (turbine) building open cooling water system (TGBOCWS). After the heat is absorbed by the circulating water (CW), the discharge water is returned to the normal heat sink. In the APR 1400 design, the mechanical draft cooling tower is used as the conceptual normal heat sink. The staffs evaluation of the TGBOCWS is described in Subsection 9.2.9 of this report.

Summary of Application DCD Tier 1: DCD Tier 1, Section 2.7.1.7 states there are no Tier 1 entries for the CW system.

10-57

DCD Tier 2: The applicant has provided Tier 2 system description in Section 10.4.5, Circulating Water System, of the APR1400 DCD. The layout of the CW system is shown in DCD Tier 2, Figure 10.4.5-1, Circulating Water System Flow Diagram.

The CWS is a non-safety-related system consisting of CW pumps, cooling towers (CT),

condensers, piping, valves, instrumentation, condenser tube cleaning system, CW pump bearing lubrication system, cooling water makeup and blowdown system, and the cooling tower chemical injection system. The CW system draws cool water from the CW cooling tower basin, passes it through the main condenser tubes to take heat from the main condenser, and returns the heated water to the cooling towers via a common discharge conduit. In addition, the CW system supplies cooling water to the TGBOCWS system and heated water from the TGBOCWS. The TGBOCWS is used to cool the turbine generator building closed cooling water (TGBCCW) system, a system used to cool the various equipment within the turbine building.

The applicant chose to use a conceptual design approach for describing a portion of the CW system. As indicated in 10 CFR 52.47(a)(24), an applicant does not seek certification for such information but presents it in order to aid the staff in its review of the application. In DCD Tier 2, Section 10.4.5, the portions of the CW system identified as conceptual design are indicated by double brackets ((( ))). A future COL applicant shall provide all the necessary information related to the conceptual design portion of the CW system, which will then be reviewed by the staff.

The staff noted that, contrary to DCD Tier 2, Section 10.4.5, the circulating water pumps were listed as non-conceptual in DCD Tier 2, Table 3.2-1, Classification of Structures, Systems, and Components. Title 10 CFR 52.6 states in part that the DC applicant shall provide complete and accurate information. Therefore, the staff issued RAI 486-8597 (ML16139A579), Question 10.04.05-2, to request the applicant to clarify which portions of the circulating water system are conceptual and modify the DCD with this clarification. In response to RAI 486-8597, Question 10.04.05-2 (ML16169A072), the applicant stated that the COL applicant will provide the design parameters, as identified in DCD Tier 2, Table 10.4.5-1, Design Parameters for Major Components of Circulating Water System, as well as the location and design of the cooling tower(s), basin, and CW pump house. The applicant goes on to clarify the following conceptual and non-conceptual design portions:

Conceptual Design Information

- Circulating Water Pumps (number and capacity of CWP, Max/Min System design pressure)

- Cooling towers and auxiliaries

- Cooling water makeup and blowdown system

- Cooling tower chemical injection system Non-conceptual Design Information

- Condenser tube cleaning system components

- CW pump bearing lubrication system 10-58

The staff verified that Revision 1 of DCD Tier 2, Table 3.2-1 incorporates the identity of the CW pumps as conceptual design information and not part of the DC. The staff finds this response acceptable as it provides consistency within the DCD and the staff considers this RAI closed.

Furthermore, the staff finds the identified conceptual design information acceptable as these portions of the system are outside the turbine generator building and site specific. The applicants Table 10.4.5-1 has identified parameters that will ensure that a COL applicant is able to establish proper heat removal and system design interfaces.

ITAAC: There are no ITAAC specific to the circulating water system.

TS: There are no TS associated with the circulating water system.

Initial Test Program: Preoperational testing for the CW system is described under DCD Tier 2, Subsection 14.2.12.1.71, Circulating Water System Test.

Regulatory Basis NUREG-0800 contains guidance for the staff in performing its review. The relevant regulatory requirements for the review of Section 10.4.5, Circulating Water System, are summarized below:

1. GDC 2, Design bases for protection against natural phenomena, in that failure of a nonsafety-related system or component due to natural phenomena such as earthquakes, tornadoes, hurricanes, and floods should not adversely affect the safety-related structures, systems, and components (SSCs).
2. GDC 4, Environmental and dynamic effects design bases, as it relates to design provisions provided to accommodate the effects of discharging water that may result from a failure of a component or piping in the CW system.
3. Title 10 CFR 20.1406, Minimization of contamination, as it relates to the standard plant DCs and how the design and procedures for operation will minimize contamination of the facility and the environment facilitate eventual decommissioning and minimize to the extent practicable, the generation of radioactive waste.
4. Title 10 CFR 52.47, Contents of applications; technical information, Item (b)(1),

which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporates the DC has been constructed and will be operated in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and NRC regulations.

Technical Evaluation The staffs evaluation of the circulating water system is based upon the information provided in the applicants DCD Tier 2.

10-59

GDC2, Design bases for protection against natural phenomena The staffs review the APR1400 CW system conformance to GDC 2 criteria, is based on adherence to Position C.1 of Regulatory Guide 1.29, Seismic Design Classification. Based on its review of the APR1400 DCD, the staff finds that the KHNP CW system is a non-safety and a non-seismically designed system and it does not interface with any safety-related and/or important to safety SSCs. Therefore, failure of the CW system or its components due to natural phenomena will have no adverse effects on safety-related SSCs, since such components are not located in the turbine generator building. Therefore, the staff finds that the APR1400 CW system meets the requirements of GDC 2 criteria.

GDC 4, Environmental and dynamic effects design bases According to SRP 10.4.5, the requirements of GDC 4 are met when the CW system design includes provisions to accommodate the effects of discharging water that may result from a failure of a component or piping in the CW system. Specifically, means should be provided to prevent or detect and control flooding of safety-related areas so that the intended safety function of a system or component will not be precluded due to leakage from the CW system. The SRP also describes provisions to minimize hydraulic transients (e.g., water hammer) and their effect upon the functional capability and the integrity of system components.

Flooding The staff considers the CW system to be the largest internal flood source for the turbine building. The internal and external flood level for the turbine building is stated in the DCD to be below the height of any non-watertight penetration or door leading from the turbine building into the auxiliary building (or other areas containing safety-related SSCs). As stated in DCD Tier 2, Subsection 10.4.5.2.5, System Operation, a CW line leak is detected with high-high condenser pit water level switches in the condenser pit sump. In the event of gross leakage into the condenser pit, the condenser pit alarm is initiated and the CW pumps are manually stopped to prevent flooding of the turbine building.

According to the drawings in DCD Tier 2, Appendix 9.5A, there are no internal openings between the turbine building and the auxiliary building. However, the DCD did not provide sufficient details on the provisions recommended to keep flood water from reaching the safety-related equipment in other buildings. The staff reviewing the main condenser in DCD Tier 2, Section 10.4.1, also had a similar question and issued RAI 99-7836, Question 10.04.01-3 (ML15204A914), asking the applicant to provide additional information regarding flooding effects due to failure of the main condenser, including a comparison of the flood height to the height of the bottom of non-watertight openings and the drainage away from structures containing safety-related equipment (e.g., auxiliary building).

In its response to RAI 99-7836, Question 10.04.01-3 (ML15308A583), the applicant stated the flood height in the turbine building is postulated by a pipe failure of the circulating water system with its six pumps operating to runout conditions. This flood height is determined to be at the 104 ft elevation (plant grade is at the 100 ft (30.48 m.) elevation). In addition, the applicant provided proposed revisions to DCD Tier 2, Section 10.4.1.3, Safety Evaluation, to change the language to state that no opening between the auxiliary and turbine buildings is located at a lower level than the flood height of the turbine building (i.e., 104 ft (31.69 m.)). The DCD had originally stated this opening would be higher than plant grade (i.e., 100 ft (30.48 m.)) which could have meant flood waters could enter into the auxiliary building and potentially affect 10-60

safety-related equipment. Regarding drainage away from the structures containing safety-related equipment, the applicants response to RAI 99-7836, Question 10.04.01-3 (ML15306A583), stated that there are no openings below the flood height and that water will flow outside via the emergency relief panel.

Regarding the turbine generator building flooding discharge to the outside and away from structures containing safety-related equipment, the staff notes the applicants response to RAI 99-7836, Question 10.04.01-3 (ML15306A583), only described openings to the wall connecting the auxiliary building and turbine building. The applicant did not provide information to ensure flooding drainage that exits the turbine building does not flow back into the auxiliary building by means of grade slope and exterior openings along the outside of the auxiliary building (or any other structure containing safety-related equipment). Therefore, the staff issued a supplemental RAI 402-8477, Question 10.04.01-6 (ML16041A092), requesting the applicant to provide this information and revise the DCD accordingly.

In its response to RAI 402-8477, Question 10.04.01-6 (ML16107A048), the applicant stated that all penetrations in exterior walls at or below the postulated flood level are sealed as described in DCD Tier 2, Subsection 3.4.1.2, Flood Protection from External Sources. Also, in its response (ML16028A449), to RAI 135-8001, Question 09.02.06-1 (ML15220A036), the applicant stated that watertight doors are installed at the exterior entrances of the safety-related buildings in order to prevent flood source from entering into the safety-related SSCs. Regarding grade slope, the applicant provided a new COL information Item, COL Item 3.4(1) (ML15301A917). It requires the COL applicant to provide the site-specific design of plant grading and drainage away from the plant structures. The staff has reviewed the applicants RAI response and found it acceptable because the sealed exterior penetrations and the sloping design will ensure any flooding waters exiting the turbine building will not enter into the safety-related SSCs in other areas of the plant.

In parallel, the staff reviewing DCD Tier 2, Section 10.4.5, also issued RAI 89-8052, Question 10.04.05-1 (ML15201A502), requesting the applicant to provide additional information on how the floodwater in the turbine building is released from the building. In its response to RAI 89-8052, Question 10.04.05-1 (ML16152B012), the applicant stated that the turbine generator building emergency flood relief panel is installed at the 100-ft elevation. The staff has reviewed the applicants RAI response and found it acceptable because the applicant has accounted for a CW system flooding event and provided measures, including a relief panel, to mitigate the flood waters. The applicant has proposed DCD mark-ups to DCD Tier 2, Subsection 10.4.5.2.5, to add the discussion about the determined flood height inside the turbine building and the emergency relief opening panel. The staff confirmed that Revision 1 of the DCD includes this related information. The staff considers this portion of RAI 89-8052, Question 10.4.5-1, to be resolved and closed.

In DCD Tier 2, Section 10.4.5.2.5, the applicant stated that the CW system meets the GDC 4 criteria because design provisions are implemented to accommodate the effects of discharge water which could result from a failure of a component or piping system. The DCD states that, if there is flooding in the yard area due to a failure in a portion of the CW system, the yard is sloped to drain the water away from the auxiliary building and compound building. Further, the CTs are to be located sufficiently far from important to safety SSCs. According to the applicant, therefore, the safe shutdown capability is not compromised by flooding in the yard area. The DCD states that the COL applicant is to provide the location and design of the cooling tower, basin, and CW pump house in this regard (COL Information Item 10.4(3)). The DCD also states 10-61

that the COL applicant is to provide elevation (e.g., drainage, topographical, grade slope) drawings in this regard (COL Information Item 10.4(5)).

In summary, the CW system design includes the following flooding provisions: no safety-related equipment inside the turbine generator building, ability to detect a flooding event via sump level monitors and tripping the CW pumps, no internal openings below the flood height between turbine and auxiliary buildings, emergency relief panel to discharge flood waters to outside of turbine generator building, sloping of the yard elevation away from the auxiliary building and compound building (and other buildings containing safety-related equipment), and the auxiliary building exterior doors are watertight. The staff finds all of these provisions acceptable, as they meet the SRP guidance to conform to the GDC 4 requirement as related to discharge water in the yard area from the CW system.

Water Hammer The staff noticed that DCD Tier 2, Section 10.4.5 addresses the possibility of water hammer for the CW pump butterfly valves; however, the application did not address the possibility of water hammer from other components of the CW system. For this reason, the staff issued RAI 89-8052, Question 10.04.05-1 (ML15201A502), requesting the applicant to provide additional information on how water hammer effects are avoided. In its response RAI 89-8052, Question 10.04.05-1 (ML15300A469), the applicant proposed a new COL Information Item 10.4(11) (later re-numbered as Item 10.4(4)), which directs the COL applicant to confirm that water hammer events are bounded by the system design pressure value with a hydraulic transient analysis or, otherwise, demonstrate that the design is acceptable to satisfy GDC 4 in regard to the design provisions that are implemented to accommodate the effects of discharging water that could result from a malfunction or failure of a component or piping in the system. The staff confirmed that Revision 1 of the DCD includes this new COL Information Item. The staff considers the remaining portion of the RAI, to be resolved and closed because the applicants response provides for how water hammer effects in the CW system will be avoided.

10 CFR 20.1406, Minimization of contamination In DCD Tier 2, Section 10.4.5.2.6, Design Features for Minimization of Contamination, the applicant stated that the CW system is designed with features to meet the requirements of 10 CFR 20.1406 and the guidance of NRC RG 4.21, as related to minimization of contamination. The APR1400 CW system is a non-safety system and, in general, does not contain radioactive materials. However, there is a potential for the CW system to become contaminated if there is a primary-to-secondary leakage, due to steam generator tube rupture, and a leak in the main condenser heat exchanger. The applicant stated that the CW system incorporates methods of early leak detection and leakage control features. Furthermore, under subsection, Prevention/Minimization of Unintended Contamination, the applicant states that system components, including the piping and heat exchangers, are designed with corrosion and erosion resistant materials for life cycle planning. Also, the system is sampled and analyzed periodically to assess water quality including the level of radiological contamination. According to KHNP, the COL applicant is to address design features for the prevention of contamination (COL. 10.4(5), later re-numbered as Item 10.4(6)). The staff finds this COL item appropriate.

The staff reviewed DCD Tier 2, Section 10.4.5.2.6, as related to prevention/minimization of CW system contamination. Because, the CW system design incorporates adequate measures such as, sampling, early leak detection, and controls are incorporated in the CW system design to minimize of the contamination, the staff concludes that the CW system, as described in the 10-62

DCD, meets the requirements of 10 CFR 20.1406 with regards to design features. The staff notes that DCD Tier 2, Chapter 12, Radiation Protection, contains the site-wide master program and procedures for all systems required to satisfy 10 CFR 20.1406.

Initial Test Program Although applicants for DC are not required to submit plans for an initial test program, RG 1.68 acknowledges that DC applicants have previously submitted these plans to assist a future COL applicant referencing the DC in meeting the requirements of 10 CFR 52.79(a)(28).

Preoperational test requirements for the circulating water system are described in DCD Tier 2, Subsections 10.4.5.4 and 14.2.12.1.71. The initial test program for the APR1400 is evaluated in Section 14.2 of this SER.

DCD Tier 2, Table 14.2-7, Conformance Matrix of RG 1.68 Appendix A versus Individual Test Descriptions, states that the COL applicant is to prepare the pre-operational test of cooling tower(s) and associated auxiliary systems per RG 1.68, Appendix A, 1.d.3.j. The staff finds this information acceptable because these system components are conceptual and will be addressed by the COL applicant.

ITAAC Applicants for standard plant DC must provide proposed ITAAC necessary to ensure that a plant incorporating the certified design is built and will operate in accordance with 10 CFR 52.47(b)(1). There are no ITAAC required for the circulating water system. The system is not safety-related and is not required for safe shutdown; therefore the staff finds this acceptable.

Technical Specifications There are no APR1400 TS sections for the circulating water system. The system is not safety-related and is not required for safe shutdown; therefore the staff finds this acceptable.

10-63

Combined License Information Items The following is a list of COL information item numbers and descriptions from DCD Tier 2, Table 1.8-2:

Combined License Information Items DCD Item Tier 2 No. Description Section 10.4(1) The COL applicant is to establish operational procedures and 10.4.5.2.6 maintenance programs for leak detection and contamination control.

10.4(2) The COL applicant is to maintain the complete documentation of 10.4.5.2.6 system design, construction, design modifications, field changes, and operations.

10.4(3) The COL applicant is to provide the location and design of the 10.4.5.2 cooling tower, basin, and CW pump house.

10.4(4) The COL applicant is to confirm that the water hammer events are 10.4.5.2.5 bounded by the system design pressure value with a hydraulic transient analysis or otherwise demonstrate that the design is acceptable to satisfy GDC 4 in regard to the design provisions that are implemented to accommodate the effects of discharging water that could result from a malfunction or failure of a component or piping in the system.

10.4(5) The COL applicant is to provide elevation drawings. 10.4.5.2.5 10.4(6) The COL applicant is to address the design features for the 10.4.5.2.6 prevention of contamination.

10.4(12) The COL applicant is to determine the wet bulb temperature 10.4.5.2.5 correction factor to account for potential interference and recirculation effects. Table 10.4.5-1 The staff finds that no additional COL information items need to be included in DCD Tier 2, Table 1.8-2 for the circulating water system.

Conclusion Based on a review of the information that is provided and as discussed above in the technical evaluation section, the staff finds that the applicant has met the requirements of GDC 2, GDC 4 and 10 CFR 52.47(b)(1), and 10 CFR 20.1406 for Section 10.4.5, Circulating Water System, of the APR1400 DCD.

10-64

10.4.6 Condensate Polishing System Introduction The CPS is designed to remove dissolved and suspended impurities from the condensate. The CPS provides condensate cleanup capability and maintains condensate quality through demineralization. It does not perform a safety-related function. Also discussed in this section is secondary plant water chemistry as described in DCD Section 10.3.5, Secondary Water Chemistry.

Summary of Application DCD Tier 1: There is no Tier 1 information for the CPS DCD Tier 2: The applicant provided a Tier 2 system description in Section 0.4.6, Condensate Polishing System, of the APR1400 DCD. Design information about the system is also summarized in Table 10.4.6-1, Condensate Polishing System Design Parameters, and in Figure 10.4.6-1, Condensate Polishing System Flow Diagram.

The CPS is designed with seven mixed-resin demineralizers (cation-bed and mixed-bed) to remove ionic impurities from the condensate during plant startup, hot standby, shutdown operations, and power operations. A condensate bypass valve is located in the condensate pump discharge header to bypass the condensate purification when not needed. The CPS consists of the following components: cation-bed ion exchanger vessels, mixed-bed ion exchanger vessels, resin traps, resin collection tank, spent-resin holding tank, resin mixing and addition tank, sampling system, and instrumentation.

The DCD Section 10.3.5 describes the secondary water chemistry, but its evaluation is included under Section 10.4.6 of this SER. This is because the CPS is one of the principal means of effecting secondary water chemistry control, and the acceptance criteria for secondary water chemistry are addressed in NUREG-0800 SRP Section 10.4.6, Condensate Cleanup System.

Initial Test Program: There are no ITP requirements for the CPS ITAAC: There are no ITAAC for the CPS TS: There are no TS associated with the CPS.

Regulatory Basis The relevant requirements of the Commission's regulations for this area of review, and the associated acceptance criteria, are given in NUREG-0800 SRP Section 10.4.6, Condensate Cleanup System, and are summarized below.

1. GDC 14, Reactor coolant pressure boundary, in Appendix A to 10 CFR Part 50, requires that the reactor coolant pressure boundary be designed, fabricated, erected, and tested to ensure an extremely low probability of abnormal leakage, rapidly propagating failure, and gross rupture. Section 10.4.6 of NUREG-0800 applies to GDC 14 because the condensate cleanup system maintains water quality to avoid corrosion-induced failure of the reactor pressure boundary, specifically the SG tubing.

10-65

2. Title 10 CFR 52.47(b)(1), which requires that a DC application include the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRC regulations.

Technical Evaluation The staff reviewed the information provided in final safety analysis report (DCD) Tier 2, Sections 10.4.6, Condensate Polishing System Revision 1, 10.3.5, Secondary Water Chemistry Revision 0, and the supplemental information provided in applicants letter (ML15198A549) against the requirements of GDC 14. GDC 14 is applicable to the CPS since the system is designed to maintain water quality and to avoid corrosion-induced failure of the reactor coolant pressure boundary, specifically the SG tubing. As described in the SRP, an acceptable method of conforming to GDC 14 is for the applicant to meet the latest version in the EPRI report series, PWR Secondary Water Chemistry Guidelines.

The EPRI PWR Secondary Water Chemistry Guidelines (EPRI Guidelines) provide several criteria for the secondary water chemistry control program including sampling frequency and other sampling requirements, guidelines for continuously monitoring water chemistry parameters, and operating limits for impurities and additives, as well as associated action responses to be carried out if limits are exceeded.

DCD Tier 2, Section 10.3.5 states that the secondary water chemistry program will be consistent with the latest version of the EPRI Guidelines, and a COL applicant that incorporates DCD Tier 2, Section 10.3.5 by reference commits to these specifications. The EPRI Guidelines provide specific Action Level 1, 2, and 3 limits for many secondary water chemistry control parameters.

Specific actions including reduced power and/or shutdown are required if these limits are exceeded. DCD Tier 2 COL Information Item 10.3(3) requires the COL applicant to address secondary side chemistry controls (e.g., threshold values, operator actions) that conform to the latest version of the EPRI Guidelines. COL Item 10.3(3) was incorporated into Revision 1 of the DCD as proposed in the applicants letter (ML15198A549). This COL item will ensure that aspects of the secondary water chemistry program such as Action Levels and pH control and optimization of the condensate/feedwater cycle are in accordance with the latest EPRI Guidelines. Although the staff does not formally review or issue a SE of the various EPRI water chemistry guidelines (including the PWR Secondary Water Chemistry Guidelines), these guidelines are recognized as representing the industries best practices in water chemistry control. Extensive experience in operating reactors has demonstrated that following the EPRI Guidelines minimizes the occurrence of corrosion-related failures. Further, the EPRI Guidelines are periodically revised to reflect evolving knowledge with respect to best practices in chemistry control. Therefore, as stated in the SRP, the staff accepts the use of the latest version of the EPRI Guidelines as the basis for the APR1400 secondary side water chemistry program.

The CPS purifies secondary water by passing it through mixed-resin (cation and anion) demineralizers. Each of the seven demineralizers has its own resin trap, and all three are served by two spent resin holding tanks and a single resin mixing/holding tank, where fresh resin is prepared and stored. As described in DCD Tier 2, Section 10.4.6.2.2, Component Description, all of these vessels are constructed of carbon steel, and all but the resin traps have a rubber lining. In the operating fleet, the use of rubber linings have been proven to provide adequate protection from corrosion of the carbon steel, and to prevent impurities from 10-66

entering the secondary water. Design details for each vessel are shown in DCD Tier 2, Table 10.4.6-1 and Figure 10.4.6-1. The design capacity of 16-100 percent flow is more than adequate to allow the plant to operate while abnormal secondary water chemistry conditions are corrected. In the event that the capacity is insufficient, the plant will be shut down in accordance with the secondary water chemistry control program action levels.

Secondary water chemistry is focused on preventing corrosion in SGs, condensers, piping, and other equipment. Principal parameters that must be controlled are impurity ion concentrations, including sodium (Na+), chloride (Cl-), and sulfate (SO4-2) ions; pH; and dissolved oxygen.

As stated in DCD Tier 2, Section 10.3.5.1, Chemical Control Basis, ammonia and ethanolamine are used as pH controllers, and hydrazine is added to control dissolved oxygen. These additives are quite volatile and would normally travel with the steam through the turbines and to the condensers. Hence, depletion of these chemicals in the CFS will be detected in the main condensers. Thus, the injection of new chemicals occurs continuously downstream of the condensate pumps or demineralizers (DCD Tier 2, Section 10.3.5).

In addition to providing suitable water quality to prevent corrosion-induced failure of the pressure boundary, adequate instrumentation and sampling must be provided to verify the effectiveness of the CPS in order to meet GDC 14 and the recommendations of NUREG-0800 SRP Section 10.4.6. Concentrations are monitored using continuous analyzers (supplemented by grab samples), as described in DCD Tier 2, Section 9.3.2, Process and Post-Accident Sampling Systems, and additive injections are determined either automatically or manually from the analytical data. The continuous monitors identified in this section are consistent with the EPRI Guidelines. The staff finds the instrumentation and sample points provided are acceptable, because they meet those recommended by the EPRI Guidelines.

Additionally, NUREG-0800 SRP Section 10.4.6 recommends that the system be connected to radioactive waste disposal systems to allow disposal of spent resin or regenerant solutions when necessary. DCD Tier 2, Section 10.4.6.2.3, System Operation, states that radioactive resin will be transferred to the radioactive waste treatment system from the spent resin holding tank. The staff finds this acceptable because it conforms to the SRP guidance. DCD Tier 2 Section 10.4.6.2.3 also includes COL Item 10.4(7) to address packaging of spent CPS ion exchange resin found to exceed a predetermined limit for radioactive contamination. The COL applicant is responsible for the temporary shielding (if required), mobile equipment for transferring the resin to containers, temporary storage, and shipment for offsite treatment or disposal. The staffs review of this topic is in Section 12.2 of this SER.

Combined License Information Items The following is a list of item numbers and descriptions from Table 1.8-2 of the DCD:

Combined License Information Items DCD Tier 2 Item No. Description Secction 10.3(3) The COL applicant is to provide secondary side water 10.3.7 chemistry threshold values and recommended operator actions for chemistry excursions in compliance with the latest version of the EPRI PWR Secondary Water Chemistry Guidelines in effect at 10-67

DCD Tier 2 Item No. Description Secction the time of COLA submittal. The COL applicant is to establish the operational water chemistry program six months before fuel load.

10.4(1) The COL applicant is to establish operational 10.4.11 procedures and maintenance programs for leak detection and contaminant control.

10.4(2) The COL applicant is to maintain the complete 10.4.11 documentation of system design, construction, design modifications, field changes, and operations.

10.4(7) The COL applicant is responsible for provisions of 10.4.11 temporary shielding, if required, and mobile equipment, including spent resin fill-head for packaging of the contaminated spent resin, provisions of temporary storage, and shipment of packaged contaminated CPS spent resin for off-site treatment and/or disposal.

The staff finds COL Item 10.3(3), addressing use of the latest version of the EPRI Secondary Water Chemistry Guidelines, acceptable for the reasons described above in Section 10.4.6.4 of this SER. The staff finds COL Items 10.4(1) and 10.4(2) acceptable because operational procedures and programs, and records of the as-built system, are the responsibility of the COL holder. Revision 1 of DCD Tier 2, Section 10.4.6.2.4, Design Features for Minimization of Contamination, incorporates changes, proposed in the applicants letter (ML15198A549), to the descriptions of COL Items 10.4(1) and 10.4(2). The staff finds the changes acceptable because they make the descriptions consistent with the wording of the COL items listed in DCD Tier 2 Section 10.4.6.11 and DCD Tier 2 Table 1.8-2. The staffs review of the acceptability of COL 10.4(7), addressing contaminated resin, is described in Section 12.2 of this SER.

Conclusion The applicant has described effective systems and procedures to maintain the purity of secondary side coolant. Additional details of the secondary side water chemistry will be provided by the COL applicant as stated in COL Item 10.3(4) and will meet the applicable criteria in the latest version of the EPRI Guidelines. The staff therefore, concludes, based on the information supplied by the applicant, that the requirements of GDC 14 and to maintain the reactor coolant pressure boundary will be satisfied. In addition, in accordance with 10 CFR 52.47(b)(1), the staff verified that no ITAAC is required for this section.

10.4.7 Condensate and Feedwater System Introduction The condensate and feedwater system (CFS) provides feedwater at the required temperature, pressure, and flow rate to the steam generators (SGs). The CFS includes all of the components 10-68

and equipment from the condenser hotwell outlet up to the SG inlet including the piping and connections to the extraction steam; heater drains; feedwater pump turbine; and feedwater vents and drains subsystems. The CFS is not a safety-related system; however, the portion of the feedwater system required to provide containment and feedwater isolation following a design-basis accident, and the portion of the feedwater piping used by the auxiliary feedwater system both perform safety-related functions and are therefore safety-related.

Summary of Application Tier 1: The Tier 1 information associated with this section is found in Tier 1, Section 2.7.1.4, Condensate and Feedwater System, of the APR1400 DCD. Figure 2.7.1.4-1, Condensate and Feedwater System, provides an illustration of the main feedwater system configuration and shows the arrangement of the safety-related CFS components.

Tier 2: The applicant has provided a Tier 2 system description in Section 10.4.7, Condensate and Feedwater System, of the APR1400 DCD, summarized here in part as follows:

The condensate and feedwater system is composed of a condensate system and a feedwater system. The boundary of the condensate system is from the condenser hotwell outlet to the deaerator, and the feedwater system boundary is from the outlet of the deaerator to the inlet of the SGs.

The condensate system consists of three condensate pumps, three stages of three parallel low-pressure (LP) heaters, a deaerator, and two deaerator storage tanks. The three 50-percent-capacity motor-driven condensate pumps (two operating and one standby) deliver condensate from the condenser hotwells through the condensate polisher, a steam packing exhauster, and three stages of LP feedwater heaters to the deaerator storage tank.

The feedwater system consists of three main feedwater pumps, three feedwater booster pumps, a startup pump, three stages of two parallel high-pressure (HP) heaters, main feedwater isolation valves (MFIVs), feedwater check valves, and feedwater CVs. Feedwater is pumped from the deaerator storage tank by the feedwater booster pumps and main feedwater pumps through the HP feedwater heaters to the SGs.

The entire condensate system is nonsafety-related. The portion of the feedwater system required to mitigate the consequences of an accident and allow safe shutdown of the reactor is safety-related and provides containment and feedwater isolation. SSCs from the main steam valve house (MSVH) to the SG are designed as ASME Section III Class 2, and seismic Category I. All other portions are designed as non-nuclear safety (NNS) and seismic Category III in conformance with NRC RG 1.29. DCD Section 3.2, Classification of Structures, Systems, and Components, Table 3.2-1 provides the classification of SSCs in the feedwater and condensate system and its conformance with NRC RG 1.29.

ITAAC: The ITAAC associated with Tier 2, Section 10.4.7, are given in Tier 1, Section Table 2.7.1.4-4, Condensate and Feedwater ITAAC.

TS: The TS associated with Tier 2, Section 10.4.7, are given in Tier 2, Chapter 16, Section 3.7.3, Seismic Subsystem Analysis, of the APR 1400 DCD.

10-69

Regulatory Basis The relevant requirements of the Commission regulations for this area of review, and the associated acceptance criteria, are given in Section 10.4.7, Condensate and Feedwater System, of NUREG-0800, Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants, and are summarized below. Review interfaces with other SRP sections are also indicated in SRP Section 10.4.7.

1. GDC 2, Design bases for protection against natural phenomena, as related to important to safety portions of the CFS designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions.
2. GDC 4, Environmental and dynamic effects design bases, as related to the dynamic effects associated with possible fluid flow instabilities (e.g., water hammer) during normal plant operation, as well as during upset or accident conditions.
3. GDC 5, Sharing of structures, systems, and components, as related to the capability of shared systems and components important to safety to perform required safety functions.
4. GDC 44, Cooling water, as related to:

The capability to transfer heat loads from the reactor system to a heat sink under both normal operating and accident conditions.

Redundancy of components so that under accident conditions, the safety function can be performed assuming a single active component failure.

(This may be coincident with the loss of offsite power for certain events.)

The capability to isolate components, subsystems, or piping if required so that the system safety function will be maintained.

5. GDC 45, Inspection of cooling water system, as related to design provisions to permit periodic in-service inspection of system components and equipment.
6. GDC 46, Testing of cooling water system, as related to design provisions to permit appropriate functional testing of the system and components to ensure structural integrity and leak-tightness, operability and performance of active components, and capability of the integrated system to function as intended during normal, shutdown, and accident conditions.
7. Title 10 CFR 20.1406, Minimization of Contamination, as it relates to the design features that will facilitate eventual decommissioning and minimize, to the extent practicable, contamination of the facility and the environment, facilitate eventual decommissioning, and minimize, to the extent practicable, the generation of radioactive waste.
8. Title 10 CFR 52.47(b)(1), which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the 10-70

acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRCs regulations.

Technical Evaluation The staff reviewed the APR1400 condensate and feedwater system design as described in the APR1400 DCD. The review, which was performed in accordance with SRP Section 10.4.7, Condensate and Feedwater System, Revision 4, issued March 2007, was based on the Tier 1 and Tier 2 information contained in Revision 1 of the APR1400 DCD. The results and conclusions of the staffs review of the condensate and feedwater system are discussed below.

The condensate and feedwater system is designed to supply feedwater at the required temperature, pressure, and flow rate to the steam generator (SG) secondary side inlet during normal operation, and to provide containment and feedwater isolation following a design basis accident. It consists of the condensate system (CDS) which runs from the condenser hotwell outlet to the deaerator and the feedwater system (FWS) which runs from the outlet of the deaerator to the SG nozzles. The CDS and nonsafety-related portions of the FWS are located within the turbine building. The safety-related portion of the FWS is located within the reactor building and inside containment. The major components of the condensate and feedwater system include condensate pumps; condensate polishers; a gland steam condenser; three strings of low-pressure heaters; a deaerator; deaerator storage tanks; main feedwater pumps; feedwater booster pumps; two strings of high pressure feedwater heaters; condensate and feedwater regulating valves; main feedwater isolation valves; and associated piping, valves, instrumentation, and controls. The system description, including component design parameters and system flow diagrams are given in Section 10.4.7, Condensate and Feedwater System, of the APR1400 DCD.

GDC 2, Design basis for protection against natural phenomena The staff reviewed the condensate and feedwater system for compliance with the requirements of GDC 2, which are based on adherence to Position C.1 of RG 1.29 for the safety-related portion of the system, and Position C.2 for the nonsafety-related portions of the system.

Regulatory Guide 1.29, Position C.1.f states that the pertinent quality assurance requirements of Appendix B to 10 CFR 50 shall apply to all activities affecting the safety-related function of those portions of the steam and feedwater systems of PWRs extending from and including the secondary side of the steam generator up to and including the outmost containment isolation valves and connecting piping of a nominal size of 2.5 inches (6.54 cm.) or larger, up to and including the first valve that is either normally closed or capable of automatic closure during all modes of normal operation.

DCD Section 10.1, Summary Description, indicates that the portion of the main feedwater piping and components from each SG nozzle inlet up to and including the main steam valve house (MSVH) penetration have safety-related functions when providing for containment and feedwater isolation following a design basis accident. In DCD section 10.4.7.2.2, Component Description, it is stated that the valves, piping, and associated support and restraints of the main feedwater system from and including the MSVH to the SG feedwater nozzles are Seismic Category I and designed to ASME Section III, Class 2 requirements. This information is also provided in DCD Table 3.2-1, item 39, which indicates compliance with the requirements of 10 CFR 50, Appendix B. In addition, DCD Section 10.4.7.3, Safety Evaluation, states that safety-10-71

related portions of the feedwater system are located in seismic Category I structures designed to protect against environmental hazards such as wind, tornadoes, hurricanes, floods and missiles, as well as the effects of high and moderate energy pipe ruptures.

RG 1.29, Position C.2 provides guidance for nonsafety-related portions of the system. The design should be such that failure of the nonsafety-related portions of the system not designed to seismic category I standards will not affect surrounding SSCs important to safety, or preclude operation of the safety-related essential parts of the system.

DCD Section 10.4.7.1, Design Basis, states that the portions of the condensate and feedwater system that are not safety-related are designed as non-nuclear safety and seismic Category III and are in conformance with NRC RG 1.29 position C.2. In its review of the CFS the staff found that the portions of the system that did not perform safety-related function were all housed in the turbine building and since the building does not contain any important to safety SSC, the seismic category III designation is found to be acceptable.

Since the safety-related portions of the system are designed in accordance with RG 1.29 (Position C.1) and are protected against environmental hazards by being housed in seismic Category I structures designed to protect against the environmental hazards; and since the nonsafety-related portions of the system are designed in accordance with RG 1.29 (Position C.2), the staff concludes that the condensate and feedwater system meets the requirements of GDC 2 as they relate to protecting the system against seismic and other natural phenomena.

GDC 4, Environmental and dynamic effects design bases The staff reviewed the condensate and feedwater system for compliance with the requirements of GDC 4, Environmental and dynamic effects design bases, as related to dynamic effects associated with possible fluid flow instabilities including water hammer and effects of pipe breaks. Compliance with the requirements of GDC 4 is based on identification of the essential portions of the system that need to be protected from dynamic effects, including internally and externally generated missiles, pipe whip and jet impingement due to high and moderate energy missiles and water hammer. The guidance in Branch Technical Position (BTP) 10-2, Design Guidelines for Avoiding Water Hammer in Steam Generators, specifically recommends that the condensate and feedwater system be designed to achieve the following provisions:

Prevent or delay water draining from the feedring following a drop in SG water level.

Minimize the volume of feedwater piping external to the SG which could pocket steam using the shortest horizontal run of inlet piping to the feedring.

Perform tests, acceptable to the NRC, to verify that unacceptable feedwater hammer will not occur and provide test procedures for staff approval.

Implement pipe refill flow limits where practical.

The applicant states in DCD Tier 2, Section 10.4.7.1, Design Bases, that the safety-related portions of the condensate and feedwater system are designed to accommodate the effects of the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents (LOCA). It is also stated in the design 10-72

bases that the CFS design includes protection against dynamic effects, including internally generated missiles, pipe whipping, and discharging fluids due to equipment malfunctions.

The applicant addresses water hammer prevention in DCD Section 10.4.7.6, Water Hammer Prevention, stating that the feedwater system design minimizes the potential for a water hammer and its effects. Design features identified in the DCD for prevention and mitigation of water hammer include:

The connection of each SG is at the highest point of each feedwater line downstream of the MFIV.

Minimization of horizontal length of feedwater from the main nozzle to the downward turning elbow of each SG.

Top feedwater lines being maintained full at all times.

Providing a check valve upstream of the auxiliary feedwater connection to the top feedwater line.

To ensure that adequate precautions are taken to prevent water hammer once the system has been put into operation, the applicant states in DCD Section 10.4.7.6 that the COL applicant is to provide operating and maintenance procedures in accordance with NUREG-0927, and a milestone schedule for implementation of these procedures. The applicant also provides a list containing the key elements that these procedures need to address.

COL Item 10.4(6) is contained in Section 10.4.11, Combined License Information, of the application and states that the COL applicant is to provide operating and maintenance for the following items in accordance with NUREG-0927 and milestone schedule for implementation of the procedures. However, no items were identified in COL Item 10.4 (6). Therefore the staff issued RAI 82-8002, Question 10.4.7-1 (ML15197A266), to have the applicant clarify what COL Item 10.4(6) requires of the COL applicant.

In its response to RAI 82-8002, Question 10.4.7-1(ML15224B411), the applicant indicated that there was an editorial error in the COL item. The applicant provided a revised description for the COL item which removed the reference that indicated that procedures would be developed for the following items, so that the COL Item 10.4(6), will read as follows:

The COL applicant is to provide operating and maintenance procedures in accordance with NUREG-0927 and a milestone schedule for implementation of the procedures The staff reviewed the applicants response and determine it to be acceptable since the proposed revision clarifies that the operating and maintenance procedures are to be in accordance with the recommendations in NUREG-0927, and DCD Section 10.4.7.6 specifies that the procedures are to address:

a. Prevention of rapid valve motion.
b. Introduction of voids into water-filled lines and components.
c. Proper filling and venting of water-filled lines and components.

10-73

d. Introduction of steam or heated water that can flash into water-filled lines and components.
e. Introduction of water into steam-filled lines or components.
f. Proper warmup of steam-filled lines.
g. Proper drainage of steam-filled lines.
h. Effects of valve alignments on line conditions.

The applicant also provided the applicable markups for DCD Tier 2, Section 10.4.11, and DCD Table 1.8.2. The staff finds that the concern raised by Question 10.4.7-1 has been adequately addressed, and based on the review of the condensate and feedwater system, as discussed above, the staff finds that the condensate and feedwater system design satisfies the requirements of GDC 4 as it relates to the dynamic effects associated with possible fluid flow instabilities. The incorporation of the DCD markups, provided as part of the RAI response, into the DCD was a confirmatory item (Confirmatory Item 10.4.7-1). The staff confirmed that the RAI response markup has been incorporated into Revision 1 of the DCD. The staff noted that COL Item 10.4(6) was re-numbered to COL Item 10.4(8) in DCD Rev. 1. The staff finds the revised item has been incorporated in the DC and Confirmatory Item 10.4.7-1 is resolved and closed.

GDC 5, Sharing of structures, systems, and components GDC 5 contains provisions restricting the sharing of structures, systems, and components important to safety between nuclear power units. The condensate and feedwater system in the APR1400 design is not shared between or among other nuclear units. Therefore, the requirements of GDC 5 are met.

GDC 44, Cooling water The staff reviewed the condensate and feedwater system for compliance with the requirements of GDC 44, Cooling water, as related to the capability to transfer heat from SSCs important to safety to an ultimate heat sink are met by demonstrating that the condensate and feedwater system is capable of providing heat removal under both normal operating and accident conditions; has redundancy of components so that under accident conditions the safety function can be performed assuming a single active component failure; and has the capability to isolate components, subsystems, or piping if required so that the system safety function will be maintained.

GDC 44 applies to the APR1400 because the system must be designed to remove heat from the reactor during normal operation, thus limiting fuel clad temperature from exceeding design limits. Preoperational tests of the condensate and feedwater systems, as described in DCD Section 14.2.12.1.68, Feedwater System Test, and 14.2.12.1.69, Condensate System Test, respectively, will be performed to show that these systems are designed to supply adequate water flow for heat removal.

The condensate and feedwater system does not perform the safety function of heat removal during accident conditions. During accidents heat removal is accomplished using the auxiliary feedwater system (AFWS), which is discussed in DCD Tier 2, Section 10.4.9. The staffs evaluation for the AFWS is included in Section 10.4.9 of this report.

10-74

The staff reviewed the condensate and feedwater system design for redundancy of components and the ability that under accident conditions the safety function can be performed assuming a single active component failure, as well as the capability to isolate components, subsystems, or piping if required. Suitable redundancy of components and power supplies are provided to assure containment and feedwater isolation under accident conditions. The main feedwater isolation valves (MFIVs) are described in DCD Section 10.4.7.2.2, Component Description.

The MFIVs provide complete termination of feedwater flow to the SGs after receipt of a main steam isolation signal even after the effects of a single failure are imposed. Two redundant and fail-closed type MFIVs in series are installed in the economizer feedwater lines and downcomer feedwater lines, and each MFIV actuator is physically and electronically independent of the other in series, so that failure of one does not cause the failure of the other.

The staff found that the condensate and feedwater system meets the requirements of GDC 44 with respect to heat removal from the reactor during normal operation, and that feedwater and containment isolation can be accomplished during accident conditions, assuming a single active component failure.

GDC 45, Inspection of cooling water system The staff reviewed the condensate and feedwater system design to ensure design provisions are provided for periodic inspections of systems, components, and equipment, as required by GDC 45. The applicant states in DCD Section 10.4.7.1 that the condensate and feedwater system is designed to permit appropriate periodic in-service inspection of important components in conformance with GDC 45. Also, in DCD Section 10.4.7.4, Inspection and Testing Requirements, it is stated that for the condensate and feedwater system, ASME Section III piping is inspected and tested in accordance with ASME Section III and XI. Therefore, GDC 45 is satisfied with respect to permitting periodic in-service inspection (ISI) of system components and equipment.

GDC 46, Testing of cooling water system The design of the safety-related portions of the condensate and feedwater system was reviewed by the staff to ensure that there are provisions for the performance of periodic functional testing of the system and components, as required by GDC 46. In DCD Tier 2, Section 10.4.7.4, it is stated that the condensate and feedwater system testing includes functional testing of the systems and components to provide reasonable assurance of structural integrity, leak tightness, operability and performance of active components, and testing of the capability of integrated system function as intended during normal, shutdown, and accident conditions. It also states that ASME Section III, Class 2, valves are periodically in-service tested for exercising and leakage in accordance with ASME OM. Based on the above, the staff concludes that the condensate and feedwater system design meets the requirements of GDC 46 since it includes provisions for the performance of periodic functional testing of the system and components.

10 CFR 20.1406, Minimization of contamination Title 10 CFR 20.1406 requires in part that each DC applicant describe how the facility design and procedures for operation will minimize, to the extent practicable, contamination of the facility and the environment, as well as the generation of radioactive waste. The condensate and feedwater system, along with the main steam system (MSS), make up the secondary cooling system. In general the condensate and feedwater system does not contain radioactive fluids.

However, since the condensate and feedwater system provides cooling on the secondary side 10-75

of the steam generator tubes, there is the potential for the condensate and feedwater system fluid to become contaminated if significant primary-to-secondary leakage occurs across the steam generator tubes.

In DCD Section 10.4.7.2.4, Design Features for Minimization of Contamination, the applicant states that the CFS is designed with specific features to meet the requirements of 10 CFR 20.1406. Specifically, it is stated that, for every subsystem that may potentially contain radioactive materials, an evaluation was performed which included leakage determination for the areas and pathways where leakage may occur, and the methods of leakage control incorporated in the system design. Based on its evaluation the applicant determined that the system design facilitates early leak detection, allowing prompt assessment and response to manage collected fluids.

With the exception of a FW piping section in the containment and auxiliary building containing flow elements and feedwater control and isolation valves, the CFS components and its associated subsystems are located inside the turbine generator building which has floors that are sloped, coated and provided with drains which are routed to the turbine building sumps.

These sumps are monitored for radiological contamination. Drainage that is detected to be contaminated is routed to the liquid waste management system for treatment. Provisions for early leak detection include radiation monitors on the condenser vacuum pump exhaust line and the steam generator blowdown line to monitor radiation levels associated with the condensate and steam generator blowdown systems. Leak detection is also included at all tube-to-tube sheet interfaces.

Additionally, there is no embedded or buried piping incorporated in the condensate and feedwater system design. The feedwater piping between the turbine generator building and the auxiliary building is routed at a high elevation and is provided with a piping sleeve. Any leakage is drained back to the turbine generator building and is collected by the floor drain system.

Cross-contamination is protected against through design and operation; normal and emergency drains are routed to the condenser and are forwarded to the condenser polishers for treatment, minimizing the spread of radiation. If leakage occurs from the condensate and feedwater system equipment, the water is drained to local drain hubs by gravity and transferred to the turbine generator building drain system sump for collection.

Based on the above discussion, the staff concludes that the condensate and feedwater system design, as described in the DCD, complies with 10 CFR 20.1406 since it provides for monitoring and leakage detection, collection and control of potential contamination, and provides accessibility for inspection and maintenance so that leaks can be readily identified and corrective actions taken.

Initial Test Program Although applicants for DC are not required to submit plans for an initial test program, RG 1.68 acknowledges that DC applicants have previously submitted these plans to assist a future COL applicant referencing the DC in meeting the requirements of 10 CFR 52.79(a)(28).

Preoperational test requirements for the CFS are listed in DCD Tier 2, Section 14.2.12.1.30, Feedwater Control System Test; Section 14.2.12.1.68, Feedwater System Test; Section 14.2.12.1.69, Condensate System Test; and Section 14.2.12.1.73, Heater Drains System Test.

The initial test program for APR1400 is evaluated in Section 14.2 of this SER.

10-76

ITAAC The proposed ITAAC for the CFS are given in DCD Tier 1, Table 2.7.1.4-4 (Condensate and Feedwater System ITAAC).

The staffs review for the CFS Tier 1 information included review of descriptive information, safety-related functions, arrangement, mechanical, I&C and electric power design features, environmental qualification, as well as system and equipment performance requirements provided in DCD Tier 1, Section 2.7.1.4. The ITAAC for the CFS verify the principal design features and functional capabilities of the system by verifying the system functional arrangements; ASME Code Data report generation; ASME compliant welding; ASME pressure testing; seismic Category I equipment being able to withstand seismic design basis loads; Class 1E equipment qualification for harsh environment; Class 1E power supply; physical separation and electrical isolation of Class 1E divisions in accordance with RG 1.75; valve performance; system alarms, controls and displays; and environmental qualification of non-metallic parts, materials, and lubricants in safety-related mechanical equipment. The staff finds that all the necessary CFS equipment has been adequately identified in the applicable tables. Based on its review, the staff finds that the DCD Tier 1 information and ITAAC requirements adequately address the design certification requirements for the CFS. Further, the staff concludes that the ITAAC requirements are sufficient to demonstrate that if the ITAAC are satisfied, the CFS has been constructed and will operate in accordance with the design certification, the provision of the Atomic Energy Act of 1954, as amended, and NRC regulations as required by 10 CFR 52.47(b)(1).

A discussion of all APR1400 ITAAC is provided in Section 14.3 of this SER.

Technical Specifications The staff reviewed DCD Tier 2 Chapter 16, TS 3.7.3, for applicability to the main feedwater system (MFWS). TS 3.7.3 provides limiting conditions for operation and surveillance requirements for the MFIVs. TS Bases 3.7.3 background description is consistent with the DCD Tier 2 description of MFIV. The staff concludes that TS 3.7.3 appropriately addresses the limiting conditions for operation and surveillance requirements for the MFIVs.

Combined License Information Items The following is a list of COL Information Items and descriptions from Table 1.8-2 of the DCD Tier 2:

Combined License Information Items Item No. Description DCD Tier 2 Section 10.4(1) The COL applicant is to provide 10.4.7 operational procedures and maintenance programs as related to leak detection and contamination control. Procedures and maintenance programs are to be completed before fuel is loaded for commissioning.

10-77

10.4(2) The COL applicant is to maintain 10.4.7 complete documentation of the system design, construction, design modifications, field changes, and operations.

10.4(8) The COL applicant is to provide operating 10.4.7 and maintenance procedures in accordance with NUREG-0927 and a milestone schedule for implementation of the procedures.

Conclusion The staff finds the APR1400 condensate and feedwater system design acceptable because it meets applicable regulatory requirements including GDC 2 regarding protection from natural phenomena, GDC 4 regarding protection against missiles and effects of pipe breaks, GDC 5 regarding shared systems, GDC 44 regarding transferring heat to the ultimate heat sink, GDC 45 regarding inspections, GDC 46 regarding periodic testing, 10 CFR 20.1406 and 10 CFR 52.47(b)(1) regarding ITAAC.

10.4.8 Steam Generator Blowdown System Introduction The steam generator blowdown system (SGBS) assists in maintaining the chemical characteristics of the secondary water within acceptable limits during normal operation and during anticipated operational occurrences such as condenser in-leakage and primary-to-secondary SG tube leakage. This is accomplished by removing accumulated impurities with continuous blowdown from the SG secondary side. The SGBS includes a non-safety-related wet layup system (WLS) used to control water chemistry during long-term shutdown. The SGBS has a safety-related function of providing SG isolation and containment isolation during design-basis events. Therefore, the system is classified as safety-related inside the containment up to and including the first isolation valves outside containment. The remainder of the system is classified as non-safety-related.

Summary of Application DCD Tier 1: In DCD Tier 1, Subsection 2.7.1.8, Steam Generator Blowdown System, the applicant described the secondary water purification function and the safety-related isolation function of the SGBS. The Tier 1 information includes design information and ITAAC related to functional arrangement, American Society of Mechanical Engineers (ASME) Code requirements, seismic design, instrumentation, controls, and radioactive waste handling.

DCD Tier 2: In DCD Tier 2, Subsection 10.4.8, Steam Generator Blowdown System, the applicant describes the main components, design requirements, equipment capacities, monitoring and controls capabilities, and operation. The SGBS consists of a flash tank, regenerative heat exchangers, filters, demineralizers, pumps, piping, valves, and instrumentation. In addition to describing the system components, the Tier 2 information 10-78

describes the safety-related and non-safety-related functions, the system operating modes, and testing and inspection requirements.

The SGBS flow diagrams are shown in Figure 10.4.8-1, Steam Generator Blowdown System Flow Diagram (1 of 2), and Steam Generator Blowdown System Flow Diagram (2 of 2). The interface with the sampling system is shown in Figure 9.3.2-2, Process Sampling System Flow Diagram (3 of 6). Additional system design information is provided in Table 10.4.8-1, Steam Generator Blowdown System Major Component Design Parameters, Table 10.4.8-2, Steam Generator Blowdown System Failure Modes and Effects Analysis, and Table 10.4.8-3, Codes and Standards for Equipment in the SGBS.

ITAAC: The ITAAC related to the SGBS are listed in DCD Tier 1, Subsection 2.7.1.8.

TS: There are no TS for this area of review.

Regulatory Basis The relevant requirements of the Commissions regulations for this area of review, and the associated acceptance criteria, are given in Section 10.4.8, Steam Generator Blowdown System, of NUREG-0800, the Standard Review Plan (SRP), and are summarized below.

Review interfaces with other SRP sections are listed in SRP Section 10.4.8.

1. GDC 1, Quality standards and records, as it relates to system components being designed, fabricated, erected, and tested to quality standards.
2. GDC 2, Design bases for protection against natural phenomena, as it relates to system components being designed to seismic Category I requirements.
3. GDC 13, Instrumentation and control, as it relates to monitoring system variables that can affect the reactor coolant pressure boundary (RCPB) and to maintaining them within prescribed operating ranges.
4. GDC 14, Reactor coolant pressure boundary, as it relates to secondary water chemistry control to maintain the integrity of the RCPB.
5. Title 10 CFR 52.47(b)(1) requires that a DC application include the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a plant that incorporates the DC is built and will operate in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and the NRC regulations.

Technical Evaluation The staff reviewed DCD Tier 2, Section 10.4.8 and Tier 1, Section 2.7.1.8, Steam Generator Blowdown System, in accordance with SRP Section 10.4.8, Steam Generator Blowdown System. Acceptance of the SGBS is based on meeting the requirements of GDC 1, GDC 2, GDC 13, and GDC 14. As stated in DCD Subsection 10.4.8.2.4, Design Features for Minimization of Contamination, the system is also designed to meet the requirements of 10 CFR 20.1406, Radiological Criteria for Unrestricted Use, and the guidance in Regulatory Guide (RG) 4.21, Minimization of Contamination and Radioactive Waste Generation. The staff also reviewed supplemental information that the applicant provided in letters dated 10-79

November 24, 2015 (ML15328A218), January 20, 2016 (ML16020A523), March 4, 2016 (ML16064A047), March 11, 2016 (ML16071A078), March 25, 2016 (ML16085A341), April 2, 2016 (ML16093A018), May 19, 2016 (ML16142A005), and June 29, 2016 (ML16181A244).

GDC 1, Quality standards and records; GDC 2, Design bases for protection against natural phenomena; GDC 13, Instrumentation and control; and GDC 14, Reactor coolant pressure boundary The principal function of the SGBS is to maintain the secondary-side water chemistry in the SGs within specified limits by removing particulate and dissolved impurities. The SGBS consists of the blowdown subsystem (BDS) and WLS. During operation, the SGBS is designed to use the BDS to continuously perform a blowdown of each of the two SGs, purify the blowdown, and return it to the steam cycle through the condenser. During long-term shutdown, the SGBS is designed to control the water chemistry using the WLS. The WLS is also used to refill the SGs following draining or dry layup.

Each blowdown line contains two isolation valves in series in order to maintain the SG inventory. The system is designed to close the valves automatically in response to the following Engineered Safety Features Actuation System (ESFAS) signals: containment isolation actuation signal, main steam isolation signal, auxiliary feedwater actuation signal, and diverse protection system auxiliary feedwater actuation signal. In addition, according to Subsection 10.4.8.2.3.5.b in DCD Rev. 0, the outermost valves are interlocked to close automatically on a high radiation signal (HRAS) from the radiation monitor at the outlet of the SGBS post-filter.

The staff found this to be a discrepancy with DCD Tier 2, Table 6.2.4-1, List of Containment Penetrations and System Isolation Positions, which also lists the Blowdown Flash Tank High-High Level Actuation Signal (BFTHHLAS) as an interlock signal that closes the outmost containment isolation valves.

In letters dated April 2, 2016 (ML16093A018), and June 29, 2016 (ML16181A244), the applicant provided clarifying information in response to RAI 381-8467, Question 10.04.08-1 (ML16032A028) and RAI 475-8596, Question 10.04.08-6 (ML16125A324), respectively. The April 2, 2016, letter proposed revisions to DCD Tier 1, Chapter 2, Design Description and ITAAC, and DCD Tier 2, Chapter 10 for consistency with DCD Tier 2 Chapter 6, Engineered Safety Features. Specifically, the response proposed adding the HRAS and BFTHHLAS to DCD Tier 1, Table 2.7.1.8-2, Steam Generator Blowdown System Component List, and the BFTHHLAS interlock signal to DCD Tier 2, Subsection 10.4.8.2.3.5.b, Abnormal Operation,.

The June 29, 2016, letter proposed corresponding changes to Tier 1, Figure 2.7.1.8-1, Steam Generator Blowdown System, and Tier 2, Figure 10.4.8-1, Steam Generator Blowdown System Flow Diagram (1 of 2). The June 29, 2016, letter also proposed a change to Tier 2 Subsection 7.3.1.9, Actuated Systems, to clarify that the containment isolation valve actuation signals are generated by ESFAS signals and process interlock signals from individual process systems. The HRAS and BFTHHLAS are the process interlock signals from the SGBS. The applicant incorporated these changes into Revision 1 of the DCD. The staff finds the changes acceptable with respect to the SGBS design meeting the requirements of GDC 13 because the revised DCD clarifies how containment isolation signals are used in the SGBS and how they are consistent with the design of Instrumentation & Controls (DCD Chapter 7, Instrumentation and Controls) and containment isolation actuation signals (DCD Chapter 6).

To meet the requirements of GDC 1, 2, and 13, the SGBS must be designed to control the concentration of chemical impurities and radioactive materials in the secondary coolant. The blowdown is normally routed to filters and demineralizers for return to the condensate. It can 10-80

also be routed to the wastewater treatment system or liquid radwaste system. To determine if the design meets the requirements, the staff reviewed piping and instrumentation diagrams, seismic and quality group classifications, design process parameters, and instrumentation and process controls. The review included the applicants evaluation of the proposed system operation and the applicants estimate of the controlling process parameters.

During normal power operation the blowdown flow rate for each SG is designed to be approximately 0.2 to 1 percent of the steam generator maximum steaming rate (SGMSR) of 4,071 tons per hour per SG (8,975,000 lbm per hour per SG). This is defined as continuous blowdown (CBD). The CBD rates of 0.2 percent and 1 percent apply to Normal Blowdown (NBD) and Abnormal Blowdown (ABD), respectively. NBD is defined as measured water chemistry within the normal limits. ABD is defined as measured water chemistry outside the normal limits. Intermittent High Capacity Blowdown (HCBD) of 5 percent of the SGMSR is designed for removing accumulated sludge in the tubesheet area. The system is designed to allow HCBD of one SG plus simultaneous ABD up to 1 percent of the second SG for two minutes. These three blowdown modes - NBD, ABD, and HCBD - are part of normal operation. Emergency Blowdown (EBD) is defined as the use of HCBD valves and piping for one SG at up to 14 percent of the SGMSR in order to reduce SG water level in the case of a beyond-design-basis multiple steam generator tube rupture (MSGTR) event. A summary paragraph in DCD Subsection 10.4.8 to describe the blowdown modes, the definition of one percent steaming rate in terms of mass per unit time, and clarification of the design blowdown rates are based on Enclosure 3 to the applicants letter (ML15328A218). Revision 1 of the DCD incorporated these changes to Subsections 10.4.8, 10.4.8.2.3.1, Plant Startup, 10.4.8.2.3.2, Normal Operation, and 10.4.8.2.3.6, Multiple Steam Generator Tube Rupture. The staff finds these changes acceptable because they clarify how the SGBS is designed to meet the requirements of GDC 1, 2, and 13 with respect to controlling the concentration of chemical impurities and radioactive materials in the secondary coolant.

The staff reviewed the design of the SGBS to determine if it meets the requirements of GDC 14 with respect to equipment capacity to perform the water cleanup function. The guidance in SRP Section 10.4.8 is that the SGBS should be sized to accommodate the blowdown flow needed to maintain secondary coolant chemistry for normal operation, including anticipated operational occurrences. As an example, the EPRI, which publishes the industry guidelines for primary and secondary water chemistry, provides quantitative recommendations for blowdown capacity for recirculating steam generators in Revision 1 of the Steam Generator Reference Book (Technical Report 103824, 1994). The recommendations are a maximum continuous blowdown rate of one percent of the main steaming rate during normal operation and three to seven percent for short periods (two to five minutes) for removing tubesheet sludge. Based on the information in the application, as supplemented by the information in the applicants letter (ML15328A218), the staff finds that the APR1400 is consistent with these design recommendations.

Under normal operating conditions, the blowdown flow rate of one percent of the SGMSR provides reasonable assurance that the SG water quality will be within specifications. This blowdown rate is typical of the design of current United States operating pressurized water reactors (PWRs). The capability to blow down a SG at up to five percent provides additional assurance that under abnormal conditions involving one SG with an unusually high impurity ingress rate the affected SG can be cleaned up rapidly. Under abnormal conditions such as contamination from a condenser leak or condensate polisher failure, protection of the SGs is provided by conformance with the EPRI Secondary Water Chemistry Guidelines. The EPRI Secondary Water Chemistry Guidelines require that power be reduced or the plant shut down if 10-81

parameters exceed the specified action levels. Therefore, the SGBS is not solely relied upon to protect the integrity of the reactor coolant pressure boundary (RCPB) under abnormal conditions. Enclosure 3 to the applicants letter (ML15328A218) proposed changing the definition of abnormal water chemistry from sodium concentration to the specifications in DCD Table 10.3.5-1, Operating Chemistry Conditions for Secondary Steam Generator Water. This change was incorporated into Revision 1 of the DCD, and the staff finds it acceptable because it makes the definition of abnormal water chemistry consistent with the secondary water chemistry specified in DCD Section 10.3.5.

The blowdown capacity and purification capabilities of the SGBS are adequate to provide interim control of the SG water chemistry while the plant power level is reduced or the plant is shut down in accordance with EPRI Secondary Water Chemistry Guidelines. In addition, the design of the SGBS includes provisions to bypass individual components and provisions to route the effluent to the waste management system if the SGBS cannot remove the impurities from the blowdown. Therefore, even if the purification function does not operate properly, the SGBS design prevents an adverse impact on the secondary water quality.

The blowdown water is drawn from near the center of the tubesheet into pipes with holes.

There is one blowdown pipe on the hot side and one on the cold side of the tubesheet.

According to the applicants supplemental letter (ML15328A218), the applicant has experience with the central blowdown design at other plants with no degradation generating loose parts or SG tube damage. Also in the letter, the applicant proposed correcting a typographical error in DCD Subsection 10.4.8.2.3.2 by changing Figure 10.4.8-3 to Figure 10.4.8-2. The correction was incorporated into Revision 1 of the DCD as proposed. Since the letter (ML15328A218) did not identify the material used for these blowdown pipes, the staff requested this information in RAI 381-8467, Question 10.04.08-2. In its response to RAI 381-8467, Question 10.04.08-2 (ML16071A078), the applicant stated that the piping is made of carbon steel. The NRC does not have detailed requirements or guidelines for these pipes, but carbon steel is compatible with the steam generator environment and used for other internals in steam generators. As discussed in Subsection 5.4.2.1, Steam Generator Materials, of the DCD and this report, this region of the steam generator is accessible for inspection and cleaning, enabling degradation to be detected and managed. Based on the material, the accessibility for inspection and cleaning, and the applicants operating experience, the staff finds the design of the blowdown pipes acceptable with respect to meeting GDC 14 as it relates to the SGBS performing its secondary-side cleanup function in support of maintaining the integrity of the RCPB. On this basis, RAI 381-8467, Question 10.04.08-2, is resolved and closed.

The SGBS also includes a non-safety-related wet layup system (WLS) used to control water chemistry during long-term shutdown. Each SG has a WLS recirculation pump and piping circuit that interfaces with the SGBS filters and demineralizers. The water chemistry requirements for the blowdown water during wet layup conditions are consistent with the EPRI Secondary Water Chemistry Guidelines. The containment isolation valves for each return line include a gate valve that is locked closed during normal operation in series with a check valve, so there is no need to actuate these valves for containment isolation.

Each SG blowdown has branch lines connected to the hot leg and to the economizer region of the secondary side. The blowdown is routed to the flash tank. Flashed steam returns to the steam and feedwater cycle by passing from the flash tank to the high-pressure feedwater heaters. The liquid in the flash tank flows to the regenerative heat exchanger, where it is cooled for processing in the demineralizers. The two demineralizers can be aligned to be used separately or simultaneously. The blowdown passes through a pre-filter prior to the 10-82

demineralizers to remove solid particles that could cause blockage. Similarly, the blowdown passes through a post-filter after the demineralizers to remove demineralizer resin particles. If the water exiting the demineralizers does not meet the secondary water chemistry specifications or contains radioactive contamination, it is routed to the wastewater treatment system or liquid radwaste system as appropriate.

Instrumentation and process controls are provided to control flashing, liquid levels, and process flow through the proper components. This includes instruments to measure flow, temperature, pressure, differential pressure, level, and conductivity. Therefore, the instrumentation and controls allow the SGBS to maintain secondary water chemistry in a range protective to the reactor coolant pressure boundary. In addition, the system is designed with a radiation monitor for isolating the blowdown lines in the event of a high radiation level, such as from SG tube leakage. The monitor, designated RE/RT-104, is located downstream of the demineralizer post-filter and shown in DCD Figure 11.5-1, Radiation Monitoring System (PR) (1 of 3). The staffs review concludes that the SGBS design meets the requirements of GDC 13 because the instrumentation described is capable of monitoring system parameters and maintaining them in a range that allows the system to perform its impurity removal function. The staffs detailed review of instrumentation and controls for the APR1400 is documented in Chapter 7, Instrumentation and Controls, of this SER.

As stated in SRP Section 10.4.8, in order to comply with GDC 14, temperature limits should not be exceeded for heat-sensitive processes. The APR1400 contains mixed-bed (anion/cation) demineralizers that contain temperature-sensitive resins. According to various sources, such as the Department of Energy Fundamentals Handbook (Chemistry, Volume 2, DOE-HDBK-1015/2-

93) and data sheets from resin manufacturers, the temperature of mixed-bed ion exchange resins should be less than about 140ºF (60ºC) to prevent thermal decomposition of the anion resin. Resin decomposition products can cause degradation of structural materials, including the steam generator tubes. The blowdown liquid from the flash tank flows to a regenerative heat exchanger, which cools the blowdown using condensate. From there, it flows through one of two pre-filters and then the demineralizers before returning to the condensate system. The APR1400 SGBS uses a temperature measurement at the exit of the regenerative heat exchanger to control the blowdown flow path. If the temperature of the blowdown water exiting the regenerative heat exchanger is greater than 57.2ºC (135ºF), the water is directed to the wastewater treatment system to avoid damage to the demineralizer resin. Identifying protection of the demineralizer resin as the basis for the temperature limit was proposed in Enclosure 3 to the applicants letter (ML15328A218), and the proposed wording was included in Subsection 10.4.8.2.3.2 of Revision 1 of the DCD. The SGBS is thus designed to prevent the temperature from exceeding the temperature limit of the demineralizer resin, and the staff finds that it meets GDC 14 as it relates to preventing temperature limits from being exceeded that could affect the chemistry of the secondary coolant and the reactor coolant pressure boundary. The staffs review concludes that the SGBS design meets the requirements of GDC 13 with respect to process monitoring and control because the instrumentation described is capable of monitoring system parameters and maintaining them in a range that allows the system to perform its impurity removal function.

DCD Tier 1, Subsection 2.7.1.8, Steam Generator Blowdown System, and Tier 2, Subsection 10.4.8.1, Design Bases, discuss the design bases for the SGBS. Compliance with GDC 1 and GDC 2 is based on SGBS components and piping from the connection inside the primary containment up to and including the first isolation valve outside the containment being designed as seismic Category I and Quality Group B. This is based on conformance with RG 1.29, and RG 1.26 as stated in SRP Section 10.4.8. In addition to DCD Tier 1, Subsection 2.7.1.8 and 10-83

DCD Tier 2, Subsection 10.4.8, the staff reviewed the DCD Tier 2, Subsection 3.2, Classification of Structures, Systems, and Components, as it relates to the SGBS. According to DCD Table 3.2-1, Classification of Structures, Systems, and Components, the SGBS design is seismic Category I and Safety Class 2 from its connection to the SG inside primary containment up to and including the first isolation valve outside the containment. In addition, DCD Table 10.4.8-3 shows that the design of the SGBS follows the Codes and Standards listed in RG 1.143, Design Guidance for Radioactive Waste Management Systems, Structures, and Components Installed in Light-Water Cooled Nuclear Power Plants. In DCD Table 3.2-1, SG Blowdown Items 86a and 86m, replacing the general term portion of with valves and piping is based on Enclosure 3 to the applicants letter (ML15328A218). Revision 1 of the DCD incorporated the change from portion of to valves and piping in Table 3.2-1.

In its response to RAI 254-8270, Question 11.02-7 (ML15293A568), from the Radiation Protection and Accident Consequences Branch (RPAC), the applicant proposed a clarification of the safety classification in the SGBS described in DCD Subsection 10.4.8.1.2. Revision 1 of the DCD added the word isolation in stating that the safety classification for the SGBS component applies to the components, up to and including the nearest isolation valves, fittings, and/or welded/flanged nozzle connections. The staff finds the proposed change acceptable with respect to the SGBS because it conforms to the guidance in RG 1.143. With respect to meeting the requirements for liquid waste management, the staffs evaluation is found in Section 11.2 of this report.

For the portion of the system downstream of the outer containment isolation valves, SRP Section 10.4.8 states that position C.1.1, Liquid Radwaste Treatment System, of RG 1.143 provides guidance for the codes and standards (position C.1.1.1), materials selection (C.1.1.2),

and height of the foundations of walls and structures (C.1.1.3). DCD Section 10.4.8.1.2 and DCD Table 3.2-1 show that the components in the downstream portion of the SGBS are designed according to the codes and standards of Position C.1.1 in RG 1.143. The building housing the downstream part of the radwaste system is classified as RW-IIa, which meets the requirement for non-safety radwaste systems. Classification of the auxiliary building housing the liquid radwaste system is reviewed in Chapter 11, Radioactive Waste Management, of this report, and the structural design of the auxiliary building is reviewed in Chapter 3, Design of Structures, Systems, components, and Equipment, of this report. Changing the classification of the auxiliary building from RW-IIc and seismic Category I to RW-IIa in DCD Section 10.4.8.1.2 and Table 3.2-1 is based on the applicants response to RAI 254-8270, Question 11.02-8, and the changes were incorporated into Revision 1 of the DCD.

Clarification in DCD Subsection 10.4.8.1.2, Non-Safety Power Generation Design Bases, that the design meets the RG 1.143 positions (rather than the intent), is based on Enclosure 3 to the applicants letter (ML15328A218). Addition to DCD Subsection 10.4.8.1.2 of a cross-reference to DCD Table 3.2-1 for a description of the quality assurance program for SGBS components is based on Enclosure 3 to the applicants letter. The clarification about meeting the RG 1.143 positions and the cross-reference to Table 3.2-1 were incorporated into Revision 1 of the DCD, Subsection 10.4.8.1.2 as proposed. Based on Revision 0 of the DCD, and the changes described above and incorporated into Revision 1 of the DCD (Table 3.2-1 and Subsection 10.4.8.1.2) for safety classification, the staff finds that the design of the of the SGBS conforms to the guidance in SRP Section 10.4.8 and RG 1.143 and, therefore, complies with GDC 1 and GDC 2 as they relate to the SGBS.

Flow accelerated corrosion (FAC) for the SGBS was addressed for steam and feedwater materials in DCD Subsection 10.3.6.3, Flow Accelerated Corrosion. The paragraph on the 10-84

SGBS described the use of carbon steel, chromium-molybdenum low-alloy steel, and stainless steel. In its letter (ML15328A218), the applicant provided clarifying information about materials selection in the SGBS and proposed deleting the paragraph on the SGBS in DCD Subsection 10.3.6.3. The applicant provided additional clarifying information in two letters. The first letter (ML16093A018), in response to RAI 381-8467, Question 10.04.08-3, proposed a new DCD Subsection 10.4.8.2.2.f, Component Description, to describe how the SGBS design addresses FAC. The second letter (ML16181A244), in response to 8596, Question 10.04.08-7 (ML16125A324), proposed additional information about FAC management in new DCD Section 10.4.8.2.2.1, Flow Accelerated Corrosion, rather than the proposed Subsection 10.4.8.2.2.f.

DCD Subsection 10.4.8.2.2.1 also identifies the portions of the system that use stainless steel or chromium-molybdenum steel, which are both resistant to FAC, and it identifies the portions that are carbon steel. Subsection 10.4.8.2.2.1 states that the carbon steel portions are managed by the FAC program, which will be addressed by a COL applicant as part of COL 10.3(3) (re-numbered in DCD Rev. 1 as COL Item 10.3(5)).

The changes proposed to address FAC in the April 2, 2016, and June 29, 2016, letters were incorporated into Revision 1 of the DCD. The staff finds the proposed Subsection 10.4.8.2.2.1 acceptable because it clarifies how FAC will be addressed for the SGBS. The staffs review of the FAC program, including COL 10.3(3) (COL Item 10.3(5) in DCD Rev. 1), is in Section 10.3.6 of this report. The June 29, 2016, letter also proposed editorial corrections to DCD Table 10.4.8-1, which the staff finds acceptable because they correct information about SGBS equipment design.

Tier 1 DCD Tier 1, Section 2.7.1.8, Steam Generator Blowdown System, describes the SGBS, including equipment/piping characteristics (Table 2.7.1.8-1), system component list (Table 2.7.1.8-2), and system ITAAC (Table 2.7.1.8-3). This DCD subsection also includes Figure 2.7.1.8-1, a schematic diagram showing the safety-related components addressed in the Tier 1 design description, the ASME Code class boundaries, the containment boundary, and the valves that perform safety functions. The staffs review of the Tier 1 information is discussed for the containment isolation safety function in Section 10.4.8.4.1 above, and for the ITAAC in 10.4.8.4.3 below.

Preoperational Testing DCD Tier 2 Subsection 14.2.12.66, Steam Generator Blowdown System Test, describes preoperational testing for the SGBS. The objectives of the testing are to demonstrate the proper operation of isolation and CVs, process interlock signals, alarm and status lights, response to safety signals, and process flow paths. The staffs review of the SGBS preoperational test plan is documented in Chapter 14 of this report.

ITAAC ITAAC for the SGBS are provided in DCD Tier 1, Table 2.7.1.8-3, Steam Generator Blowdown System ITAAC. The purpose of these ITAAC is to ensure the safety-related function of isolating the secondary side of the SGs in accordance with 10 CFR 52.47(b)(1). The ITAAC address the following topics: the functional arrangement of the as-built SGBS, ASME Code Section III requirements, seismic category requirements, electrical requirements, environmental qualification requirements, functional testing, and division separation requirements. These 10-85

ITAAC define the safety-related portion of the system as extending from the SG blowdown nozzles to the outermost containment isolation valves.

The components covered by ITAAC match the safety significance of the system (i.e., the piping and components designed to ASME Code, Section III and seismic Category I). However, there is a discrepancy between the location of the safety-related portion of the system defined in DCD Tier 1, Subsection 2.7.1.8.1 (containment and the auxiliary building) and that defined in DCD, Table 2.7.1.8-1 (containment building). In RAI 381-8467, Question 10.04.08-4, the staff requested clarification of the location of the portion of the system defined as safety-related, and consistency within the DCD. The staff needed to determine if these ITAAC are adequate to ensure future plants will be built in accordance with the DC related to the SGBS because they include the applicable items listed in SRP Section 14.3 for fluid systems. In its response to RAI 381-8467, Question 10.04.08-4 (ML16064A047), the applicant clarified that the safety-related portion of the SGBS is located in the containment and the auxiliary building. The response proposed a revision to DCD Tier 1, Table 2.7.1.8-1 to add Auxiliary Building to the location, and this was incorporated in Revision 1 of the DCD as proposed. The staff finds this acceptable because it makes the text of DCD Tier 1, Subsection 2.7.1.8.1 consistent with DCD Table 2.7.1.8-1.

The staff finds that there is reasonable assurance that, if the proposed ITAAC are performed and the acceptance criteria met, the SGBS will be constructed and operated in accordance with the certified design, the AEA and NRC regulations. Therefore, the staff finds the proposed ITAAC comply with 10 CFR 52.47(b)(1).

Combined License Information Items The table below lists the COL items related to the SGBS. COL Item 10.4(9) states that a COL applicant will describe the system for the steam generator drain. It was not clear to staff whether drain refers to a component or to how the SG will be drained. Since DCD Subsection 10.4.8.2.3.4, Steam Generator Drain, states that the SGBS is used to drain the SG, it is the staffs understanding that the COL applicant is to describe a system for draining the SG, rather than the drain itself. The staff requested clarification of the required COL information in RAI 381-8467, Question 10.04.08-5. In its response to RAI 381-8467, Question 10.04.08-5 (ML16142A005), the applicant proposed clarifying the COL information by requiring the COL applicant to provide the nitrogen or equivalent system design for the SG drain mode. The clarification to COL Item 10.4(9) was incorporated in Revision 1 of the DCD as proposed. The staff finds this acceptable because adding the word mode clarifies the information required from the COL applicant. COL Item 10.4(10) requires a COL applicant to prepare the Site Radiological Environmental Monitoring Program. This program is necessary and is related to the SGBS because of the potential to contain liquid radwaste. COL Items 11.2(11) and 11.3(6) include this same requirement, and the staff is reviewing these COL items in Chapter 11.

Combined License Information Items Item No. Descrription DCD Tier 2 Section 10.4(9) The COL applicant is to describe the 10.4.8.2.3.4 nitrogen or equivalent system design for SG drain mode 10.4.11 10-86

10.4(10) The COL applicant is to prepare the 10.4.8.2.4 Site Radiological Environmental Monitoring Program 10.4.11 Conclusion Based on the review above, the staff concludes that the SGBS design is acceptable and meets the requirements of GDC 1, 2, 13, and 14 with respect to controlling the concentration of chemical impurities and radioactive materials in the secondary coolant. The SGBS design meets the RCPB integrity requirements of GDC 13 based on the capability to monitor secondary water chemistry variables and control them within prescribed ranges that limit corrosion of the steam generator tubes and other components. The SGBS design meets the RCPB integrity requirements of GDC 14 based on the capability to process the secondary coolant during normal operation and anticipated operational occurrences and thereby limit corrosion of the SG tubes and leakage of the primary coolant. The SGBS design meets the quality and seismic requirements, respectively, of GDC 1 and 2 based on conforming to RG 1.26 and RG 1.29 for the portion of the system that serves as part of primary containment, and on conforming to RG 1.143 for the portion of the system outside containment. Also based on the review above, the staff finds the SGBS design meets the requirements of 10 CFR 52.47(b)(1) with respect to including necessary and sufficient ITAAC.

10.4.9 Auxiliary Feedwater System Introduction The auxiliary feedwater system (AFWS) provides an independent safety-related means of supplying the SGs with feedwater when the reactor coolant temperature is above the cut-in temperature for shutdown cooling, and the main feedwater system is unavailable. It is designed to provide adequate cooling water to the steam generators following transient conditions or postulated accidents such as a reactor trip, main steam line break, feedwater line break, small break loss-of-coolant accident (LOCA), loss of offsite power (LOOP), station blackout (SBO),

anticipated transient without scram (ATWS) and steam generator tube rupture (SGTR). The AFWS consists of two mechanical divisions, each of which has two independent auxiliary feedwater trains which are aligned to feed into the respective steam generator. Each mechanical division has an AFW tank, a full-capacity motor driven pump that is powered from a safety-related electric bus, and a full-capacity turbine-driven pump which is driven with steam from the main steam system. The AFWS is a safety-related system.

Summary of Application DCD Tier 1: The Tier 1 information associated with this section is found in DCD Tier 1, Section 2.7.1.5, Auxiliary Feedwater System (AFWS). Figure 2.7.1.5-1, Auxiliary Feedwater System, illustrates the AFWS.

DCD Tier 2: The applicant has provided a Tier 2 system description in DCD, Tier 2 Section 10.4.9, Auxiliary Feedwater System, summarized here in part as follows:

The AFWS is normally in standby mode, available for operation during normal power operation and during plant transients and accident. The AFWS is not used during plant startup and normal plant shutdown.

10-87

The AFWS consist of two 100 percent capacity motor-driven pumps, two 100 percent capacity turbine-driven pumps, two 100 percent capacity auxiliary feedwater storage tanks (AFWSTs), valves, two cavitating flow-limiting venturis, and instrumentation. The AFWS flow diagram is shown in DCD Tier 2, Figure 10.4.9-1, Auxiliary Feedwater System Flow Diagram, and the AFWS design parameters and flow requirements are given in DCD Tier 2, Tables 10.4.9-1, Auxiliary Feedwater System Component Parameters, and 10.4.9-6, Steam Generator Makeup Flow Requirements.

Each AFWS pump takes suction from its respective AFWST and has a respective discharge header. One motor driven and one turbine-driven pump are configured into one mechanical division and are joined together inside containment to feed their respective steam generator through a common AFW header, which connects to the SG downcomer feedwater line. Each of the common AFW headers contains a cavitating venturi to restrict the maximum AFW flow rate to each SG.

A cross-connection is provided between the AFWSTs so that either tank can supply either division of the AFWS. The AFWSTs are seismic Category I and has a minimum usable safety-related water volume of 400,000 gallons (1,514164 l.), which is sufficient to achieve safe cold shutdown based on eight hours operation in hot standby, followed by six hours of cooldown to shutdown cooling entry conditions. A non-safety backup water source by gravity feed to AFW pump suction is also available from the condensate storage tank and raw water storage tank.

TS: The AFWS TS associated with DCD Tier 2, Section 10.4.9, are given in DCD Tier 2, Chapter 16, Sections 3.7.5, Auxiliary Feedwater System, and 3.7.6, Auxiliary Feedwater Storage Tank.

Regulatory Basis The relevant regulatory requirements for this area of review and the associated acceptance criteria are given in NUREG-0800, Section 10.4.9, Auxiliary Feedwater System (PWR),

Revision 3, and are summarized below. Review interfaces with other SRP sections also can be found in this NUREG-0800, Section 10.4.9.

1. GDC 2, Design bases for protection against natural phenomena, as it relates to structures housing the system and the system itself being capable of withstanding the effects of natural phenomena such as earthquakes, tornadoes, and hurricanes.
2. GDC 4, Environmental and dynamic effects design bases, as it relates to the capability of the system and the structure housing the system to withstand the effects of pipe breaks and external missiles.
3. GDC 5, Sharing of structures, systems, and components, as it relates to sharing of SSCs of the steam and power conversion systems of different nuclear power units.

10-88

4. GDC 19, Control room, as it relates to the design capability of system instrumentation and controls for prompt hot shutdown of the reactor and potential capability for subsequent cold shutdown.
5. GDC 34, Residual heat removal, and GDC 44, Cooling water, as they relate to the capability of the system to transfer heat loads from the reactor system under both normal operating and accident conditions, assuming any single active failure, coincident with the loss of offsite power for certain events, and the capability to isolate components, subsystems, or piping if required to maintain system safety function.
6. GDC 45, Inspection of cooling water system, as it relates to design provisions made to permit periodic in-service inspection of system components and equipment.
7. GDC 46, Testing of cooling water system, as it relates to design provisions made to permit appropriate functional testing of the system and components.
8. GDC 60, Control of releases of radioactive materials to the environment, as it relates to design provisions for tanks handling radioactive material in liquids.
9. Title 10 CFR 50.62, Requirements for Reduction of Risk from ATWS Events for Light-Water-Cooled Nuclear Power Plants, as it relates to the design provisions for automatic initiation of the EFWS in an ATWS event.
10. Title 10 CFR 50.63, Loss of all Alternating Current Power, as it relates to the design provisions for withstanding and recovering from a station blackout.
11. Title 10 CFR 52.47, Contents of applications; technical information, Item (b)(1),

which requires that a DC application contain the proposed ITAAC that are necessary and sufficient to provide reasonable assurance that, if the inspections, tests, and analyses are performed and the acceptance criteria met, a facility that incorporates the DC has been constructed and will be operated in accordance with the DC, the provisions of the Atomic Energy Act of 1954, as amended, and NRC regulations.

12. Title 10 CFR 20.1406, Minimization of Contamination, as it relates to the standard plant design certifications and how the design and procedures for operation will minimize contamination of the facility and the environment facilitate eventual decommissioning and minimize to the extent practicable, the generation of radioactive waste.

Technical Evaluation The staffs evaluation of the auxiliary feedwater system and storage tanks is based upon the information provided in the applicants DCD, Revision 1, including Tier 1 and Tier 2. The staff reviewed the AFWS and AFWSTs in accordance with the review procedures in SRP Section 10.4.9, Auxiliary Feedwater System (PWR), Revision 3. Applicable portions of SRP 9.2.6, Condensate Storage Facilities, Revision 3, were also used for the review of the AFWSTs.

10-89

GDC 2, Design bases for protection against natural phenomena The staff reviewed the AFWS and AFWST for compliance with the requirements of GDC 2 with respect to their designs for protection against the effects of natural phenomena such as earthquakes, tornados, hurricanes and floods. Compliance with the requirements of GDC 2 is based on adherence to Position C.1 of RG 1.29 for the safety-related portion of the system, and position C.2 for the nonsafety-related apportions of the system.

GDC 2 requires that nuclear power plant structures, systems, and components (SSCs) important to safety withstand the effects of earthquakes without loss of capability to perform their safety functions. DCD Tier 2, Section 10.4.9.1.1, Functional Requirements, contains the AFWS design basis functional requirements. In that section it is stated (item i) that The AFWS is an ASME Section III, Class 2 and 3, seismic Category I, redundant system with Class 1E electrical components, and that The AFWS is designed to remain functional after a safe shutdown earthquake (SSE).

The location, safety classification and seismic category for the AFWS components are listed in DCD Tier 2, Table 3.2-1, Classification of Structures, Systems, and Components. Based on the information on the system and its components in DCD Tier 2, Table 3.2-1, the staff confirmed that AFWS system components and piping essential to AFWS operation are designed as seismic Category I, and therefore are designed to withstand the effects of earthquakes with no loss of function.

GDC 2 also requires that the nuclear power plant structures housing the AFWS be capable of withstanding the effects of natural phenomena such as earthquakes, tornadoes, and hurricanes.

DCD Tier 2, Section 10.4.9.1.2, Design Criteria, states that the AFWS components are located in the auxiliary building which is designed as seismic Category I and protects the AFWS components from external environmental hazard such as wind, tornado, hurricane, flood, and earthquakes, as described in DCD Tier 2, Sections 3.3, Wind and Tornado Loadings, 3.4, Water Level (Flood) Design, and 3.7, Seismic Design.

The staff reviewed the AFWS flow diagram (DCD Tier 2, Figure 10.4.9) and confirmed that the AFWS components and piping are located inside the auxiliary building and the reactor containment buildings, both of which are seismic category I structures, designed to provide protection against tornadoes, floods, missiles, and other external environmental hazards. The protection provided by these buildings against the above mention natural phenomena are evaluated in Section 3.2, Classification of Structures, Systems, and Components, 3.3, 3.4, 3.5, Missile Protection, and 3.8, Design of Category I Structures,of this SER.

DCD Tier 2, Table 3.5-4, Essential Systems and Components to be Protected from Externally Generated Missiles, contains a list of protected SSCs as well as the credited missile barrier.

Table 3.5-4 did not identify the AFWS components as being components to be protected from external missiles in the original submittal of the DCD. However, the applicant has identified AFWS components among those to be protected in its proposed revision to Table 3.5-4 in the response (ML16182A536) to RAI 88-8046, Question 03.05.02-3 (ML15201A473). The review of the information in DCD Tier 2, Table 3.5-4, and the response to RAI 88-8046, Question 03.05.02-3 is included in section 3.5 of this report.

The AFWSTs are discussed in DCD Tier 2, Section 10.4.9.2.2.3, Auxiliary Feedwater Storage Tanks. Each tank, which consists of a stainless-steel-lined reinforced enclosure, is an integral part of the safety-related, seismic Category I auxiliary building and is protected against 10-90

environmental hazards. The location, safety classification and seismic category for the auxiliary feedwater storage and transfer system components are listed as item 6 under heading II, System and Components, in DCD Tier 2, Table 3.2-1. The information on the system and its components in DCD Tier 2, Table 3.2-1, and DCD Tier 2, Figure 10.4.9-1 was used by the staff to confirm that the AFWSTs, along with the auxiliary feedwater makeup piping from the storage tank up to and including the AFWST inlet manual valves, and the auxiliary feedwater piping from the storage tank up to the auxiliary feedwater suction manual valves are safety class 3 and seismic Category I. The AFWST cross connection line up to and including the AFWST connection manual valves and the non-safety backup supply lines up to and AFW pump suction manual valves are also safety class 3 and seismic Category I. The rest of the auxiliary feedwater storage and transfer system components located in the auxiliary building that are not safety-related are designed to seismic Category II.

The safety-related AFWS and AFWSTs are designed in accordance with RG 1.29 Position C.1.

In addition, the non-safety components are designed in conformance with RG 1.29 Position C.2.

The AFWS and AFWSTs are housed in the auxiliary building and the reactor containment building, and are therefore protected from external environmental hazard such as wind, tornado, hurricane, and floods. Based on the above review, the staff concludes that the AFWS design conforms to the guidelines of Positions C.1 and C.2 of RG 1.29 and the requirements of GDC 2 as they relate to protecting the system against natural phenomena and are protected from the effects of natural phenomena such as earthquakes, tornados, hurricanes and floods.

GDC 4, Environmental and dynamic effects design bases The staff reviewed the AFWS for compliance with the requirements of GDC 4 with respect to the capability of the system and the structures housing the system to withstand the effects of pipe breaks and internally and externally generated missiles, and pipe whip and jet impingement due to high and moderate energy pipe breaks. Compliance with the requirements of GDC 4 is based on identification of the essential portions of the system as protected from dynamic effects including internal and external missiles and meeting the guidance in BTP 10-2, Design Guidelines to Avoid Water Hammer in Steam Generators.

In the APR1400 design, the AFWS and AFWSTs are located inside the auxiliary building and the reactor containment building, both of which are seismic Category I structures. Since these structures are designed to withstand the effects of severe natural phenomenon, including external missiles, as discussed in Section 3.5 of this report, the safety-related portions of the AFWS and AFWST are protected from external missiles. With respect to internal hazards, the design bases for the AFWS and AFWST call for the safety-related portions of these systems to be appropriately protected against the possible effects of postulated high or moderate energy pipe failure including whip or jet impingement as described in DCD Tier 2, Section 3.6, Protection against Dynamic Effects Associated with the Postulated Rupture of Piping, and internal flooding and internal missiles as described in DCD Tier 2, Sections 3.4 Water Level (Flood) Design, and 3.5, Missile Protection, respectively.

The protection of the safety-related AFWS and AFWST SSCs from the effects of the above mentioned internal hazards is generally accomplished in the APR1400 design by physical separation of redundant trains and by enclosing redundant trains in separate compartments which provide both a physical/structural barrier for the SSCs in the compartment and separation distance between the redundant trains. The staff reviewed the general plant arrangement drawings (DCD Tier 2 Figures 1.2-13 and 1.2-14) and confirmed that the general arrangement of the system is such that the redundant components of the AFWS and AFWST are protected 10-91

from internal hazards due to separation of the two safety-related divisions, and their location in enclosures provide protection from dynamic effects.

BTP 10-2 and NRC GL 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems, contain design guidelines and recommendations to reduce or eliminate piping damage caused by water hammer transients.

The applicant addresses water hammer prevention for the AFWS in DCD Tier 2, Section 10.4.9.3, Safety Evaluation, indicating that the AFWS is designed to preclude water hammer in accordance with BTP 10-2 and NUREG-0927, Evaluation of Water Hammer Occurrence in Nuclear Power Plants. Specifically, the APR1400 temperature upstream of the AFW isolation check valve is continuously monitored for early detection of back leakage from the main feedwater to minimize heated water introduction, and is alarmed in the main control room. Also for the APR1400, the steam supply line up to the AFW pump turbine steam isolation valve is warmed during normal power operation to minimize condensation and, as part of the design, a low-point drain upstream of the AFW turbine steam isolation valve provides a continuous blowdown through a pressure-reducing orifice to minimize water entrainment.

To ensure that adequate precautions are taken to prevent water hammer once the system has been put into operation, the applicant states in DCD Tier 2, Section 10.4.9.3, Safety Evaluation, that the COL applicant is to provide operating and maintenance procedures in accordance with NUREG-0927 and a milestone schedule for implementation of the procedure, and has included COL information Item 10.4(6) in the DCD. It also provides a list containing the key elements that the procedures need to address. Therefore the staff concludes that the essential portions of the AFWS are protected against the effects of pipe breaks and internally and externally generated missiles, pipe whip and jet impingement due to high and moderate energy pipe breaks and water hammer and meets the requirements of GDC 4.

GDC 5, Sharing of structures, systems, and components The staff reviewed the APR1400 design for compliance with the requirements of GDC 5 with respect to sharing of SSCs. Acceptance is based on the failure of any component including a pipe break and single active failure not preventing the safe shutdown and cool down of either unit (together or singularly). As stated in DCD Tier 2, Section 3.1.5, Criterion 5 - Sharing of Structures, Systems, and Components, the APR1400 is a single plant, and does not share safety-related SSCs with other units or plants. Thus, the requirement of GDC 5 for sharing systems between units does not apply.

GDC 19, Control room The staff reviewed the AFWS for compliance with the requirements of GDC 19, as the system relates to the design capability of system instrumentation and controls for prompt hot shutdown of the reactor and potential capability for subsequent cold shutdown. Compliance with the requirements of GDC 19 is based on conformance to BTP 5-4, Design Requirements of the Residual Heat Removal System, in regard to cold shutdown from the control room using only safety grade equipment.

The APR1400 has a main control room (MCR) from which actions can be taken to operate the plant under normal conditions and to maintain it in a safe manner under accident conditions. In DCD Tier 2, Section 10.4.9.2.4, Auxiliary Feedwater System Operation and Control, it is stated that the AFWS can be manually or automatically actuated by an auxiliary feedwater actuation signal (AFAS) from the engineered safety features actuation system (ESFAS) or the diverse 10-92

protection system (DPS). It is also stated that the AFWS and supporting systems are designed to provide the required flow to the SG(s) during a loss of offsite power event, assuming a single active failure and, following the event, the AFWS is capable of maintaining hot standby and facilitating a plant cooldown from hot shutdown to shutdown cooling system initiation. In the event of a station blackout the turbine-driven pump lines provided with battery-backed power are capable of providing auxiliary feedwater to the SGs coincident with a single failure for 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />.

The MCR and remote shutdown room (RSR) have instrumentation that provides indication of AFW pump suction pressure, discharge pressure and pump flow, as well as temperature and level indication for the AFWSTs and inlet pressure and turbine speed for the AFW pump turbines. As discussed in DCD Tier 2, Sections 7.3, Engineered Safety Features Systems, and 7.8.1.1, Diverse Protection System, the diverse protection system (DPS) initiates an AFWS actuation when the level in either of the two SGs decreases below the nominal setpoint value in DCD Table 7.8-1. At the low water level setpoint of the SG, the AFAS from the engineered safety features system (ESFAS) and the DPS actuates the AFWS which delivers flow to the SG within 60 seconds. Thus the APR1400 is designed to provide automatic imitation of the AFWS, and is consistent with the recommendation of item II.E.1.2 (Auxiliary Feedwater System Automatic Initiation and Flow Indication) of NUREG-0737, Clarification of TMI Action Plan Requirements (ML083040141), and the APR 1400 design also satisfies the requirement GDC 19 with respect to timely initiation of the AFW system.

DCD Tier 2, Section 10.4.9.2, (item m) states that the automatic initiation signals and circuits are designed so that their failure does not result in the loss of ability to manually initiate the AFWS. In describing the APR1400 compliance with Regulatory Guide 1.62, the applicant indicated that the ESFAS, which includes the AFAS signals, can be manually activated with switches located on the safety console in the MCR, and that some engineered safety function (ESF) also have manual actuation at the remote shutdown room. The DCD states that the manual initiation of a protective system is provided at the system level and causes the same actions to be performed by the protection system as would be performed if the protection system had been initiated by automatic action. The manual initiation of the ESFAS, which includes the AFAS signals, is discussed in DCD Tier 2, Sections 7.3.1.3, Actuation Logic, and 7.3.1.4, Component Control Logic. In section 7.8.2.2, Diverse Manual Engineered Safety Features Actuation Switches, the applicant states that the diverse manual action (DMA) switches are provided to permit the operators to manually actuate the ESF functions from the control room, and that the DMA switches are diverse from the manual and automatic logic functions performed by the PPS and engineered safety features component control system (ESF-CCS). The applicant also states in the DCD that the AFWS, as indicated in DCD Tier 2, Section 10.4.9.3, is provided with AC and DC emergency power and suitable redundancy in components and features to supply auxiliary feedwater to the SG(s) for removal of heat in the event of a single active component failure. Therefore, the staff finds that the APR1400 provides adequate instrumentation and controls for prompt initiation of shutdown using safety-related equipment consistent with the recommendation of item II.E.1.2 of NUREG-0737 and branch technical position 5-4 and in accordance with the requirements of GDC 19.

GDC 34, Residual heat removal and GDC 44, Cooling water The staff reviewed the AFWS for compliance with the requirements of GDC 34 and GDC 44, with respect to the capability to transfer heat loads from the reactor system to a heat sink under both normal operating and accident conditions, assuming any single active failure, coincident with the LOOP for certain events, and the capability to isolate components, subsystems, or 10-93

piping if required to maintain system safety function. To demonstrate compliance with GDC 34 and GDC 44, SRP Section 10.4.9 states, in part, that the system design should conform to the guidance of BTP 10-1, Design Guidelines for Auxiliary Feedwater System Pump Drive and Power Supply Diversity for Pressurized Water Reactor Plants, as it relates to AFWS pump drive and power supply diversity.

The staff reviewed the AFWS for compliance with the requirements of BTP 10-1, as related to AFW pump drive and power supply diversity. Guideline B.1 in BTP 10-1 states that the AFWS should have at least two full-capacity, independent systems with diverse power sources. The APR1400 design provides diversity by using two types of pump drives (electric motors and steam turbines). DCD Tier 2, Section 10.4.9.2, System Description, states that the AFWS has two 100 percent capacity motor-driven and two 100 percent capacity turbine-driven AFW pumps. The turbine-driven AFW pump trains are controlled and powered from battery-backed Class 1E power supplies as specified in DCD Tier 2, Section 10.4.9.2.3, Electrical Power Supply, and therefore their operation is completely independent from the motor-driven AFW pumps and controls. DCD Tier 2, Section 10.4.9.3 states that, in the case of a station blackout, the turbine-driven pump lines provided with battery backup are capable of providing auxiliary feedwater to the SGs coincident with a single failure for 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, and that battery-backed power is also available to the turbine governor speed control. Redundancy and independence is provided through the use of two independent auxiliary feedwater trains as shown in DCD Tier 2, Figure 10.4.9-1. Each pump takes suction from a respective AFWST and discharges to a respective discharge header, and one motor-driven pump and one turbine-driven pump are configured into one mechanical division and joined together inside containment to feed their respective SG through a common auxiliary feedwater header, which connects to the SG downcomer feedwater line. Based on a review of the AFWS design description and corresponding system flow diagram (DCD Tier 2, Figure 10.4.9-1) the staff finds that the guidance in of BTP 10-1, as related to EFW pump drive and power diversity, is satisfied.

The staff reviewed the AFWS for its capability to transfer heat loads from the reactor system to a heat sink under both normal operating and accident conditions, assuming any single active failure and its ability to maintain required system safety function. DCD Tier 2, Section 10.4.9.1, Design Bases, states, as a functional requirement, that the AFWS and its supporting systems are to be designed to provide the required flow to the SG(s) with a loss of offsite power event, assuming an active failure. Each AFW pump is capable of providing 650 gpm assuming the maximum SG downcomer nozzle pressure, and the pump suction at the minimum suction pressure.

The AFWSTs provides a minimum of water inventory of 400,000 gallons in each of the two storage tanks. The applicant has determined that for limiting case approximately 378,000 gallons (1,434,392 l.) of water would be needed to support AFW operation to maintain the plant at hot standby for eight hours and an additional six hours to cooldown down to shutdown cooling entry conditions. The AFWS can operate for approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> with the water in a single AFWST. The staff therefore finds that the 800,000 gallons (3,028,329 l.) (400,000 per tank) exceeds the minimum water volume required and thus provides sufficient inventory to enable the AFWS to remove the required heat from the RCS under normal operating and accident conditions, assuming any single active failure, coincident with the LOOP. The AFWS can also be supplied with makeup water from the demineralized water storage tank (DWST).

Based on the staffs review as detailed above, the staff finds that the AFWS and AFWSTs are capable of transferring heat loads from the reactor system to a heat sink under both normal 10-94

operating and accident conditions assuming single active failure and thus satisfy the requirements of GDC 34 and GDC 44.

Generic Recommendations As identified in the Acceptance Criteria of SRP 10.4.9, in addition to addressing GDC 34 and 44, the applicant is also expected to meet the generic recommendations of NUREG-0611, Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse - Designed Operating Plants, January 1980 (ML082590256), NUREG-0635, Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Combustion Engineering - Designed Operating Plants, January 1980 (ML083540675), and 10 CFR 50.34(f)(1)(ii).

Generic Short Term Recommendation No. 3 (GS-3): GS-3 recommends that measures be taken to eliminate or reduce the potential for water hammer from AFWS discharge. A review of measures taken to eliminate or reduce the potential for water hammer was discussed above in this section of the SE, with regard to the applicants compliance with the requirements of GDC

4. These measures include system design provisions which help preclude water hammer, AFWS monitoring to detect back-leakage, which could contribute to conditions for water hammer to occur, and the inclusion of COL information item 10.4(8) to ensure that appropriate operation and maintenance procedures will be used to minimize the probability of water hammer occurrences. Based on the above, and the staffs review of the AFWS compliance with GDC 4, as discussed above, the staff concludes that the APR1400 design meets GS-3.

Generic Short Term Recommendation No. 4 (GS-4): GS-4 recommends emergency procedures to be available for transferring to alternative sources of AFW supply. DCD Tier 2, Section 10.4.9.5.4, Level Instrumentation, states that level indication and low-level alarms for the AFWSTs are provided in the MCR and RSR by redundant level instrumentation on each tank. The low-level alarm is set to allow 30 minutes for alignment of the other AFWST or the non-safety backup makeup supply before the level decrease to a point where pump suction is lost. DCD Tier 2, Section 10.4.9.2.2.3 states that the AFWS is supplied with makeup water from the demineralized water storage tank, and that a nonsafety-related backup water source by gravity feed is also available from the condensate storage tank and raw water storage tank.

There are also two external water injection lines provided to makeup AFWST at the AFWST cross-connection line when the AFWSTs and nonsafety-related water source runs out. While the staff was able to confirm the presence of various sources that may be available to supply makeup to the AFWS, the staff could not find a commitment that procedures are or would be developed that specifically address the switch to a backup water source. The applicant also did not provide sufficient information on what water level the alarm would be set at and the level at which AFW pump suction will be lost (inadequate NPSH). Therefore, the staff requested in RAI 86-8003, Question 10.04.09-1 (ML15197A269), that the applicant demonstrate how it will be assured that the emergency procedures will be develop for the switch over of water to the DWST, CST, or other backup water source and what AFWST water level will be used to assure pump suction is not lost.

In its response to RAI 86-8003, Question 10.04.09-1 (ML15301A860), the applicant stated that it indicated in DCD Tier 2, Section 13.5.2.1.3, Emergency Operating Procedure Program, that the COL applicant is to provide a program for developing and implementing emergency procedures. The applicant also include COL Item 13.5(5) to ensure that the emergency procedures for switch over of water to the alternate source will be prepared by the COL applicant in accordance with DCD Tier 2, Subsection 13.5.2.1.3, Emergency Operating 10-95

Procedure Program. In regards to the AFWST level used to provide the alarm in the control room alerting operators to switch over to the alternate source, the applicant indicates that the reserved volume from the level requiring operator action to empty is 22,063 gallons (83,517 l.).

Therefore, the level requiring operator action is appropriate to meet the minimum dedicated AFW capacity.

On the basis of its review of the applicants response, the staff finds that the concerns identified in RAI 86-8003, Question 10.04.09-1 are resolved, given that the applicant has included COL Item 13.5(5) for the COL applicant to develop the necessary emergency procedures for switch over to backup water supplies, and the applicant has selected an AFWST level alarm that will provide for sufficient time for operator action to be taken to switch backup water source once the low tank level alarm setpoint is reached.

Generic Short Term Recommendation No. 5 (GS-5): GS-5 recommends the plant to be capable of providing required AFW flow for at least two hours from AFWS pump trains independent of any ac power source. Each of the AFWS trains can be operated using a turbine-driven pump during SBO conditions. The use of the turbine driven pumps allows for establishment of the required AFW flow to the steam generators. DCD Tier 2, Section 10.4.9.3 states that, in the event of a station blackout, the turbine driven pump lines provided with battery-backed power are capable of providing auxiliary feedwater to the SGs coincident with a single failure for 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />; thus under a station blackout scenario the AFWS can provide the required flow for greater than two hours. However, during a station blackout the alternate ac (AAC) power source can be credited and thus the safety-related cubicle coolers for the motor-driven auxiliary feedwater pump rooms may be used to cool the area. If no AC power is available the pump room temperature will increase. The staff could not find information regarding the effect of the loss of cooling in the pump room would have on the turbine-driven pump availability or accessibility if required by operators to perform manual actions need for operation of the pumps. Therefore, that staff requested in RAI 86-8003, Question 10.04.09-2 (ML15197A269), that the applicant provide information on the time dependent room temperature and the environmental qualification the turbine-driven AFW (TDAFW) pump and its supporting equipment (mechanical and electrical).

In its response to RAI 86-8003, Question 10.04.09-2 (ML15197A269), the applicant stated that the EQ envelope temperature of the TDAFW pump room in an abnormal condition when room cooling is not available is 160 ºF (71ºC) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and the calculated transient room temperature is 133 ºF (56ºC) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Additionally the applicant stated that the TDAFW pump is automatically started on receipt of AFAS or DPS-AFAS. Therefore, operators will not need access to the TDAFW pump room at the start of or during TDAFW operation and the guidance of GS-5 is met.

Generic Short Term Recommendation No. 6 (GS-6): GS-6 recommends confirmation of the availability of the AFW flow path that has been taken out of service to perform periodic testing or maintenance, including TS requirement and procedures that require an operator to verify proper alignment of the flow path. The staff identified that TS SR 3.7.5.5 in Chapter 16 of the DCD Tier 2 requires a flow test to verify proper alignment of required AFW flow paths by verifying flow from auxiliary feedwater storage tanks to each steam generator whenever the reactor has been in cold shutdown, refueling, or defueled for a period greater than 30 days, consistent with the recommendations of GS-6. The procedures should include an independent check by a second operator to verify the flow alignment. However, the staff could not find a commitment that the COL applicant would develop procedures that specifically require confirmation of the availability of an AFW flow path that has been previously taken out of service to perform periodic testing or 10-96

maintenance, including independent verification by a second operator. Accordingly, the staff requested in RAI 86-8003, Question10.04.09-3 (ML15197A269), that the applicant provide the procedures that demonstrate how verification of the propose flow path will be accomplished.

In its response to RAI 86-8003, Question 10.04.09-3 (ML15301A860), the applicant added COL Item 10.4(11) to DCD Tier 2, Section 10.4.9.4.1, Auxiliary Feedwater Performance Test. The new COL item provides that the COL applicant develop procedures to perform periodic test, including independent verification in accordance with NUREG-0635. Thus, the recommendation for confirmation of availability of AFWS flow path for system returning to service has been met.

On the basis of its review of the applicants response, the staff finds that the concerns identified in RAI 86-8003, Question 10.04.09-3 is resolved and, based on the above, recommendation GS-6 has been met. This RAI is resolved and closed and the necessary changes were incorporated in Revision 1 to the DCD Additional Short-term Recommendation (Primary AFWS Water Source Low Level Alarm):

In accordance with this additional short-term recommendation, the plant should provide redundant level indication and low level alarms in the control room for the AFWS primary water supply. The low level alarm setpoint should allow at least 20 minutes for operator action, assuming the largest capacity AFW pump is operating. In accordance with DCD Tier 2, Section 10.4.9.5.4, level indication and low-level alarms for the AFWSTs are provided in the MCR and RSR, and the low-level alarm is set at a point to allow 30 minutes for manual alignment of the other AFWST or the non-safety backup supply before the level decrease to a point where pump suction is lost. Since the APR1400 is provided with AFWST level indication which provides for 30 minutes for operator action to establish an alternate water source, the staff finds that the short term recommendation concerning the AFWS low level alarm is satisfied.

Additional Short-term Recommendation (AFW Pump Endurance Test): In accordance with this additional short-term recommendation, it is requested that a one-time 72-hour endurance test be performed on the AFWS pumps. Following the 72-hour pump run, the pumps should be shutdown and cooled down and then restarted for one hour. In accordance with SRP 10.4.9 Section III, Item 3, a 48-hour test is acceptable rather than the 72-hour test. In DCD Tier 2, Section 10.4.9.4.2, Reliability Tests and Inspections, the applicant indicates that a 48-hour endurance test is to be performed on the AFW pumps to demonstrate that the pumps have the capability for continuous operation over an extended period of time. While the applicant makes reference to a 48-hour endurance test in section 10.4.9 of the DCD, the staff was unable to find any information on the requirements of the endurance test in DCD Tier 2, Section14.2.12.1.34, Auxiliary Feedwater System Test. Therefore, the staff requested in RAI 86-8003, Question 10.04.09-4 (ML15197A269), that the applicant specify the requirement for the endurance test, by including the test objectives and the verification by listing the duration in DCD Tier 2, Section 14.2.12.1.34.

In its response to RAI 86-8003, Question 10.04.09-4 (ML16107A042), the applicant revised DCD Tier 2, Section 14.2.12.1.34, Auxiliary Feedwater System Test, by indicating that a 48-hour endurance test is to be performed. The 48-hour test included in DCD Tier 2, Section 14.2.12.1.34 satisfies the recommendation for endurance testing of the AFW contained in NUREG-0611.

On the basis of its review of the applicants response, the staff finds that the concerns identified in RAI 86-8003, Question 10.04.09-4 are resolved, given that the applicant has included in DCD 10-97

Section 14.2.12.1.34 a 48-hour test in accordance with the recommendation in NUREG-0611 on AFW pump endurance testing. This RAI is resolved and closed.

Generic Long Term Recommendation No. 3 (GL-3): The GL-3 recommendation is the same as GS-5 discussed above in this section of this SE. The staff concluded above that the APR1400 is in compliance with recommendation GS-5. Therefore, the staff also concludes that the AFWS is in compliance with GL-3.

10 CFR 50.34(f)(1)(ii): In accordance with this requirement a simplified AFWS reliability analysis that uses event-tree and fault-tree logic techniques to determine the potential for AFWS failure under various loss-of-feedwater transient conditions should be performed. Particular emphasis should be given to determining potential failures that could result from human errors, common causes, single-point vulnerabilities, and test and maintenance outages.

DCD Tier 2, Section 10.4.9.1.2 (Item O) indicates that an AFWS reliability analysis was performed in accordance with the Three Mile Island (TMI) Action Item II.E.1.1 of NUREG-0737, and that the AFWS is designed to have unreliability from 10-5 to 10-4 per demand as described in DCD Tier 2, Chapter 19, Probabilistic Risk Assessment. The staff was unable to locate the referenced information in Chapter 19. Therefore, the staff requested in RAI 86-8003, Question 10.04.09-6 (ML15197A269), that the applicant provide the staff with the description and results of the AFWS reliability analysis that reference was made to in DCD Tier 2, Section 10.4.9.1.2.

In its response to RAI 86-8003, Question 10.04.09-6 (ML16153A479), the applicant states that the AFWS reliability analysis was performed in accordance with TMI action item II.E.1.1 of NUREG-0737, and that the results of the reliability analysis will be added as Table 10.4.9-6 in the DCD. However, the description of the performed reliability analysis was not provided and there was no discussion as to why such analysis is in accordance with TMI Action Item II.E.1.1 of NUREG -0737. Therefore, the staff issued follow-up RAI 537-8664, Question 10.04.09-8 (ML17034A380), requesting the applicant to provide a description of the AFWS reliability analysis that was performed to support DCD Tier 2, Section 10.4.9.1.2 (Item O), and clarify how the information demonstrates compliance with the AFWS unavailability target. The response to RAI 537-8664, Question 10.04.09-8, and the resolution of this issue was tracked as Open Item 10.04.09-1.

The applicant provided its response to RAI 537-8664, Question 10.04.09-8 (ML17219A177). In its response the applicant stated that AFW system reliability analysis was performed for the APR1400 using event-tree and fault-tree logic techniques to determine the potential for AFW system failure under various loss-of-main-feedwater-transient conditions. The applicant confirmed that the analysis performed for the APR1400 demonstrates an unreliability in the range of 10-4 to 10-5 per demand, and indicated that a description of the AFW reliability analysis will be provided and discussed within DCD Chapter 19, and the results will be summarized in the DCD, Table 19.1-162. A markup of the DCD showing the necessary changes to support the addition of the AFWS reliability study in DCD Chapter 19 was also included with the applicants response. The staff finds the applicants response acceptable because the information added to the DCD in Chapters 10 and 19 demonstrates compliance with TMI action item II.E.1.1 of NUREG-0737. The RAI and Open Item 10.04.09-8 are therefore considered closed.

10-98

GDC 45, Inspection of cooling water system and GDC 46, Testing of cooling water system The staff reviewed the AFWS for compliance with the requirements of GDC 45 as related to design provisions to permit periodic in-service inspection (ISI) of system components and equipment, and GDC 46 regarding provisions to permit appropriate functional testing of the system and components.

The staff reviewed the AFWS for compliance with the requirements and found that the AFWS pumps and the appropriate system valves were included in the plant in-service testing (IST) program (Table 3.9-13, Inservice Testing of Safety-Related Pumps and Valves ) as described in DCD Tier 2, Section 3.9.6, Functional Design Qualification, and In-service Testing Programs for Pumps, Valves, and Dynamic Restraints. DCD Tier 2, Section 10.4.9.2.2.1, Auxiliary Feedwater Pumps, states that each AFW pump has adequate flow capacity to provide the required design flow to the SGs plus the capacity to continuously recirculate the flow, and that the recirculation lines are adequately sized so that full pump flow can be recirculated through the bypass provided around the flow restrictive orifice for full flow pump testing during power operation. The bypass line contains a manual flow control valve to vary the pump flow for performance testing.

The applicant indicates in DCD Tier 2, Section 10.4.9.3 that the AFWS system is designed to allow inspection of the system components and functional testing for the system operability and functionality performance.

Based on the above review, the staff finds that the AFWS satisfies the requirements of GDC 45 and GDC 46, since design provisions are provided to permit periodic ISIs of AFWS components and equipment and operational testing of the AFWS during normal plant conditions.

GDC 60, Control of releases of radioactive materials to the environment The staff reviewed the design of the AFWSTs for compliance with the requirements of GDC 60 with respect to control of releases of radioactive materials.

GDC 60 requires that a means be provided to control the release of radioactive materials in liquid effluents system. AFWST overflow would not be subject to radioactive contamination, given that the AFWST inventory is provided by means of the DWST. Since the AFWSTs will not contain liquid effluents containing radioactive material, the staff concludes that there is no potential for the release of radioactive material to the environment from the AFWSTs and GDC 60 does not apply.

10 CFR 50.62, Requirements for reduction of risk from ATWS events for light-water-cooled nuclear power plants The staff reviewed the AFWS for compliance with the requirements of 10 CFR 50.62 regarding provisions for automatic initiation in an ATWS. It is stated in DCD Tier 2, Section 10.4.9.2, Item P, that the AFWS can be either manually or automatically actuated by an auxiliary feedwater actuation signal (AFAS) from the ESFAS, as described in DCD Tier 2, Section 7.3, or the DPS.

As previously indicated, DCD Tier 2, Section 10.4.9.2 (item m) states that the automatic initiation signals and circuits are designed so that their failure does not result in the loss of ability to manually initiate the AFWS. In describing the APR1400 compliance with Regulatory Guide 1.62, the applicant indicated that the ESFAS, which includes the AFAS signals, can be manually activated with switches located on the safety console in the MCR, and that some ESF functions 10-99

also have manual actuation at the remote shutdown room. In DCD Tier 2, Section 7.8.2.1, Diverse Protection System, it is stated that the DPS is designed to mitigate the effects of an ATWS event characterized by an anticipated operational occurrence (AOO) followed by failure of the reactor trip portion of the protection system. Therefore, based on the above, the design was found to satisfy 10 CFR 50.62 regarding provisions for automatic initiation in an ATWS.

10 CFR 50.63, Loss of all alternating current The staff reviewed the AFWS for compliance with the requirements of 10 CFR 50.63 regarding the capability for responding to a SBO. An applicant may demonstrate compliance with this requirement by meeting Positions 3.2.2, 3.3.2 and 3.3.4 of RG 1.155, Station Blackout, which is based on the AFWS design providing for sufficient decay heat removal in a SBO. DCD Tier 2, Section 8.4.1, System Description, states that during a Station Blackout a non-Class 1E AAC gas turbine generator (GTG), with sufficient capacity and reliability, provides power for the set of required shut down loads enough to bring the plant to safe shutdown.

Both trains of the AFWS have turbine-driven AFW pumps that can operate during SBO conditions. In DCD Tier 2, Section 10.4.9.3, it is stated that, in the event of a station blackout, the turbine-driven pump lines provided with battery-backed power are capable of providing auxiliary feedwater to the SGs coincident with a single failure for 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, and that battery-backed power is also available to the turbine governor speed control. In addition the AAC GTG is provided for the operation of the motor-driven AFW pump lines during an extended SBO.

With credit for AAC generated electrical power, the plant can withstand an SBO condition for at least 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. DCD Tier 2, Section 10.4.9.3 indicates that the total usable water inventory in the AFWSTs (800,000 gallons) is sufficient for decay heat removal during the 16 hour1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> SBO duration. Therefore, based on the above, the staff concluded that the design satisfies 10 CFR 50.63 regarding the capability for responding to a SBO.

10 CFR 20.1406, Minimization of contamination Title 10 CFR 20.1406 requires in part that each DC applicant describe how the facility design and procedures for operation will minimize, to the extent practicable, contamination of the facility and the environment, as well as the generation of radioactive waste. The AFWS is not used during normal operation and, in general, does not contain radioactive fluids. However, there is a segment of AFWS piping connected to the high-pressure feedwater lines after the containment penetration to the SGs that may become contaminated by the feedwater. In addition the turbine driven AFW pumps may also be subject to contamination since they receive steam from the main steam system.

In DCD Section 10.4.9.2.5, Design Features for Minimization of Contamination, the applicant states that the CFS is designed with specific features to meet the requirements of 10 CFR 20.1406. Specifically, it is stated that, AFW piping is required to be fabricated of stainless steel material, be welded construction, and be designed to safety class 3 and seismic Category I requirements. In addition to minimize leakage of unintended contamination of the facility and the environment, leakage developed in the segment of AFWS piping connected to the high-pressure feedwater lines after the containment penetration to the SGs will be collected in the sump. The AFWS valve stem leak-off and drains are collected and directed to the liquid radwaste system for treatment and release. Based on the above, the staff concludes that the applicant provided an adequate description of how the facility design will minimize contamination.10-100

Initial Test Program Although applicants for DC are not required to submit plans for an initial test program, RG 1.68 acknowledges that DC applicants have previously submitted these plans to assist a future COL applicant referencing the DC in meeting the requirements of 10 CFR 52.79(a)(28).

Preoperational test requirements for the AFWS are listed in DCD Tier 2, Section 14.2.12.1.34, Auxiliary Feedwater System Test, and Section 14.2.12.4.13, Feedwater and Auxiliary Feedwater System Test.

ITAAC Proposed ITAAC for the AFWS are given in DCD Tier 1, Table 2.7.1.5-4, Auxiliary Feedwater System ITAAC. Table 2.7.1.5-4 contains test and inspection requirements for the AFWS. The ITAAC for the AFWS verify the principal design features and functional capabilities of the system by verifying the system functional arrangements; ASME Code Data report generation; ASME compliant welding; ASME pressure testing; seismic Category I equipment being able to withstand seismic design basis loads; Class 1E equipment qualification for harsh environment; Class 1E power supply; physical separation and electrical isolation of Class 1E divisions in accordance with RG 1.75; valve and pump performance; system alarms, controls and displays; physical separation of mechanical divisions by a fire barrier; AFWS NPSH; storage tank capacity; AFWS system actuation; AFW pump flow; and environmental qualification of non-metallic parts, materials, and lubricants in safety-related mechanical equipment. The staff finds that all the necessary AFWS equipment has been adequately identified in the applicable tables.

Based on a review of the information provided in DCD Tier 1, Table 2.7.1.5-4, the staff concludes that the ITAAC will adequately confirm AFWST and AFWSTs design capabilities, design features, and systems interfaces and that they satisfy the requirements of 10 CFR 52.47(b)(1).

A discussion of all APR1400 ITAAC is provided in Section 14.3 of this SER.

Technical Specifications The staff reviewed the TS requirements for the AFWS as presented in DCD Tier 2, Chapter 16.

In MODES 1, 2, and 3, the AFWS, including the AFWSTs, are required to be operable. For MODE 4, when a steam generator is relied upon for heat removal, only one AFW train, which includes a motor driven pump, is required to be operable.

Applicable AFWS Limiting Conditions for Operation (LCO) are provided in DCD Tier 2 Chapter 16 LCO 3.7.5. For applicability to MODES 1, 2, and 3, the LCO and the associated Bases were reviewed and found to be acceptable. A detailed evaluation of the TS is contained in Chapter 16 of this report.

Surveillance requirements (SRs) for the following parameters are provided: (1) valve alignment confirmation, (2) pump developed head, (3) verification that automatic valves actuate to correct position on actual or simulated actuation signal, (4) pump start on actual or simulated actuation signal, and (5) verification that the AFWS is properly aligned from AFWSTs to the SGs prior to entering MODE 2 after more than 30 days in MODE 5 or 6. AFW alignment is also verified following extended outages.10-101

The staff determined that the surveillance parameters listed above for the AFWS are reasonable, since they provide for pump operability, proper system alignment, and correct automatic response of the AFWS pumps and valves.

The staff reviewed the LCO and the associated Bases for the AFWSTs and found them to be acceptable. The applicable LCO for the AFWSTs is provided in DCD Tier 2 Chapter 16; LCO 3.7.6. The LCO includes two action levels for a condition in which one or both AFWSTS become inoperable.

There is one SR for the AFWSTs, namely that the tank level be maintained at or above 1,524,165 L (400,000 gallons) (SR 3.7.6.1).

Based on a detailed review of proposed TS Sections 3.7.5 and 3.7.6 and Bases 3.7.5 and 3.7.6, the staff finds the AFWS will be operated in accordance with its design bases requirements.10-102

Combined License Information Items The following is a list of COL item numbers, with the table-provided descriptions, from DCD Tier 2, Table 1.8-2, Combined License Information Items, that are directly applicable to the AFWS.

Combined License Information Items DCD Tier Item No. Description 2 Section 10.4(1) The COL applicant is to establish 10.4.9 operational procedures and maintenance programs for leak detection and contamination control.

10.4(2) The COL applicant is to maintain 10.4.9 complete documentation of the system design, construction, design modifications, field changes, and operations 10.4(8) The COL applicant is to provide operating 10.4.9 and maintenance procedures in accordance with NUREG-0927 and a milestone schedule for implementation of the procedures.

10.4(11) The COL applicant is to develop 10.4.9 procedures to perform periodic testing or maintenance, including independent verification in accordance with NUREG-0635.

Conclusion The staff finds the APR1400 auxiliary feedwater system design acceptable because it meets applicable regulatory requirements including GDC 2 regarding protection from natural phenomena, GDC 4 regarding protection against missiles and effects of pipe breaks, GDC 5 regarding shared systems, GDC 19 regarding prompt shutdown of the reactor, GDC 34 and GDC 44 regarding transferring heat to the ultimate heat sink, GDC 45 regarding inspections, GDC 46 regarding periodic testing, GDC 60 regarding control of release radioactive materials, 10 CFR 50.62 regarding ATWS, 10 CFR 50.63 regarding the ability of the plant to cope with a station blackout, 10 CFR 20.1406 and 10 CFR 52.47(b)(1) regarding ITAAC.10-103

10.4.10 Auxiliary Steam System Introduction The auxiliary steam system is a nonsafety-related system that supplies auxiliary steam required for plant use during startup, cleanup/recirculation, and shutdown when the MSS is not available.

The system includes a control valve to reduce the main steam pressure, an auxiliary steam header, a condensate receiver tank with vent condenser, condensate return pumps, an auxiliary boiler package, and associated piping, valves, instrumentation, and controls.

Summary of Application DCD Tier 1: DCD Tier 1, Section 2.7.1.9, Auxiliary Steam System, states that there are no Tier 1 requirements specific for the auxiliary steam system.

DCD Tier 2: DCD Tier 2, Section 10.4.10, Auxiliary Steam System, provides the design description and operational details for the auxiliary steam system. The auxiliary steam system is supplied by the MSS through a pressure-reducing valve, when the unit is in operation and by the auxiliary boiler at all other times. A schematic of the system is depicted in DCD Tier 2 Figure 10.4.10-1, Auxiliary Steam System Flow Diagram.

DCD Tier 2 Subsection 10.4.10.2.1, General Description, indicates that for operation as required during startup, shutdown, plant regular inspection, and normal operation, the auxiliary steam from the auxiliary boiler or main steam is supplied to the components continuously or intermittently depending on the task and mode of operation of the plant. During plant normal operation, the auxiliary steam system supplies steam to various equipment for the following purposes: deaerator pegging during recirculation/clean up and low power operation, turbine seals until main turbine extraction steam is available, feedwater pump turbine seals until main steam is available, feedwater pump turbine testing during plant shutdown, auxiliary feedwater pump turbine testing during plant shutdown, boric acid concentrator package and gas stripper package in the chemical and volume control system, decontamination services in the reactor containment building and fuel handling area, and to the solid radwaste system (SRS) for heating the SRS concentrates treatment system. The auxiliary steam system operation for the APR1400 is provided in DCD Subsection 10.4.10.2.2, System Operation.

DCD Subsection 10.4.10.2.3, Design Features for Minimization of Contamination, provides details of the auxiliary steam system design features for minimization of contamination. The DCD describes the prevention/minimization of unintended contamination, adequate and early leak detection, reduction of cross-contamination, decontamination, waste generation, and operational details and documentation. Also, the DCD provides guidance to combined license (COL) applicants to establish operational procedures and maintenance programs as related to leak detection and contamination control in accordance with NRC RG 4.21 (COL 10.4(1)).

DCD Subsection 10.4.10.5, Instrumentation Requirements, indicates that the auxiliary steam system is provided with the necessary controls and indications for local or remote monitoring of system operation. A radiation monitor is provided to monitor for the presence of leaked radioactive materials in the condensed water from the boric acid concentrator package, gas stripper package, or solid waste treatment system. If the condensate is contaminated, the radiation monitor will actuate an alarm in the main control room (MCR) and automatically redirect the condensate to the liquid waste management system for treatment.

ITAAC: There are no ITAAC specific to the auxiliary steam system.10-104

TS: There are no TS associated with the auxiliary steam system.

Regulatory Basis The relevant requirements of the NRC regulations for this area of review, and the associated acceptance criteria, are summarized below:

1. GDC 2, Design bases for protection against natural phenomena, as it relates to the failure of nonsafety-related systems or components due to natural phenomena such as earthquakes, tornadoes, hurricanes, and floods not to adversely affect the safety-related SSCs.
2. GDC 4, Environmental and dynamic effects design bases, as it relates to a failure of the auxiliary steam system due to pipe break or malfunction of the auxiliary steam system to not adversely affect essential systems or components necessary for safe shutdown or accident prevention or mitigation.
3. GDC 60, Control of releases of radioactive materials to the environment, as it relates to the ability of the auxiliary steam system design to control releases of radioactive materials to the environment.
4. GDC 64, Monitoring radioactivity releases, as it relates to provisions being included in the nuclear power unit design for monitoring the effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including AOOs, and from postulated accidents.
5. Title 10 CFR 20.1406, Minimization of contamination, as it relates to the design features that will facilitate eventual decommissioning and minimize, to the extent practicable, the contamination of the facility and the environment and the generation of radioactive waste.

Acceptance criteria to meet the above requirements include:

1. RG 1.29, Seismic Design Classification, as it relates to identifying and classifying system portions that should be designed to withstand the effects of a safe-shutdown earthquake.
2. RG 4.21, Minimization of Contamination and radioactive Waste Generation -

Life-Cycle Planning as it relates to design consideration employed for facility life-cycle planning to meet the requirements of 10 CFR 20.1406.

Technical Evaluation The staff reviewed the auxiliary steam system described in Tier 2 of the DCD, Revision 1, to determine if a failure or malfunction of the system could adversely affect safety-related systems and components (SSCs), or result in the release of radioactive materials to the environment.

The staffs acceptance of the auxiliary steam system is based on the compliance of the system design with the requirements of GDC 2, GDC 4, GDC 60, GDC 64 and the adherence to 10 CFR 20.1406.10-105

GDC2, Design bases for protection against natural phenomena, and GDC 4, Environmental and dynamic effects design bases The staff reviewed the auxiliary steam system for compliance with the requirements of GDC 2 and GDC 4. Compliance with the requirements of GDC 2 is based on the determination, by the staff through its review, that the auxiliary steam system is designed to withstand the effects of postulated natural phenomena, including earthquakes, such that it would not result in the loss of the capability of the important to safety SSCs to perform their safety functions. Compliance with the requirements of GDC 4 is based on the determination, by the staff through its review, that failure of the auxiliary steam system due to pipe break or malfunction of the auxiliary steam system does not adversely affect any of the plants essential systems or components (i.e., those necessary for safe shutdown or accident prevention or mitigation).

The staff reviewed DCD Tier 2, Section 10.4.10, Figure 10.4.10-1, Figures 1.2-1 through 1.2-49 (figures showing the general arrangement of the APR 1400), and Table 3.2-1 "Classification of Structures, Systems, and Components." The staff found that all the major components of the auxiliary steam system, except the auxiliary boiler, are located in enclosed cubicles inside the auxiliary building. The auxiliary boiler is located in the auxiliary boiler building in the yard area.

Piping for the auxiliary steam system can be found outside the auxiliary building, such as the reactor containment building, the turbine building, the compound building, and the concrete tunnel running between the auxiliary boiler building and the turbine generator building. The cubicle enclosure provides protection against the effects of pipe breaks and component failures.

The auxiliary steam system piping supplies steam to various equipment including the boric acid concentrator package and the gas stripper package. The auxiliary steam system piping are considered high energy lines. The auxiliary steam system is not required to be seismic category I because it is a nonsafety-related system and is therefore not relied upon to remain functional following a seismic event. The piping in the auxiliary building is seismic category II and quality group D as identified in DCD Tier 2 Figure 10.4.10-1 and Table 3.2.1. This classification meets the guidance in Regulatory Guide (RG) 1.29, Seismic Design Classification, Revision 4, and will not adversely impact those safety-related systems co-located within the auxiliary building.

Regarding auxiliary steam system piping located within the compound building and turbine building, this piping is classified as seismic category III and quality group D. There are no safety-related SSCs located in these areas and therefore the adverse effects of a pipe break or component failure on any safety-related equipment is not required. Consequently, the auxiliary steam system piping classification in the turbine and compound building meets RG 1.29.

DCD Tier 2, Table 3.2-1 and Figure 10.4.10-1 depict the auxiliary steam system piping as seismic category II, quality group D inside the auxiliary building and reactor containment building except for the containment penetration which is classified as seismic category I, quality group B, between and including the isolation valves. In accordance with RG 1.29, these isolation valves perform a safety-related function and therefore must be seismic category I and quality group B. Further staff evaluation of containment isolation is found under Section 6.2 of this report. The remaining portions of the auxiliary steam system piping within the auxiliary building and reactor containment building must be at a minimum seismic category II since these buildings house safety-related equipment. Other areas, such as the turbine generating building and compound building (CB) are identified as seismic category III, quality group D. This is acceptable as the auxiliary steam system does not need to function following post-earthquake (as would a seismic class I system) and there are no safety-related equipment housed in the turbine generator building and compound building.10-106

Based on the review above, the staff concludes that the auxiliary steam system satisfies the requirements of GDC 2 and GDC 4 with regards to the auxiliary steam system being designed to withstand the effects of postulated natural phenomena, including earthquakes, and any failure of an auxiliary steam system pipe would not result in the loss of the capability of the important to safety SSCs to perform their safety functions.

GDC 60, Control of releases of radioactive materials to the environment, and GDC 64, Monitoring radioactivity releases The NRC staff reviewed the design of the auxiliary steam system for compliance with the requirements of GDC 60 with respect to control of releases of radioactive materials and GDC 64 with respect to the monitoring of radioactive releases. The requirements of GDC 60 and 64 are met if the auxiliary steam system design includes provisions to monitor and prevent excessive release of radioactivity to the environment in the event of an auxiliary steam system or component failure.

The auxiliary steam system provides steam to the boric acid concentrator, gas stripper, and solid waste treatment system, and thus the auxiliary steam system may potentially contain radioactive effluents. DCD Subsection 10.4.10.2.1 states that condensate from the boric acid concentrator package, gas stripper package, and solid waste treatment system is collected in the condensate receiver tank and transferred to the condenser if the source of steam is from the MSS, or back to the auxiliary boiler if the source of steam is from the auxiliary boiler via the condensate return pumps. It also states that at the discharge of the condensate return pump, the condensate is monitored continuously for radioactivity. If contaminated, the radiation monitor actuates an alarm in the MCR and automatically diverts the radioactive or potentially radioactive condensate to the liquid radwaste system. Based on the provisions described above, the staff finds that the design includes sufficient provisions to prevent excessive release of radioactivity to the environment and to monitor for any potential amounts of radioactivity released in the event of failure of the SSCs in the auxiliary steam system.

10 CFR 20.1406, Minimization of contamination Title 10 CFR 20.1406, Minimization of contamination, requires in part that each DC applicant shall describe how the facility design and procedures for operation will minimize, to extent practicable, contamination of the facility and environment and the generation of radioactive waste.

In DCD Tier 2, Subsection 10.4.10.2.3 Design Features for Minimization of Contamination, the applicant states that the APR1400 is designed with specific features to meet the requirements of 10 CFR 20.1406 and RG 4.21, Minimization of Contamination and Radioactive Waste Generation: Life-Cycle Planning. The applicant also indicated that Subsection 12.4.2 of the DCD provides summary information on how the auxiliary steam system meets the basic principles of RG 4.21, and specifically delineates the four design objectives and two operational objectives contained in the RG. The following evaluation summarizes the primary features included by the applicant to address the design and operational objectives for the auxiliary steam system.

Among the features for minimization of contamination identified in DCD Subsection 10.4.10.2.3 are the use of a design to contain any leaks; provision of sufficient space to allow for prompt assessment and evaluation of the adequacy and the appropriateness of responses to isolate and mitigate leaks; the locating of the auxiliary steam system condensate receiver tank, vent 10-107

condenser, and pumps in an enclosed area at the foundation level inside the auxiliary building; and the location of the auxiliary boiling building outside the auxiliary building to house the boiler.

To the extent practicable, cubicles housing auxiliary steam system equipment will be designed with early leak detection capabilities to detect component leakage, overflow, and/or tank rupture, and will have provisions to initiate alarm signals for operator actions. Concrete sumps will be coated and have seals to prevent unintended infiltration of liquid into the concrete sumps, and the use of embedded piping will be minimized. Where embedment cannot be avoided, consideration will be given to minimizing embedded piping lengths and using double-walled piping with leak detection capabilities on the outer piping. The use of buried piping in the yard between buildings and facilities will be minimized, and the use of pipe tunnels for piping carrying radioactive or potentially radioactive liquids will have leak detection capability and adequate accessibility.

The leak identification evaluation indicates that the auxiliary steam system is designed to facilitate early leak detection and the prompt assessment and response to manage collected fluids. In addition to design features, the minimization of contamination is achieved through the use of appropriate operation procedures and maintenance programs. Site-wide programs and procedures relied upon to satisfy 10 CFR 20.1406 are addressed in DCD Chapters 11 and 12.

The programs and procedures proposed by the applicant under Chapter 10 are in fact a subset of what is presented in Chapters 11 and 12 and therefore were not reviewed by the staff. The staffs review of the 10 CFR 20.1406 site-wide programmatic aspects can be found under Sections 11 and 12 of this SE.

Based on the review above, the staff concludes that the auxiliary steam system satisfies the requirements of 10 CFR 20.1406 with regards to how the design will minimize, to extent practicable, contamination of the facility and environment and the generation of radioactive waste.

Initial Test Program Although applicants for DC are not required to submit plans for an initial test program, RG 1.68 acknowledges that DC applicants have previously submitted these plans to assist a future COL applicant referencing the DC in meeting the requirements of 10 CFR 52.79(a)(28).

Preoperational test requirements for the auxiliary steam system are described in DCD Tier 2 Section 10.4.10.4, Inspection and Testing Requirements, and Section 14.2.12.1.128, Auxiliary Steam System Test. The initial test program for the APR1400 is evaluated in Section 14.2 of this SER.

ITAAC There are no ITAAC required for this system. The system is not safety-related and is not required for safe shutdown; therefore the staff finds this acceptable.

Technical Specifications There are no APR1400 TS sections for the auxiliary steam system. The system is not safety-related and is not required for safe shutdown; therefore the staff finds this acceptable.

Combined License Information Items The following is a list of COL Information Items:

10-108

Combined License Information Items DCD Tier 2 Item No. Description Section 10.4(1) The COL applicant is to establish operational 10.4.10.2.3 procedures and maintenance programs for leak detection and contamination control.

10.4(2) The COL applicant is to maintain complete 10.4.10.2.3 documentation of system design, construction, design modifications, field changes, and operations.

The review of COL Information Item 10.4(1) can be found in Subsection 10.4.10.4 under 10 CFR 20.1406 of the SER.

Conclusions Based on the review above, the staff concludes that the APR1400 auxiliary steam system design is acceptable because it meets applicable regulatory requirements including GDC 2 regarding protection from natural phenomena, GDC 4 regarding protection against missiles and effects of pipe breaks, GDC 60 regarding control of radioactive material releases, GDC 64 regarding monitoring radioactive releases, and 10 CFR 20.1406 regarding minimizing contamination.10-109

Retrieved from "https://kanterella.com/w/index.php?title=ML18044A185&oldid=2619944"