ML20093F532
| ML20093F532 | |
| Person / Time | |
|---|---|
| Site: | 05000447 |
| Issue date: | 06/30/1984 |
| From: | Fox J, Hankins D, Holtzclaw K GENERAL ELECTRIC CO. |
| To: | |
| Shared Package | |
| ML20093F530 | List: |
| References | |
| TASK-***, TASK-OR NEDO-30670, NUDOCS 8407190305 | |
| Download: ML20093F532 (178) | |
Text
NEDO 30670 fm CLASSI O
JUNE 1984
- O l
32 l
l l
3
- 8 IE RESOLUTION OF APPLICABLE
'H5 UNRESOLVED SAFETY ISSUES AND z
GENERIC SAFETY ISSUES FOR GESSAR ll jo
,m C
9 E
J. N. FOX m
D. A. HANKINS C
K. W. HOLTZCLAW P. D. KN ECHT g
Z-lC t
g E
o=
Q 12=
=
0004k7 pyg A
GENERAL h ELECTRI
/
E NED0-30670 Class I June 1984 RESOLLTION OF APPLICABLE UNRESOLVF.D SAFETY ISSLTS AND GENERIC SAFETY ISSLTS FOR GESSAR II J. N. Fox D. A. Hankins K. W. Holtzclaw P. O. Knecht Approved:
'7 /3 h G.'G.$herwoodfManager' Safety and Liebnsing Operation NUCLEAR ENERGY BUSINESS OPERATIONS + GENE AAL ELECTAIC COMDANY SAN JOSE. CALIFOANIA 95125 GENERAL h ELECTRIC O
DISCLAIMER OF RESPONSIBILITY This document was prepared by or for the General Electric Company. Neither the General Electnc Company not any of the contributors to this document:
A.
Makes any warranty or representation, express or implied, with respect to the accuracy, completeness, or usefulness of the information containedin this docu-ment or that.the use of any information disclosed in this document may not intnnge privately owned rights; or B. Assumes any responsibility forliability or damage of any kind which may result from the use of any information disclosed in this document.
O 4
e se esmum o
e es -
e e e eD
(
NEDO-30670 CONTENTS Page f
ix NOMENCLARIRE
- 1. ' INTRODUCTION 1-1
1.1 Background
1-1 1.2 _0utline of Report 1-1 1.3 References 1-2 2.
UNRESOLVED SAFETY ISSUES 2.0-1 2.1 Water Hammer (Task A-1) 2.1-1 2.1.1 Issue Description 2.1-1 2.1.2 Safety Significance 2.1-1 2.1.3 Resolution for GESSAR II 2.1-2 2.1.4 References 2.1-4 2.2 Systems Interaction (Task A-17) 2.2-1 2.2.1 Issue Description 2.2-1 2.2.2 Safety Significance 2.2-2 2.2.3 Resolution for GESSAR II 2.2-3 2.2.4 References 2.2-7 2.3 Containment Emergency Sump Reliability (Task A-43) 2.3-1 2.3.1 Issue Description 2.3-1 2.3.2 Safety Significance 2.3-2 2.3.3 Resolution for GESSAR II 2.3-3 2.3.4 References 2.3-4 2.4 Station Blackout-(Task A-44) 2.4-1 2.4.1 Issue Description 2.4-1 2.4.2 Safety Significance 2.4-1 2.4.3 Resolution for GESSAR II 2.4-3 2.4.4 References 2.4-5 2.5 Shutdown Decay Heat Removal Requirements (Task A-45) 2.5-1 2.5.1 Issue Description 2.5-1 2.5.2 Safety significance 2.5-2 2.5.3 Resolution for CESSAR II 2.5-4 2.5.4 References 2.5-6 2.6 Safety Implications of control Systems (Task A-47) 2.6-1 2.6.1 Issue Description 2.6-1 2.6.2 Safety Significance 2.6-1 2.6.3 Resolution for GESSAR II 2.6.4 References 2.7 Hydrogen Control (Task A-48) 2.7-1 2.7.1 Issue Description 2.7-1 2.7.2 Safety Significance 2.7-1 2.7.3 Resolution for GESSAR II 2.7-3 2.7.4 References 2.7-8 3.
GENERIC SAFETY ISSUES 3.0-1 3.1 Nuclear Power Plant Design for the Reduction of Vulnerability to Industrial Sabotage (Item A-29) 3.1-1 3.1.1 Issue Description 3.1-1 3.1.2 Safety Significance 3.1-2 3.1.3 Resolution for GESSAR II 3.1-2 3.1.4 References 3.1-4 e
iii
CONTENTS (Continued)
Page_
3.2 Adequacy of Safety-Related DC Power Supplies (Item A-30) 3.2-1 3.2.1 Issue Description 3.2-1
-3.2.2 Safety Significance 3.2-1 3.2.3 Resolution for GESSAR II 3.2-2 3.2.4 References 3.2-2 3.3-Ductility of Two-Way Slabs and Shells and Buckling Behavior of Steel Containments (Item B-5) 3.3-1 3.3.1 -Issue Description 3.3-1
-3.3.2-Safety Significance 3.3-2 3.3.3 Resolution for GESSAR II 3.3-2 3.3.4 -References 3.3-3
- 3.4 Loads, Load Combinations, Stress Limits (Item B-6) 3.4-1 3.4.1 Issue Description
-3.4-1 3.4.2 Safety Significance 3.4-2 3.4.3 Resolution for GESSAR II 3.4-3 3.4.4~ References 3.4-4
- 3.5 Behavior of-BWR Mk III Containment (Item B-10) 3.5-1 3.5-1 3.5.1 Issue Description 3.5-2
'3.5.2 Safety Significance
-3.5.3 Resolution for GESSAR II 3.5-2 3.5.4 References 3.5-3 3.6 Criteria for Safety-Related Operator Actions (Item B-17) 3.6-1
+ ~
3.6-1 3.6.1 Issue Description 3.6-1 3.6.2 Safety Significance 3.6.3 Resolution for GESSAR II 3.6-1 3.6-3 3.6.4 References 3.7 Structural Integrity of Containment Penetrations (Item B-26) 3.7-1 3.7.1 Issue Description 3.7-1 3.7.2 Safety Significance 3.7-2 3.7.3 Resolution for GESSAR II 3.7-2 3.7.4 References 3.7-5
+
- 3.8 Improved Reliability of Target Rock Safety-Relief Valves (Item B-55) 3.8-1 3.8.1 Issue Description 3.8-1 3.8.2 Safety significance 3.8-1 3.8.3 Resolution for GESSAR II 3.8-3 3.8.4 References 3.8-3 3.9 Diesel Reliability (Item B-56) 3.9-1 3.9.1 Issue Description 3.9-1 3.9.2 Safety significance 3.9-1 3.9.3 Resolution for CESSAR II 3.9-2 3.9.4 References 3.9-2 3.10 Passive Mechanical Failures (Item B-58) 3.10-1 3.10.1_ Issue Description 3.10-1 3.10.2 Safety Significance 3.10-1 3.10.3 Resolution for GESSAR II 3.10-2 3.10-2 3.10.4 References iv
..--.,.,.,--.w.-
~--,-.,--,..,-,.,,-..,-..-y,...,.<,.w---.,,,,-,%-
.. -,, - -,. -. - - - -,.,v...w
---.----,-v,,-
vy-r,=,*
NEDO-30670 CONTENTS (Continued)
P,, age 3.11 Allowable ECCS Equipment Outage Periods (Item B-61) 3.11-1 3.11.1 Issue Description 3.11-1 3.11.2 Safety Significance 3.11-1 3.11.3 Resolution for GESSAR II 3.11-1 3.11.4 References 3.11-2 3.12 Main Steam Line Leakage Control Systems (Issue C-8) 3.12-1 3.12.1 Issue Description 3.12-1 3.12.2 Safety Significance 3.12-2 3.12.3 Resolution for GESSAR II 3.12-3 3.12.4 References 3.12-4 3.13 Assessment of Failure and Reliability of Pumps and Valves (Item C-11) 3.13-1 3.13.1 Issue Description 3.13-1 3.13.2 Safety Significance 3.13-1 3.13.3 Resolution for GESSAR II 3.13-1 3.11.4 References 3.13-3 3.14 BWR Jet Pump Integrity (Issue 12) 3.14-1 3.14.1 Issue Description 3.14-1 3.14-1 3.14.2 Safety Significance 3.14.3 Resolution for GESSAR II 3.14-1 3.14.4 References 3.14-2 3.15 Reactor Coolant Pump Seal Failures (Issue 23) 3.15-1 3.15.1 Issue Description 3.15-1 3.15-1 3.15.2 Safety significance 3.15.3 Resolution for GESSAR II 3.15-1 3.15-1 3.15.4 References 3.16 Bolting Degradation or Failure in Nuclear Power Plants (Issue 29) 3.16-1 3.16-1 3.16.1 Issue Description 3.16-1 3.16.2 Safety Significance 3.16.3 Resolution for CESSAR II 3.10-2 3.16-3 3.16.4 References 3.17 Safety Concerns Associated with Pipe Breaks in the BWR Scram System (Issue 40) 3.17 1 7
3.17-1 3.17.1 Issue Description 3.17-1 3.17.2 Safety Significance 3.17-1 3.17.3 Resolution for CESSAR II 3.17-1 3.17.4 References 3.18 BWR Scram Discharge Volume Systems (Issue 41) 3.18-1 3.18-1 3.18.1 Issue Description 3.18-1 3.18.2 Safety significance 3.18-1 3.18.3 Resolution for GESSAR II 3.18-1 3.18.4 References 3.19 Reactor Vessel Level Instrumentation in BWRs (Issue 50) 3.19-1 3.19.1 Issue Description 3.19-1 3.19.2 Safety Significance 3.19-1 3.19.3 Resolution for GESSAR II 3.19-2 3.19.4 References 3.19-2 v
N
r.
NEDO-30670 CONTENTS (Continued)
Page 3.20 SRV Line Break-Inside the BWR Wetwell Airspace of Mark I and II Containments (Issue 61) 3.20-1 3.20-1 3.20.1 Issue Description 3.20-1 3.20.2 Safety Significance 3.20-2 3.20.3 Resolution for GESSAR II 3.20-2 3.20.4 References 3.21 Probability of Core Melt Due to Component Cooling Water 3.21-1 System Failures 3.21-1 3.21.1 Issue Description 3.21-1 3.21.2 Safety significance 3.21-1 3.21.3 Resolution for GESSAR II 3.21-2 3.21.4 References 3.22 Flooding of Safety Equipment Compartments by Back Flow 3.22-1 Through Floor Drains (Issue 77) 3.22-1 3.22.1 Issue Description 3.22-2 3.22.2 Safety Significance 3.22-3 3.22.3 Resolution for GESSAR 11 3.22-4 3.22.4 References 3.23 Beyond Design Basis Accidents in Spent Fuel Pools 3.23-1 (Issue 82) 3.23.1 Issue Description 3.23-1 3.23-1 3.23.2 Safety Significance 3.23-2 3.23.3 Resolution for GESSAR II 3.23-3 3.23.4 References 4-1 4.
SUMMARY
JUU) CONCLUSIONS APPENDICES A.
EFFECTS OF HYDROGEN CONTROL ON THE RISK FROM SEVERE ACCIDENTS A-1 FOR GESSAR II B.
NRC LETTER ON THE STATUS OF GENERIC SAFETY ISSUE A-29 B-1 C-1 C..GE LETTER C0KHENTING ON DRAFT NUREG-0978 vi s
NEDO-30670 TABLES Table Title Page 1-1 Applicable Unresolved Safety Issues 1-3 1-2 Applicable Generic Safety Issues 1-4 2.2-1 Special Engineering Studies 2.2-12 2.2-2 GESSAR II PRA Interdependencies Between Different Systems and Components 2.2-13 2.2-3 Methods Used for Dependent-Failure Analysis 2.2-14 2.2-4 Examples of Initiating Event and Mitigating System Interdependencies 2.2-15 2.2-5
. General Areas of operational Readiness Review 2.2-16 2.2-6 System Interactions from Recent Review 2.2-17 4-1 Summary Status of Unresolved and Generic Safety Issues Resolution for GESSAR 11 4-2 vii/viii t.
NEDO-30670 NOMENCLATURE ac Alternating Current ACRS Advisory Committee on Reactor Safety ADS Automatic Depressurization System AEOD-Office of the Analysis and Evaluation of Operational Data BOP Balance of Plant ASME American Society of Mechanical Engineers
.ATWS Anticipated Transient Without Scram BN1 Brookhaven National Laboratory BWR Boiling Water Reactor CI Condensate Injection CPL Construction Permit CRGR Committee to Review Generic Requirements de Direct Current DEGB Double-Ended Guillotine Break D/G Diesel-Generator ECC Emergency Core Cooling ECCS Emergency Core Cooling System EPG Emergency Procelure Guideline EPRI Electric Power Research Institute ERIS Emergency Response Information System FDA Final Design Approval FMEA Failure Modes and Effects Analysis FW Feedwater GE General Electric Company GSI Generic Safety Issue HCU Hydraulic Control Unit HEC Human Engineering Discrepancy NELB High Energy Line Break HPCS High Pressure Core Spray HVAC Heating. Ventilating and Air Conditioning INPO Institute for Nuclear Power Plant Operations 10RV Inadvertent Open Relief Valve ISI In-Service Inspection ix
NEDO-30670 LER License Event Report IOCA Loss-of-Coolant Accident LLNL Lawrence Livermore National Laboratory
~
LPCI Low Pressure Coolant Injection LPCS Low Pressure Core Spray LRG Licensing Review Group MSIV Main Steam Isolation Valve MSIVLCS Main Steam Isolation Valve Leakage Control System NDE Non-Destructive Test NRC Nuclear Regulatory Commission OL Operating License PARV Power Actuated Relief Valve PCS Power Conversion System PDA Preliminary Design Approval PRA Probabilistic Risk Assessment PWR Pressurized Water Reactor RCP Reactor Coolant Pump RCIC Reactor Core Isolation Cooling RCPB Reactor Coolant Pressure Boundary RHR Residual Heat Removal RPS Reactor Protection System RPV Reactor Pressure Vessel RY Reactor Year SER Safety Evaluation Report SROA Safety-Related Operator Actions j
SRV Safety / Relief Valve SSE Safe Shutdown Earthquake SV Safety Valve TIP Traveling In-Core Probe TMI Three Mile Island USI Unresolved Safety Issue
)
X
NEDO-30670 1.
INTRODUCTION 1.1 RACKGROUND The most recent draft of the NRC's proposed policy on severe accident issues for future _ reactor designs (Reference 1) requires demonstration of technical resolution of all applicable USIs and of the MEDIUM and HIGH priority GSIs. The status and NRC action plans for the USIs are presented in NUREG-0606 (Reference 2). The GSIs are discussed in detail in NUREG-0933 (Reference 3).
Also included in NUREG-0933 d, the prioritization of the'GSIs.
It should be noted that Appendix 1B to CESSAR II contained an assessment
]
of the applicable USIs and formed an information base, considered by the NRC in its review of GESSAR II contained in NUREG-0979 (Reference 4).
It was con-cluded in Reference 4 that the GESSAR Il plant could be operated, without undue
' risk to the health and safety of the public, before final resolution of the nine USIs considered.
To obtain agreement on the specific issues to be considered by GE in the severe accident review, a meeting with the NRC staff was held on May 10, 1984.
At that meeting, the USIs and GSIs were reviewed and discussed relative to GESSAR II, and the specific issues for consideration by GE were defined. The
-list of applicable issues included 7 USIs and 23 GSIs. Those are the issues considered in this report.
The USIs are enumerated in Table 1-1 and the CSIs are contained in Table 1-2 along with their prioritization from NUREG-0933.
1.2 OUTLINE OF REPORT In Sections 2 and 3, the USIs and GSIs are covered, respectively. The format of presentation is the same for both sections. First, a description of the issue is presented. For the most part, this description is excerpted from Reference 3.
Second, the safety significance is addressed, with most of the information also coming from Reference 3.
Finally, the resolution of the issue for GESSAR II is identified. The overall summary and conclusions are presented in Section 4.
1-1
1.3 REFERENCES
1.
NUREC-1070, "NRC Policy on Future Reactor Designs: Decisions on Severe Accident Issues in Nuclear Power Plant Regulation", April 18, 1984 (Draft).
2.
NUREG-0606, " Unresolved Safety Issues Summary", U.S. Nuclear Regulatory Commission, Vol. 6, No. 1, February 17, 1984.-
3.
NUREG-0933. "A Prioritization of Generic Safety Issues", U.S. Nuciear Regulatory Commission, December 1983.
4.
NUREG-0979, " Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design". U.S. Nuclear Regulatory Commission, April 1983.
)
1-2
l NED0-30670 Table 1-1 APPLICABLE UNRESOLVED SAFETY ISSUES Number Title I-l Waterhammer A-17 Systems Interaction A-43 Containment Emergency Sump Reliability A-44 Station Blackout A-45 Shutdown Decay Heat Removal Requirements A-47 Safety Implications of Control Systems A-48 Hydrogen Control
')
i l
l-3
NEDO-30670 Table 1-2 APPLICABLE GENERIC SAFETY ISSUES Priority" Number Title
'A-29 Nuclear Power Plant Design for the Reduction of MEDIUM Vulnerability to Industrial Sabotage A-30 Adequacy of Safety-Related DC Power Supplies HIGH B-5 Ductility of Two-Way Slabs and Shells and Buckling MEDIUM Behavior of Steel Containments B-6 Loads, Load Combinations, Stress Limits HIGH B-10 Behavior of BWR Mark III Containment HIGH B-17 Criteria for Safety-Related Operator Actions MEDIUM B-26 Structural Integrity of Containment Penetrations MEDIUM MEDIUM B-55 Improved. Reliability of Target Rock Safety-Relief Valves HIGH B-56 Diesel Reliability HEDIUM B-58 Passive Mechanical Failures B-61 Allowable ECCS Equipment Outage Periods MEDIUM HICH
.C Main Steam Line Leakage Control Systems C-11 Assessment of Failure and Reliability of Pumps and MEDIUM
~*
Valves MEDIUM 12 BWR Jet _ Pump Integrity HIGH 23 Reactor Coolant Pump Seal Failures HIGH 29 Bolting Degradation or Failure in Nuclear Power Plants l
NOTE 2 40 Safety Concerns Associated with Pipe Breaks in the b
BWR Scram System NOTE 3 41 BWR Scram Discharge Volume Systema
~
NOTE 1 50 Reactor Vessel Level Instrumentation in BWRa MEDIUM SRV Line Break Inside the BWR Wetwell Airspace of 61~
Mark I and II Containments 1-4 i
i-
m.
NEDO-30670 Table 1-2 APPLICABLE GENERIC ISSUES (Continued)
Number Title Priority" 65
. Probability of Core Melt Due to Component Cooling Water HIGH
. Systems Failure 77 Flooding of Safety Equipment Compartments by Back Flow HIGH Through Floor Drains 82 Beyond Design Pasis Accidents in Spent Fuel Pools MEDIUM
- Reference 3 Legend:
High Safety Priority HIGH Medium Safety Priority MEDIUM Possible Resolution Identified for Evaluation NOTE 1 Resolution Available NOTE 2 Resolution Resulted in either the Establishment of New Requirements NOTE 3 or No New Requirements h
1-5/1-6
NEDO-30670 2.
UNRESOLVED SAFETY ISSUES
)
3
)
2.0-1/2.0-2 L
F NEDO-30670 2.1 WATER HAlttER (TASK A-1) 2.1.1 Issue Description Since 1969, there have been over 150 incidents involving water hammers in BWRs and PWRs reported. The water hammers (or steam hammers) have involved steam generator feedrings and piping, the RHR system, ECC and containment spray, service water, feedwater and steam lines. The incidents have been
-attributed to such causes as rapid condensation of steam pockets, steam-driven slugs of water, pump startup with partially empty lines, and rapid valve motion. Most of the damage reported has been relatively minor, involving pipe hangers and restraints; however, there have been several incidents which have resulted in piping and valve damage.
2.1.2 Safety Significance In Reference 1 the value-impact data on the proposed NRC actions relat-ing to water hansner, a risk assessment study was performed to assess the risk significance of' water hammer occurrence with respect'to overall plant risk.
The following bases were incorporated in the analysis:
-1.
Water hammer frequencies were derived from reported occurrences d
2.
Component or system failure models were developed from system assessments 3.
Three specific plants were analyzed, including two BWRs:
l Millstone 1 (BWR/3) and Browns Ferry 2 (BWR/4). These plants were selected as representative of operating BWRs and had PRA models available.
4.
Public dose values were derived using the CRAC code and assuming l
the guidelines and quantities of radioactive isotopes used in i
Reference 2.
Release categories corresponded to the radiological release causes described in Reference 2.
l 2.1-1 i
L
c.
NEDO-30670 5.
Assumptions on meteorology, population density and evacuation are discussed in Reference 1.
The results of the study were noted to be conservative since the assump-tion was made that safety system disablement occurred from a frequency of failure or demand model as derived from reported water hammer events. The results for the BWR were summarized as follows (Reference 1):
"... water hammer effects on BWR risk are negligible, or small..."
No new plant hardware modifications or design changes were recommended as a result of the USI A-1 concluding efforts. As noted in Reference 3, closure efforts for USI A-1 had not identified, at that time, design features or oper-acional measures beyond those planned for implementation in GESSAR II.
This was also the case in the closure for USI A-1 documented in References 1 and 4.
2.1.3 Resolution for GESS AR II The proposed actions identified in Reference 1 for resolution of the water hammer issue have been implemented in the GESSAR II design. These features were identified in Appendix 1B of GESSAR II and noted in Reference 3.
For completeness in the documentation of closure of this issue, the GESSAR II design features addressed in GESSAR II Appendix 1B are repeated in this Subsection.
)
As noted in Reference 3, although a number of water hammer events have occurred, none have caused major pipe failures in a boiling water reactor and non( have resulted in the offsite release of radioactivity. The most severe water hammers observed to date have been in steam generators or isolation condenser piping.
Since the GESSAR II design does not utilize a steam gener-ator or isolation condenser, those worst cases are eliminated. Furthe rmore, any water hammer which may occur in main steam piping will not impair the ECCS since ECCS vater enters the reactor vessel via five separate reactor vessel nozzles independent of main steam piping. The ECCS piping is protected from the effects of water hammer as discussed in the remainder of this subsection.
2.1-2
NED0-30670 To protect the GESSAR II ECCS (CESSAR II. Subsection 6.3.2.2.5) against
~
. the effects of water hammer, the ECC Systema are provided with jockey pumps.
These jockey pumps keep the ECCS lines full of water up to the motor operated injection valves so that the ECCS pumps will not start pumping into voided lines. In addition, to ensure that the ECCS lines remain full, vents have been installed and filling procedures established.
Further assurance for filled discharge piping is provided by pressure instrumentation that is used to initiate an alarm that sounds in the main control room if the pressare falls below a predetermined setpoint, indicating difficulty maintaining a filled discharge line.'
Should,this occur, or if.an instrument becomes inoperable, the required action is identified in the Technical Specification.
To provide additional protection against potential water hammer events in the GESSAR 11 design, piping design codes require consideration of impact
- loads. Approaches used at the design stage include:
(1) avoiding rapid valve operation; (2) piping layout to preclude water slugs in steam-filled lines; (3) use of snubbers and pipe hangers; and. (4) use of vents and drains. The use of snubbers and pipe hangers are a by-product of protection from seismic loads; however, their use helps to mitigate the effects of water hammer events.
In addition, a preoperational vibration and dynamic effects test program will be conducted by the Applicant, in conjunction with GE. in accordance with Standard OH-3 of the ASME for all Class 1. Class 2, Class 3 and other piping systems and piping restraints.
9 These tests will provide adequate assurance that the piping restraints have been designed to withstand dynamic effects due to valve closures, pump trips, and other operating modes.
t Nonetheless, in the unlikely event'that a pipe break did result from a severe water hammer event, core cooling is assured by the ECCS, and protec-t l
tion is provided against the dynamic effects of such pipe breaks inside and outside of containment.
I l'
2.1-3 i
L L_
E NEDO-30670 2.1.4 References 1.
NUREG-0993. "Value-Impact Analysis for USI A-1. Water Hammer " U.S.
Nuclear Regulatory. Commission issued for comment May 1983.
2.
WASH-1400 (NUREG-75/014). " Reactor Safety Study, An Assessment of Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission. October 1975.
3.
NUREG-0979. " Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design." U.S. Nuclear Regulatory Commission. April 1983.
4.
NUREG-0927. Revision 1. " Evaluation of Water Hammer Occurrence in Nuclear Power Plants." U.S. Nuclear Regulatory Commission, March 1984.
h 2.1-4
NEDD-30670 2.2 SYSTEMS INTERA" TION (TASK A-17) 2.2.1 Issue Descy ption Th.i design of a r.ucicar power plant is accomplished by groups of engineers and scientists organized into engineering disciplines and into scientific disciplines. The reviews perfor'aed by the designers include interdisciplinary reviewa to assure the functional compatibility of the plant structures, sys-tems, and components. Safety revices and accident analyses provide further assurance that system functional requirements will be met.
These reviews include it.ilure mode analyses.
The NRC rm,iew and evaluation of safety systems is accomplished in accord-ance w'ith Reference 1 in which primary and secondary review responsibilities are assigned to organizational units arranged by plant systems or by disci-plines. Each element of Reference 1 is assigned to an organizational unit for ptimary responsibilitly and, where appropriate, to other units for secondary responsibilities.
Thus,,the design and analyses by the plant designers, and the subsequent review and evaluation by the NRC staff, take into consideration the inter-disciplinary areas of concern and account for systems interaction to a large extent.
Furthermore, u.!ny of our rogulatory criteria are aimed at controlling the risks from systems interacticns. Examples include the single failure criterion and separation criteria.
A Nevertheless, there is some question regarding the interaction of various plant systems, both as to the supporting roles such systsas play and as to the effect one system can have on other systems, particularly with regard to whether actions or consequences could adversely affect the presumed redundancy and independence of safety oystems.
The problem to be resolved by this task is to identify where the present design, analyais, and review procedures may not acceptably account for poten-tially adverse systems interaction and to recommer.d the regulatory action that should be taken.
2.2-1
f The issue of systems interaction was originally raised because design, construction and operation of nuclear power plants involve many functional i
l specialists (e.g., civil, electrical, mechanical and nuclear engineers); and experience at operating plants raised the question whether the work of these I
specialists is sufficiently integrated to avoid serious adverse interactions (dependencies) among systems that are intended to be independent. Similarly, it was postulated that the review and evaluation of these systems may not have been sufficiently integrated to allow identification of such interactions.
l The ACRS identified a generic need to examine the matter of systems interactions in a letter to L. M. Huntzing dated November 8,1974. The Staff initiated a systems interaction program in May of 1978 with the definition of USI A-17 " Systems Interaction in Nuclear Power Plants." Subsequent events and follow-up actions led to initiation of various programs to investigate the issue.
,t 2.2.2 Safety Significance Many significant events at operating nuclear power plants have been traced to, or postulated to be the result of, a single common cause, as opposed to multiple independent causest as a result, the required independence among the plant safety systems and the interdependence of the safety systems from the non-safety systems has been questioned.
These common characteristics include inherent features such'as single manufacturers, common maintenance practices, and common testing practices.
In addition, earthquakes and floods are recognized common causes.
These common causes have the potential for safety significance if they I
affect several of the multiple systems included in the CgSSAR 11 design which prevent core damage or which mitigate the effects of a severe accident.
Several system interactions have been included in the CgSSAR 11 PRA (CgSSAR II, Section 150.3). These ir.clude the dependencies between the Emergency Diesel Generators and smergency and Service Water Systems on the operation of the gCCS network.
2.2-2 t
s-NED0-30670 T
There are other human dependencies such as transmitter calibration and reason-able operator action which are included in the individual system fault trees and event trees in Appendices C and D in the GESSAR II PRA. Furthermore, a detailed PRA for seismic events which recognized the spacial dependencies on building structural failure was evaluated.
Because of the above reasons, the safety significance of the significant recognized system interactions has been included in the evaluation of plant and public risk in the GESSAR Il PRA. Other system interactions have been and continue to be addressed by the GE design process which deterministically reviews potential adverse system interactions and takes corrective action.
2.2.3 Resolution for GESSAR II Systems interaction is an integral part of the BWR design process which has led to the GESSAR II design. The GE organizational structure for inte-grated system design, design procedures, f eedback of operational experience, and onsite readiness reviews combine to identify and correct potential system interactions which might have a negative impact on plant safety or cause risk to the general public. Although potential system interactions may be identi-fied in the future, the overall des 1'gn process has accounted f or known system
~
interactions to the maxicum extent.
The organizational structure is use'd in the design process to focus the responsibility of all aspects of ecch system design on a Lead System Engineer whose function is to ensure that his system will perform its function under all reasonably expected conditions. In ad'dition, a systems integration func-tion is carried out by sultidisciplined review teams of senior' engineers which l
look for espects of the design which may be subject to common mode failures or adverse intera'ctions between systems. These include such items as duty cycles,
~
environmental controls, seismic response, and system interf. ice requirements.
I The Lead System Engineers must. satisfy the diverse system integration tasks into their designs, including the potential adverse system interactions which may be identified.
l
\\
x-2.2-3
NEDO-30670 Three basic areas contribute to the identification of adverse system interactions:
(1) Experience Reviews. (2) Design Reviews end Special Studies, and (3) Operational Readiness Reviews. The following sections discuss these areas and describe how they have been used or can be used to minimize the occurrences of adverse system interactions in the GESSAR II design considering:
1.
Spacial dependencies 2.
Functional dependencies 3.
Human dependencies
'The result of the application of this design process is the GESSAR II design which is significantly improved, over previous designs, in its con-J leration of potential adverse system interactions.
2.2.3.1 Experience Reviews The experience gained through eventc which have occurred in the oper-ating BWRs is integrated into the design process through several methods.
The LERs and other industry data bases such as the NUCLEAR NETWORK operated by INPO are periodically reviewed and pertinent information distributed to the Lead System Engineers.
Events of major importance such as the fire which occurred at the Brown's Ferry Nuclear Power Plant and which have system intery action implications are given detailed review to determine if there are generic implications that should be considered in the GESSAR II design. Finally, in the periodic design reviews of system designs, GE personnel from plant startup and operating plant services are frequently used to bring operational and human engineering aspects under consideration.
2.2-4
NED0-30670 2.2.3.2' Design Reviews and Special Studies A significant number of special engineering studies have been undertaken in the design of GESSAR II.
These are summarized in Table 2.2-1.
The result of these studies has been a systematic review of specific potential system interactions and consideration of potential adverse consequences in the CESSAR II design.
The CESSAR II design minimizes the likelihood of system interactions due to' spacial causes because of the extent of equipment separation and compart-mentalization which is part of the plant arrangement philosophy. Redundant trains are located in separate compartments and, where separation or compartmentalization were impractical, other methods were employed such as barriers, enclosures, or shields. Consideration of high energy Aine breaks was also considered as the effect on equipment in the vicinity of the break.
Flooding of equipment in the GESSAR II design has also been considered by separation of the equipment with watertight doors. Because of this sepa-ration, any one division may be flooded without affecting the other two divi-sions, which are used for cooling the reactor core. Alarms are also included to alert the operators of room flooding so that they can take action to isolate the source of the flooding.
'Similarly, common cause effects on the important systems due to fires are minimized by the building designs with 3-hr seals, doors, floors, and l
ceilings, noncombustible insulation material, solid steel cable trays and automatic sprinkler systems in heavily cabled areas.
Human actions are considered in the Control Room Design Review cask analysis, especially under severely degraded conditions such as a station
. blackout. The BWR/6 simulator of the Black Fox station was used as a basis to identify such areas as lost instrumentatica during station blackout events, The results are another source for the identification of potential adverse r
system interaction which has been considered in the GESSAR II design.
l-2.2-5
NED0-30670 Two areas (PRAs and FMEAs) deserve special attention because they have been especially useful in evaluating potentially adverse system interactions.
2.2.3.3 Probabilistic Risk Assessment The GESSAR II PRA has evaluated the frequency of core damage events and the offsite consequences of these events for both internal and seismic events.
In the development of the system fault trees, specific system interactAons, such as the dependencies on electrical power, service water, and room cooling, were modeled so that the effects of these interactions were taken into account.
Other system interactions were also considered to the extent that they had been identified. These included dependencies on transmitter calibration pro-cedures, operator actions, and Equipment Out of Service Limiting Conditions for Operation. In the development of these f ault trees, a thorough review of the system dependencies was obtained. As a result, potentially adverse system interactions were identified. Event trees for transients with and without scram, a range of loss-of-coolant break sizes and location, and consideration of prolonged loss of offsite power ensured that a broad range of plant condi-tions was considered during which potentially adverse system interactions l
might have occurred.
f-Components common to more than one safety system were identified in the functional level fault trees by use of the same designator code. The NRC con-tractor in its review of the PRA (Reference 2) identified additional dependen-i>
cies which resulted in less than a factor of 3 increase in core melt frequency above the original GESSAR II PRA value. The small increase in core melt fre-quency which resulted from the thorough independent review demonstrates the adequacy of the modeling of system interactions in the GESSAR II PRA.
l The types of system dependencies (functional dependencies) analyzed in the GESSAR II PRA and how each one was treated are given in Tables 2.2-2 and l
[
2.2-3.
The interdependencies between the initiating event and the mitigating systems used.in the event trees were identified during the process of con-structing and quantifying each event tree. Some examples are given in Table.2.2-4.
2.2-6
NEDO-30670 The identification and quantification of accident sequences in the GESSAR
.II PRA included the following three types of common mode failures:
1.
Common mode failures, 2.
Propagating failures, 3.
Common cause failures.
Each of these failures is described below.
Common mode failures are multiple, concurrent and dependent failures of identical equipment that fails in the same mode (functional dependencies).
In general, multiple component failures (identical equipment) do not occur simultaneously. However, there are some exceptions. The following systems have demonstrated some potential for common mode equipment failures:
1.
Failure of D/G to start and run 2.
Control rod drives 3.
Reactor Vessel Depressurization System 4.
Heat exchanger plugging l
All of.these common mode failures were considered in the GESSAR II PRA.
L Propagating failures (e.g.. fire, flooding, pipe whip and missiles) are failures that cause sufficient changes in operating conditions, environments or requirements to cause other equipment f ailures (spatial dependencies).
l System location and proximity to other systems were analyzed for system L
l l
i I
2.2-7 l
i NEDO-30670 propagating failures. The use of isolation barriers and restraints prevent damage from these failures. System limitations resulting from the failure of another system to perform as required are addressed within the success criteria. The functional level fault trees include the environmental and power support functions for each system.
Common cause failures are multiple equipment / system failures caused by some single cause common to them all.
The following common cause failures were considered in the GESSAR II PRA:
-1.
Common support equipment systems (functional dependencies) including electrical equipment, instrument air, control instrumentation, and service water; 2.
Human-errors (human dependencies) including test and maintenance and instrument calibration.
In their review of the GESSAR II PRA, the NRC contractor (Reference 2) identified the various categories of dependencies and examples of how each was addressed. The various types of dependencies can be classified as:
(1) functional dependencies, (2) physical dependencies, and (3) humanly induced dependencies.
It should be noted that these three types of dependencies are not necessarily mutually exclusive. A finer resolution of them yields the following six categories:
(1) system functional dependencies, (2) system physical dependencies, (3) system humanly induced dependencies, (4) component
. functional dependencies, (5) component physical dependencies, and (6) component humanly induced dependencies.
2.2-8
NEDO-30670 2.2.3.3.1 Systen Functional Dependencies This type of dependence can be characterized by a functional relationship which exists between two or multiple systems.
The GESSAR II PRA addressed this type of dependence in the functional fault tree approach.
2.2.3.3.2 System Physical Dependencies This type of dependence was treated in the GESSAR II PRA. For inscance, the effect of containment failure due to overpressure resulting frou loss of containment heat removal was incorporated in the containment event trees.
The GESSAR II PRA assumed that only a fraction of the containment failures would lead to loss-of-coolant injection to the core. In the event of a station blackout, loss of room cooling was considered.
2.2.3.3.3 System Humanly Induced Dependencies These dependencies were also addressed. These dependencies include cog-nitive errors of the operator; an example included in the analysis is the failure to inhibit ADS in an ATWS event.
Errors of commission were not included in the analysis; however, specific guidance in the EPGs lessen this concern.
2.2.3.3.4 Component Functional Dependencies This type of dependence was partially addressed in the GESSAR II PRA.
.j Implicitly, the PRA assumed that the fault trees were developed up to a point at which no functional dependence exists between the basic events (component f ailures). However, these are treated by the FMEA studies.
L 2.2.3.3.5 Component Physical Dependencies This type of dependency was not addressed in the GESSAR 11 PRA. However, these dependencies are considered in the operational readiness review (sub-section 2.2.3.5).
2.2-9
r NEDO-30670 2.2.3.3.6 Component Human Interaction Dependencies This type of dependency was partially addressed by including in the analysis common mode failures of components due to operator errors during test and maintenance. Failures of multiple components owing to miscalibration were included in the system fault trees.
The NRC contractors changes to the GESSAR 11 fault trees to account for additional dependencies are given in Table 3A.1 of Reference 2.
As noted l
previously, the fact that these changes only resulted in a minor increase (factor of 3) in core melt frequency suggests that system interactions have been adequately assessed in the GESSAR II PRA.
2.2.3.4 Failure Modes and Effects Analysis At a system level somewhat more detailed than system fault trees, 71 FMEAs were conducted of the CESSAR II design. Of these, 32 were identified as required by Regulatory Guide 1.70 Revision 3.
Seventeen of these EiEAs were completed sufficiently to be included in GESSAR II.
The remaining 15 will be completed and documentation will be provided when GESSAR II is referenced in a plant application. These st'udies have been useful in identifying any common cause or unanticipated failures within a system and also in determining the effects of the' loss of interfacing system such as cooling watcr or air supplies.
As a result of the FMEA process, potentially adverse interactions within the system and due to interfacing systems can be identified.
)
2.2.3.5 Operational Readiness Review The completion of a project is accompanied by a plant operational readi-ness review which is conducted by senior engineering personnel to ensure that the plant is ready for operation. The areas of this review are indicated in Table 2.2-5.
In addition to the functional readiness items, the review also
' addresses " System Interfaces and Interac' tion" and " Safety and Reliability"
-items.
2.2-10
NEDO-30670 Applicants are expected to provide for such a systematic visual inspection by a multidisciplinary team to review the "as-built" condition of the plant areas where physical interactions could potentially result in adverse effects on important systems and equipment. These inspections are expected to also consider spatial effects which could become important during or following seismic events or as the result of missiles.
Recent experience at the Kuo Sheng and Grand Gulf sites has confirmed the design adequacy of the BWR/6 Mark III plant. The types of system interactions identified in these reviews are summarized in Table 2.2-6.
Additional readiness reviews are provided for plants in the U.S. by INPO.
These reviews are expected to be an additional means by which potential adverse system interactions may be identified.
2.2.4 References 1.
NUREG-0800, " Standard Review Plan," U.S. Nuclear Regulatory Commission.
N. Hanan, et al., "A Review of BWR/6 Standard Plant Probabilistic Risk 2.
Assessment, Volume 1:
Internal Events, Core Damage Frequency," March 1984'(Draft).
O 2.2-11
NEDO-30670 Table 2.2-1 SPECIAL ENGINEERING STUDIES RCIC/KPCS Suction Crosstie Hydrogen Accumulation Control Room HVAC Chiller Loading Backup Hydrogen Control ATWS Control Room Design Jeview Plant Duty Cycles Foreign Chemicals Intrusion Electrical-Control Systems Failures Pipe Break - Jet Impingement Pipe Break - Compartment Flooding
~
Probabilistic Risk Assessment (FRA)
Failure Mode and Effects Analysis (adEA)
Fire Hazards Analysis Environmental Control Systems Failures Plant Dynamic Loads Missiles I
2.2-12
NEDO-30670 Table 2.2-2 CESSAR II PRA INTERDEPENDENCIES BETWEEN DIFFERENT SYSTEMS AND COMPONENTS Types of Dependent Failures Description / Comment Shared support systems Separate fault trees developed for support systems Intersystem dependencies Common subtrees incorporated within system fault trees using the same identification codes Systems using shared Single component failure affects components multiple systems Component included in each system fault tree using the same identifi-cation code Intercomponent dependencies
- Common cause failures Failures that affect multiple com-ponents at the same time
- Calibration
- Maintenance
- Single common element
'/
Included in each system fault tree using the same identification code
- Common mode failures Concurrent failures of selected identical equipment Included in fault tree 2.2-13
NEDO-30670 Table 2.2-3 METHODS USED FOR DEPENDENT-FAILURE ANALYSIS Method Type of Tree System level Individual system fault tree quantified with and without support system (s)
Functional level Multiple system fault trees linked together with support system (s)
Results converted to event tree success i
logic
- Tree size reduced by combining independent component failures Tree restructured to reduce computer time I
I r
2.2-14
,I
l Table 2.2-4 l
1 i
EXAMPLES OF INITIATING EVENT AND MITIGATING SYSTEM INTERDEPENDENCIES Initiating Event System Limitations Loss of steam to FW pumps and PCS Isolation FW, CI and PCS all unavailable Loss of Offsite Power Power for RCIC room cooling required HPCS dependent on No. 3 D/G Low pressure systems dependent on No. 1 and 2 D/Gs Delayed automatic scram IORV
- RCIC turbine back pressure limited Possible loss of boron concentration FW and PCS unavailable Large LOCA
- RCIC not available l
l r
l l
l 2.2-15 l
l.
4 NEDO-30670 Table 2.2-5 CENERAL AREAS OF OPEFATIONAL READINESS REVIEW ELECTRICAL AC and DC power Systems, Cable and Cable Tray Separations, Standby Power Systems, Grounding Systems MECHANICAL.
Drywell Piping, Containment Piping ECCS Pur p Systems Refueling Systems, HVAC, Maintenance and Service
' INSTRUMENTATION Process Instrumentation, Water Level Measurement.
AND CONTROL Process Radiation Monitoring Area Radiation Monitoring. TIP System. Instrument Calibration, Computer.
.*.ir systems STARTUP, PREOP Procedures Operation and Maintenance Organization
- TESTING AND TRAINING-RADWASTE AND OFFGAS Operability, Maintenance, Reliability WATER CHEMISTRY AND Practices, Procedures Reactor Water, Fuel Pool, HEALTH PHYSICS and Suppression Pool Cleanup Systems SYSTEM INTERFACES Operability, Maintenance, Reliability AND INTERACTION SAFETY AND RELIABILITY Flood, Fire, Spills, Missiles, etc.
LICENSING Applicable Regulatory Body Requirements that are imposed upon the systems.
e 2.2-16
NEDO-30670 Table 2.2-6
~'
SYSTEM INTERACTIONS FROM RECENT REVIEWS Potential interference from debris Personnel exposure / access limitations Arailability of fire protection equipment Instrumentation availability with loss of offsite power Inadvertent suppression pool makeup initiation Curbs for spill control Piping interference Key-lock system rest'rictions Electrical separation violations Equipment. maintainability deficiencies 2.2-17/2.2-18
NEDO-30670 2.3 CONTAINMENT EMERGENCY SIMP RELIABILITY (TASK A-43) 2.3.1 Issue Description f
Following a LOCA in a PWR, water flowing from the break in the primary
- system would collect on the floor of containment. During the injection mode, water for core cooling and containment spray is drawn from a large supply tank.
When the water reaches a low level in the tank, pumps are realigned to draw
- from the containment. This is called the recirculation mode wherein water is
- drawn from the containment floor or surp and pumped to the primary system or containment spray headers. This program addresses the safety issue of adequate sump or' suppression pool. function in the recirculation mode.
It is the objec-tive of this program to. develop improved criteria for design, testing, and evaluation which will-provide better assurance that emergency sumps will func-tion to satisfy system requirements.
The principal concerns are:somewhat interrelated, but are best discussed separately. One deals with the various kinds of insulation used on piping and components inside of containment. The concern being that break-initiated debris from the insulation could cause blockage of the sump or otherwise
~
- adversely affect the operation of the pumps, spray nozzles, and valves of the safety systems.
The second concern deals with the hydraulic performance of the sump as i
- related to the hydraulic performance to safety systems supplied therefrom.
9 Preoperational tests have been performed on a number of plants to demonstrate operability in the recirculation mode.
Adverse flow conditions have been encountered ' requiring design and procedural modifications to eliminate them.
I' These conditions, air entrainment, cavitation, and vortex formation, are aggravated by blockage. If not avoided or suppressed, they could result in pump failure during the long term cooling phase following a LOCA.
The concerns relative to debris, blockage, and hydraulic performance also apply to BWRs during recirculation from the suppression pools.
2.3-1
~
NEDO-30670 2.3.2 Safety Significance Following a postulated LOCA in a BRR/6 Mark III, i.e., a break in the reactor coolant system piping, the water flowing from the break would be 1
1 r
collected in the region below the reactor inside the weirwall. The water l
level would eventually reach the top of the weirwall allowing the water to spill over into the suppression pool. This water would be recirculated through the reactor system by the ECCS pumps to maintain core cooling. Loss of the 4
)
ability to draw water from the suppression pool could disable the ECCS pumps.
TheLNRC concern addressed by Task A-43 as it applies to boiling water reactors is primarily focused on the potential for degraded ECCS performance as a result of thermal insulation debris that may be blown from pipes in the drywell and by some means get into the suppression pool during a LOCA, causing blockage of the pump suction lines. A second concern is potential vortex formation above the pump suctions and subsequent loss of net positive suction head to the ECCS pumps.
The NRC is investigating the potential for debris from insulation causing blockage of the ECCS pump strainers. The NRC investigation includes analysis of plant specific designs and the types of insulation used. Also, the NRC had conducted full-scale containment emergency sump hydraulic tests at Alden Research Laboratory. The NRC's evaluation of the potential for void formation indicates that there is a much lower level of air ingestion due to vortex formation than previously hypothesized by the NRC. The NRC has also found that up to 2 to 4% air void can be accommodated without significantly degrad y ing pumping capacity. The technical findings relative to USI A-43 are con-tained in Reference 1.
In the GESSAR II PRA (CESSAR II, Section 15D.3) the potential for block-age of suction lines was included explicitly in the fault trees for the core cooling systems. The following table provides the figure number and page number where screen blockage is included in the system fault trees.
2.3-2
h NEDO-30670 Fault Trees System Figure Pm HPCS D2-1 15D.3-409/6 RCIC D2-2 15D.3-419/9 LPCS D2-4 15D.3-449/1 LPCI D2-5 15D.3-459/5 RHR D2-8 15D.3-465/6 There has been no attempt to separate the impact of screen blockage from
-the total PRA results to determine its risk significance.
However, based on a cursory review of the quantified fault trees, that element is not of overriding importance. This is primarily due-to the design features of the suction strainer design and location as noted in Subsection 2.3.3.
2.3.3 Resolution for GESSAR II In both GESSAR II Appendix ~1B and Reference 2, the design features of the GESSAR II ECCS intakes were highlighted as reasons why degraded pump perform-ance due to blockage of pump suction lines would not be expected. The follow-
.ing paragraph is from Reference 2.
With regard to potential blockage of the intake lines, the likeli-hood of any insulation being drawn into an emergency core cooling system pump suction line is very small. The potential debris in the drywell could only be swept into the suppression pool through the horizontal vents. Any pieces reaching the pool would tend _to settle.on. the bottom and would not be drawn into the pump suction because the suction centerline is 10 ft above the pool bottom. -In addition, boiling water reactors employ strainers on the suction with flow areas 200% larger than the suction piping.
With regard to the concern of possible vortex formation, the substantial
-depth of the suppression pool and the low approach velocities negate adverse flow conditions.
In addition, concerns are reduced because of the availability of the Suppression Pool Makeup System.
2.3-3
NEDC-30670 Based on the evaluation of the GESSAR II design contained in the PRA, which included operability of ECCS pumps under potential suction line block-ages, it is concluded that the GESSAR II design features resolve the BWR issues contained in USI A-43.
2.3.4 References 1.
NUREG-0897, " Containment Emergency Sump Performance," U.S. Nuclea-Regulatory Commission, issued for comment April 1983.
2.
NUREG-0979, " Safety Evaluation Report Related to the Final Design
-Approval of the GESSAR II BWR/6 Nuclear Island Design " U.S. Nuclear Regulatory Commission, April 1983.
.)
l i-P I
i t
2.3-4 l.
~
.~
NEDO-30670 2.4 STATION ' BLACKOUT (TASK A-44) 4 2.4.1 Issue Description Electric power for safety systems at nuclear power plants is supplied by two redundant and independent divisions. Each of these electrical divisions includes an offsite ac source, an onsite ac source (usually diesel-generators),
and a de source. Appendix A to 10CFR50 defines a total loss of offsita power as an anticipated occurrence and, as such, it is required that an independent 4
emergency onsite power supply be provided at nuclear power plants.
The unlikely, but possible loss of ac power (that is, the loss of ac power from the offsite source and from the onsite source) is referred to as a station blackout.
In the event of a station blackout, the capability to cool the reactor core would be dependent on the availability of systems which do not
. require ac power supplies, and on the ability to restore ac power in a timely The concern is that the occurrence of a station blackout may be a manner.
relatively high probability event and that the consequences of this event may be unacceptable; for example, severe core damage may result.
ji 2.4.2 Safety Significance This. issue arose because of operating experience regarding the
. reliability of ac power supplies. A number of operating plants have exper-lenced a total loss of offsite electrical power, and more occurrences are
.)
expected in the future. _ During each of these loss-of-offsite-power events, the.onsite emergency ac power supplies were available to supply the power needed by. vital safety equipment. However, in some instances, one of the redundant 'energency power supplies has been unavailable.
In addition, there have been numerous reports of emergency diesel-generators f ailing to start and run -in operating plants during periodic surveillance tests.
2.4-1
~
NEDO-30670 A loss of all ac power was not a design basis event for the GESSAR 11 Nuclear Island. Nonetheless, a combination of design, operating, and testing requirements has been imposed to ensure that GESSAR II will have substantial resistance to a loss of all ac power and that, even if a loss of all ac power should occur, there is reasonable assurance the core will be cooled. These design, operating, and testing requirements are discussed in this subsection.
A loss of offsite'ac power involves a loss of both the preferred rad backup sources of offsite power. The NRC staff's review and basis for acceptance of the design, inspection, and testing provisions for the offsite power system will be described in Section 8.2 of the SER on the FSAR refer-encing GESSAR II.
If offsite ac power is lost, three diesel generators and their associated distribution systems will deliver emergency power to safety-related equipment.
The Staff's review of the design, testing, surveillance, and maintenance pro-visions for the onsite emergency diesels is described in Section 8.3 of Refer-ence 1.
Staff requirements include preoperational testing to ensure the reliability of the installed diesel-generators.
If both offsite and onsite ac power are lost. BWRs may use a combination of SRVs and the RCIC System to remove core decay heat without reliance on ac Power. These systems ensure that adequate cooling can be maintained for at
' least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which allows time for restoration of ac power from either off-site or onsite sources.
j The loss of ac power for a period of time exceeding 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> has been analyzed in the GESSAR II PRA (GESSAR II Section 15D.3). Although this event was found to be a dominant contributor to core damage probability, the fre-quency and consequences of the event are very low and do not represent an unacceptable risk.
Further, GE has performed an analysis subsequent to the PRA which evaluated the capability of the GESSAR II design and found that the actual plant capacity 2.4-2
NEDO-30670 was between 6 to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, rather than the 2-hr capability assumed in the PRA.
For these reasons, it can be concluded that station blackout does not repre-sent a significant safety concern for the GESSAR II design.
Task A-44 involves a study of the following elements.
First, the NRC, through technical assistance contracts, is evaluating the expected frequency and duration of offsite power losses at nuclear power plants. Next, an esti-mation of the reliability and an evaluation of the factors affecting the reliability of onsite emergency ac power supplies will be conducted. The risks to the public posed by station blackout events will then be evaluated.
From the preceding information, the NRC plans to assess the effectiveness of safety improvements which they perceive may reduce public risk from station blackout events.
The issue of station blackout was considered by the Atomic Safety and Licensing Appeal Board (ASLAB-603) for the St. Lucie No. 2 facility.
In addition, in view of the completion schedule for Task A-44 (October 1982), the Appeal Board recommended that the Commission take expeditious action t~o accom-modate a station blackout event. The Commission has reviewed their recommendations and determined that some interim measures should be taken at all facilities while Task A-44 is being conducted. A review and prompt implementation, as necessary, of emergency procedures and a training program for station blackout events was requested in NRC Generic Letter 81-04.
Consequently, interim emergency procedures and operator training for safe oper-ation of the facility and restoration of ac power will be implemented by all operating reactors and by Applicants before their fuel load date, which will'#
supplement the existing set of emergency procedure guidelines.
2.4.3 Resolution for GESSAR 11 The GESSAR II design includes redundant power supply systems to provide protection against the loss of offsite power. This includes,three ac and four de onsite power supply divisions.
2.4-3
NEDO-30670 A loss of all ac power is not a design basis event for CESSAR II.
The probability of any long-term " station blackout" event is extremely low.
Loss of offsite power events, if they occur, have a high probability of being short-term in nature. Nonetheless, a combination of design, operating, and testing requirements has been imposed to assure that a loss of all alternating current is highly improbable. This includes provision of three emergency diesels.
Even if a loss of all alternating current should occur, there is reasonable assurance that the core will be cooled by the RCIC System, c steam powered de controlled system. These design, operating, and testing requirements are discussed in this subsection.
In addition, dual transmission systems supply each divisional bus, and only one power source is required to provide ac power for shutdown cooling systems.
If offsite ac power is lost, three diesel-generators and their associated distribution systems will deliver emergency power to safety-related equipment.
The design, testing surveillance, and maintenance provisions for the onsite emergency diesels are described in GESSAR II, Sections 8.3.1.1 and 9.5.
The requirements include preoperational testing to assure the reliability of the diesel-generators.
In the unlikely event that both offsite and all three onsite ac power sources are lost, the GESSAR II design uses a combination of SRVs and the RCIC System to remove core decay heat from the reactor vessel without reliance on ac power. The GESSAR II suppression pool has a large passive decay heat storage capability which allows the operator to concentrate on the restoration of power to injection systems by manual means and to take other '"
corrective actions. During station blackout, adequate core cooling can be maintained by the RCIC System for more than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during which time ac power from either offsite or onsite sources can be restored.
In addition, the station blackout event is treated in the GESSAR II PRA.
The overall PRA results (core damage and subsequent risk to the public),
including the risk due to loss of offsite power initiated events are extremely low and well within the currently proposed NRC safety goals.
2.4-4 i
)
NEDO-30670 Subsequent to the submittal of the GESSAR 11 PRA, a study of the realistic capability of the CESSAR II design for prolonged station blackout was performed. The results of that study indicate a station blackout capa-bility exceeding 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> is possible, assuming credit for straightforward operator actions and potential design improvements. Therefore, should a requirement for a longer than 2-hr capability be imposed, the design could meet it.
Therefore, based on the existing capability of the GESSAR II design with respect to station blackout, it is concluded that there is reasonable assurance A
that the plant can be operated without endangering the health and safety of the public.
2.4.4 References 1.
NUREG-0979, " Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design," U.S. Nuclear Regulatory Commission April 1983.
.h 2.4-5/2.4-6
NEDO-30670 2.5 SHUIDOWN DECAY HEAT REMOVAL REQUIREMENTS (TASK A-45) l 2.5.1 Issue Description
'Although many improvements to the steam generator auxiliary feedwater system were required of the reactor manufacturers by the NRC following the TMI-2 accident, the NRC staff feels that providing an alternative means of decay heat' removal could substantially increase the plants' capability to deal with-a broader spectrum of transients and accidents and potentially could, therefore, significantly reduce the overall. risk to the public. Consequently.
Task A-45 will investigate alternative means of decay heat removal in PWR plants, including, but not limited to the use of existing equipment where possible. The USI will also investigate the need and possible design requirements-for improving reliability of decay heat removal systems in lBWRs.
The overall purpose of Task A-45 is to evaluate the adequacy of current licensing design requirements, to ensure that nuclear power plants do not pose an unacceptable risk as the result of failure to remove shutdown decay heat.
The objective will be to develop a comprehensive and consistent set of shut-
- down cooling requirements for existing and future LWRs, including the study of alternative means of shutdown decay heat removal and of diverse " dedicated" systems for this purpose.
The main objectives of the program are as follows:
.)
1.
Determine the safety adequacy of decay heat removal systems in existing power plants for achieving both hot shutdown and cold shut-down conditions.
i 2.
Evaluate the feasibility of alternative measures for improving
~
decay heat removal systems, including diverse alternatives dedi-cated to the decay heat removal function.
2.5-1
\\
i l
NEDO-30670 3.
Assess the value and impact of the most promising alternative measurements.
4.
Develop a plan for implementing any new licensing requirements for decay heat removal systems.
2.5.2 Safety Significance i
Following a reactor shutdown, the radioactive decay of fission products 1
I continues to produce heat (decay heat) that must be removed from the primary system. The principal means for removing this heat in a BWR while at high pressure is through the steamlines to the turbine condenser. The condensate l
is normally returned to the reactor vessel by the feedwater system; however, the steam turbine-driven RCIC System is provided to maintain primary system inventory if ac power is not available. When the system is at low pressure, the decay heat is removed by the RHR System. Work on this USI will evaluate the benefit of providing an alternate means of decay heat removal which could sub-stantially increase the plant's capability to handle a broader spectrum of transients and accidents.
The GESSAR II reactor has various methods for removal of decay heat.
As discussed above, the decay heat is normally rejected to the turbine condenser, ai.d condensate is returned to the vessel by the feedwater system. The RCIC System provides an alternate means of supplying makeup water to the vessel.
This turbine-driven pump takes suction from the RCIC storage tank and pumps,,
to the vessel.
If the condenser is not available (for example, loss of off-site power), heat can be removed by means of the SRVs to the suppression pool.
Also, high-pressure core spray is provided if the RCIC System is not available.
If the RCIC and high-pressure core spray are unavailable, the reactor system pressure can be reduced by the ADS so that cooling by the residual heat removal system can be initiated. When the condenser is not u' sed, the heat rejected to the suppression pool is subsequently removed by the RH2 System.
2.5-2
NEDO-30670 The RCIC and HpCS systems in GESSAR II have improvements ever comparable systems at, older BWRs. The RCIC has been upgraded to safety-grade quality (now required for all BWRs), and the high-pressure core spray is powered by its own dedicated diesel, so it can operate with an assumed loss of all other sources of ac power. Also, the RHR System contains three pumps; the flow capacity of any single pump is sufficient to easily remove the decay heat.
The quantitative evaluation of the safety significance of the loss of decay heat remova1' capability is given in the GESSAR II PRA (GESSAR II, Section 15D.3).
Based on this assessment, the present design provides sufficient capability such that the contribution to risk from loss of decay heat removal is less than 1% of core danage frequency. Therefore, this issue has little safety significance'in the CESSAR 11 design.
TaskLA-45 is designed.to investigate the need and possible design require-ments for improving the reliability of decay heat. removal systems. The over-all purpose is e,o evaluate the adequacy of licensing design requirements, in order to ensure that nuclear power plants do not pose an unacceptable risk
. due to failure to remove shutdown decay heat. The NRC staff perceives that an alternate means 'of decay heat removal may increase the plants' capability to deal with a broader spectrum of transients and accidents.
The NRC objective is to develop a comprehensive and consistent set of sbutdown cooling cequirements, including the study of a'lternative means of shutdown decay heat removal and of diverse systems for this purpose.
.)
The study will consist of a generic system evaluation and will result in repommendations regarding possible design requirements for improvements in existing systems. Also, an alte'rnative decay heat removal method may be
,, considered if it is evaluatt.d to significat.tly reduce the overall risk to the public.
-2.5-3
-m v,m-
,v q
c-o c--
,w on---
w w
>-we,m memm'
~
er
. - = _ - -.. _ - -
NEDO-30670 Following the TMI accident, GE and the BWR Owners' Group performed and documented extensive analyses of feedwater transients and small-break LOCAs to support acceptability of current designs including the BWR/6. A report of these analyses was provided to the NRC (Reference 1).
As documented in Reference 1 adequate core cooling can be assured by the many diverse inventory maintenance and decay heat removal paths for a wide range of transients and accidents.
~2.5.3 Resolution for GESSAR II The GESSAR II design includes several alternative means for the removal of decay heat. The decay heat is normally rejected via the PCS. This includes the supply of steam to the main turbine, heat being removed in the main condenser and condensate returned to the vessel by the feedwater system.
If. the condenser is not available, the SRVs operate in either an automatic or manual mode to discharge heat to the suppression pool with any of 13 pumps available to make up the subsequent loss in water inventory; the pool cooling system is operated to transfer this heat to the ultimate heat sink. Under normal shutdown conditions, the RHR System is effective in removing decay heat.
During abnormal shutdown conditions, the water level in the RPV can be raised to flood the steam lines and decay heat can be removed via an SRV to the suppression pool and then transferred to the ultimate heat sink by use of the pool cooling system. These decay heat removal and inventory makeup systems are summarized in GESSAR 11. Section 15D.2 and are described in detail in GESSAR II.-Sections 5.4 and 6.3.
The GESSAR II PRA (CESSAR II, Section 15D.3) results indicate that the loss of long-term decay heat removal is not a dominant event, in fact it con-tributes less than 1 percent of the core damage frequency and risk. Conse-quently, improvements in the decay heat removal function would not significantly reduce the overall risk to the public.
In addition, Reference 2 concludes that modifications related to improving decay heac removal are not cost beneficial.
in the GESSAR design.
2.5-4
kEE MhM s
NEDO-306io However, Reference 2 also concludes that if any modification is to be inplemented, addition of the Ultimate Plant Protection System (UPPS) provides the.grestest risk reduction and lessens ttie importance. of many of the USI's (including A 45) and GSI's.
As described by Reference, 3, UPPS is one of the recent modifications reade,to the CESSAR II design. This system is to be used during extended station blackout. It is composed of diesel driven fire pumps, fire truck or other pumping capability outside the containment-linked with a system of pfping which will remotely depressurize the reactor and permit core cooling for an indefinite period'of time. No conventional controls, ac power, de power, or other systems are required for this operation. The containment vent is an intpgral part of UPPS.
In the event of the loss of RHR or other means of heat renoval, the suppression pool can be utilized to stcre large quantities of heat. In order to enhance the effectiveness, the containment can be vented by the' operator using Emergency Procredure Guldelinen. Further-more, for -postulated severe accidents given the filtering capability of the pool there shod 1d be no concern for exposing the public to radiation hazard.
This containment venting capability provides both heatsremoval and means for
~
protecting the containnnnt from overpressure.
In sum: nary, it can be concluded 'that this issue has been resolved for GESSAR II for the following reasons-7 1.
The GESSAR II design already inc. des several alternate means for the removal of decay heat.
2.
The GESSAR II PRA results indicate that the J-kng-term decay heat' removal is not a dominant eve
..v -
utes <l% of
-core damage frequency and risk).
3.
The UFPS, which has recently been added to the GESSAR II design
~
adds still another alternate means for the removal of decay heat.
2.5-5
NEDO-30670 2.5.4'. References
- 1.
NEDO-24708A, " Additional Information Required for NRC Staff Generic
, Report on Boiling Water Reactor 5." Revision 1. General Electric Company.
December 1980.
2.
NEDE-30640, " Evaluation of Proposed Modifications to the GESSAR II Design," General Electric Company, June 1984.
~ 3.
Letter for J.C. Ebersole from G.G. Sherwood, "GESSAR New Design Changer,"
June 28, 1984 1
0 e
2.5-6~
~
s
NEDO-30670 2.6 SAFETY IMPLICATIONS OF CONTROL SYSTEMS (TASK A-47) 2.6.1 Issue Description This issue concerns the potential _for accidents or transients being made more severe as a result of control system f ailures or umlfunctions. These f ailures or malfunctions may occur independently or as a result of the accident or transient under consideration and would be in addition to any contrel system failure that may have initiated the event. Although it is generally believed
-that control system failures'are not likely to result in loss of safety tunc-
~
'tions which 'could lead to serious events or result in conditions that safety systems are not able to cope with, in-depth studies have not been per' formed to support this belief. The potential for an accident that would affect a particu-lar control system and the ef fects of the control system f ailures will dif f er from plant to plant. Therefore, it is not likely that it will be possible to develop generic answers to these concerns, but rather plant-specific reviews will be required. The purpose of this USI is to define generic criteria that may be used for plant-specific reviews. A specific subtask of this issue will be to study the steam generator overfill transient in PWRs and the reactor overfill transient in BWRs to determine and define the need for preventive and/
or mitigating design measures to accommodate this transient.
2.6.2 Safety Significance AsnotedinSubsection2.6.1,thisissueisconcernedwiththepotentiag for transients or accidents being made more severe as a result of control system failures or malfunctions.
.One concern is the potential for a single failure such as a loss of power supply, short circuit, open circuit, or sensor failure to cause simultaneous malfunction of several control features. Such an occurrence could conceivably result in a transient more severe than those transients analyzed as anticipated operational occurrences.
2.6-1
NEDO-30670 A second concern is for a postulated accident to cause control system failures which would make the accident more severe than that which is analyzed.
Accidents could conceivably cause control system failures by creating a harsh environment in the area of the control equipment or by causing damage to the control equipment. Although it is generally believed that such control system failures would not lead to serious events or result in conditions that safety systems cannot safely handle, in-depth studies have not been rigorously per-formed to verify this belief. The potential for an accident that would affect a particular control system, and effects of the control system failures, may differ from plant to plant.
Also noted in Subsection 2.6.1, the NRC believes it is not possible to develop generic answers to these concerns, but rather plant-specific reviews are required. Also, a specific subtask of the NRC activities will be an NRC evaluation of the reactor overfill transient for BWRs to determine the need for preventative or mitigative design measurcs to accommodate this transient.
2.6.3 Resolution for GESSAR II GESSAR II Appendix 1B and Reference 1 provided information on the closure of this issue for GESSAR II.
The GESSAR II safety systems have been designed with the goal of ensuring that control system failures (either single or multiple) will not prevent automatic or manual initiation and operation of any safety system equipment required to trip the plant or to maintain the plant in a safe shutdown condi)
This has tion following any anticipated operational occurrence or accident.
been accomplished by either providing indapendence between safety-and nonsafety-grade systems.
These devices preclude the propagation of nonsafety-grade system equipment faults so that operation of the safety-grade system equipment is not impaired.
A wide range of bounding transients and accidents is presently analyzed in a conservative manner to ensure that postulated events would be adequately mitigated by the safety systems. Systematic reviews of safety systems have been performed with the goal of ensuring that control system failures (single 2.6-2
.c.
NEDO-30670 or multiple) will not defeat safety system function. Specifically, these reviews include identification and evaluation of the potential adverse effects on plant safety as a result of control system failures, effects from loss of non-Class 1E power sources, and harsh environments following high energy line breaks. A systenatic evaluation of the control system design, such as con-templated by the NRC for this USI, has not been performed to determine whether
. postulated accidents could cause significant control system failures which would make the accident consequences more severe than presently analyzed.
However, the fault. trees utilized in the PRA (CESSAR II Section 15D.3)- did account for control system failures. More details on the interaction of control system failures and the impact on potential severe accidents is pro-vided in Subsection 2.2.3.3.
As noted in Reference 1, GE was requested (NRC Information Notice 79-22,
" Qualification of Control Systems," September 17, 1979) to review the possi-bility of consequential control system failures that exacerbate the effects of HELBs and adopt new operator procedures, where needed, to ensure that the postulated events would be adequately mitigated. As part of the review, the NRC staff is also evaluating the qualification program to ensure that equip-ment that may potentially be exposed to HELB environments has been adequately f
qualified or that an adequate basis has been provided for not qualifying the f
equipment to the limiting hostile environment.
The Staff's evaluation of the GE response to Information Notice 79-22 and the adequacy of the qualification program are reported in Sections 7.7.2.1 and 3.10 of Reference 1, respectively.
With the recent emphasis on the availability of post-accident instrumen-tation (Regulatory Guide 1.97, " Instrumentation for Light-Water-Cooled Nuclear Power P1&nts to Assess Plant Conditions During and Following an Accident"),
the staff reviews evaluate designs to ensure that control system failures t
will not deprive the operator of information required to maintain the plant in a safe shutdown condition after any anticipated operational occurrence or accident. General Electric was asked to evaluate the GESSAR II control sys-tems and identify any control systems whose malfunction could impact plant safety. General Electric was asked to document the degree of interdependence of these identified control systems and identify the use (if any) of common power supplies and the use of common sensors or common sensor impulse lines i
2.6-3 i
NEDO-30670 whose failure could have potential safety significance. Yhe status of these reviews and the Staff's evaluation are documented in Section 7.5.2.2 of Reference 1.
In addition, IE Bulletin 79-27 (" Loss of Non-Class 1E Instrumentation and Control Power System Bus During Operation," November 30, 1979) was issued to the Applicant, requesting-that evaluations be performed to ensure the adequacy of plant. procedures for accomplishing shutdown on loss of power to any elec-trical bus supplying power-for instruments and controls. The results of that review are documented in Reference 1, Section 7.5.2.4.
i~
With regard to the subtask of this issue concerned with reactor vessel overfill transients, a few early operating BWRs have experienced reactor vessel overfill transients with subsequent two-phase or liquid flow through the SRVs.,
Following these early events, commercial-glade high-level trips (Level 8) have been installed in most BWRs including the GESSAR II design to terminate flow from the appropriate systems. Periodic surveillance testing of these high level trips is required by the Technical Specifications. No overfilling events have occurred since the Level 8 trips were installed. High level trips are also provided for the RCIC and HPCS Systems. In addition, the GESSAR II dssign employs a high'1evel scram that reduces the consequences of an overfill event.
f on the basis of the information provided herein, it is concluded that the-technical information for resolution of this issue for GESSAR II has been g
provided.
.2.6.4.
References l
l 1.
NUREG-0979, " Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design," U.S. Nuclear L
Regulatory Commission, April,1983.
t I
2.6-4
,v NEDO-30670 2.7 HYDROGEN CONTROL (TASK A-48) 2.7.1 Issue Description Postulated reactor accidents which result in a degraded or melted core can result in generation and release to the containment of large quantities of hydrogen. The hydrogen is formed from the reaction of the zirconium fuel cladding with steam at higher temperatures and/or by radiolysis of water.
Experience gained from the TMI-2 accident indicates that the NRC may w&nt to require more specific design provisions for handling larger hydrogen releases than required by current regulations, particularly for smaller, low pressure containment designs.
The scope of this USI is limited to the generic resolution of hydrogen control and equipment qualification for ice condenser and BWR containments.
2.7.2 Safety Significance The GESSAR II design includes features which provide an extremely high level of protectiot, against the generation of hydrogen. The Mark III contain-ment also contains design features with the capability to mitigate the con-sequences of hydrogen generation, in the unlikely event it occurs. To prevent the generation of hydrogen, the design provides diverse and redundant water delivery systems capable of preventing core damage (GESSAR 11 Section 15D.2). To provide continued protection for the public if large amounts of hydrogen were to be generated, the Mark III containment is expected to maintain its fission product retention functions (CESSAR II Section 15D.2).
Therefore, additional hydrogen control systems will not significantly improve the safety of the plant.
2.7-1
- - - - - - - - - - _ _ - - -. _ _ _ - _.. - ~ _ _ _ _ _ _. _ _
m m m m..
I i
NED0-30670 In Task A-48, the NRC will investigate the means to predict the quantity and rate of hydrogen generation during degraded core accidents. In addition, the NRC will examine various means to cope with large releases of hydrogen to the containment, such as inerting the containment or controlled burning.
The potential effects of proposed hydrogen control measures on safety, including the effects of hydrogen burns on safety-related equipment, will also be investigated.
Because of the potential for significant hydrogen generation as the result of an accident, 10CER Section 50.44, " Standards for combustible Gas Control System in Light Water Cooled Power Reactors," and Criterion 41 of the General Design Criteria, " Containment Atmosphere Cleanup," in Appendix A to 10CFR Part 50, require that systems be provided to control hydrogen in the contain-ment atmosphere following a postulated accident to ensure that containment integrity is maintained.
The current regulation,10CFR Section 50.44, requires that the combustible gas control system be capable of handling the hydrogen generateu as a result o'f a design basis LOCA. To provide margin, the assumed hydrogen release is five times the amount calculated in demonstrating compliance with 10CFR Section 50.46 or the amount corresponding to reaction of the cladding to a depth of 0.00023 inch, whichever amount is greater.
The accident at TMI-2 on March 28, 1979, resulted in hydrogen generation well in excess of the amounts specified in 10CFR Section 50.44.
As a conse-quence, the NRC concluded that additional design measures may be needed for handling larger hydrogen releases. As a result, the Commission determined that a rulemaking proceeding should be undertaken to define the manner and extent to which hydrogen evolution and other effects of a degraded core need to be taken into account in plant design. An advance notice of the rulemaking proceeding on degraded core issues was published in the Federal Register on October 2, 1980.
2.7-2
c-NEDO-30670 Recognizing that a number of years may be required to complete this rule-making proceeding, a set of short-term or interim actions relative to hydrogen control requirements was developed and implemented. These interim measures were described in a second October 2, 1980 Federal Register notice.
For plants with Mark III containments, such as GESSAR II, the proposed interim ' rule specified that either (1) it must be demonstrated that the con-Y tainment can withstand hydrogen burns or explosions, or (2) a detailed evalu-ation of possible hydrogen control measures must be performed and the selected
. measures installed.
deneral Electric, as well as other industry groups, has evaluated various methods of hydrogen control and have concluded that the viable options are
' post-accident inerting and distributed ignition systems. General Electric has completed analyses of the benefit of such systems and shown that little improvement in safety can be gained by addition of these hydrogen control systems to the GESSAR II design. A discussion of these evaluations is given in this subsection.
'2.7.3. Resolution for GESSAR II The GESSAR II PRA (CESSAR II, Section 15D.3) demonstrates that the risk from the severe accidents considered is extremely low relative to the proposed NRC safety goals and, therefore, there would be insignificant risk reduction achieved through the utilization of additional hydrogen control systems. First, the PRA shows that core uncovery and subsequent metal water reac+1on for any sequence is highly improbable. Second, the PRA shows that even for the few events where the accident prevention systems are postulated to fail and significant amounts of hydrogen are evolved, the drywell and suppression pool will remain in place so the fission products will be directed to the pool. Finally, suppression pool scrubbing tests performed by GE (CESSAR II, Section 15D.2) demonstrate the high efficiency of the suppression pool in retaining fission products. These findings all contribute to the final
.PlVL conclusion that the GESSAR II design provides the public with in-depth protection from hydrogen generation events.
2.7-3
EEDO-30670 As discussed before, the GESSAR Il PRA demonstrated that core uncovery and any subsequent metal water reaction for any sequence is highly improbable.
However, for the purpose of evaluating the consequences of such hypothetical accidents, estimates were made of the time dependent hydrogen generation for each accident sequence. For the various generation rates and ignition times, the probability of hydrogen combustion or detonation was then assessed.
Several conclusions can be drawn from the analysis results. There is a high probability that the multiple ignition sources already present in the contain-ment would lead to hydrogen combustion before the detonation limit is reached.
For many hydrogen combustion events, containment integrity would be expected to be maintained. Low concentration hydrogen combustion could potentially result in static overpressurization and loss of primary containment integrity for a few events, but will not affect the drywell and supprer.sion pool integrity. The remote possibility of hydrogen combustion or detonation has little ef fect on the public risk since the containment function is still maintained by the drywell and suppression pool in nearly all cases.
The GESSAR II design employs a unique multi-building, multi-barrier con-tainment. The reactor vessel is enclosed in a strong steel and concrete drywell which is surrounded by the pressure suppression pool. These structures are fully enclosed in a large, strong containment building and a shield building which form a second and third barrier.
Containment function refers to either maintaining primary containment structural integrity cg; maintaining the fission product retention mechanisms.
Analyses performed in support of the GESS AR 11 PRA demonstrated that the drywell and suppression pool integrity will be maintained in most cases.
Therefore, potential radiological releases are expected to pass through the suppression pool before reaching the containment building. The suppressio,.
pool effectively retains halogens and particulate fission products as demon-strated by the GE suppression pool scrubbing tests (GESSAR II, Section 15D.2).
2.7-4 s.
mm o
NEDO-30670 In addition to suppression pool scrubbing, fission products are further retained by containment sprays and natural plate-out mechanisms.
Thus, it is concluded that the GESSAR II design is highly capable of preventing the generation of hydrogen, or mitigating the consequences of its presence in the unlikely event is is generated.
Two evaluations were performed to quantify the benefit of additiodal hydrogen control. One evaluation assumed an accident which involved restora-tion of core cooling af ter significant hydrogen generation, but prior to RPV melt-through.
The second evaluation assumed a full core-meltdown and loss of containment integrity from non-condensible gases generated during core-concrete reaction.
In the second case, a " perfect" hydrogen control system was assumed available.
The assumptions made on the functional capabilities of the proposed hydrogen control system were as follows:
1.
Syutem_ reliability = 1.0 (i.e., the system always worked) 2.
Loss of containment integrity by hydrogen combustion or detonation was eliminated.
3.
Loss of drywell integrity by hydrogen combustion or detonation was eliminated.
4.
The system had nc adverse impact on the accident sequence (no addition of heat to containment; no additional pressure increase due to system operation).
2.7-5
NEDO-30670 The measure of risk was the latent fatality risk and man-Rem exposure results since hydrogen control has no effect on core damage probability or acute fatalities. The' analyses are described in Appendix A.
The results of this analysis show that the man-Rem exposure from an accident with partial core-meltdown and early loss of containment integrity are insignificant in terms of public risk. The man-Rem exposure is equivalent to 3% of the annual background radiation exposure to the population near (within 50 miles) the plant. For the full range of accident sequences, the maximum risk reduction is 0.14 man-Rem per reactor year. Therefore, it can be concluded that in an
~
-absolute or relative-sense, the GESSAR II risk is so low that any additional modifications to decrease the risk are not warranted.
Although GE is convinced that additional hydrogen control systems are clearly not worth while, the GESSAR II design does comply with the CP/ML Rule
- (10CFR50.34 (f)). The following summarizes the GESSAR II compliance with the hydrogen control portions of the CP/ML Rule:
1.
- CP/ML Item (1) (xii), Evaluation of Alternative Hydrogen Control
' Systems.
(a)
GE concludes only distributed ignition (ignitors) and carbon-dioxide post-accident inerting are viable.
(b)
Applicant will provide analyses and test data to verify compliance with the requirements of ~ 10CFR50.34 (f) (2) (ix),
and the design descriptions of equipment, function, and layout.
2.
CP/ML Item (2) (ix) Hydrogen Control System Preliminary Design.
(a)
The Applicant will provide a Hydrogen Control System capable of handling hydrogen generated by the equivalent of a 100% active fuel-clad metal water reaction.
2.7-6
[(b)
The Hydrogen Control System shall provide with reasonable assurance that:
4:
'_ 1)
Uniformly distributed hydrogen concentrations in the
(
containment do not. exceed 10% during and following an accident that releases an equivalent amount of hydrogen as'would be generated from a 100% fuel-clad metal water reaction, or that the post-accident atmosphere will not support hydrogen' combustion.
'(2)
Combustible concentrations of hydrogen will not collect in areas where unintended combustion or detonation could cause loss of containment integrity of loss of appropriate mitigating features.
(3)
Equipment.necessary for achieving and maintaining safe shutdown of the plant and maintaining containment integ-rity wil,1 perform its safety function during and after being exposed to the environmental conditions attendant with the release of hydrogen generated by the equivalent of a 100% fuel-clad metal water reaction, including the environmental conditions created by activation of the i-hydrogen control system.
(c)
The following criteria will be used by the Applicant to design
~
the Hydrogen Control Systems (1)
Tha system will be single active failure proof.
(2)
Operation of the Hydrogen Control System will not adversely affect the safe shutdown of the plant.
(3)
The system will be protected from tornado and external missile hazards.
2.7-7 L
k
y --
NEDO-30670 (4)
The system will not compromise the containment design.
(5)
If the method chosen for hydrogen control is a' post-accident inerting system, inadvertent actuation of the system must be safely accommodated during plant operation.
' Since'the design complies with the hydrogen control portions of the CP/ML Rule, it can be concluded that USI A-48 is resolved for GESSAR II.
2.7.4 References None.
2-f e
. 2.7-8
S' NEDO-30670 3.
GENERIC SAFETY ISSUES 4
9 1
3.0-1/3.0-2
l
' 3.1 NUCLEAR POWER PLANT DESIGN FOR THE REDUCTION OF VULNERABILITY TO I
INDUSTRIAL SABOTAGE (ITEM A-29) 1 3.1.1 Issue Description The safety concern of this item deals with the consideration of alternatives to the basic design of nuclear power plants with the emphasis primarily on reduction of the vulnerability of reactors to industrial
. sabotage. Extensive efforts and resources are expended in designing nuclear plants to minimize the risk to the public health and safety from equipment or system malfunction or failure. However, reduction of the vulnerability of reactors to industrial sabotage is currently treated as a plant physical security function and not as a plant design requirement. Although present reactor designs do provide a great deal of inherent protection against indus-trial sabotage, extensive physical security measures are still required to
- provide an acceptable level of protection. An alternate approach would be 1
- to more fully consider reactor vulnerabilities to sabotage along with economy.. operability, reliability, maintainability, and safety during the pre-i
- liminary design phase. Since emphasis is being placed on standardizing plants, it is especially important to consider measures which could reduce the vulnerability of reactors to sabotage. Design features to enhance physical protection must be consistent with present and future system safety require-
[F
- ments.
The design change assumed for the purpose of analyzing this safety issue is the addition of an independent hardened decay heat removal system which is p
. designed to be only used in a sabotage incident or other extreme emergency as determined by plant operators. This proposed design change is based on con-P siderations and recommendations.in a Sandia report (Reference 1) completed for the NRC. Several other design changes were considered in the report.
i t
.The design chosen for development and for estimating cost uses electric
- power for its operation., Power is supplied by a diesel generator located (with the remainder of the equipment required for the system) in a hardened building. Heat loads associated with the diesel-generator and other i
3.1-1
- _, ~...
NEDO-30670 mechanical equipment are transferred to the atmosphere by an air-cooled heat exchanger. A pipe tunnel connects the hardened decay heat removal building with the containment bailding. The system is a single, complete system with-out redundancy or single-failure capability. The design period of unattended operation is 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. The independent hardened decay heat removal system is assumed to be added only to new PWRs and BWRs based on information in the Sandia report (Reference 1).
3.1.2 Safety significance 4
The basis for the MEDIUM pricrity determination for this issue is contained in Reference 2.
The priority was set based on the potential large risk reduction, the large uncertainty in determining the risk and the possibility of developing a lower cost solution, and not on the value/ impact assessment. The value/ impact ansessment would have placed this issue in a LOW ranking.
3.1.3 Resolution for GESSAR II Appendix 1F of GESSAR II provides a description of the design features that inhibit and mitigate postulated acts of sabotage. The inhibiting aspects of the multiple redundancies in shutdown mechanisms, water supplies and decay heat removal methods are presented. The redundant systems capable of performing these functions are located in separate compartments at several elevations and in different buildings with individual pipe chases for important water supply systems. This physical separation further inhibits postulated acts of sabotage.
There are four separate de electrical divisions for control and instrumen-tation with offsite power available from three separate sources. Each division has its own batteries for de power, and three divisions have individual diesel /
generators located in two separate buildings to supply emergency on-site ac Division cable routing includes separated raceways, cable tunnels plus power.
separated cable rooms in the Control Building.
3.1-2
NEDO-30670 Access control to important features begins at the protected area boundary and continues throughout the individual compartments. The Applicant's compliance with 10CFR73.55 is aided by the Nuclear Island's provision of key-locked doors, electric-locked doors, vestibules and mounting boxes for access control devices.
The GESSAR II design includes passive features which provide added assurance of protecting the public against postulated acts of sabotage.
These passive features include natural circulation within the RPV, plus the heat sink and scrubbing capability of the suppression pool.
Since these features do not require active components, they are not subject to postulated acts of sabotage. Their inhibiting and mitigating capabilities to provide adequate core cooling, accommodate decay heat and retain fission products can be assured for sabotage as well as transient initiated events.
Directions for mitigating postulated acts of sabotage are provided to the operators via the EPGs. These sympton-oriented procedures specify actions for achieving safe shutdown using normal or alternate reactivity controls and water supplies. These damage control type activities are aided by design features of direct water level indications for both the RPV and the suppression pool and by the ERIS and Nucienet Control Room. Other important features are multiple control locations, multiple power supplies, and the capability to manually intertie divisional power supplies and water supply systems.
Further mitigation of extremely severe (and highly unlikely) postulated sabotage scenarios is provided by the fission product retention features of the GESSAR 11 design. These features include the Condenser Offgas System, the suppression pool, the Containment Spray System and the Standby Gas Treatment System.
Radiological sabotage studies by NRC contractors have concluded that structural changes to a plant similar to the GESSAR II design would not significantly enhance or provide additional protection against postulated acts of sabotage. Their basis for this conclusion is that current designs include sufficient compartmentalization. The contractor conclusions regarding 3.1-3
NEDO-30670 upgraded security computers and other security matters are the responsibility of the Applicant. Another contractor conclusion is that damage control can be effective in sabotage titigation provided it uses installed systems and components. The EPGs specify damage control type activities and use installed systems and components.
In conclusion, the information contained in Appendix 1F of GESSAR II, in conjunction with the GE evaluations of USI A-44 (Section 2.4) and USI A-45 (Section 2.5), constitutes a basis for resolution of GSI A-29.
It should be noted that the NRC has reviewed Appendix 1F of GESSAR II and is in the process of completing review activities to provide safety evaluation input for GESSAR 11 for GSI A-29.
The letter contained in Appendix B provides additional information.
3 1.4 References 1.
NUREG/CR-1345, " Nuclear Power Plant Design Concepts for Sabotage Protection " U.S. Nuclear Regulatory Commission, 1981.
2.
NUREG-0933, "A Prioritization of Generic Safety issues" U.S. Nuclear Regulatory Commission Decembcr 1983.
3.1-4
NEDO-30670 3.2 ADEQUACY OF SAFETY-RELATED DC POWER SUPPLIES (ITEM A-30) 3.2.1 Issue Description This issue is documented in Reference 1 and addresses the adequacy of safety-related de power supplies which was questioned by a nuclear consultant in a letter. to the ACRS in April 1977 (Reference 2, Attachment B).
The Staff performed an initial study of the de power supplies' safety adequacy and reviewed typical designs, operating experience, and decay heat removal c.p uility with de power system failure. The results of this initial Staff assessment were reported in Reference 2, in which performance of a quantitative reliability assessment was recommended. Results of the completed assessment are documented in Reference 3.
3.2.2 Safety Sinnificance The de power system in a nuclear power plant provides control and motive power to valves, instrumentation, emergency diesel generators, and many other components and systems during all phases of pl, ant operation, including abnormal shutdowns and accident situations.
The minimum acceptable de power system, specified in CDC-17 (10CFR$0, Appendix A) and in Section 8.3.2 of Reference 4, is comprised of two physically independent divisions which supply de power for control and actuation of redundant safety-related systems.
Assurance of de power supply reliability is subject to two concerns:
(1) the batteries and other system elements should remain in full operation-ready.(not degraded) condition, and (2) independence of the two redundant divisions should be assured. An aspect of the potential significance of the issue is that failure of one division would generally cause a reactor scram which could result in a demand for de power to remove decay heat and prevent core melt.
3.2-1 v
- ~--
--n----
n,. _..
NELO-30670 In Reference 3 the frequency of core-melt due to de power failure was estimated at 4x10 per reactor year.
Based on this result, a HIGH priority ranking was assigned to Item A-30.
This was a generic estimate and Reference 3 stated that plant specific analyses could have lower values. An estimate of de initiated core melt frequency for GESSAR II was given in the draft review of the GESSAR II PRA (CESSAR II, Section 15D.3) performed by ENL. That estimate
~7 was 4.3x10 per reactor year, or about three orders of magnitude smaller than the Reference 3 estimate.
Based on this result, it can be concluded that Item A-30 does not have a high safety significance and, therefore, coul.1 not have a HIGH priority ranking for the GESSAR II design.
3.2.3 Resolution for GESSAR II A qu'antification of the impact of loss of two de power divisions on the GESSAR 11 core melt frequency was performed by the NRC contractor as part of the GESSAR II PRA review. The GESSAR II PRA did not develop explicit event trees for this event since there are four separate electrical divisions, each with its own batteries for de power, and the judgment was that it would not be a significant contributor to core-melt frequency. Although GE believes the absolute number (4.3x10'I per reactor year) calculated by the NRC contractor is higher than the realistic contribution to core damage frequency, the number is so low as to provide justification for the elimination of Item A-30 as a concern for the GESSAR II design (specific responses to Refer-ence 3 is contained in GESSAR II Appendix 15E).
3.2.4 References 1.
NUREG-0371, " Task Action Plans for Generic Activities (Category A),"
U.S. Nuclear Regulatory Conunission. November 1978.
2.
NUREG-0305, " Technical Report on DC Power Supplies in Nuclear Power Plants", U.S. Nuclear Regulatory Commission, July 1977.
3.
NUREG-0666, "A Probabilistic Safety Analysis of DC Power Supply Requirements for Nuclear Power Plants". U.S. Nuclear Regulatory Commission. April 1981.
3.2-2
NEDO-30670 4.
NUREG-0880, " Standard Review Plan". U.S. Nuclear Regulatory Commission.
3.2-3/3.2-4 L
NEDO-30670 3.3 DUCTILITY OF TWO-WAY SLABS AND SHELLS AND BUCKLING BEHAVIOR OF STEEL CONTAINMENTS (ITEM B-5)
This item has been divided into two parts which have been addressed separately.
3.3.1 Issue Description 3.3.1.1 Ductility of Two-Way Slabs and Shells This issue was identified in Reference 1 and involved concern over the lack of information related to the behavior of two-way reinforced concrete slabs loaded dynamically in biaxial membrane tension (resulting from in-plane
-loads), flexure, and shear. A task is defined which involves developing a more dependable and realistic procedure for evaluating the design adequacy of Category I reinforced concrete slabs subject to a postulated LOCA or HELB.
3.3.1.2 Buckling Behavior-of Steel Containments This issue is identified in Reference 1 and involves concern over the lack of a uniform, well-defined approach for design evaluation of steel containments. The structural design of a steel containment vessel subjected to unsymmetrical dynamic loadings may be governed by the instability of the shell.
For this type of loading, the current design verification methods, analytical techniques, and the acceptance criteria may not be as comprehensive as they should be.
Section III of the ASME Code does not provide detailed guidance on the treatment of buckling of steel containment vessels for such loading conditions. Moreover, this Code does not address the asymmetrical nature of the containment shell due to the presence of equipment hatch openings and other penetrations. Recommended in Regulatory Guide 1.57 (Reference 2) is a minimum factor of safety of two against buckling for the worst loading condition, provided a detailed rigorous analysis, considering inelastic, behavior, is performed. On the other hand, the 1977 Summer Addendum of the ASME Code 3.3-1
permits three alternate methods, but requires a factor of safety between 2 and 3 against buckling, depending upon the applicable service limits.
At the present..the NRC has developed and is using a set of interim criteria (Reference 3) for evaluating steel containment buckling for plants undergoing licensing review.
3.3.2 Safety Significance 3.3.2.1 Ductility of Two-Way Slabs and Shells If structures (concrete slabs) were to fail (floor collapse or wall collapse) due to loading caused by a LOCA or HELB, there would be a possibility that other portions of the reactor eco?. ant system or safety-related systems could be damaged. Such loads would be caused by very concentrated high-energy sources causing direct impact on the structures of concern. The damage could lead to an accident sequence resulting in the release of radioactivity to the environment.
.3.3.2.2 Buckling Behavior of Steel Containments
.If steel. containment shells were to fail due to loading which may cause buckling, one of the plant's levels of defense would be lost and could result t
l in release of radioactivity to the environment. The loading would have to be due to a high-energy source. A large LOCA or HELB near the containment wall could possibly provide such a load. A small fraction of these would occur close enough to the containment wall to potentially rupture the barrier. If the containment-is not adequately designed, a failure could occur.
3.3.3 Resolution for CESSAR II l
3.3.3.1 Ductility of Two-Way Slabs and Shells In Reference 4 it is concluded that there is sufficient information pertaining to the design of two-way slabs subjected to dynamic loads and 3.3-2 I'
l
c NEDO-30670 biaxial tension to enable a reasonably accurate analysis. Based on this information, the NRC concludes that a solution has been identified for this part of the overall issue.
As discussed in Section 3.5.3 of Reference 5, the GESSAR II procedures used to determine the effects and loadings on Seismic Category I structures, and missile shields and barriers, induced by design-basis missiles are acceptable because these procedures provide a conservative basis for engineer-ing design to ensure that the structure or barriers are adequately resistant to and will withstand the effects of such forces. Hence, this issue is considered resolved for GESSAR II.
i 3.3.3.2 Buckling Behavior of Steel Containments Section 3F.1 of GESSAR 11 already commits to the rather conservative Reference 3 interim criteria for evaluating steel containment buckling.
As previously noted, loading sources such as a large LOCA or HELB near the containment wall may cause buckling and compromise one of the plant's level of defense against the release of radioactivity. However, the risk of a large LOCA or HELB near the containment wall is expected to be quite small. A final resolution of this issue will be forthcomming in conjunction with Item B-6 (Section 3.4).
j 3.3.4 References 1.
NUREG-0471, " Generic Task Problem Descriptions (Categories B, C, and D) "
U.S. Nuclear Regulatory Commission,' June 1978.
2.
Regulatory Guide 1.57, " Design Limits and Leading Combinations for Metal Primary Reactor Containment System Components," U.S. Nuclear Regulatory Commission, June 1973.
f l
3.
NRC Interim Criteria for Evaluating Steel Containment Buckling, June 21, 1982.
t l
3.3-3 3
n NEDO-30670 4.
Memorandum for E. Sullivan from R. Bosnak, " Generic Issues," September
- 17. 1982.
5.
NUREG-0979, " Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design", U.S. Nuclear Regulatory Commission April 1983.
O 3.3-4
~.
4'
' NEDO-30670 3.-
's 3.4 LOADS ' LOAD COMBINATIONS. STFISS LIMITS (ITEM B-6) u 3.4.1 I_saue Description.
l This issue,vah identified as a generic problem in Reference 1 and concerns the design' of pressure vessels and pipina system components which must be designed 'to' accommod'at'e individur41 and combined loads due to normal operating conditions system transients, and postulated.lo'w probability events (accidents and natural phenomena).. This fasue became more controversial in recent years because postulated large LOCA and SSE loads were each increased by a factor of
- two or more to account for such phenomena as asymnotric blowdown and because better techniques for defining loading have been developed. The work efforts to -investigatie and establish a position on dynamic response combination metho'delbgy were completed and reported in Eeference 2.
Reference 3 was revised to reflect the new position on load combinat' ions and. stress limits
'(Reference 4).
The NRC has. concluded from studies completed (References 5 and
- 6) that. seimic-loads.and LOCA and ERV loads on containment structures should continue to be combined using the absolute sum method (Reference 7).
Hence.
the only work remaining is research into decoupling the LOCA and SSE events.
It is on this aspect that'this value/ impact assessment focuses. Reports on two investigations addressing this issue have been released (References 8 and 9).
The Code _of Fedapal Regulations requires that structures, systems, and l
(componentis - that af fect the safe operation of nuclear power. plants be designed
.to with,scNd combinations of loads that can be expected to result f rom natural 1
4 y s
-phenomena. normni oprrating conditions, and postuisted accidents. An example load combination requirement mandated for nuclear power plants includes i
coupling the effects of SSE with a LOCA.
In a recent evaluation, these combined loads were increased to further account for phenoecna such as
, ; anyametric blowdowns in PWRs and because improved techniques for defining los' ding have.been developed.
[
+
These changes have raised questions concerning implementation of new 7
i regulations. increased construction costs increased radiation exposure of maintenance crews per' forming increased inspection and maintenance actions, and reduced r'e11 ability of stiffer systems under normal operating transients.
f 3.4-1 i
s s %
y-4 T v"w
~w* 7
""9"*'+
wee
.-d m w-'m w e W ' T m e M m
- 'w e n N we ev
NEDO-30670 Reference 10, in addressing the probability of large LOCA-induced earthquakes, identifies the following results for PWRs:
Through-wall cracks are about a 'illion times more likely to occur 1.
m than DEGBs. This supports the leak before break nypothesis.
2.
Fatigue crack growth due to all transients, including earthquakes, is an extremely unlikely mechanism for inducing a large LOCA. The contribution of earthquakes to the occurrence of this unlikely event is a small percentage of the total probability.
3.
An upper bound estimate of the probability of asymmetric blowdown loads (resulting from rupture of in-cavity piping) due to direct and indirect mechanisms is 10 ' over the 40-yr plant life. The primary
~
contribution to this estimate is indirect, seismically induced, asymmetric blowdown.
It is felt that the best estimate of the probability is several orders of magnitude lower.
While the described research was performed on PWRs, similar results are also expected on BWRs.
The proposed resolution for this issue is to decouple the SSE-LOCA load requirements. This would permitt (1) the removal of some snubbers, (2) the removal of pipe whip restraints, and (3) the deletion of the requirements for asymmetric blowdown analyses for forward-fit plants which would eliminate the
- additicnal stif fening of the PWR reactor pressure vessel.
3.4.2 Safety Sinnificance In the quantitative analysis of.this issue given in Reference 11, it was assumed that there will be a small reduction in risk to the public due to the removal of appropriate snubbers in systems designed to withstand SSE plus LOCA-induced loads. This reduction in system stiffeners should help preclude potential lockup of snubbers during normal operating transients, thus reducing 3.4-2
NEDO-30670 large stresses'on piping t.nder normal operating conditions. The actual
~
I removal.of equipment (snubb'ers $nd pipe restraints) will introduce an added (one-t.ime)-occupat'ional dose for those plants.having the devices installed.
Hovcver,' the' deleted snubbers'will result in a reduction in occupational exposure because inspection and maintenance will no longer be necessary on the deleted items. The removal-of the pipe restraints will improve the access to
-many equipment' items and, as a result, will reduce plant personnel time.in high radiation' areas for maintenance and inspection, providing a further reduction in occupational exposure.
It has been. suggested that removing the snubbers required for the comb'ined LOCA and SSE loads would reduce the stiffness arid pdtential lockup of the snubbers during normal operation. This would result in'a reduction in the probability of pipe rupture during norr41' operating t'r ansients (e.g., startup,
~
thermal transients,-etc.). The best estimate, by engineering judgment, is that
~
the probability of pipe rupture would be reduced'by 25% across the board.
~
'Of further importance to this issue is the reduction in occupational exposure brought.about by the reduction of work time to perform ISI in a radiation, environment. An accumulated exposure of 1,100 man _-Rem / plant for FWRs and 1,410 man-Rem / plant for BWRs is expected in.the removal of snubbers and pipe. restraints (Referen'ce 11). For all backfit plants, this results in an exposure of 4.5 x 10' man-Rem for all PWRs and 2.26 x 10 man-Rem for BWRs.
t The -removal of - ndbbers and the elimination _of pipe restraint removal to accomplish pipe inspec'tions' is estimat5d to save 1,120 man-hours / year / plant for PWRstand l',440 man-hours / year / plant for.BWRs in maintenance and operation time in radiation environments. For all applicable reactors' lifetimes, this
.accumul'at'ed' exposure reduction is calculated'to be 6.77 x 10 man-Rem for PWRs 0
P
'and 3.68 x 10 man-Rem for BWRs. This result s in a total reduction in
~
5 occupatiogal risk exposure of 9.8 x 10 man-nem.
~
' V
- h,
/ es$lution for CESSAR'11 3.4.3 R
~
,A:presentr~ tion before the CRCR on the resolution of Item B-6 for BWRs is l
scheduled for'early 1985. -The LLNL Mark't nECB probabi!Istic study is currently
~
fr. y' :
~.
y n
) '
g c3.4-3(,
j j,,
,A
~
4(g 'g,*#!! w.
e
~--
.: a
.y y
NEDO-30670 in progress and scheduled for completion in December 1984. Since this is a generic resolution for BWRs, GE has proposed (Reference 12) DEGB probabilistic studies for Mark II and Mark III plants to supplement the LLNL Mark I studies.
Reference 12 intends to perform Mark II and III DEBG probabilistic studies in parallel with _the LLNL Mark I studies, utilizing alternate (simplified) calcu-lational models that can be benchmarked to the rigorous LLNL models. Refer-ence 12 also proposed that the NRC review the Mark II and DEGB probabilistic studies in conjunction with the January 31 1984 submittal on the CESSAR II docket supporting the leak-before-break approach. Timely completion of these
-Mark I, II and III DEGB probabilistic studies should allow resolution of this issue in early 1985. At this time, it is fully expected that these DEGB studies will-support decoupling of the LOCA and SSE events.
As demonstrated in Subsection 3.4.2, there are substantial reductions in both public risk and occuptiona'l risk exposure. Because of the character of the proposed resolution (e.g., removal of some snubbers, removal of pipe whip restraints), there are clearly reductions in plant cost. Since both risk and
~
costs are reduced, GE is anxious to incorporate the resolution of this issue
~
into the GESSAR II design.- The overall risk estimated by the PRA will be somewhat decreased by decoupling the LOCA and SSE events.
3.4.4 References' l.
-NUREG-0471, " Generic Task Problem Descriptions (Categories B, C, and D)."
'U.S. Nuclear Regulatory Commission, June 1978.
2..
NUREG-0484 " Methodology for Combining Dynamic Responses," U.S. Nuclear s
s Regulatory Commission, May 1980, Revision 1.
'3.
NUREG-0800, " Standard Review Plan," U.S. Nuclear Regulatory Commission, Section 3.9.3.
4.
Memorandum for W. Minners from R. Bosnak, " Comments on Generic Issue B-6 "
August 26, 1982.
3.4-4
-,w-v,-n-w-w,,,-i w,
y y,,
, -2,--v----,--<r y-g-,y--r-m-ww,-
w,y.,--g y,.---'
NEDO-30670 5.
NUREG/CR-2039, " Dynamic Combinations for Mark 11 Containment Structures,"
U.S. Nuclear Regulatory Commission, June 1982.
6.
NUREG/CR-1890 " ABS, SRSS and CDF Response Combination Evaluation for Mark III Containment and Drywell Structures, U.S. Nuclear Regulatory Commission, March 1982.
7.
Memorandum for W. Minners from F. Schauer, " Generic Issue B-6 "
September 2, 1982.
4 8.
NUREG/CR-2136, " Effects of Postulated Event Devices on Normal Operation of Piping Systems in Nuclear Power Plants " U.S. Nuclear Regulatory Commission, May 1981.
9.
NUREG/CR-2189, " Probability of Pipe Fractu in the Primary Coolant Loop of a PWR Plant," U.S. Nuclear Regulatory Commission, September 1981.
- 10. Memorandum for H. Denton from R. Minogue, "Research Information Letter No. 117 - Probability of Large LOCA Induced by Earthquakes," April 10, 1981.
11.
NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritiza-tion Information Development," U.S. Nuclear Regulatory Commission, February 1983.
12.
Letter for R. J. Bosnak from J. F. Quirk, " Proposed Mark II and III DEGB Probabilistic Studies to Support the CRGR Review of Task Action Plan B-6 for BWRs," May 31, 1984.
3.4-5/3.4-6
~..
NIDO-30670 3.5 BEHAVIOR OF BWR MARK III CONTAINMENTS (ITEM B-10) 3.5.1 Issue Description Aa' described by Reference 1, this item is an ACRS generic concern.
' Evaluation and approval is required of various aspects of the MARK III contain-
- ment. design-which differs from the previously reviewed MARK I and MARK II designs. The task involves the completion of the staff evaluation of the MARK III containment and documentation of the method used to validate the analytical models and assumptions needed to predict the containment pressures
.in the event of a LOCA.
The MARK III suppression pool dynamic loads were reviewed by the NRC at the CP stage for Grand Gulf Nuclear Station Units 1 and 2, and at the PDA stage for GESSAR II.
It was concluded at the time that the information avail-
.able was sufficient to adequately define the pool dynamic loads for those nuclear plants under review for cps. Since the issuance of Reference 2 in December 1975,'GE has conducted further tests and analyses to confirm and refine the original load definitions. To keep the NRC~and MARK III applicants apprised of the curren't status'of these tests, GE issued an Interim Contain-
. ment Loads Report (22A4365) in April of 1978 and revised this report several
- times before GESSAR II was provided to the NRC staff uin March of 1980.
GESSAR II is General Electric's EDA submittal for their standard BOP design and is to be-referenced by MARK III OL applicants. Appendix 3B of GESSAR II
..provides the finalized pool dynamic load definition for MARK III containments
-and is the basic document used for review by the NRC_ staff and its
~
1 consultants.'
. The NRC staf f. is currently reviewing General Electric's pool c'ynamic load.
s definitions to arrive at a finalized hydrodynamic load definition that can be
~
lutilized by MARK III_ containment. Applicants for operating licenses. The pool dynamic loads were being reviewed under USI A-39, "Determinati,on of Safety
. Relief Valve (SRV) Pool Dynamic Loads and Temperature Limits for BWR Contain-ment" (Reference 3).
-3.5-l'
NEDO-30670 3.5.2 Safety significance Following a postulated LOCA, escaping steam forces the suppression pool out of the drywell into the wetwell. This action results in pool swell and loads from vent clearing, jets, chugging, impact of water, impact from froth impingement, pool fallback, condensation, and containment pressure.
The concern is that these loadings may damage structures and compe.nents located within the wetwell.
Although many of these structures (e.g., walkways) are.by themselves not related to safety, the'various ECCS systems take suction from the wetwell and, therefore, damage in the vetwell may affect the performance of the ECCS.
1 The MARK III plants af fected by this issue will be reviewed to determine if their structures meet the NRC Acceptance Criteria for MARK III LDCA-related pool dynamic loads. Structural fixes will then be implemented where necessary.
3.5.3 Resolution for GESSAR II This issue was resolved for GESSAR II in the Staff evaluation contained
.in Section 6.2.1.8.3 of Reference 2.
As a part of that resolution, GESSAR II contains a commitment that the Applicant will address the NRC acceptance criteria for LOCA-related MARK III containment, pool dynamic loads (CESSAR II, Table 1.9-3, Item 3.40).
This' item covers the differences in the procedures
. described in GESSAR II for evaluation of MARK III containment response to L
LOCA-related pool dynamic loads versus the NRC directives in Reference 2.
It should be noted that following the issuance of Reference 2, the NRC
' issued Reference 4 relating to GSI B-10.
General Electric reviewed Refer-ence 4 and confirmed that it was consistent with the approved load definition contained in Appendix 3B of GESSAR II and Reference 3 with two minor excep-tions. These two exceptions consisted of the deletion of additional criteria for bulk impact loads on small structures less than 4 feet long and less than 6 feet above the pool, and the addition of a multiplier for structures l
3.5-2
~
NEDO-30670 above grated areas at the HCU floor for froth impact loads. Recent GE correspondence on this issue is contained in Appendix C.
As noted above, this issue is resolved for GESSAR II.
3.5.4 References 1.
NUREG-0471, " Generic Task Problem Descriptions (Categories B, C and D),"
U.S. Nuclear Regulatory Commission, June 1978.
2.
NUREG-0979, " Safety Evaluation Report related to the final design approval of the CESSAR II BWR/6 Nuclear Island Design," U.S. Nuclear Regulatory Commission, April 1983.
3.
NUREG-0371, " Task Action Plans for Generic Activities (Category A)," U.S.
Nuclear Regulatory Commission, November 1978.
4.
NUREG-0978, " Mark III LOCA-RELATED Hydrodynamic Load Definition," U.S.
Nuclear Regulatory Commission, February 1984, Issued for Comment.
3.5-3/3.5-4
NEDO-30670 3.6 CRITERIA FOR SAFETY-RELATED OPERATOR ACTIONS (ITEM B-17) 3.6.1 Issue Description Current plant designs are such that reliance on the operator to take action in response to certain transients is necessary.
In addition, some current PWR designs require manual operations to accomplish the switchover from the injection mode to the recirculation mode following a LOCA. The required time for the ECCS realignment operations is dependent on pipe break size, and the operation must be accomplished before the inventory in the borated water storage tank is depleted.
The. CESS AR II design includes reliance on the operator for some transient events. The development of a time criterion for SROA is addressed by this issue, including a determination of whether or not automatic actuation will be required.
3.6.2 Safety Significance Development and implementation of criteria for SROA may result in the automation of some actions currently performed by operators, if such actions are shown to be burdensome or to reault in a high likelihood for error due to a short time available for their acconplishment. For such actions, automation of the controls in lieu cf operator action may reduce the frequency of taproper action during the response to or recovery from transients and acci-dents by reducing the potential for operator error. This, in turn, could reduce the expected frequency of core damaging events and, therefore, reduce the public risk accordingly.
3.6.3 Resolution for GESSAR II The GESSAR II design has been evaluated for SROAs that could pose an l
unacceptable stress on the operator and consequently have a negative implica-tion on overall public risk. The GESSAR II PRA (GESSAR II, Section 15D.3) 3.6-1
NEDO-30670 includes estimates of the operator error probability based on the work by Swain and Guttmann (Reference 1) and estimates of the time available to accomplish the actions.
GESSAR II, Chapter 18, is the result of the Control Room Design Review for the GESSAR II control room.
Included in that review is a task analysis con-ducted on a BWR/6 simulator for the events which are dominant contributors to plant risk. One of the purposes of that review was to ascertain whethtr there were safety-related actions for which insufficient or limited time was avail-able. The task analysis was conducted in real time specifically for this purpose.
In addition, the IIEDs which resulted from the GESSAR II design Control Room Design Review have been reviewed to determine any conditions which might impact an SROA.
Finally, the EPGs (Reference 2) have taken into consideration the time available for SROAs in their development, as judged by the operational exper-ience of the contributing utility representatives.
As a result of these evaluations, the itaplication on public risk due to
(
SROAs has been thoroughly reviewed and some modifications have been made to the GESSAR II design.
For example, the ADS logic has been modified in response to Reference 3 to eliminate the need for operator action to depres-surize the reactor pressure vessel following transients which do not also cause high drywell pressure - A time delay was added to the logic specifically to provide the operator with more time to stabilize the reactor water level before inhibiting the ADS logic during Anticipated Transient Without Scram events. Addition of this timer eliminated the burden on the operator to repeatedly (every 105 seconds) reset the ADS initiation time delay logic while also controlling reactor water level.
The conclusion of these previously cited revieu; is that this issue has been adequately addressed in the GESSAR II design through probabalistic risk studies, simulator reviews, and consideration of operator experience.
3.6-2
NEDO-30670 3.6.4 References 1.-
NUREG/CR-1278, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," U.S. Nuclear Regulatory Commission, April 1980.
2.
Emergency Procedure Guidelines BWR 1-6, Revision 3.
- 3.
NUREG-0737, " Clarification of TMI Action Plan Requirements," U.S.
Nuclear Regulatory Commission, November'1980.
Y I
3.6-3/3.6-4
NEDO-30670 3.7 STRUCTURAL INTEGRlTY OF CONTAINMENT PENETRATIONS (ITEM B-26)
-~ 3. 7.1 Issue Description A's' described in Reference 1, this issue involves NRC evaluations to assess the adequacy of specific containment penetration designs f rom the point of view of structural integrity. ISI requirements, and new surveillance or analysis methods: applicable to containment penetrations which are identified as inacces-
'sible. The issue is applied to all operating plants as well as those plants currently under construction and up for licensing review.
In accordance with Reference 2, that part of the issue involved with the
. structural integrity ~of specific containment penetration design, i.e., forged versus welded design, has been resolved. This resolution is based on a draft report by an_NRC consultant. A report is being considered to document this
~
-resolution..The second concern which involves the volumetric examination as required by Reference' 3. is only partially resolved for (1) plants under licensing review, where inspection and surveillance problems associated with
. inaccessible penetrations must be resolved in some manner before startup operations' can occur; and (2) operating reactors, where inspection and surveil-lance problems are reviewed during reviews of licensees' ISI programs.
The Staf f review should determine whether or not the configuration and l~
accessibility of the welds in the proposed design, and the procedures proposed for performing' volumetric examination, permit in-service examination require-r ments of. Reference 3 at an augmented freq.uency in break exclusion regions, as
'~
L required by Reference 4.
If penetration designs are found inadequate with respect to conducting current.in-service inspections, alternative surveillance
~
or -analysis methods would be implemented to ensure that inspections can be completed - (Reference 2).
e 0
i 1.
t 3.7-1
.,_.w..,_,-
_. _ - - ~,. -.., -. -., ~,, - - --.-
e-
NEDO-30670 3.7.2 Safety Significance Upon satisfactory resolution of inspectability concerns, this issuc should not affect public risk. However, should it be impractical for a plant to assure the above stated in-service examination requirement in accordance with Reference 4, no specific guidance is provided as to what measures would provide an acceptable resolution.
In such cases, Staff approval on a case-by-case review basis may result in inconsistent penetration requirements ' rom plant to plant. Such inconsistencies, should they occur, could result in increased risk to the public. To account for this possibility, the potential public risk reduction is obtained by assuming that the likelihood of radio-active releases from containment may be reduced.
3.7.3 Resolution for GESSAR II This issue is considered resolved in GESSAR II since the design meets the requirements of Reference 4.
Specifically, the GESSAR II meets the follow-ing requirements:
1.
For ASME Code Section III Class 1 piping, the following stress and fatigue limits are not exceeded.
(a) The maximum stress range between any two load sets (including the zero load set) as calculated by Equation 10 of NB-3653 for normal and upset plant conditions (including an operating i-basis earthquake) do.es not exceed 2.4 S,.
.(b) The cumulative usage factor must be less than 0.1.
(c) If the calculated maximum stress range of Equation 10 exceeds 2.4 S,, then the stress ranges calculated by both Equations 12 and 13 of NB-3653 do not exceed 2.4 S,.
l I
3.7-2 i
I
.NEDO-30670 (d) The maximum stress as calculated by Equation 9 of NB-3652, under the loadings resulting from a postulated piping failure beyond the required restraints, does not exceed 2.25 S,.
Higher stresses between the isolation valves and restraints were permitted, provided a plastic hinge was not formed and operability of the valves with such stresses was assured.
'2.
For ASME Code Section III Class 2 piping, the following strees and fatigue limits are not exceeded.
4 (a) The maximum stress ranges calculated by the sum of Equations 9 and 10 of NC-3652 for normal and upset plant conditions (including an operating basis earthquake) does not exceed 0.8 (12. Sh+S)*
a (b) The maximum stress as calculated by Equation 9 of NC-3652, under the loadings resulting from a postulated piping failure beyond the required restraints, does not exceed 1.8 S. Higher h
stresses between the isolation valves and restraints were per-mitted, provided a plastic hinge was not formed and oper-ability of the valves with such stresses was assured. When the piping beyond the isolation valve is constructed in accordance with ANSI B31.1, this exception may be applied, provided the pipe is either of seamless construction with full radiography of all circumferential welds or all longitudinal and circum-ferential welds are fully,radiographed.
3.
.The piping runs are straight.
4.
Welded attachments for pipe supports or other purposes were avoided, unless the detailed stress analyses or tests were performed to demonstrate compliance with the stress limits given in Items 1 and 2.
3 7-3
y NEDO-30670 5.
The number of circumferential and longitudinal piping welds and branch connections are minimized. Where guard pipes are used, the enclosed portions of piping are of seamless construction and have no circumferential welds unless specific provisions for access are made to permit 100% in-service volumetric examination of all welds.
6.
The length of these portions of piping is reduced to the minimum length practical.
7.
The design of pipe anchors or restraints (e.g., connections to containment penetrations and pipe whip restraints) does not require welding directly to the outer surface of the piping (e.g., flued
. integrally-forged pipe fittings may be used), except where such welds are 100% volumetrically examinable in service and a detailed stress analysis was performed to demonstrate compliance with the stress limits given in Items 1 and 2.
8.
Guard pipes are constructed in accordance with the rules of Class MC, Subsection NE. ASME Code Section III, where the guard pipe is part of the containment boundary. In addition, the entire guard pipe assembly is designed to meet the following requirements and tests.
(a) The design pressure and temperature are not less than the I
maximum operating pressure and temperature of the enclosed pipe under normal plant conditions, (b) The design stress limits of Paragraph NE-3131(c) are not j
exceeded under the loading associated with the containment design pressure and temperature in combination with the SSE.
(c) Guard pipe assemblies are pressure tested in accordance with the ASME Code Section III. Article NE-6000.
3.7-4
NEDO-30670 3.7.4 References 1.
NUREG-0471, " Generic Task Problem Descriptions (Categories B, C, and D),"
U.S. Nuclear Regulatory Commission, June 1978.
2.
Memorandum for E. Sullivan from R. Bosnak, " Generic Issues,"
September 17, 1982.
3.
. ASME Boiler and Pressure Vessel Code,Section XI, " Rules for Inservice Inspection of Nuclear Power Plant Components," American Society of Mechanical Engineers, 1974.
4.
NUREG-0800, " Standard Review Plan," U.S. Nuclear Regulatory Commission, Section 3.6.2.
i 3.7-5/3.7-6 t
m
NEDO-30670 3.8 IMPROVED RELIABILITY OF TARGET ROCK SAFEIY RELIEF VALVES (ITDi B-55) 1 3.8.1 Issue Description The BWR pressure relief system is designed to prevent overpressurization of the RCPB under the most severe abnormal operational transient (closure of the main steam line isolation valves with failure of the MSIV position switches to scram the reactor). This design function is accomplished through the use lof a plant-unique combination of SVs, PARVs, and dual function SRVs. The majority of the valves in BWRs are commonly referred to as Target Rock SRVs.
In addition to the RCPB overpressure protection design functions of the BWR pressure relief system, a specified number of the PARVs or SRVs utilized in the pressure relief system of each BWR facility are used in the ADS, which
'is one of the ECC systems. In the event of certain postulated small-break LOCAs, the ADS is designed to reduce reactor coolant system pressure to permit the LPCS and/or LPCI to function. The ADS performs this design function by automatically actuating certain preselected PARVs or SRVs following receipt of specific signals from the protection system.
3.8.2 Safety Significance Certain safety concerns result when:
(1) a valve fails to open properly on demand, (2) a valve opens spuriously and then f ails to properly reseat, and (3) a valve opens properly, but fails to properly reseat. The failure of a j
pressure relief system valve to open on demand results in a decrease in the total available pressure-relieving capacity of the system.
Spurious openings of pressure relief system valves, or failures of valves to properly reseat after opening, can result in inadvertent reactor coolant system blowdown with unnecessary thermal transients on the reactor vessel and the vessel internals, unnecessary hydrodynamic loading of the pressure-suppression system and its internal components, and potential increases in the release of radioactivity to the environs. In addition, if the failed valve also serves as part of the ADS, a degradation of the capability of the ADS to perform its emergency core cooling function could result.
3.8-1
NEDO-30670 A 'significant number of failures (due to various causes) of the Target Rock valves have occurred in approximately 160 RY of operating experieace.
Studies and testing of these valves by the BWR Owners' Group, in some cases at the suggestion of the NRC, have resulted in design changes in the "alves and the issuance of several formal generic installation, operating, and maintenance instructions (Reference 1).
In 1978, it was concluded by the NRC staff (Reference 3) that the inad-
.vertent blowdown events that have occurred to date as a result of pressure relief system valve malfunctions have neither significantly affected the structural integrity or capability of the reactor vessel, the reactor vessel internals, or the pressure suppression system, nor resulted in any significant radiation releases to the environment. They concluded that such events, even if they were to occur at a more frequent rate than indicated by operating experience, would not be likely to have any significant effects on the reactor vessel or the vessel internals.
It was also concluded that pressure relief valve blowdown events will not result in offsite radiological conse-quences appreciably different from those encountered during a normal reactor shutdown.
With respect to the pressure-suppression containment system, the slowly progressive nature of the material fatigue mode of failure, associated with the dynamic loading conditions resulting from pressure relief valve blowdown events, and the substantial fatigue life margin currently available in the affected structures have led the Staff to conclude that additional short-term actions are not required to assure that the integrity and functional capability of the system will_.be maintained.
In addition, current programs to provide additional containment system structural safety margins for the long term (i.e., the anticipated 40-yr lifetime of the BWR f acilities) are acceptable.
The performance of these valves, however, is under continuous surveillance and the' consequences of their failures are subject to review. This issue is
~
~ documented in Reference 1.
3.8-2
NEDO-10670 3.8.3 Resolution for GESSAR II The GESSAR II design specifies the direct acting spring-loaded type SRV, not'the pilot operated Target Rock type; hence Item B-55 should not be a concern for GESSAR II.
However, GE recognizes the importance of SRV perform-ance and the limited in situ performance data for the type of SRVs employed in the GE3SAR II design.
Consequently, GESSAR II commits the Applicant to participate in the SRV surveillance program developed by LRG-1 and reviawed by the BWR Owners' Group for TMI and LRG-II.
LRG-I, in concert with LRG-II, has requested that INPO review the surveil-lance program and accept responsibility for centralized compilation of the required data. This request was made via the letter from P. L. Powell, Chairman LRG-1, to E. L. Zebroski, Vice President-INPO, dated October 27, 1981.
The SRV surveillance program, as described in the attachment to the referenced letter, specifies more detailed information than required for LERs or for the Nuclear Plant Data Reliability System.
3.8.~4 References 1.
NUREG-0471, " Generic Task Problem Descriptions (Categories B, C, and D),"
U.S. Nuclear Regulatory Commission, June 1978.
2.
NUREG-0462, " Technical Report on Operating Experience with BWR Pressure Relief Valves " U.S. Nuclear Regulatory Commission, July 1978.
3.8-3/3.8-4
)
NEDO-30670 3.9 -' DIESEL RELIABILITY (ITEM B-56)
. 3.9.1 -Issue Description v:
This GSI was promulgated by a review of LERs which indicated that emergency.onsite. diesel generators at operating plants were demonstrating an
- average starting reliability of about 0.94 per demand. The NRC's goal for new f
plants, as expressed in Regulatory Guide 1.108, is a diesel generator etarting i
l.
reliability of 0.99 per demand. The NRC awarded a contract to the University of Dayton Research Institute to identify the more significant causes of diesel-generator unreliability. The Dayton University study is now complete and the
' significant causes and recommended corrective action are identified in Refer-J ence 1.
This issue is documented in Reference 2.
3.9.2 Safety Significance i
l Events (offsite and onsite) which result in a loss of offsite power necessitate reliance on the onsite emergency diesel-generators for successful
.f accident mitigation. Improvement of the starting reliability of onsite emer-gency diesel-generators will reduce the probability of events which could escalate into a core-melt accident and, thus, could effect an overall reduction in public risk.
r
.This item is closely related to USI-A44 (section 2.4), and much of the (significance with respect to the GESSAR II design has been discussed previously.
The contribution to core damage frequency is dominated.by common node failure of the three. diesel-generators and far exceeds the random failure frequencies of individual diesel-generators. As such.-increasing diesel-generator relia-
-bility.would have no appreciable impact on core melt frequency. Therefore, the risk reduction achievable would be negligible; thus, the HIGH priority ranking given Item B-56 is not applicable to the GESSAR II design.
l 3.9-1 i;
m.
l N-NEDO-30670 l
3.9.3 ' Resolution for CESSAR II The GESSAR II PRA (GESSAR II, Section 15D.3) included an assessment of the reliability of the three diesel-generators which supply emergency onsite power.. The individual reliability values are given in Appendix D to
.Section 15D.3 of GESSAR II.
The assessed frequency for a diesel-generator
-2 failing to start and keep running is 2 x 10 In addition, a detailed assess-ment of common mode diesel-generator failure was submitted on September 2, 1983.
The results of that study showed a three diesel-generator common cause failure probability of about 1 x 10 '.
Improvement in-diesel-generator reliability would not necessarily improve this common cause failure probability and therefore would provide little or no risk-reduction.
Since the frequency and risk from core melt caused by loss of all diesel-generators is already very low, this item should not have a HIGH priority ranking for the GESSAR II design.
- 3. 9.' 4 References 1
NUREG/CR-0660,- " Enhancement of On-Site Emergency Diesel Generator Reliability," "J.S. Nuclear Regulatory Commission, February 1979.
2.
NUREG-0471, " Generic Task Problem Descriptions (Categories B C, and D),"
U.S. Nuclear Regulatory Commission, June 1978.
3.9-2
NEDO-30670 3.10 PASSIVE MECHANICAL FAILURES (ITEM B-58) 3.10.1 Issue Description This Reference 1 task involves a review of valve failure data in a systematic manner to verify the Staff's present judgment regarding the likeli-hood of passive mechanical valve failures, to categorize these and other valve failures as to expected frequency, to specify acceptance criteria, and co determine if and how the results of this effort should be applied in licensing reviews. This issue-is related to a number of other issues dealing with valve reliability:
a.
C-ll:
Assessment of Failure and Reliability of Pumps and Valves b.
II.D.2:
Research on Relief and Safety Valve Test Requirements c.
.II.E.6:
In-Situ Testing of Valves Issue C-ll, in particular, is aimed at active failure of pumps and valves.
Valve f ailure data collected at the Nuclear Safety Information Center were studied to identify failure frequency for active failure mechanisms (Refer-ence 2).
Those data are examined here to identify passive failure mechanisms.
The distinction is made here that active failures typically occur during valve operation while passive failures occur over a period of time, going unnoticed I
as the valve is rendered inoperable. Detection of failure then occurs after valve operation is demanded.
3.10.2 Safety Significance Since saf ety-related systens contain about 500 valves, passive f ailures present a potentially significant safety concern because the effects on safety-related systems can be so widespread.
3.10-1 I
e..
-n
T' "
NEDO-30670 3.10.3 Resolution for GESSAR II The GESSAR II environmental qualification program for safety-related mechanical and electrical equipment meets all of the Reference 3 requirements.
Since the Reference 3 requirements are more rigorous than the previous requirements (Reference 4), Applicants referencing the GESSAR II design are expected to experience a marked reduction in passive mechanical failures relative to existing plants.
In addition, the GESSAR II design provides added confidence that components will perform satisfactorily in service by commiting to Reference 5.
Passive mechanical failures have been included in the GESSAR II PRA (GESSAR II, Section 15D.3). All failures of mechanical components to perform their intended functions (i.e., actively and passively) make up the components failure rate data base.
It should be noted that over the life of an existing plant, average hardware-related passive failures represent only about 12% of all valve failures. This means that active failures overshadow mechanical component failure rates.
Certainly there is a strong incentive to minimize these passive mechanical failures since improved performance reduces public risk, reduces occupational exposure and saves money (labor, equipment and downtime). However, passive mechanical failures have little impact on the PRA because they are only a small fraction of the total failure rate data base.
In summary, this issue is considered resolved for GESSAR II because mechanical failures have already been included in the PRA, they are only a small fraction of the total failure rate and improved mechanical component performance in GESSAR II plants is e.*;pected through utilization of Refer-ences 3 and 5.
3.10.4 References 1.
NUREG-0471, " Generic Task Problem Descriptions (Categories B C, and D) "
U.S. Nuclear Regulatory Commission, November 1978.
3.10-2
NEDO-30670 2.
NUREG/CR-0848, " Summary and Bibliography of Operating Experience with Valves in Light-Water-Reactor Nuclear Power Plants for the Period 1965-1978," U.S. Nuclear Regulatory Commission, August 1979.
3.
NUREG-0800, " Standard Review Plan," Section 3.11. U.S. Nuclear Regulatory Commission Section 3.11.
4.
NUREG-75/087, " Standard Review Plan," U.S. Nuclear Regulatory Com.ission, Section 3.11.
5.
Regulatory Guide 1.116. " Quality Assurance Requirements for Installation, Inspection, and Testing of Mechanical Equipment and Systems," U.S. Nuclear Regulatory Commission, Revision 0-R, May 1977.
l 3.10-3/3.10-4
NEDO-30670 3.11 ALLOWABLE ECCS EQUIPMENT OUTAGE PERIODS (ITEM B-6.1.)
3.11.1 Issue Dercription This issue concerns establishing surveillance test intervals and allow-able equipment outage periods, using analytically based criteria and methods for the Technical Specitications. The present Technical Specifications allow-able equipment outage intervals and test intervals were determined prirarily on a basis of engineering judgement.
3.11.2 Safety Significance Where equipment outage times can be reduced, the availability of ECCS equipment may be improved with a result that reduces the risk to the public.
On the other hand, more f requent test intervals may increase the amount of operator occupational radiation exposure. The overall safety significance will depend on the combination of all the changes to the Technical Specifi-l cations which are based on analysis rather than engineering judgment. Since any proposed change which would pose a significant increase in the public risk is not expected to be adopted, it can be judged that the overall signifi-reduc-cance to public risk would be small, but there may bc =cre important tions in operational risk.-
3.11.3 Resolution for GESS AR II The GESSAR 11 PRA (CESSAR II, Section 15D.3) includes equipment unavail-ability due to maintenance probabilities based on outage periods allowed by the Standard Technical Specifications (Reference 1).
As such, the total risk from this issue is addressed by the results of the PRA.
Since a conclusion of the PRA is that there is an acceptable public risk from the GESSAR II plant design, it can also be concluded that the GESSAR II design is acceptable from the standpoint of this issue.
i 3.11-1 i
NEDO-30670 The Technical Specifications for a GESSAR II plant, as for any plant, are currently the responsibility of the NRC. Nevertheless there are generic ongoing activities through the BWR Owners' Group which are attempting to define ways in which the equipment outage time requirements may be optimized to pro-vide the greatest operational flexibility, while not significantly affecting ECCS or RPS effectiveness in limiting the total plant risk. Results from these
. activities are expected to be submitted to the NRC for review and ultimate incorporation into the Standard Technical Specifications.
-7t is concluded that the GESSAR II design is acceptable in regard to this issue, and that further improvements may ultimstely be reflected in the Standard Technical Specification which would then be applied to the GESSAR II operating license application.
'3.11.4 References 1.'
Standard Technical Specifications General Electric Boiling Water Reactors (Draft) [GE-STS) BWR/6.
I 3.11-2
NEDO-30670 3.12 MAIN STEAM LINE LEAKAGE CONTROL SYSTEMS (ITEM C-8) 3.12.1 Issue Description Dose calculations by the NRC in 1975 indicated that operation of the MSIVLCS required for some BWRs may result in higher offsite accident doses than if the system is not used and the integrity of the steam lines and con-denser is maintained. The dose calculations performed by the NRC at that time assumed nonoperation of the MSIVLCS and took credit-for cold trapping of iodine and volatiles in the steam lines and condenser.
In addition, long holdup times and release either through stack filters via the waste gas treatment system or leakage from the steam system was assumed. Leakage from the main steam condenser system would be small because normal operation requires that leakage be maintained at a low level.
Integrity of these systems is not assured during earthquakes since they are not designed for SSE. However, the I
probability of failure of both the fuel and these systems due to earthquake is 1
small. By contrast, the MSIVLCS draws a negative pressure downstream of the MSIVs to collect leakage past the valve seats and processes the collected leak-age through a safety grade filtration system for release to the environment.
Relatively little cold trapping or holdup time occurs when the MSIVLCS is used.
Therefore, the caJculated doses for releases through the MSIVLCS are greater than the calculated doses for releases through the steam system, unless the integrity of the steam system is lost.
This NUREG-0471 (Reference 1) task was initiated to investigate whether-L the MSIVLCS currently recommended in Regulatory Guide 1.96 (Reference 2) is L -
r; desirable. Since its inception, this issue has been categorized to be of little or no significance to plant risk (i.e., Category C).
Recent data (Reference 3) on the magnitude and frequency of MSIV leakage at BWRs have b
renewed concerns for the viability of the MSIVLCS design. In addition, the question of backfitting MSIVLCS to BWRs that do not have the systems has been
- raised -(Reference 4). The prioritization of Item C-8 incorporates all of the concerns outlined above.
I l
3.12-1 l-I l
NEDO-30670 3.12.2 Safety Significance Calculations by the NRC in 1975 for accidents with a TID source (Reference 5) indicated a potential increase in offsite releases of iodine by two to three orders of magnitude for proper operation of an MSIVLCS, when compared to the calculations of releases assuming the steam system is intact and MSIV leakage is eventually released through the condenser. Therefore, use of the MSIVLCS prescribed by Regulatory Guide 1.96 could increase the everall risk to the public. Additionally, the above calculations assumed a relatively low rate of MSIV leakage. Recent data has revealed a high frequency of measured MSIV leakage at some operating plants which may be in excess of the Technical Specification limit of 11.5 scfh by more than two orders of magni-tude. Leakage of this magnitude is beyond the design capacity of most MSIVLCSs and, as a result, the public risk associated with excessive MSIV leakage may be higher than previously assumed.
The safety significance of this issue has been decreased recently because of a program of testing and maintenance procedures initiated by the BWR Owners' Group.
The MSIVs have been the subject of extensive study over the last several years stemming from the operating plant maintenance activities to meet Tech-nical Specification limits. As a result, there are new techniques for testing and repairing the MSIVs which improve their sealing capability. Work with the BWR Owners' Group has also provided recommendations for maintenance and valve modification to reduce MSIV leakage.
Plants which have recently implemented the BRR Owners' Group recommenda-tions have found that the MSIV leakage has been within the Technical Specifi-cations or within a f actor of two of the Technical Specifications.
Based on these results, this item does not warrant a HIGH priority ranking for CESSAR II.
3.12-2 a_
=
' J < ?i
' C ;'
~;
)
\\
3.12.3 Resolution;for GESSAR II l
)
i
.The consequence evaluation performed to determine the priority ranking Lof this item contained several assumptions not applicable to CESSAR II.
- First, no credit' was given for " cascading" leakage in a main steam line with two or mors'HSIVs in s'eries. In fact, the GESSAR II design.has a total of four valves
.T-between the RPV and the turbine:
the inboard and outboard MSIVs, a leakage control valve and5the turbine stop valve. Second, leakage was assumed to be freleased directly to the environment.
In the GESSAR II design, leakage past all four valves would'be into the main condenser and most likely to the
. Turbine. Building through the gland seals. The large surface area for fission
'o y
-Lproductplatfo'ut, col'd trapping of iodine, steam atmosphere, multipla turns 4
1 s
- and bends, and smsll leakage pathways in this system provide significant fission product retention.
Third, the suppression pool bypass study documented in Reference 6 evaluated the prob' ability and consequence of fission product release through the<MSIVs. Nhe results of 'that study showed that the potential fission product release through the main steam. lines was negligible compared to the fission products which had received pool scrubbing and were, released after containment 4
failure. Therefore, this pathway has been evaluated and shown to contribute
'negligiblerisk[iftheGESSARIIdesign.
N
^'
+ e.
Fourth', 'according to the NRC staf f's ~ evaluation, only sequences with N
'leaka'ge rates of more than 100 scfh were dominant cSn:ributors to offsite i
Since the revised test and maintenance procedures are resulting consequences.
in leakage rates which are only 20% of the 100 scfh value, and the cascading effect of four valves in series would further' reduce ' leakage by f actors of
.two or more, the large leakage rates assumed in the NRC staff analysis are not x
-c Thus, a HIGH priority ranking is not
, applicable.to th; GESSAR II design.
_ appropriate for this item relative to GESSAR II.-
s N
\\
1
?
I\\
s
,s a
3.,12-3 is s
1 1
a
1 3.12.4 References 1.
NUREG-0471, " Generic Task Problem Descriptions (Categories B, C, and D),"
U.S. Nuclear Regulatory Commission June 1978.
2.
Regulatory Guide 1.96. " Design of Main Steam Isolation Valve Leakage Control Systems for Boiling Water Reactor Nuclear Power Plants," U.S.
Nuclear Regulatory Commission, June 1976.
3.
Memorandum for D. Eisenhut from E. Jordan, " Main Steam Isolation Valve (MSIV) Survey," July 1,1982.
4.
Memorandum for S. Hanauer from R. Mattson, " Request for Prioritization of BWR Main Steam Line Isolation Valve Leakage as a Generic Issue,"
July 30, 1982.
5.
TID-14844, " Calculation of Distance Factors for Power and Test Reactor Sites," U.S. Atomic Energy Commission, March 23, 1962.
6.
Letter for D. G. Eisenhut from J. F. Quirk, " General Electric Source Term Sensitivity Analysis," May 17, 1984.
3.12-4
g,,
4 ~. j.~ -7,6 3e a n.;
w g
- ~.-
s, 7 J
s
,, 4 NEDO-30670
~
y; 4
.l t}
l'
.,a 3.13 ASSESSMENT OF FAILUFE AND RELIABILITROF PUMPS AND VALVES (ITEM C-11)
~/ '
. j l '.
a
~.
3.13rl Issue Description 3
~
_i l_
- )
<4
.fTheoperatingexperienceofnuclcarpowerp(antsindicatesthatanumber
.m, ofjalves,4valveoperators,an{pumpsfailstooperateasspecifiedinthe Tschnical Specifications either under testing conditions or when they are
~
r called upon'to perform. Most of~11)mt' occurrences relate to valve leakage, valve actuation, and ' SRV operation outside their. operation'al b'ounds.
The s.
' lmainsteamisolation, safety,y$bes51 oidrvalves cause the most frequent
~
z ebnerm l occurrenceri in s&fety-related systems: U alve malfunctions can cause
' forced outage 4-ef oper/Ji'ng plants.
It is note'd thatsbout 10% of all outage time can be attributed to the malfunction of the criticai? pumps and valves u,
within thg plant. Of primayy interest are cutages' caused by the MSIVs and
.e SRVs.. 3' f'
l' w
The principal NRC activity rel{tive to Item C-ll a4' described in Refer-s ence 1 will b.,e thel evaluation of active pumps and valves with respect to their operability and reliabilit.y /nnderuccident loading,'pc.,' LOCA and SSE, and s.
implementation of a(corrective getion prograa spiegifically directed toward
,i,e
' improved design and fabric $51on of activq runps and4alves.'
~<-
7,
- pq
~
i s?
l3.13.2 Safety Signific,ance
,+
N UnreliabilityTofactivevalvesandpumpsinsl,/clgarplantsafet.ysystems contributies to the risk associated with postulated'ccre-mcit ~ accident J
w sequences.
~,
y v
p
~
3.13.3 Re up % for CESSAR II 3
e t
Ihis, item addresses improved $talve,or ruurn dgsign le.:li., SRVs, MSIVs 6
/
(including orientation effects), ECCS purps). :The conc,ern stems largely from w
'the TMI evcni in which valve failures contifibOted to the unintentional release offis3[ionproducth{ic,ntheplant. The GESSAR.II design is significantly improvSd over prevlous,BWR product lines and iges.not contain the same type r
of problema encountered at TH5., The SP.Vc are,'of a-different design (analog y
r d fy /
v I
i 3.13-0,
n9
,'d
'.q r
NEDO-30670 trip unit) and have features such as position indication (CESSAR II, Section lA.24) and reduced IORV frequency (CESSAR II, Section IA.60) which make the SRVs less of a concern from the standpoint of plant risk. As noted in the
. response to Item B-55, the GESSAR II design utilizes the direct acting spring loaded type SRV, not the pilot operated Target Rock type.
The MSIVs have been the subject of extensive study over the last several years stemming from the operating plant maintenance activities to meet Tech-nical Specification limits. As a result, there are new techniques for testing and repairing the MSIVs which improve their sealing capability. Training pro-grams are also available to utilities to ensure MSIV reliability. Work with the BWR Owners' Group has also provided recommendations for maintenance and valve ' modification to reduce MSIV leakage. As noted in response to Item C-8, these procedures have resulted in leakage tests which have been within a factor of 2 of the allowable leak rate.
The failures of active pumps and valves leading to core damage has been evaluated in the GESSAR II PRA (Section 15D.3).- The core damage frequency is dominated by Station blackout with failure of the RCIC System.
This sequence contributes about 90% to the core damage frequency.
Therefore improved. reliability of pumps and valves will not substantially decrease risk unless the improvement decreases the frequency of the CTl-Pa and CT1-Pb acci-dent sequences (GESSAR II, Section 15D.3, Appendix C).
As shown in the GESSAR II PRA, the CTI-P sequences are dominated by the common _ mode failure
^ of the'three diesel generators. -The reliability of RCIC is about 90%; it has a steam-driven turbine pump and all control valves are de-powered.
'If the RCIC were assumed to be perfectly reliable the risk reduction is only a factor of 1.2, as determined in Reference 2.
Therefore, any further improvement in reliability of active pumps and valves over the values assumed in the GESSAR II PRA (based on operational data given in GESSAR II, Section 15D.3, Appendix A) would not achieve the reductions in core-melt frequency estimated by the NRC staff in Reference 3 to determine this item's value/
impact.
3.13-2
NEDO-30670 In summary, improvements in the GESSAR II design relative to SRVs, and improvements in testing and maintenance of MSIVs have decreased the signifi-cance of these valves to risk. Further increases in the reliability of the remaining pumps and valves would have a negligible impact on the GESSAR II risk.
3.13.4 References 1.
NUREG-0471, " Generic Task Problem Descriptions (Categories B, C, rad D),"
U.S. Nuclear Regulatory Commission, June 1978.
2.
NEDE-30640, " Evaluation of Proposed Modifications to the GESSAR II Design,"
General Electric Company (Froprietary; to be issued).
3.
NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioriti-zation Information Development," U.S. Nuclear Regulatory Commission, February 1983.
3.13-3/3.13-4
NEDO-30670 3.14 BWR JET PUMP INTEGRITY (ISSUE 12) 3.14.1 Issue-Description Reference 1 drew attention to the generic issue of BWR jet pump integrity.
The concern that motivated Reference 1 was a February 1980 jet pump failure at
~
Dresden Unit 3, together with previous jet pump integrity-related problems at Dresden and Quad Cities.
The Dresden failure was caused by progressive stress corrosion cracking of the pump's hold-down beam. The unit was shut dosa and the failed beam was replaced with six other beams for which indications of cracking were found upon ultrasonic inspection.
Information concerning an earlier-(May 1979) jet pump beam failure at a foreign GW BWR came to NRC's attention after the Dresden 3 failure.
3.14.2 Safety significance 4
l[n CE BWRs (except in the earlier plants), water recirculation within the reactor vessel-during normal power operation is accomplished by a ring of 16 to 24 water-jet pumps. Failure of a pump is of concern not only because of each pump's contribution to proper distribution of water flow within the vessel-during normal operation, but also because the pumps are designed to assure maintenance of water level well up in the core region in the event of a LOCA.
..The jet pump inlet is located about two-thirds of the way up the core height.
j.
If pump. failure should lead to damage further down in the pump's diffuser, a i
lower-level outlet path could be opened to prevent reflooding of the core l
following a break in a recirculation line. A degraded jet pump could be more
(~
. vulnerable to damage from stresses due to water hammer or LOCA loads, should they occur. Also, jet-pump damage could permit increased rate of coolant loss in a LOCA since, in a LOCA, the jet pump's nozzle area is the limiting I
area for flow.
l I
3.14.3 -Resolution for CESSAR II I
y The issue of BWR jet pump integrity associated with progressive stress f
L corrosion cracking of the pump's hold-down beam has been solved by changing the material of the hold-down beam. The heat treatment material was qualified
('
3.14-1 L
i
i-r NEDO-30670 with extensive laboratory testing (Reference 2 and 3).
The factor of improve-ment was obtained by dropping the preload using a preheat treatment to get the 40-yr life. The improved hold-down beams were installed in the Kuo Sheng plant and have been operating for about 2 years.
Since the GESSAR II design utilizes.the improved hold-down beams, this issue has been resolved for GESSAR II.
3.14.4 References 1.
Memorandum for H. Denton from C. Michelson, "BWR Jet Pump Integrity",
May 23, 1980.
2.
Memorandum for J. N. Kass and G. M. Gordon from M. M. Bensch, " Rising Load Screening Test for Inconel X-750", March 1982 (General Electric Company Proprietary).
3.
Memorandum for J. N. Kass and G. M. Gordon from M. M. Bensch, "Inconel X-750 Screening Tests", September 15, 1982 (General Electric Company Proprietary),
3.14-2
NEDD-30670 3.15 REACTOR COOLANT PUMP SEAL FAILURES (ISSUE 23) 3.15.1 Issue Descriptions This issue deals with the high rate of RCP seal failures that challenge the makeup capacity of the ECCS in PWRs. The RCP seal failures in BWRs occur at a frequency similar to that experienced in PWRs.
However, operating exper-ience indicates that the leak rate for major RCP seal failures in BWRs is smaller. The smaller leak rate, larger RCIC, HPCS, and feedwater makeup capabilities, and isolation valves on the RCP loops negate the potential problem in BWRs.
3.15.2 Safety Significance As stated above, the safety significance in BWRs is minimal due to the makeup capability and the lower amount of leakage experienced in operating BWRs. The NRC has issued a Safety Evaluation Report (Reference 1) on this subject for BWRs in response to TMI Action Plan Item II.K.3.25, which concludes that no modifications to the seal cooling for recirculation pumps are required.
3.15.3 Resolution for GESSAR II
~
The CESSAR II design uses the same recirculation pumps as are currently in use in operating BWRs.
It is concluded that Reference 1 applies to CESSAR II design and that no modifications are required to address this issue.
3.15.4 References 1.
Safety Evaluation of BWR Owners' Group Generic Response to Item II.K.25 of NUREG-0737, Effect of Loss of Alternating Current Power on Pump Seals, December 1, 1982.
3.15-1/3.15-2
NEDO-30670 3.16 BOLTING DEGRADATION OR FAILURE IN NUCLEAR POWER PLANTS (ISSUE 29) 3.16.1 Issue Description There'are numerous bolting applications in nuclear power plants. The most
-crucial bolting applications are those constituting an integral part of the
' primary pressure boundary such as closure studs and bolts on reactor vessels, reactor coolant pumps, and steam generators. Failure of these bolts or studs could result in the loss of reactor coolant and thus jeopardize the safe opera-tion'of nuclear power plants. Other bolting applications, such as component support and embedded anchor bolts or studs, are essential for withstanding transient loads created during abnormal or accidental' conditions.
In recent years, the number of bolting-related incidents reported by the licensees of operating reactors and reactors under construction has increased.
A'large. number of the reported bolting incidents are related to primary pres-sure boundary applications and major component support structures. Therefore, there is increasing concern regarding the integrity of the primary pressure boundary in operating nuclear power plants and the reliability of the component
. support structures following a LOCA or earthquake. A report (Reference 1) summarizing bolting failure experience has been issued.
3.16.2 Safety Significance Most of the bolting incidents were discovered either during refueling
(
- outages or scheduled in-service inspections or maintenance / repair outages.
l Therefore fsuch reported incidents have no immediate impact on public health L
and safety and, so far, the bolting incidents have not resulted in accidents.
Degradation or_ failure of such studs end. bolts constitutes a reduction in the integrity of the primary pressure boundary. Concern is compounded by the fact that there is currently no reliable NDE method to detect the cracking or degradation of such bolts or studs resulting from the principal modes of failure: strese corrosion, fatigue, erosion corrosion, and boric acid corrosion.
l 3.16-1 v-g-
~
, +. -.. - - -.,, -,.. - - - -
-#,,-%---.v- - -.-,_ree-
-,4w m
,-e - *r e ew w e ve c r my --e-v----ve-w-w~ v -ww w w w T tw vrv e*m--
--ww--v--v-NEDO-30670 Visual examination is currently the only reliable method to discover degradation by boric acid corrosion or erosion corrosion.
In almost all cases, this requires disassembly of the component to inspect the bolts or studs.
If there is no clear evidence of boric acid leakage to the surroundings, bolt-ing degradation by boric acid corrosion can potentially be undetected until the bolts or studs completely fail. Under the present in-service inspection program, visual inspection of bolts is not a mandatory requirement and UT inspection is not required on pressure-retaining bolts or studs with diameters less than 2 inches.
A major accident such as a LOCA could conceivably accur as the result of undetected extensive bolting failure of the primary pressure boundary.
3.16.3 Resolution for GESSAR II As indicated in Reference 2, there have been a total of 44 bolting incidents, all reported by licensees of PWR plants. No BWR bolting incidents have been reported. The principal types or modes of Folting failure or degradation were classified as stress corrosion, fatigue, boric acid corro-sion, erosion corrosion, and "other".
A total of 19 bolting incidents were identified as resulting from stress corrosion which is the most common type of bolting failure.
Boric acid corrosion was the second most common type of bolting failure or degradation reported. A total of 12 bolting incidents resulting from boric acid corrosion have occurred.
The remaining 13 PWR incidents resulted from either fatigue, erosion corrosion, or "other".
The GESSAR II design is not subject to the boric acid corrosion mechanism of bolting failure or degradation.
The GESSAR II design guards against the most common type of bolting failure or degradation by not utilizing high strength (>l70 ksi ultimate) bolts. The following are specified for bolting materials:
i.
SA193, GR B7 (120 ksi) Flanges l
SA193, GR B8
( 75 ksi) Flanges SA193, GR B16 (125 ksi) Flanges SA564, Tp 630 (140 ksi) Submerged Services SA325, GR1-(105 ksi) Supports SAS40, GR B21 CL 1 (165 kai) Supports 3.16-2 l
L
NEDO-30670 Since no bolting failures have been reported to occur in BWRs, BWRs are not subject to the boric acid corrosion mechanism of bolting failure or degradation and the GESSAR II design does not utilize high strength bolts, this issue is considered resolved for GESSAR II.
3.16.4 References 1.
Memorandum for R. Vollmer from D. Eisenhut, " Transmittal of Report on Threaded Fastener Experience in Nuclear Power Plants," August 25, 1982.
2.
NUREG-0933, "A Prioritization of Generic Safety Issues," U.S. Nuclear Regulatory Commission, December 1983.
l l
t l
[
l f.
3.16-3/3.16-4 l
t
NEDO-30670 3.17 SAFETY CONCERNS ASSOCIATED WITH PIPE BREAKS IN THE BWR SCRAM SYSTEM (ISSUE 40)_
3.17.1 Issue Description This issue concerns failure of the scram discharge volume or associated piping which makes up the BWR Scram System. The concern is that such a leak would be unisolatable and thus contribute significantly to the public risk.
- Defined in Reference 1 is certain guidance which would provide mitigation and detection capabilities for the areas surrounding the scram discharge volumes.
3.17.2 Safety Significance 4
The concerns of this issue largely apply to Mark I and II containment types since in those designs the scram discharge volume and associated piping is located outside of the primary containment.
Since the CESSAR II design
-locates these components inside the primary containment, any leakage returns to the suppression pool, thus negating any concern over flooding of ECCS equipment.
3.17.3 Resolution for CESSAR II The GESSAR II design is acceptable without modification to respond to this issue because the scram discharge volume and associated piping is located
, within the primary containment. Furthermore, features of the GESSAR II design, such as containment sprays, make it possible to mitigate the effects of scram system breaks.
3.17.4 References l'.
NUREG-0803, " Generic Safety Evaluatinn Report Regarding Inerting of BWR Scram System Piping", U.S. Nuclear Regulatory Commission, August 1981.
h 3.17-1/3.17-2
NED0-30670 3.18 BWR SCRAM DISCHARGE VOLUME SYSTEMS (ISSUE 41) 3.18.1 Issue Description This issue concerns deficiencies in the scram discharge systems in BWRs.
The issue was raised in response to events which occurred at Browns Ferry j
Unit 3 in 1980, in which about 40% of the control rods failed to scram during a routine shutdown. Subsequent investigations by GE, the BWR Owners' Group and the NRC identified other problems with the scram discharge volume systems which required modification. These recommendations are included in Reference 1.
3.18.2 Safety Significance The safety significance of this issue lies in the potential for scram failure. The scram function is necessary in many transients to prevent core uncovery and/or overheating of the suppression pool. The GESSAR II PRA (GESSAR II, Section 15D.3) includes the probability for Scram System failure in the event trees based on the GESSAR design which includes modifications required in Reference 1.
Because of these modifications and the other modifi-cations to address ATWS events, the overall risk to the public is minimized.
The GESSAR II PRA indicated that ATWS events contribute about 1% of the total core damage frequency in the GESSAR II design.
3.18.3 Resolution for GESSAR II The recommendations of Reference 1 are incorporated into the GESSAR II design and are discussed in GESSAR II Subsection 4.6.1.1.2.4.2.5.
Therefore, this issue is resolved for the GESSAR II design.
l l-3.18.4 References 1.
NRC Letter to all BWR Licensees, "BWR Scram Discharge System",
December 9, 1980.
I 3.18-1/3.18-2
.,.,,,-e
-,.,m-,,-,.., -,. -.
NEDO-30670 3.19 REACTOR VESSEL' LEVEL INSTRUMENTATION IN BWRs (ISSUE 50) 3.19.1 Issue Description The BWRs use reactor level instrumentation to perform a number of func-tions including control functions, such as feedwater control, and protective functions, such as automatic scram and autostart of the ECCS. This issue considers the potential for adverse system interactions between the control system and the protection systems. As an example, the interactions may lead to loss of reactor water level due to automatic termination of normal feedwater i:
(control) and failure to automatically start the emergency feedwater source (protection).
This issue has been addressed generically by the BWR Owners' Group in Reference 1 along with other concerns regarding BWR water level measurement systems. One of the conclusions of Reference 1 which relates to this issue is that for plants which have demonstrated a vulnerability to adverse system interaction following a water level reference leg break. a plant specific study should be conducted to evaluate potential logic or configuration changes which would address the concern.
3.19.2 Safety Significance The consequence of an adverse system interaction which prevented an automatic reactor scram due to an erroneous high water level indication (resulting from a break in the narrow range water level instrument reference leg in combination with reduced actual water level in response to the feedwater control system) is similar to a loss of feedwater event which is addressed in the GESSAR II PRA (GESSAR II, Section 15D.3). However, since this system interaction makes up only a very small fraction of the loss of feedwater event frequency, its contribution to total public risk is slight.
b
- n. s, -. :. n.
3.19-1
~r
NEDO-30670 3.19.3 Resolution for CESSAR II The GESSAR 11 design includes features not found in previous BWRs which further reduce the significance of this issue. Specifically, in response to Reference 2, an Enhanced Water Level Instrumentation System was included in the GESSAR 11 design. This enhanced design includes indication of instrument line breaks or leaking equalizer valves to alert the operator that one channel of the water level measurement system may be erroneous. With this information, the operator would normally switch the control of the feedwater control system to.the correctly functioning channel. This eliminates any further potentially adverse system interae* ion. In addition, the GESSAR II design contains mul-tiple ECC Systems activated from one of two mechanical divisions in such a way as to ensure adequate core cooling in the event of instrument line breaks. It is concluded that the GESSAR II design is acceptable so far as this issue is concerned.
3.19 4 References 1.
Review of BWR Reactor Vessel Water Level Measurement Systems, SIL 8211, July 1982.
2.
" Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident, Regulatory Guide 1.97, Revision 2. U.S.-Nuclear Regulatory Commission, December 1980.
3.19-2
NEDO-30670 3.20 SRV LINE BREAK INSIDE THE BWR WETWELL AIRSPACE OF MARK I AND MARK II CONTAINMENTS (ISSUE 61) 3.20.1 Issue Description The SRVs of a BWR plant provide protection against overpressur'ization of I
the reactor primary system. During normal operation, the SRVs which are mounted in the main steam lines open on high pressure permitting steam to escape from the reactor vescel.
The SRV discharge lines carry the steam through the drywell, into the wetwell, and discharge into the suppression pool thus condensing the steam. Failure to condense the steam would eventually lead to rupture of the containment boundary and possibly loss of reactor coolant inventory.
This issue postulates a break in the SRV discharge line in the wetwell airspace above the suppression pool of tbrk I and II plants. Coupled with the line break is a failure of the relief valve to close after its actuation in response to the transient. The relief valve must be postulated to remain open for a significant amount of steam to escape, bypass the pool, and threaten overpressurization of the containment vessel with rupture in approximately 10 minutes.
3.20.2 Safety Significance The scenario described above would result in a direct release of reactor coolant and effluents to th*e environment.
If major core damage or core-melt were to occur, either as a result of the above event or as an independent event, large offsite releases of radioactivity would be experienced.
One of the design differences between the tbrk I or II containments and the Mark III containment resolves this issue, thereby negating any safety significance for the GESSAR II design.
3.20-1
NEDO-30670 3.20.3 Resolution for GESSAR II One of the proposed solutions identified by the NRC to reduce the e
probability of containment failure for the stuck-cpen SRV with discharge line failure in the wetwell air space involved the installation of guard pipes around the SRV discharge lines in the wetwell air space. The GESSAR II design takes the guard pipe concept one step further. The SRV discharge line is routed through the drywell wall and enters the suppression pool below the water line.
If for some reason the water level would be below normal, the design also incorporates a sleeve which surrounds the discharge line and ter-minates in the pool at a depth equal to the coverage of the first row of horizontal vents. This design (CESSAR II, Figure 3BA-2) effectively eliminates the possibility of a discharge line break in the wetvell air space. Therefore, this design improvement in GESSAR II resolves Issue 61.
3.20.4 References None.
3.20-2
NEDO-30670 3.21' PROBABILITY OF CORE-MELT DUE TO COMPONENT COOLING WATER SYSTEM FAILURES (ISSUE 65) 3.21.1-Issue Description This issue concerns the failure of component cooling water systems which have the consequence of rendering the ECCS pumps or containment cooling systems inoperable, causing a small LOCA, or otherwise affecting the ability of a plant to prevent a core-damage event. The issue is primarily a concern for PWR designs which rely heavily on component cooling for engineered safety featurcs. An analogous concern for the BWR is a possibility.
3.21.2 Safety Significance 4
The GESSAR II PRA (GESSAR II, Section 15D.3) considered the support sys-tems required for continued operation in the system fault trees. The failure probabilities-for room cooling units, and other cooling required by the emergency service water were assessed and quantified for the evaluation. The failure of component cooling water to the recirculation pump seals has also been considered and is discussed in Section 3.15 (Issue 23). The conclusion drawn from these evaluations is that the significance of component cooling water failure is either insignificant or already accounted for in the CESSAR II PRA wh'.ch shows an acceptable risk to the public.
3.21.3 Resolution for GESSAR II The GESSAR II design uses self-cooling for the pumps in the RCIC and essential service water for the other ECCS components.
Component cooling via a closed cooling water system is used only for functions such as sample cool-ing, drywell cooling, and recirculation pump seals which do not pose a signifi-cant risk if they fail to function. Because part of the Essential Service Water System design is outside the GESSAR II scope, its potential to contribute to the probability of core melt is addressed by an interface requirement as discussed in Reference 1.
3.21-1
__-.4
_.-,.-,,.-,-,.r-
- - + - - - -.
+ - - - -
s t.-
.2-NEDO-30670
' 3.21.4 ' References-
- 1. -.
1.etter for D. G._Eisenhut from J. F. Quirk, " Control of GESSAR II Nuclear Island Balance of Plant Interfaces", to be issued.
4, 3.21-2
NEDO-30670 3.22. FLOODING OF SAFETY EQUIPMENT COMPARTMENTS BY BACK-FLOW THROUGH FLOOR DRAINS (ISSUE 77) 3.22.1 Issue Description On November. 11, 1981, Calvert Cliffs, Units 1 and 2, had been notified that the water. tight integrity of the service water pump rooms in both units could be impaired because check valves had not been installed in the floor drain system, which drains by gravity to the turbine condenser pit in the Turbine Building. Without these check valves, the operability of the service water pumps for both units could not be assured in the event of a circulating water conduit break in the Turbine Building of that unit.
This event was subsequently reported as LERs 81-79 and 81-47 for Units 1 and 2, respectively.
'This matter was presented in Reference 1, in which an evaluation was
. performed on-the generic implications of these events.
It was noted that the
. Systematic Evaluation Program, begun in 1978, did not specifically review the matter-of backflow flooding protection through drain lines in safety-related equipment compartments.
In addition, AEOD reviewed other programs to establish
. hether.this issue had been treated elsewhere.
It was established that a w
generic review entitled, " Flood of Equipment Important to Safety" was tracked as T pic 3-18 in the Regulatory Licensing-Status Summary (NUREG-0328) and was applicable to all operating plants as of March 1974. Topic 3-18 was not con-cluded successfully, however, and the problem was assigned to Generic Technical Issue B-11,~"Subcompartment Standard Problems". A review by AEOD led to the conclusion that the drain line problems and the matter of backflow flooding protection had not been. addressed adequately. Currently, the most relevant ongoing w'rk that has been identified by AEOD is USI A-17, " Systems Inter-o actions in Nuclear Power Plants" and an adjunct TMI Action Plan Item, III.C.3,
" Systems Interaction." However, it was concluded that these activities do not explicitly address the issue of improperly designed floor drain systems.
An I&E Information Not' ice -(Reference 2) concerning the potential generic implications of this issue was published on July 1, 1983.
3.22-1
NEDO-30670 3.22.2 Safety Significance The Service Water Systems at Calvert Cliffs, Units 1 and 2, each have three pumps and serve both safety and nonsafety equipment. The three service water pumps for each unit are located in a single room and service water systems for Units 1 and 2 can be cross-connected by spool pieces to allow the Unit 1 System to backup Unit 2 and vice versa. However, Units 1 and 2 share a common Turbine Building, so both of the service water pump rooms would be simultaneously affected by a circulating water conduit break in the Turbine Building if backflow flooding protection was not provided. Additional specific details concerning the Calvert Cliffs plants are presented in Reference 1.
The safety significance of the loss of the service water pumps lies in the fact that the Service Water System serves as the ultimate heat sink in nuclear plants.
In general, the service water provides cooling, either directly or indirectly, for the following plant components: component cooling water heat exchangers, containment fan coolers, diesel-generator coolers, control room air conditioning system condensers, computer room air conditioning system condensers, Auxiliary Building ventilation system cooling coils, con-tainment spray pump diesel engine coolers, Auxiliary Building room coolere and, is the auxiliary feed pumps emergency suction supply. The component cool-ing water, in turn, is required for the proper operation of essential pumps and heat exchangers required for the safe shutdown of a nuclear plant. Without these essential systems, the probability of core-melt becomes unacceptable.
The safety significance of this issue does not apply to plants reviewed and licensed in accordance with Reference 3 because the Reference 3 Sections 9.3.3., " Equipment and Floor Drainage Systems," and Section 10.4.5, "Circulat-ing Water System," adequately deal with the concern presented in this issue.
The safety significance is limited to older plants which were licensed some time before the formalization of Reference 3, but the extent of possible design deficiencies in these older plants is unknown at present.
In addition, it is noted that the fundamental problem of backflow flood-ing of safety systems through drains is a potential problem with implications that are much broader than those related to the specific situation at Calvert i
I 3.22-2 J
l NEDO-30670 i
Cliffs, used for the purposes of analysis herein. Safety components other than service water pumps may be affected in either BWR or PWR Systems, and the flooding may be from sources other than circulating water conduits and thb turbine condenser pit. An example illustrating this point is the flooding incident which occurred at the Oconee Nuclear Station, resulting from the inadvertent opening of a main condenser isolation valve.
.3.22.3 Resolution for GESSAR II As indicated in Subsection 3.22.2, the safety significance of this issue does not apply to plants reviewed and licensed in accordance with Reference 3, Sections 9.3.3 and 10.4.5.
The NRC review (Reference 4) of the GESSAR II equipment and floor drain system considered those safety systems needed to provide safe plant shutdown and the physical location of those systems with regard to potential in-plant flooding. Because of their location at the lowest elevation in the Auxiliary Building, the ECCS equipment rooms that contain components required for safe plant shutdown were considered to be of particular importance with respect to provisions for prevention of water accumulation.
In addition, each ECCS pump is located in an individual watertight room that contains a sump to collect leakage from equipment within the room. The collected leakage then flows by gravity through an embedded line to the Auxiliary Building floor drain room sump.
Finally, backflooding of the ECCS rooms is prevented by a Seismic Category I manually operated, normally closed valve in the line lead-ing to the sump.
Each sump contains redundant safety-related level switches that operate an alarm in the control room to alert the operators to open the
. valve and that there is leakage in the room.
The circulating water system is not within the scope of the GESSAR 11 design and this system will be supplied by the Applicant referencing GESSAR II.
However, meeting the requirements of Reference 3, Section 10.4.5, are assured in accordance by GESSAR 11. Subsection 1.8.0.1, which commits the Applicant, with the SRp Rule [10CFR50.34(g)], to provide a summary of deviations from Reference 3 ~ for those plant de sign features outside the CESSAR 11 scope with 3.22-3
NEDO-30670 corresponding evaluations that describe the basis which the Applicant concludes that the underlying requirements are satisfied.
In summary, this issue is considered resolved on GESSAR II since the design explicitly meets the requirements of Reference 3, Section 9.3.3 and CESSAR 11 provides the commitment for the Applicant to address any differences between its circulation water system design and the requirements of Reference 3, Section 10.4.5.
3.22.4 References 1.
Memorandum for H. Denton from C. Heltemes, " Engineering Evaluation Report, Investigation of Backflow Protection in Common Equipment and Floor Drain Systems to Prevent Flooding of Vital Equipment in Safety-Related Compart-ments," March 11, 1983.
2.
I&E Information Notice No. 83-44, " Potential Damage to Redundant Safety Equipment as a Result of Backflow Through the Equipment and Floor Drain System," U.S. Nuclear Regulatory Commission, July 1, 1983.
3.
NUREG-0800, " Standard Review Plan", U.S. Nuclear Regulatory Commission.
4.
NUREG-0979, " Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design", U.S. Nuclear Regulatory Commission, April 1983.
3.22-4
e-NEDO-30670 3.23 BEYOND DESIGN BASIS ACCIDENTS IN SPENT FUEL POOLS (ISSUE 82) 3.23.1 Issue Description The risks of beyond design basis accidents in the spent fuel storage pool were examined in Reference 1.
It was concluded that these risks were orders of magnitude below those involving the reactor core. The basic-reason for this is the simplicity of the spent fuel storage pool: the coolant is at atmospheric pressure, the spent fuel is always suberitical and the heat source is low, there is no piping which can drain the pool, and there are no antici-pated operational transients that could interrupt cooling or cause criticality.
-The reasons for re-examination of spent fuel storage pool accidents are two-fold. First, spent fuel is being stored instead of reprocessed.
This has led to the expansion of onsite fuel storage by means of high density storage racks, which results in a larger inventory of fission products in the pool, a greater heat load on the pool cooling system, and less distance between adjacent fuel assemblies. Second, some laboratory studies have provided evi-dance of the possibility of fire propagation between assemblies in an air-cooled environment (References 2 and 3).
These two reasons, put together, provide the basis for an accident scenario which was not previously considered.
3.23.2 gafety Significance A typical spent fuel storage pool with high density storage racks can hold roughly five times the fuel in the core. However, since reloads typically discharge one third of a core, much of the spent fuel stored in the pool will have had considerable decay time. This reduces the radioactive inventory somewhat. More importantly, after roughly 3 years of storage, spent fuel can be air-cooled, i.e., such fuel need not be submerged to prevent melting.
(Submersion is still desirable for shielding and to reduce airborne activity, however.)
If the pool were to be drained of water, the discharged fuel from the last two refuelings would still be " fresh" enough to melt under decay heat.
However, the Zircaloy cladding of this fuel could be ignited during the heatup 3.23-1
NED0-30670 (Reference 2).
The resulting fire, in a pool equipped with high density j
storage racks, would probably spread to most or all of the fuel in the pool The heat of combustion, in combination with decay heat, would certainly release considerable gap activity from the fuel and would probably drive " borderline aged" fuel into a molten condition. Moreover, if the fire becomes oxygen-starved (quite probable for a fire located in the bottom of a pit such as this), the hot zirconium would rob oxygen from the uranium dioxide fuel, forming a liquid mixture of metallic uranium, zirconium, oxidized zirconium, and dissolved uranium dioxide. This would cause a release of fission products from the fuel matrix quite comparable to that,of molten fuel (Reference 4).
In addition, although confined, spent fuel pools are almost always located outside of the primary containment. Thus, release to the atmosphere is more likely than for comparable accidents involving the reactor core.
The ACRS comments en this issue (Reference 5) were that the priority of MEDIUM is the absolute maximum that could possibly be tolerated. The ACRS considers that a priority of LOW would be quite acceptable for this issue since the MEDIUM ranking was based on very pessimistic assumptions, and even the use of these assumptions resulted in low consequences.
The safety significance and MEDIUM priority ranking of this issue are based on the estimate of a seismic event capable of draining the pool which
-5 has a frequency of 10 per reactor year. Loss of pool makeup was assessed
-6 at a conditional probability of 0.19 giving an accident frequency of 2x10 The analysis is based on the WASH-1400 assumption of a fuel pool design which was at an elevation approximately 10 stories above grade. This assumption is not applicable to the GESSAR II spent fuel pool which is located below grade and, therefore, the MEDIUM priority ranking is questionable for application to GESSAR II.
3.23.3 Resolution for GESSAR II The fuel pool in the GESSAR II design is located below grade in the Seismic Category I Fuel Building at the elevations given in GESSAR II, Figure 1.z-9.
The bottom of the pool is 23 feet below grade and sits on the basemat.
3.23-2
NEDO-30670 Relative to seismic events, the seismic capacity of the Seismic Category I buildings (Control, Fuel, Auxiliary) was evaluated, and the results are reported in the Seismic Event. Analysis (Reference 6).
The assessed median seismic capability of these buildings was 2.0g.
Therefore an earthquake with
-3 frequency of 10 per reactor year has only a 10 probability of causing
~
damage to the fuel storage pool. Therefore the frequency of a seismic event causing pool drainage is about three orders of magnitude less for the GESSAR II design relative to the WASH-1400 assumptions.
Another assumption which was included in,the NRC staff's consequence evaluation for this event was that the " freshest" fuel stored was only 7 days old at the time of the event.
The probability of a seismic event occurring within the first 7 days after core off-load is 0.013 (7 days out of 18 months).
Therefore the frequency of the event analyzed to determine the risk was
-6
~0 actually 2x10 x 0.013 = 2.6x10 per reactor year.
It would have been more appropriate to evaluate the consequences for an event with fuel decay time of 270 days (9 months) which corresponds to the median (probability equal to 0.5),
decay time, which would have been much less consequence than the low probability This more likely consequence analysis would also have resulted in a case.
lower priority ranking for this issue.
The lower frequency of the postulated spent fuel pool accident for the GESSAR II design can be attributed to the improved seismic design and the below grade elevation of the pool. The low frequency and low consequences of this sequence resolve the issue for GESSAR II.
3.23.4 References 1.
WASH-1400 (NUREG-73/014), " Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
2.
Memorandum for T. Speis from R. Mattson, " Proposed Generic Issue on Beyond Design Basis Accidents in Spent Fuel Pools," August 10, 1983.
3.23-3
NEDO-30670 3.
NUREG/CR-0649, " Spent Fuel Heatup Following Loss of Water During Storage,"
U.S. Nuclear Regulatory Commission, May 1979.
4.
Memorandum for Z. Rosztoczy from P. Williams, " Trip Report: International Meeting on Severe Fuel Damage and Visit to Power Burst Facility," April 25, 1983.-
5.
Memorandum for W. Dircks from R. Fraley, "First Set of ACRS Comments on the Prioritization of the Remaining Generic Issues", May 15, 1984.
6.
Letter for D. G. Eisenhut from J. F. Quirk, "GESSAR II Seismic Event Analysis in Support of the Severe Accident Review of GESSAR II",
September 21, 1983.
1 1
J i
3.23-4
NEDO-30670 4.
SLWiARY AND CONCLUSIONS As noted in Section 1, the intent of this report is to demonstrate the technical resolution for applicable USIs and GSIs for GESSAR II.
Based on the information provided in this report and the information supporting this report, it is concluded that the technical resolution of all applicable USIs and GSIs has been demonstrated as being consistent with the intent of the NRC's proposed policy on severe accident issues for future reactor designs. A summary status of these resolutions is provided in Table 4-1.
4-1
I.
La NEDO-30670
.n 1
f A
1-Table 4-1
.h
$139tARY STATUS OF UNRESOLVED AND GENERIC SAFETY ISSUES RESOLITIION TOR GESSAR II 4
i
's i
\\
GESSAR II
,( j Resolution 1's.
g Number-r Title Category a N'
}'
Q, Unresolved Safety Issues, i\\
l g
s,s
(
1 A-1 ' %
Waterhasser{
x
- A-17 Sys tems 'I'titera ction
'h ' <
'l
\\
3 s
t P,\\
^5+
' % d-d3'e Ccatainment' Ekrg'ency Sump'Rel'iab'111ty.!
1 s :-
I, S'
\\
3 fA-44 Station Blackout s
p
(
i
'A-45' Shutdown Decay Heat Rgmoval Requirements 1
A Safety \\;3 Implications of Coatrol Systems 3
,4..s
,P IA-47)
.Ak8
'HydrNgIn Cmitrol" N
3 l
\\
'.,,.\\.k 3*
yi
\\
{
Gee sic Safety-Issur
\\
6:
s A
1
-w.
gy
'A-29' Y Nuclear"Powcr P'.anCDesi n for the Reduction of
?Vu.lnerability,t'o)IndustrialSabotage 1
v.
4
.y A-30'j,
Adequacy of' Safety-Related DC Power Supplies 1
\\
3-5' Ductility of Teo-Way Slabs and Shells and Buckling Behavior of SYtel Containments 1/2 1.
{
"ah Ddetility of Two-Way Slabs and Shells (1) 6 g]
' b2, Buckling Behavior of Steel containments (2) 3-6'i Loads,,14d Combinations. - Stress Limits 2
re 3 -
'A-10 Behavier 'o! BWR Mark III Containment 2
I' s
I B,*,17; Criteria fo;tt Salety-Related
' ator Actions 3
]M 'E-26.N as; Structural frt,'tgrity of Containment Penetrations 1
9
/
s
.3 s
s 5-55 Improved Reliability of Target Rock Safety-Relief
,y i
1
.,3., t y-; q p yalves Dl/ \\ 5-56'. C Diesel Reliability 1
t
\\\\
9.,.
B-58 I Passive Mechanical Failurds 1
i s
t.
B-61 A1.twable ECCS Equipment'Ontage Periods 3
i
-s C-8 Maisk,SteamLineLeakageControlSystems 3
s t.
s
s C-11; AssepsentofFailureandReliabilityofPumpsand 1.. a.
Valus}
3 i
I X4-2 4
g l
1 x
_ -. _ _ ~ - _..... _.,, - -, _,. _. _ _..,, -
NEDO-30670 Table 4-1 SIRMARY STATUS OF Uh' RESOLVED AND GENERIC SAFETY ISSUES RESOLUIION
=
FOR GESSAR II (Continued)
GESSAR II Resolution Number Title Category a Generic Safety Issues 1
12 BRR Jet Pump Integrity 23 Reactor Coolant Pump Seal Failures 1
29 Bolting Degradation or Failure in Nuclear Power 1
Plants 40 Safety Concerns Associated with Pipe Breaks in the 1
BRR Scram System 1
41 BWR Scram Discharge Volume Systems 50 Reactor Vessel Level Instrumentation in BWRs 1
61 SRV Line Break Inside the BWR Wetwell Airspace of 1
Mark I and II Containments 65 Probability of Core Melt Due to Component Cooling 3
Water Systems Failure 77 Flooding of Safety Equipment Compartments by Back 1
Flow Through Floor Drains 82 Beyond Design Basis Accidents in Spent Fuel Pools 3
- Resolution Category 1 - Completely Resolved 2 - Resolution in Process 3 - Resolution with NRC Concurrence 4-3/4-4
.s s.
a v,
~> s t
t a
4 OPPENDIX A x
m s
ETTECTS OF HYDROGEN CONTROL ON 'fHE"FJSK J"0M SEVERE ACCIDE:ES
,'n FOR GEGSK.'1b y
~
x
/
/
4 4
,,e lc
/
4'
, ~ - %sA M i
h
$)
g x/
r' f
f
/
- w. O sw s
s
- ,s f
/, 7 s
t 9e r
< ~. i
..s..
1,
f, e
t /_ '
s-r i
r j ~f.f,< '
, y s,
, r..
D w
>- j,
- s,
,c, -
. l.
r i>
(
v
+
s
.s,,.
m s
- e.
,~
t
~.
v 4
A.-
.m x.
r a
/
s$
7>
s u
~
,,7
?
s
/
.> r u
s
~
y w
A-1/A-2
~
E O W' Y q
/
et
/,
-O
. ?' '
L
~
r-NEDO-30670 CONTENTS e
Section Title h
i.
A.1 INTRODUCTION A-5 A.2 METHODOLOGY A-5 A.3 RESULTS A-7 A.4
' COMPARISON TO PROPOSED SAFETY GOAL A-8 A.S CONCLUSIONS A-10 A.6 REFERENCES A-10 x:
L
., f ' _ 3 -
4 4
A-3/A-4
NEDO-30670 A.1 INTRODUCTION One of the key issues identified by the NRC related to severe accidents has been hydrogen control.
In the notice of Proposed Rulemaking on Interim Requirements Related to Hydrogen Control in December,1981, the NRC has
. proposed additional hy rogen control systems for the BWR/6 - Mark III design d
to accommodate hydrogen release from postulated severe accidents. The proposed rule would require Applicants to demonstrate maintenance of con-tainment integrity for events which release an amount of hydrogen equivalent to 75% metal-water reaction of the active fuel cladding.
This quantity of hydrogen can only be generated from a severely degraded core and most probably an accident with substantial core melt. Core meltdown accidents may lead to core-concrete interaction and loss of containment integrity by the generation of non-condensible gases, such as carbon monoxide and carbon dioxide. Precluding hydrogen combustion in the accident sequence will not prevent eventual loss of containment integrity. Overpressurization of containment by concrete decomposition products can occur in all current light water reactor containment designs.
Discussed in this appendix is the potential risk reduction for precluding hydrogen combustion in a Mark III containment. The potential risk reduction is minimal because the Mark III containment is designed to mitigate the effects of loss of containment integrity caused by either hydrogen combustion or concrete decomposition.
- \\'
The GESSAR II PRA (CESSAR II, Section 15D.3) considered hydrogen genera-tion for severe accidents. The PRA quantified the consequence of hydrogen combustion events taking account of the structural capability of the drywell and suppression pool to assure scrubbing of potential fission product releases, even for cases with loss of primary containment integrity. Fission product retintion by suppression pool scrubbing means that the containment function (limiting offsite doses) is maintained even for severe accidents.
A-5 e
Quantification of the fission product scrubbing capability of the suppression pool during severe accidents was based on General Electric's Fission Product Scrubbing Program (CESSAR II, Section 15D.2). A first principles analytical model was developed to describe fission prod
-t scrubbing in the suppression pool.
Experimental verification of this model was obtained at GE facilities by mass-transfer and hydrodynamic testing and further verified by teste conducted by EPRI. This model predicts that the suppression pool would reduce particulate fission product releases by a factor of 10,000 in the unlikely event of a severe accident. These results confirm that the BWR suppression pool would effectively retain fission products release during severe accidents.
Utilizing the accident sequence results developed in the PRA for full core meltdown accidents and an assessment of partial core-melt accidents (where the melt propression is terminated inside the reactor pressure vessel), the maximum potential risk reduction for a hydrogen control system in the GESSAR II design was evaluated.
A.2 METHODOLOGY Two approaches were used to assess the maximum risk reduction afforded by the addition of a hydrogen control system to the GESSAR II design. The first approach used PRA techniques to assess the plant risk in terms of man-Rem / year.
[
- The PRA assumes that all core damage sequences result in full core meltdown and loss of containment integrity.
I The results from all accident sequences were grouped into 15 fission product' release categories (compared to 5 used in Reference A-1).
These 15 release'categhries were input to the analysis which determines offsite con-sequences. In 7 of the 15 categories, loss of primary containment integrity was pcuculated to result from hydrogen combustion.
In the remaining eight 1 categories, containment overpressurization by steam or noncendensible gases-was postulated. The effect of precluding hydrogen combustion for the first seven. categories is to shift the loss of containment integrity from the time of hydrogen combustion to the time of containment overpressurization from i
inoncondensibles generated primarily by core concrete interaction. This delay l-A-6 l~
f
NEDO-30670 in the time of fission product release could reduce risk by allowing additional time for fission product decay before the loss of containment integrity.
Mean risk was calculated using the CRAC code with the Reference A-1 Site 6 meteorology and population within 50 miles of the plant. Site 6 was used as a representative site because it has average site characteristics. The population within 50 miles was used to allow comparison with the proposed NRC safety goal (Reference A-2).
Relative to the proposed safety goal, the GESSAR 11 plant risk is well below the proposed numerical guidelines for core melt probability and risk.
The second rethod of assessing the maximum effect of hydrogen control on severe accident risk considered partial core-melt sequences. Partial core-melt is defined as an accident where core cooling is restored in time to arrest the melt progression and establish coolable geometry within the reactor pressure vessel. Partial core-melt was analyzed since the NRC has focused on less than a full core meltdown for consideration in hydrogen control rulemaking. Two cases were analyzed:
10% of the core melted and 50% of the core melted. These two cases were chosen to represent approximate bounds for partial core-melt i
conditions. Events with less than 10% core melt do not produce substantial amounts of hydrogen (less than 12% metal-water reaction). For events with greater than 50% core melt, termination of the event within the reactor pressure vessel cannot be assured, and the event would then fall into one of l-the full meltdown sequences previously discussed.
Fuel releases of fission products were calculated as a function of temperature and time at temperature. Six transient-initiated accident I'
sequences were modeled. These sequences contribute 98% of the assessed frequency of core damage- (see Table A-1) for GESSAR II.
A.3 RESULTS Risk results of the full core-melt accident sequences are given in' l
The results are expressed as man-Rem per reactor year (for a Table'A-2.
A-7 l
~
NEDO-30670 population to 50 miles) and the GESSAR II PRA result (for a population to 500 miles). The PRA result is provided for comparison only. These results a
combine the probability of the accident and its consequences.
It can be concluded that the maximum risk reduction achievable (including mitigation of concrete decomposition effects) is 0.14 man-Rem / reactor year which is a small risk reduction when compared to the safety goal numerical guidelines discussed in Subsection A.4.
Table A-3 gives the results of the partial core-melt analyses in man-Rem.
- A comparison is made to the natural background radiation (100 millirem) received by the same population in one year. The partial core-melt results are expressed in terms of consequences only with no regard for the probability of. accident occurrence (i.e., accident probability assumed equal to one).
It can be seen that for the 50% core-melt case, the total exposure from the acci-dent ~is equivalent to 3% (24,360 man-Rem) of the annual background radiation exposure. Therefore, in absolute terms, any reduction in this exposure is not significant.
4
'A.4 -COMPARISON TO PROPOSED NRC SAFETY GOAL In February'1982, the NRC published for public comment a proposed policy statement on; safety goals for nuclear power plants.
In addition, a separate report.(Reference A-3) discussing the development of the proposed policy c
statement was. published. Although the NRC safety goal policy is only-in draft
. form, it' provides a useful comparison in assessing the results of the l
GESSAR 11 PRA.
The proposed NRC policy statement'pr' poses the following numerical o
guidelines:
1.'
Individual and Societal Mortality Risks i
The risk to an individual or to the population in the vicinity l.
of a nuclear power plant site of. prompt fatalities that might result f rom reactor accidents should not exceed one-tenth of one A-8
~
NEDO-30670 percent'(0.1%)'of the sum of prompt fatality risks resulting from other accidents to which members of the U.S. population are generally exposed.
The risk to an individual or to the population in the area near a nuclear power plant site of cancer f atalities that might rc : ult from reactor accidents should not exceed one-tenth ~of one percent (0.1%) of the sum of cancer fatality risks resulting from all other causes.
1
-2.
Benefit-Cost Guideline The benefit of an incremental reduction of risk below the numerical guidelines for societal mortality risks should be compared with the associated costs on the basis of $1,000 per man-Rem averted.
3.
Plant Performance Guideline
.Large-Scale Core-Melt: The likelihood of a nuclear reactor accident that results in a large-scale core-melt should normally be less than one in 10,000 per year of reactor operation.
A comparison of the PRA results to the NRC proposed guidelines is provided in Table A-4.
Comparison is made to all the numerical guidelines dealing with mortality risks and plant performance.
-6 The calculated core melt probability of about 5 x 10 per reactor year for.the GESSAR II plant is a factor of 20 below the proposed plant performance guideline. There were no calculated early (prompt) fatalities for the sequences considered. Consequently, the GESSAR II results are well below the NRC guidelines for individual and societal prompt fatality risks. The NRC numerical guideline for individual latent (cancer) fatality risk is based on
~0 0.1% of national statistics and is equivalent to %2.0 x 10 The GESSAR II A-9
-0 individual latent fatality risk within 1 mile was calculated to be 2.0 x 10
-5 The societal latent fatality risk is calculated to be 1.7 x 10 and is five -
orders of magnitude below the guideline value of 3.2.
Comparison of the results in Table A-2 to the proposed cost-benefit guide-line of $1000 per man-Ren averted shows that an estimated $10 million hydrogen control system fails the proposed cost-benefit comparison by orders of magnitude.
If a system could avert all man-Rem from the accident (which is clearly impossible), the system should cost less than $140 per year (0.14 man-Rem x $1000) to be cost-beneficial. Considering partial core-melts without regard to accident probability, the maximum risk reduction afforded by a hydrogen control system is insignificant (24,000 man-Rem) compared to annual background radiation (800,000 man-Rem).
A.5 CONCLUSIONS Relative to natural background radiation, the addition of a hydrogen control system provides minimal risk reduction. Further, the CESSAR Il plant risk ~is already low compared to the proposed NRC Safety Goal and, thus, the provision of an additional hydrogen control system is not cost effective.
A.6 REFERENCES A-1. WASH-1400 (NUREG-75/014), " Reactor Safety Study. An Assessment of Accident Risks in U.S. Commerical Nuclear Power Plants". U.S. Nuclear
-Regulatory Commission, October 1975.
A-2. NUREG-Ob80, " Safety Goals for Nuclear Power Plants: A Discussion Paper",
U.S. Nuclear Regulatory Commission, February 1982.
A-3. NUREG-0800m : Standard Review Plan", U.S. Nuclear Regulatory Commission.
A-10 t
NEDO-30670 Table A-1
~
GESSAR II PRA RESULTS:
BREAKDOWN OF THE ASSESSED FREQUENCY OF CORE DAMAGE PER REACTOR YEAR Frequency of Core Damage Percent of Core Event Description Per Reactor Year Damage Probability o *-ansients 98
-6
- o. ioss of Offs'ite Power 4.1 x 10 (88) o 'All others 5 x 10" (10)
-8 o Loss of Heat Removal 2 x-10 0.4 o ATWSJ 6 x 10~
1.3
-9 o LOCA 2 x 10 0.94
-6 Total 4.7 x 10 Table A-2 GESSAR II PRA RISK RESULTS FOR FULL CORE HELTDOWN SEQUENCES Risk (man-Rem' per reactor-year) o. Standard Plant PRA' Result, All accident sequences 0.26 Population within 500 miles o All accident. sequences 0.14 Population within 50 miles l
l' e
L l
lJ l
I-
- j..
I A-Il
NEDO-30670 Table A-3 PARTIAL CORE MELT RESULTS MAN-REM PER EVENT
- o 100% core melt 30,120 o.50% core melt 24,360 o 10% core melt 19,430 MAN-REM PER YEAR b
o Background Radiation 820,000
-6
- t should'be noted that the probability of this event is only %5 x 10 per year whereas the background radiation occurs every year.
bAnnual exposure to 8.2 'million people within 50 miles radius of plant.
1 O
=
A-12
NEDO-30670 Table A-4 COMPARISON OF GESSAR II PRA RESULTS TO PROPOSED NRC SAFETY GOALS Proposed NRC GESSAR II Criteria e
Per Reactor Year Guideline Result
-0
~
Cere-Melt Probability 1.0 x 10
%5.0 x 10 Individual Prompt
_7 b
a Fatality-Risk 5.0 x 10 0
Individual Latent-8
-6
-10
-Fatality Risk 2.0 x 10 2.0 x 10 Societal Prompt
-4 b
C Fatality' Risk' 1 x 10 0
Socie*-1' Latent d
-5 Fatality._ Risk 3.2
- 1. 7 x 10
- 0.1% of National Fatality Statistics.
bNo prompt fatalities were calculated-in any of the 238 Nuclear Island PRA accident sequences.
Assuming 1-mile average population of 168 people.
dAssuming 50-mile average population of 1.7 million people.
A-13/A-14
NEDO-30670 APPENDIX B NRC LETTER ON THE STATUS OF GENERIC SAFETY ISSUE A-29 i
(It'should be noted that the information contained in the NRC review will have to be updated to reflect char ges in the plant due to other rulemaking activities - notably the installation of ARI for ATWS; specifically, the last paragraph of page.B-7.)
S
+,?A S1 B-1/B-2
~,
-~
_ pa neuq
[(7 k
UNITED STATES NUCLEAR REGULATORY COMMISSION o
5 3 A
WASHINGTON, D. C. 20585 MAR 23 #4 MEMORANDUM FOR: Roger J. Mattson, Director Division of Systems Integration
-THRU:
L. S. Rubenstein, Assistant Directore for Core and Plant Systems, DSI FROM:
Olan D. Parr, Chief Auxiliary Systems Branch, DSI
SUBJECT:
STATUS OF GENERIC ISSUE A-29 provides the evaluation of the vulnerability of the GESSAR II design to sabotage and tampering and completes our effort on GESSAR II for subtask 1.1.a of the task action plan for Generic issue A-29.
The evaluation provides a qualitative overview of the GESSAR II features providing sabotage protection. The features of the GESSAR II design which inhibit or mitigate sabotage and tampering were basically the result af regulatory requirements l
in other areas such as system reliability, and flood, missile and fire pro-tection. The next step in the process for resolving A-29 as outlined in the task action plan is to review the Sandia research to determine if further re-duction in vulnerability to sabotage or tampering is possible for GESSAR II.
The subtask 1.1.a evaluation will form the basis for a safety evaluation l
input for the GESSAR II licensing review.
Additionally, based on experience to date with resolution of this issue, we're proposing a reorganization of the task action plan. Enclosure 2 provides our proposed revised tasks and GMICS. The foreign plant evaluations were made a separate task and the schedule extended to reflect up-to-date estimates on l-the availability of information.
Further, the separate subtasks for development l
of a decision rationale for new and existing plants were combined and added to l
a subtask for development of techniques for quantifying the reduction in l
vulnerability to sabotage. The separate subtasks for development of a regula-l tory package for new and existing plants were also combined into one task, l-The proposed revisions provide a consolidation of work to increase manpower effectiveness and provide our current best estimate of the completion dates L
for each task. No change in the scope of our effort on A-29 is provided. We would appreciate your consnents before proceeding with issuance of the revised task action plan.
l f
h3. h-an D. Parr, Chief Auxiliary Systems Branch Division of Systems Integration l
Enclosures:
As stated l
ec: See next page
Contact:
N. Fioravante, X-28299 j
n_,
NEDO-30670 Roger J. Mattson y;g 2 3 BEM cc w/ enclosures:
R. Capra J. Wemiel-R. Kendall S. Rhow E. McPeek
.W. - Kennedy B. Mendelsohn P. Ting-N. Fioravante F. Schroeder i
l-i l
B-4
.._.,,.___.u..,_._..
NEDO-30670 ENCLOSURE 1 NUCLEAR POWER PLANT DESIGN FOR THE REDUCTION OF VULNERABILITY TO SABOTAGE (GENERIC ISSUE A-29)
Subtask 1.1.a Evaluation
~
INTRODUCTION Generic Issue A-29, " Nuclear Power Plant Design for the Reduction of Vulnerability l
to Sabotage," deals with the effectiveness of different nuclear power plant system
~
designs to reduce such vulnerability. Although present reactor designs do pro-vide some inherent protection against sabotage, extensive physical security measures are currently necessary to provide an acceptable level of protection.
An alternative approach would be to more fully consider and integrate other possible means for reducing reactor vulnerabilities to sabotage and tampering and their effects on plant safety, operability, reliability, maintainability, and physical security. For resolution of this generic issue, the first step was to evaluate the design of and research work on the standard plants. Then, t
the lessons learned from the standard plants would be coupled with the research work'on damage control measures for possible application to existing reactors
[
(in operation or under construction).
l For generic issue A-29 consideration, sabotage implies " radiological sabotage" which is defined by 10 CFR 73.55.as any deliberate act ' directed against a plant l
which could directly or indirectly endanger the public health and safety by i
exposure to radiation. Thus, it is assumed that the goal of a saboteur is to cause plant conditions which would lead to severe core damage and radiation l-exposure to the public. For generic issue A-29 consideration, " tampering" is defined to be malicious acts (. vandalism) against limited plant equipment.
While tampering does not directly cause core damage by itself, when coupled with an additional random event, these acts increase the risk to the public B-5 t
u NED0-30670
, 1 health and safety, particularly for undetected tampering. The primary focus of generic issue A-29 regarding both sabotage and tampering is with regard to acts committed-by an " insider" who may have access to vital areas.
Subtask 1.1 of generic issue A-29 is an evaluation of the vulnerability of the standard plant designs to sabotage and tampering. The review of the standard plants is also 'to include identification of plant design features
(
- which inhibit sabotage. The standard plant designs include the Westinghouse APWR and the General Electric GESSAR II designs. The following is the subtask 1.1.a evaluation for GESSAR II.
EVALUATION
.The vulnerability of the GESSAR II plant design to sabotage and tampering was evaluated by considering the plant features which inhibit sabotage, the plant's capability to mitigate sabotage and the balance between safety and safeguards.
These three issues were included in the applicant's, General Electric Company
- (GE), assessment of the sabotage risk for the GESSAR II design as provided in l
Amendment No.16 to the GE Standard Safety Analysis Report.
The GESSAR II nuclear island design consists of a siagle boiling water reactor
- unit (BWR/6). While no GESSAR II nuclear islands are presently under construction, the BWR/6 boiling water reactor design 'is utilized in recently reviewed designs such as ' Perry, Grand Gulf and Clinton. The reactor system for GESSAR II designs 1
will be housed in a GE Mark III containment, which is a free-standing steel vessel within a reinforced concrete cylindrical building.
Generally, a saboteur is considered " success-oriented", which implies actions would only be taken against the plant if severe core damage could be assured.
l B-6 f
- i. l l.
Thus, design features which decrease the saboteur's. chances for success would be considered an inhibitor to sabotage. The plant design features which the applicant considered to inhibit sabotage are the redundancy of safety systems,
~ ~
separation of equipment, access control features, the "Self Test" system, the i
status monitoring capability and the passive core cooling capabilities of the GESSAR II design.
The GESSAR II design provides system redundancy for the capability to achieve
~
shutdown (reactivity control), to provide makeup water to the reactor vessel and to remove decay heat. Reactivity control is provided by either the control rod drive system or the standby liquid control system. The redundant trains of the control rod drive system are designed to provide reactivity control under normal operation and anticipated operational occurrences with an appro-priate allowance for a stuck rod. The standby liquid control system is a backup reactivity control system consisting of redundant active components that infect sodium pentaborate into the primary system to provide an independent means of shutting down the reactor. Additionally, emergency procedure guidelines I
provide the' operator the necessary instruction for lowering reactor power level via water level control, thereby extending the tire to initiate either the control rod drive system or the standby liquid control system for reactor shutdown.
While the GESSAR II BWR/6 design provides redundant safety systems for reactivity control, other BWR/6 designs offer further redundancy. The Perry plant design ncludes an alternate rod insertion feature which provides a redundant and diverse capability from the control rod drive system's scram function. Addi-tionally, the Perry plant design includes an increased capacity standby liquid B-7 l
NED0-30670.
control system. The system design will include both manual and automatic
~
initiation capability; however, the means are currently provided only for manual initiat'on. While these additional features for the Perry design were not intentionally provided for sabotage protection, some additional capability to inhibit sabotage is provided. These features will ba included in subtask 1.2 which will evaluate additional means for providing a reduction in the vulnera-bility of the standard plant designs to sabotage.
For providing makeup water to the reactor vessel, the GESSAR II design provides the capability to utilize ten different systems which include a total of 21 pumps.
Systems with high pressure capability include the main feedwater system, the high pressure core spray (HPCS) system, the reactor core isolation cooling (RCIC) system and the control rod drive system.
Low pressure systems include the low pressure core spray system, the low pr;.ssure coolant injection function of the residual heat removal system, the condensate system, the service water system, the fuel pool cooling water system and the fire water system. The re-dundancy and diversity provided by these systems is consistent with the BWR/6 design and are not unique to GESSAR II. Although this redundancy and diversity was not specifically designed for sabotage concerns, it is available to inhibit and mitigate sabotage.
Additionally, system redundancy is provided in the decay heat removal function for the GESSAR II design. Occay heat can be removed utilizing the main condenser, several modes of the residual heat removal (RHR) system or the alternate shutdown cooling. The alternate shutdown cooling capability provides for discharging water through the safety relief valves to the suppression pool. The RHR system is then B-8
NEDO-30670 utilized to cool the discharged water and return it to the reactor vessel.
Additionally, the reactor water cleanup system and the fuel pool cooling and cleanup system can provide limited decay heat removal. Again, the redundancy and diversity provided by these systems was not specifically designed for sabotage concerns but provides measures to inhibit sabotage.
Support functions for the above reactivity control, reactor inventory makeup and decay heat removal systems are provided by three independent divisions of AC power.
Each of the independent divisions can be powered by either off-site sources or its own individual onsite diesel generator. Four separate DC battery systems are provided for each of the four divisions of instrumentation and control. Additionally, since the RCIC system utilizes a steam-driven turbine, diversity of power exists for the above systems, including the capability to pro-vide vessel inventory independent of AC power for a.t least two hours. Cooling for the emergency core cooling system (ECCS), including HPCS, LPCS and RHR systems
(
equipment, and tne RCIC equipment rooms is provided by individual room coolers.
I Each cooling fan is powered from the same division as the equipment in the l
And, cooling water to the cooling coils of the room' coolers is supplied room.
by the respective division of the service water system. Thus, the support l
[
function also provides redundancy and separation, thereby limiting the vulnerability of the safety system to sabotage. The redundancy and diversity i
of the safety systems and support functions also Ifmit tiie impact of tampering.
l Features of the GESSAR II design in addition to redundancy which inhibit l
sabotage are separation of the above systems and access control features. Appli-cation of the current flood, missile and fire protection licensing criteria B-9 I~
NEDO-30670 resulted in most of the above systems being located in individual compartments.
I The water makeup systems are located in separate compartments throughout six different buildings. Piping for the ECCS pumps and the RCIC pumps are pro-vided with separate, individual, hardened pipe chases and containment penetra-tions. The Division 1 and 2 diesel generators are located on opposite sides of. the reactor and auxiliary building.
Essential electrical power from each div'ision is physically separated. The combination of system redundancy and equipment separation would require an insider to enter multiple compartments and disable the equipment without being detected or proceed from area to area
)
l in a short time span.
For compartments outside containment, damage to all equipment within any one area would not lead to core damage because of the l'
above separation of safety systems. Even for loss of the control room, the 1
GESSAR II design provides for redundant remote shutdown capability independent of the control room.
)
l l
Additional features which inhibit sabotage are the self-test and status 1
monitoring systems. The self-test system provides monitoring of the circuit integrity of all safety-related systems needed to achieve safe shutdown. The g
L status monitoring capability provides status indication of all safety-related equipment (pumps, valves, motors) on a continuous basis. While the self-test l
f and status monitoring systems will not prevent sabotage, a higher degree of sophistication is required if the saboteur wishes to be undetected. Addition-ally, these systems would provide effective detection agatrist many potential acts of tampering which are generally considered to require a lesser degree of sophistication to accomplish than acts of sabotage.
B-10
~,
.,a w.,,_,
+ -
i NiDO-30670 A passive inhibitor to sabotage is provided by the core cooling capabilities of the GESSAR II design which include the suppression pool and the inherent natural circulation capability of a boiling water reactor. The suppression pool. provides a long-term water source for the ECCS, provides the capability
~
to quench steam and absorb decay heat, and would retain particulate fission j
l i
products under postulated accident conditions.
It would also scrub out gaseous iodine following accident conditions. The suppression pool is com-i posed of thick reinforced concrete located below grade elevation. Further, so long as sufficient water inventory to cover the core is provided, the capability to remove heat from the core is assured via natural circulation.
Therefore, a saboteur would need to eliminate all water inventory capability L
l l
and limit use of the suppression pool in order to present an immediate hazard.
While the above features were not specifically designed for sabotage protection, J.
they provide measures to inhibit sabotage.
l i
An alternative approach to inhibiting sabotage is to provide the capability to i
l mitigate sabotage. The applicant considers the capability of the symptom-oriented emergency proceduresguidelines and inherent fission product reten-tion capability of GESSAR II as design features which mitigate sabotage. The symptom-oriented emergency procedures guidelines provide operator response to all off-nomal scenarios up to and including severely degraded core conditions.
The guidelines can accommodate the effects of sabotage-initiated transients and induced LOCAs. The guidelines direct the operator for assuring reactivity control, reactor water inventory control and containment integrity. The guide-l j
lines also provide damage control capabilities to some extent as they outline I
shutdown methods under assumed degraded modes of operation (system unavailabilities).
B-11 l
f
NEDO-30670 8-Since sabotage is defined as deliberate acts which result in radiation exposure to the public, the capability to limit fission product release would be con-
~
sidered as mitigating sabotage. The design of the GESSAR II nuclear island provides inherent retention of fission products. Retention, scrubbing, or plating out of fission products is provided by water in the reactor vessel and the vessel itself, safety-relief valve discharge lines or the drywell vents, the suppression pool, containment or secondary containment, and the standby gas treatment system. Thus, the fission product retention capability provided limits.the effects of sabotage.
The balance between safety and safeguards is generally an operational concern rather than a design feature; however, a number of design features impact both safety and safeguards. Vital area doors will be provided with a card reader system to limit access. The card reader system and associated locking mechanism will restrict entrance but will not prevent emergency egress from a locked area. The locking mechanism will not permit key access when the card reader system is powered. On loss of power, the locking mechanism secures vital doors and would require key access. Corridors and passages have been designed to pennit emergency egress away from vital areas. Also, design features such as the status monitoring system provide compensation for the loss of causal surveillance caused by compartmentalization of equipment. The separation of equipment which may cause a delay in operator response to a problem is also compensated by the self-test and status monitoring system which provide early detection of off-nonnal conditions, thereby increasing system reliability and availability.
B-12
.g.
CONCLUSION The GESSAR II design contains a number of features which limit the vulnerability to sabotage. The combination of multiple and diverse means of providing makeup water to the reactor vessel along with the inherent natural circulation capa-f bility of the boiling water reactor design and the suppression pool provides a significant inhibitor to sabotage. The system separation and the self-test and ststus monitoring system provide further inhibitors to sabotage. Redundancy of safety systems, system separation and the status monitoring limit the adverse impact of tampering.
It is important to note that with the exception of the access control features, no plant system features were designed specifically for sabotagh inhibition or mitigation. Thus, application of present regulatory requirements in other areas (e.g., flood, missile and fire protection and system monitoring re-l; quirements) resulted in the significant level of sabotage protection provided by I
the GESSAR II design. Some application of the regulatory requirements such as separation of the diesel generators exceeded the requirements and resulted in a higher level of sabotage protection.
j i
L Subtask 1.2 of generic. issue A-29 will consider the further reduction in the vul-nerability of the GESSAR II design to sabotage provided by the design features described in the Sandia research. Additionally, the alternate rod insertion capa-l bility and the upgraded standby liquid control system will be evaluated in subtask 1.2 of generic issue A-29.
Features of the GESSAR II design which will be con-sidered in the subtask evaluating existing reactors include the capability to utilize service water and the fire water system for reactor vessel inventory, the self-test system, the status monitoring systems, and the synptom-oriented procedure guidel ines. The importance of present regulatory requirements impacting sabotage protection will be factored into the subtasks for development of a decision rationale for ranking proposed changes.
B-13 l'
I.
e,,n.-,..
- - - - -,_-,n.
= _ - - ~, - - - - - - - - - - -,, _ - - - -.. _. - - -..-..-
ENCLOSURE 2 PROPOSED REVISED TASKS Task 1 - Evaluate New Plant Designs The program will assess new plant designs to determine their vulnerability to sabotage and tampering and assess the decrease in vulnerability which could be provided by the alternatives outlined in the research program. The plants' design to both protect against and mitigate tike effects of sabotage will be considered.
Subtask 1.1 - Evaluate the vulnerability of the standard plant designs to sabotage and tampering.
Identify plant design features which inhibit s at.otage. The standard plant designs include the Wettinghouse APWR and General Electric GESSAR II designs.
Subtask 1.2 - Review alternative designs including plant layout designs proposed by the research programs to determine which proposed alternatives
~
would provide a reduction in the vulnerability for the standard plant l-designs. Where possible, quantify the reduction in the vulnerability to i-sabotage, but primarily the assessment will be qualitative in natus:.
Review alternative physical security measures such as the two-man rule and visual monitoring of vital areas to determine which proposed alterna-tives would provide a reduction in the vulnerability for the standard plant designs.. For alternatives offering a reduction in the vulnerability, determine the impact on safety, operability, reliability, and maintain-l ability of the plant. The subtask evaluation will be provided in two parts; l
Part A will provide the qualitative evaluation and Part B will provide the quantitative evaluation.
3-14 l
NEDO-30670 Task 2 - Evaluate Foreign Plant Designs The program will assess the foreign plant experiences and designs to identify features which inhibit sabotage and tampering.
Subtask 2.1 - Review the decision rationale for determining the level of sabotage protection provided in foreign plants. Review decision criteria for determining trade-offs between protecting against sabotage versus protecting the capability to mitigate postulated sabotage and for determining trade-offs between safeguards and access to assure safe operation of the plant during normal and emergency conditions.
Review methods to quantify the risk to the public from sabotage.
Subtask 2.2 - Review the foreign plant designs to identify plant layout and system features which inhibit or mitigate sabotage.
Task 3 - Develop Methodology for Evaluating Reduction in Risk The program will develop a methodology for assessing the reduction in risk i
provided by proposed system design changes, damage control measures and security measures.
Subtask 3.1 - Develop a decision rationale for ranking acceptance criteria for new and existing plants based on current consideration of threat preception, effectiveness of 10 CFR 73.55, the proposed insider rule impact, due account of safeguards event experience with respect to tampering and cost / benefit. Methods such as the guidelines of NUREG/CR-2800 will be considered. The cost / benefit analysis of A-45 will be utilized to the extent possible.
B-15
Subtask 3.2 - Develop a technique for quantifying the reduction in vulnerability to sabotage in terms of the reduction in risk to the public health and safety or the reduction in risk to severe core damage. The quantification of risk will consider both the risk from sabotage and tampering. The technique will be used to provide a ranking of proposed system design changes, damage control measures and security measures.
Task 4 - Evaluate Existing Reactors This task includes all operating reactors and reactors under construction. The vulnerability of existing reactors will be characterized generically and possible alternatives for reduction of the vulnerability will be evaluated.
Plant designs to both protect against and mitigate the effects of sabotage will be considered.
Subttsk 4.1 - Review previous vulnerability evaluations of operating reactors.
If.necessary, re-evaluate a sample of operating reactors to determine their vulnerability to radiological sabotage and tampering. The work of A-45 will be utilized to the e.xtent possible for this subtask.
Subtask 4.2 - Review alternatives developed in the research program coupled with lessons being learned in the standard design reviews to determine the reduction vulnerability which would be provided. Review alternative physical security measures such as the two-man rule and visual monitoring of vital areas to determine the reduction in vulnerability which would be provided. Evaluate each design change or damage control method for its effect on safety, physical security, operability, reliability and main-tainability. Both system design and physical security measures can be
- used to assure a safe shutdown capability. Thus, the evaluation of B-16
^
1.
\\
+
6 v
4 r
O Y
A
-N-
,. alternative.s. willsinclude identification of safet'y-safeguards trade-
-offs inarptecting vital equirnent to ensure a minimum safe shutdown s
x s.
i capability as an adequate level of protection against sabotage. The
~
proposed 1 tern tive,: comidered for A-45 will be integrated with proposed x
? ;1f-alternatives for this subtask. The subtask evaluation will be provided 1
y in twa parts; Part A will provide the qualitative evaluation and Part B
't s,will pr. ovide the quantitative evaluationk
\\.
s Task Implement Re'sults Based on the results of the 2bove tasks, recomend changes in the safeguards rehuirements for new and: existing plants. Recommend a form of. implementation,
, q-i.e., whether through rulemaking,iregulatory guide or standard review plan m
changes. All recommendahlo'ns will be hoordinated with.the work of A-45.
s.,
x
/
, Prepare a Tegulatory package (CRGR review).
. i
(
M i
Js s
's
. 4,
}
~
_,4 l,
l-l ll; 3
3,.
e
?
,i 4
3
,7,
,.i -
i
){
s s
. \\
s
}.
t t
4
,t 4
x s
s 5
g B-17/3-18
\\
NEDO-30670 PROPOSED REVISED GMICS Issue No.
Priority Branch Task Manager NRR Operating Plan A-29 Medium AS8 N. Fioravante (X-28299)
Yes
~~
Title:
NUCLEAR POWER PLANT DESIGN FOR THE REDUCTION OF VULNERA81LITY TO SABOTAGE Milestones Original Current Actual Comments Task Action Plan issued for comment 08/26/83 08/26/83 Complete Task Action Plan Approved by Director, DSI 01/31/84 01/10/84 Complete Contract Support a.
Issue RTP 02/01/84 02/02/84 Complete b.
Proposals evaluated and accepted 03/30/84 L
c.
Contract issued 04/15/84 TASK 1 - Evaluation of New Plant Designs 1.1 Evaluate the vulnerability of star.dard plant designs to sabotage and tampering a.
Complete GESSAR II Review 02/29/84 03/23/84 Delay due to fire protection inspection of Syron
'b.
Complete WAPWR Review 06/30/84 1.2 Evaluate alternative designs (plant layouts and systems) for reducing the vulnerability to sabotage and tampering a.
Lomplete qualitative evaluation 07/31/84 b.
Complete quantitative evaluation 02/15/85 TASK 2 - Evaluation of Foreign Plant Designs 2.1 Review of decision rationale for sabotage protection 12/31/84
~
2.2 Review of foreign plant designs 12/31/84 B-19
k
[+;
[l v
f
.NEDO ')O670 j '.".,
4
/
4 y
~
w
^*
.A-29 Milestones Contintied ;
h t
a+
Milestones
, s
>j Original Current Actual Comments
- e.,
,,r TASK 3 - Develop Mett.edolch Eva,j,uating ReducM.)n Risk j
M 3.1 Develop a dMi,sion tationale', fur ranking
, acceptance criteria 04/30/85
~
y_
,,,c; Je
- u d }-,%
l 3.2 Develop techr3que for-t49tifying i.
reduction iniulrtrs4Illity 10/1'5/34
~
4
~
4 x
4 TaSM 4 - Evaltiation of histing_ Pla3ts
- ['#
t
~i 4.T Evaldate a sample of ooiNLing'retctors
~
f-f to determine thel 1* v41Reability,tc sabotage anFtaapertr.9 i
/
's u',
10/30/84 c* ^ 4
. - [. 4.2 Evaluate alternativ'e-plant designs,r /
A *' )
4
'and damage control weasures for *["
s aM ^ 'k b N'
reducing the v.dneftbility to r *.
sabe,tage and tampering g,-
.i g
Complete' qualitative; evalt.ation 11/30/8,4
\\>
,e l
y 's,.
a b.
CDmplete quantitativ'e ' evaluation,, " 02/15/85
/
Q s.;
TASK 5 - Implea$nta tion of Resul,ts, s
4 l '. //
a.1\\{ Develop detailed milestone schedule
- /
or regulatory package processing 04/30/85
,a w
'b.
CRG2 p'&c'impt tc. Division IMbector n# 05/31/85 t
9 :,,
Complete-[ssue.SP. Prev {?sion, RG, 04/30/86
./ v a
1 v
' f'.
c.
~ ~
j,,'% "t' rule, or Generic' Letter as approprfste
~
s c/
. -A x
/
'W
.g.
..,-e
\\'
JY y
f i
'm s
t "P y q<
k
(
l
/
,A 7
'm x.
- ~
4 1
l.
w e. )
A i'
s
(.
'f
- .A i il A
- j.
p
+<
n
\\.
B-20 l
. p[..
,{^
~
-A,,
.J.e n. [j =.
~$'
l
r'
-f-
[
f APPENDIX C l
GE LETTER COMMENTING ON DRAFI NUREG-0978 1-a i
t
{
?.
k I.
f 1
l P
k c-1/c-2 e.
NEDO-30670 GENERAL $ ELECTRIC NUCLEAR POWER SYSTEMS DM510N GEt!ERAL ELECTRIC CCMANY e 175 (URTNER AVENUE
- SAN JOSE, CAUFORNIA 95125 MFN-064-84 MC 682, (408) 925-3392 May 25,1984 Secretary of the Commission U.S. Nuclear Regulatory Commission c
Washington, DC 20555 Attention:
Docketing and Service Branch Gentlemen:
SUBJECT:
INPUT TO REQUEST FOR PUBLIC COMMENT ON DRAFT NUREG-0978 -
TECHNICAL EVALUATION REPORT ON MARK III LOCA-RELATED HYDRODYNAMIC LOAD DEFINITION t
This letter provides General Electric's input in response to the issuance of the draft NUREG-0978 for public comment via Federal Register Notice 7590-01.
We have reviewed the subject report and have confirmed that it is consistent with the approved load definition contained in Appendix 3B of GESSAR II and the GESSAR 11 SER NUREG-0979 with two minor exceptions (acceptable to the GESSAR 11 standard plant design). The two exceptions consist of deletion of additional criteria for bulk impact loads on small structures less than 4 ft. long and less than 6 ft. above the pool and the addition for froth impact loads of a multiplier for structures above grated areas at the HCU floor.
As additional input, please find attached some additional justification for the methodology used for determining condensation oscillation (CO) loads on submerged structures. discussed in Section 3.4.2 of the subject report. The justification re.olves an issue, initisted by the Containment Systems Branch of NRR, regarding the frequency content of the CD sub-Thus, the CO load definition in GESSAR 11 remains merged structure load.
acceptable, as noted in the previously mentioned Section 3.4.2.
Sincerely, H. C. Pmf erlen, Manager BWR Licensing Programs Nuclear Safety and Licensing Operation NCP: rf:rm/G05031 L. S. Gifford (GE, Bethesda) cc:
W. R. Butler (NRC)
M. B. Fields (NRC)
J. A. Kudrick (NRC) c-3/c-4
NEIO-30670 Justification of the 2-3.5 Hz Range of Application of the Condensation Oscillation Submerged Structure Loading The pressure-suppression containment utilized in General i
Electric's BWR design has several advantages but also poses some unique loading phenomena.
One of the phenomena is known as Condensation Oscillation (CO).
The current GE containment design has a suppression pool encircling the reactor pressure vessel area.
Upon a failure in the reactor vessel area causing steam release, this suppression pool acts as a buffer to the rest of the containment.
After steam pressure increases to the point where it is sufficient to exit through a horizontal vent below the suppression pool water level into the suppression pool,
.a sequence of unique phenomena initiate.
One of these phenomena is CO which is characterized by the rapid condensation of the steam cpon contcet with the pool water just after exiting the l
top horizontal, or main, vent.
The continuous steam flow and rapid condensation come to equilibrium conditions establishing an interface which gives the appearance of oscillation, hence the name condensation oscillation.
Within the suppression pool are several structures which I
may_be affected by CO.
The'present design loading on submerged l
structures during CO is applied only over the 2-3.5 range covering the primary frequency of the phenomenon.
The.nc has posed the concern that higher frequency components up to 15 Hz i
C-5 y-y
-e
-y,.w.-
,ym,--m--
w-wp-,,. - - -we-_e,e.
weair.*-,---,qre-v.,-,w-r
-.m.-v--e
-y
NEDO-30670 can and do exist during CO and therefore should be included into the present CO load definition for submerged structures.
The evidence of the higher frequency components is shown by the wall boundary CO load definition which contains frequencies up to 15 Hz.
The current submerged structure CO load definition is justified by demonstrating that the high frequency loading components for submerged structures are bounded by other design loads, in particular, the pool swell submerged structure load.
Upon evaluation of the information provided, the frequency loading components above 3.5 Hz in the CO submerged structure load is bound by pool swell for all cases at all pool locations where there are submerged structures.
This conclusion encompasses all load combinations.
Thus, the present CO load definition for l
submerged structures is adequate.
In this analysis, the appropriate load combinations are considered as well as the individual loads of CO and pool swell.
All submerged structure loads are computed according to the method detailed in GESSAR II - Appendix L.
Several submerged structure locations are considered to assure conclusions remain l
1 valid throughout the pool.
Figure 1 is a representation of the structure locations within the pool.
The chosen structure size L
l is a cylinder one foot in diameter and two feet in length.
This structure is oriented vertically in the pool as typical l
pipes entering the pool.
c C-6
A 2
NIDO-30670 Since the NRC suggested that the CO submerged structure load should have frequency content similar to the CO wall c
boundary load, an amplified response spectra (ARS) was generated of the CO wall boundary load.
This gives a frequency
"- ~
1 representation of an alternate CO submerged structure load.
I ~
However, the peak magnitude of this ARS is not in proper l.
proportion to the various submerged structure loadings.
To 1
I achieve the proper magnitude of the new alternate CO submerged structure load, an ARS of the present CO submerged structure
- load. definition is generated and the peak amplitude of the CO wall boundary load ARS is scaled to coincide with the peak of the submerged structure ARS.
This scaling factor between the i
two peaks is then applied to the entire ARS of the CO wall boundary load, thus giving an alternate CO submerged structure load definition having the same frequency content as the CO wall l
l boundary load.
This procedure is repeated for each chosen submerged structure location.
l l
L In order to compare the CO load to the pool swell load, f
l l
an ARS of the pool swell submerged structure load was generated i
for each location shown in Figure 1.
This ARS is compared to the ARS of the present CO submerged structure load and ARS of the ' alternate CO submerged structure load, or LOCA pool boundary normalized CO load. 'All three ARS's are graphed on one figure l
. T.5ese L
- for each location and shown in Figures 2 through 6.
L figures show the pool swell load definition bounds the upper frequency content of the CO by a nearly constant factor of two 1
\\
for all structure locations.
I C-7
NEDO-30670 The only load combination case in which pool swell and CO are not combined with the same phenomenon is during an Intermediate Break Accident (IBA).
During an IBA, pool swell combines with a single safety relief valve (SRV), whereas CO combines with the Automatic Depressurization System (ADS) actuation.
The submerged structure loading at each location for both SRV and ADS are generated according to the methodology
.in C-ESSAR II - Appendix L.
At each location, the appropriate load combination, CO and ADS or pool swell and SRV, is combined such that the peak positive pressures for the two conditions coincide.
The ARS from this pressure time history is generated and the two load combination ARS's are compared.
As described before, the CO wall boundary load is normalized to the 2-3.5 Hz peak of the CO and ADS ARS and all three ARS's are shown for each location in Figures 7 through 11.
These show that the l
pool swell plus SRV ARS bounds the upper frequency information of the CO plus ADS ARS up to approximately 9.5 Hz for all l
l locations.
For the frequency information above 9.5 Hz, it is t
apparent that the ADS load is of such a large magnitude that the upper frequency CO information is negligible.
C-8 l
l
.. _.., _ _, _. _.. _ _ _ _ _ _ _ _ _ _ _ _... _ _ _ _ _ ~ - - _ - -. _ _ _ _ _
1 NEDO-30670 Figure 1 Submerged Structure Locations scale 1/2" = 28
- ~. -,.
?
A D
Top vent C
E A
20 ft l
12.5 ft E
B l
V v
i 18.5 ft Structures A & E Located Between Vents Structures B, C & D Incated On, Vent Centerline C-9
$ is O kW
~
o EM 5%
8
~
3 cy 5
y -
M e
8' D1 l
l
\\
~
43
~
5 8 O
g r
M E
e J
N i
I l
I r
s b
l G
1 r
u A
)
g g
5 0
a
- O N
a 1
W i
O ef
?
B 1
, i tts w
l 8E y
s i
/
E w
w L s
m l
[
hh C
(
\\
M
\\
C o
s
~
m A. g -
- LL 2
dU i
" 17, t
l e
i-O l E ' r "a
~
)
l
.-.n a
O I
o O
O O
O O
O~
O O
O O
CD LD
=2' N
l 3SN0dS3W 031dlldWB C-10
NEDO-30670 lb.
r o
0
~
h E6 Ee S
et
- ~ -
l tg 1
1 i
3 bl 43
~
Eg
_ ~o r
l a
8
);
?
(
l
\\
f
\\ /
E a[
hf r
~
=
I r
a i
o E
)
l u
a" U
I w
u a-w z
m e
o w 8
i e
i
-a n
y
__ P I
i o
o w
\\
/
/
w 8m s
o l
c W
\\
l
/
,/
cc.
u Q-m7 7 IE
\\
J
=
c
[
\\
a E. _
s w
6m
'h U-i rm e
\\<
?>
U.
- E
,C, 1
i T
o o
o o
o o
o~
m o
m l
g g
r 3SN0dS3W D3IdI7dWB g
t l
C-11
NED0-30670 I L.
s t
3 >m -
E o
i
=*
s 3
a"
=, _
~
C=
gn 8
3 i
c, 43 58 o
i 1
z =.
I
(
l!
7 N
3
\\I
~
z e
i i
l t
g i
)
5 l
e g
,/
w u
a
-u i
o 0 5 v
o m
m 4
o g
iw
\\
f
'/
W l
9 w
x
/
/
E l
3
.K-V i
-s g
- r c
u a
_ t.
g5
(
\\
a
.J
\\
N w
Au m
61
'i
~
i
- 5 t
o
.=
e l
t o
~
8 8
8 8
CD (D
- f' N
3SN0dS39 03IdlldWB g
C-12 l
l
- b ap.
R i.
e Jr g
1 8
O d
y I
m y
cg 2
5 l
\\
}
y, ab k8 o
i c
8" I
- a. -
e I
/
$a
)
~
l N
I j
b l
h 1
u e
o a
m
.. c.
W 2
s I
z n
-r e
o w o
s s
n U
2
'n Q
f W
f g
o G
La r
\\
/
W r
i y
W
\\
N
/
/
C i
K f
\\
4 s
'O
- w 7 '.
N J
t z
-\\
Es$
(
ow x
~
~
co
'E lA.
$Y
.i
~
em t
u o
9 c
l' e=e n
l-l 1
l 1
l l
l 7
t l
o l
8 8
R 8
8 l
~
e N
m
=r K
3SN0dS2W 031.411dWB g
C-13 I
l
-..,.. ~.. _ -.
t 6
i t
- l
)t. - L:
?$wo
=
=.T s
3
=!
8 d %n 9
d I
mr 1
a m
I a.
't 90 l
i l
/'
R e
E w
S E
a*u I
l tt o
E o
j P
.C r
[s-yd ra ao dLn 2
uO oC 0
B d
1 l e oz oi Fl a A m Cr g'
Oo LN 1
da Z
m H
I M
e
(
o n
t m
g
(-
R i
T S
s O
e C
R D
Y E
C C
i P
E O
N C
S d
0 E g
k 1
U 8
6 E
N
[
Q o
[
u O N
e S s
u N
E
,i r N g
R g P r
/
F s
i L1 F S eE r.
d
/
k E
sM R
e l
0 T R D
NO E
R. L I
PE f
2 i
F t
.C T
I 0U L
1R W
P 5T F
e M
- S P
1 0
A H
- L
~
1
. S 3
i 0
1 n
0 g
M 0
g 0
o 0
0 6
=
i s
h ogVw owwu,, kE
)
ne nb
,i:;
1;j!
l!
i1i
! a 1l2 5i):4
- j i ; j i1 i
13 1l
a o
m li 2
~.
u P
~
Ir a
v L
l
,3 p'
B o-
/)
3" ra 8"
I r
- a. -
S E' p
~
=
e Se C
~
x E
O e_
_f
-u
,, o5 1,
m 7
e
- ~
-D La n
v
~ ~
x E
m r
x x u
S
=
5 5
1 N N n
m m
C g
,l
/
NY
'\\\\f M
i ("
g
\\
\\1
+
w o.
8 I
[
'Ses o
+
dggs' a
o L
y&
"3 E
o
- o s. <;,
2 a
~
l i
, o a
e rv co
-r o-y.s c:
t 50t:SE0041 - 3SN0dS39 031311dx0 t
C-15
a 3
J' O
~
d 5
e c
eo e
n
}
Di 43
.I 8 -
~
O E
?
o ga_
,e D
- a. *~
O D
~
E s.-
//
V 8
I r
D U
j g
y e
O w m
M x~~
r p
, g:j n
'NN
(
O
\\
7 N/
w W O e
d
\\
^
{
~
h$
\\
\\ T
- a.
=
i W"
i
\\/
h S
R.I
}
Aco-m E
SE!g!
.s c w
9 O
h w-i
- E 53.;
8 6
l l
l 7
O l
O O
O O
O~
O O
O O
LD N
CD
=r
[_,
l astossas catallawe C-16 i
20 oboe o iv 2
r w.
yd ral 0
n ao 1
dtl 1
n o
uD i
m.
oC 6
B e
d 1
l e e
R oz oi C
Fl O
o a
d"u M
A m E
Crl C
O o E
LI s D
r 2
0 y
1
\\
d
/
a
\\
m J
I SD l
A
\\,
\\
Z
+
H O
1 C
M
=
(
x U
i p
m R
T S
, P E
i A0 O
Y C
H C
E C
N E
S f.
1 U
V Q
9 E
i
//
E e S a
R
'f r N F
u O g
P C
A-I i
i F S
=
EC E
=
R
=
J R
T I
T C
D N
U d
E A. 0 'H a
m-I P 05I I
N F
1 0
V T.N R
DS I
S e
L T D R
SAI P
I l
+-
L 0
H H
T U
't 4
1 l
'l e
e
- . 2 w
S lo I
o P
8 i
t i
- , l ei 0
1 0
1 I.
i 0
t 1
i 1
l l'
1 1
i i
l S
7.
i l
. ;'hE WlCk' t,WE )W U
o C
(
nbw i
.n...
NED0-30670 E
t' a
i
=
o w.
c-
@, r-w i
s i
5 4
.e I
c$i l
$"s e
wI M
uti (i
r.
/ bi o
143 i
\\
i
/
J "$ 8 v'
1
(
O
/
l 85
(
)*%
E i
,1 b-O' s
2 D
)
i a
c b
b i
>-u i
5 i
af wa.
t
-O m
e iw ( _.)
o a
ri
~
'-s.
1 Lu g
/
N C
m w
z
//
NI
'41
/
\\
N
$E o
)
C Ye
/
a-G
\\
y w o a, -
y b
M Qu
.R@gb
~
+
o
'?
v
- s
!a c :. m :; 4, 9=
4 a
c wu,,
8 n.
i t
I
[._
l i
i l
i i
I l
l l
r, e.:
o,
\\
i S0s,6500H1 - 35N0dS3B 03ldi'IdWO 5
C-18
N NEDO-30670 E
h.
e f
I I
g:
5 5-
-i b
em E
- i C
w t
p, -
4.Ija
~
O
)
8"_
3 S
~
5 r
Se s_
/
f I I
)
E (N
\\
~
s
[
d z
i z
O J
- L3 a
/
e w
r, u
z O y W
m I
w e
7 y
N
(
g Jl
'M s
LLJ f
N y y
c W e
\\.
Y C'
$o
\\
h L
. f c.
w N
1-
- me i
W" 1
S E9 0 h
D
)
c
-s, E
NEhf E
i.;m;..;
e y
o l
~
O O
O O
O O
C" O
O O
O b
N 3SN0dS38 031dlldWB e
j C-19/C-20
~~
,