westinghouse electric co., response to request for ...section 9.1.4.3.3 states that the fuel...

)Westinghouse

U.S. Nuclear Regulatory CommissionATTENTION: Document Control DeskWashington, D.C. 20555

Westinghouse Electric CompanyNuclear Power PlantsP.O. Box 355Pittsburgh, Pennsylvania 15230-0355USA

412-374-6206412-374-5005siskl [email protected]

Direct tel:Direct fax:

e-mail:

Your ref: Docket No. 52-006Our ref: DCP/NRC2505

June 4, 2009

Subject: AP1000 Response to Request for Additional Information (SRP 9)

Westinghouse is submitting a response to the NRC request for additional information (RAI) on SRPSection 9. This RAI response is submitted in support of the AP1000 Design Certification AmendmentApplication (Docket No. 52-006). The information included in this response is generic and is expected toapply to all COL applications referencing the AP 1000 Design Certification and the AP 1000 DesignCertification Amendment Application.

Enclosure 1 provides the response for the following RAI(s):

RAI-SRP9.1.4-SBPB-03 R1RAI-SRP9.1.5-SBPB-09 RI

Questions or requests for additional information related to the content and preparation of this responseshould be directed to Westinghouse. Please send copies of such questions or requests to the prospectiveapplicants for combined licenses referencing the AP 1000 Design Certification. A representative for eachapplicant is included on the cc: list of this letter.

Very truly yours,

Robert Sisk, ManagerLicensing and Customer InterfaceRegulatory Affairs and Standardization

/Enclosure

1. Response to Request for Additional Information on SRP Section 9

01691jb.doc _Cý ) ý (L? ý ý_)Y\144_0

DCP/NRC2505June 4, 2009

of 2

cc: D. JaffeE. McKennaP. BuckbergT. SpinkP. HastingsR. KitchenA. MonroeP. JacobsC. PierceE. SchmiechG. ZinkeR. GrumbirP. Loza

- U.S. NRC- U.S. NRC- U.S. NRC- TVA- Duke Power- Progress Energy- SCANA- Florida Power & Light- Southern Company- Westinghouse- NuStart/Entergy- NuStart- Westinghouse

IE1E1E

1E1E1E1E1E1E1E1E1E1E

01691jb.doc

DCP/NRC2505June 4, 2009

ENCLOSURE 1

Response to Request for Additional Information on SRP Section 9

01691jb.doc

AP1000 TECHNICAL REPORT REVIEW

Response to Request For Additional Information (RAI)

RAI Response Number: RAI-SRP9.1.4-SBPB-03Revision: 1

Question:

Section 9.1.4.3.3 states that the fuel handling machine (FHM) "has the same design functionsas the refueling machine (RFM) and includes the same safety features." DCD Revision 16,Sections 9.1.4.2.4 and 9.1.4.2.2.3 state that the RFM services the core including the function tolatch and unlatch control rods. No such function is attributed to the FHM. Additionally, DCDRevision 16, Section 9.1.4.2.3 states that the FHM is used to load spent fuel into the shippingcasks. No such function is attributed to the RFM. Additionally, the RFM operates exclusively incontainment, whereas the FHM operates exclusively in the fuel handling area. Please explainhow the FHM has the same design functions as the RFM.

Westinghouse Response:

A design change proposal (DCP) is being processed to change the FHM design from a "Sigma"type RFM to a bridge/gantry style handling machine with two 2-ton overhead hoists. Thefeatures of this bridge/gantry style handling machine are described in the proposed DCDmarkup below.

Additional Westinghouse Response based on NRC comments at 3/18/09

The staff has indicated that in W response to RAI-SRP9.1.4-SBPB-03 RO (DCP/NRC2177June 26, 2008, responses to RAI-SRP9.1.4-SBPB-01 to -04 RO, ML0818207240), the applicantstated that "The fuel handling machine is restricted to raising a fuel assembly to a height atwhich the water provides a safe radiation shield," and in response to RAI-SRP9.1.4-SBPB-04RO the applicant stated "each FHM hoist will have a mechanical limit based on maximum hoistup travel and spent fuel handling tool length." The new FHM will be moving both new fuel andspent fuel, and new fuel is handled above deck level when it is transferred to the new fuel racksand transferred from the new fuel storage vault into the spent fuel pool. Use of the FHM hoistfor new fuel also apparently conflicts with the revised Table 2.1.1-1 item 5 of ITAAC, whichstates that the "FHM hoists are limited such that the minimum required depth of water shieldingis maintained." The applicant needs to state in the DCD how the same cranes that arerestricted in hoist up travel can handle new fuel above deck level.

This has been answered in the sixth paragraph of the Rev 1 response to RAI-SRP9.1.4-SBPB-04, provided via DCP/NRC2485, May 20, 2009. The applicable paragraph of the response isrepeated here.

Spent fuel handling is restricted to using the non-single failure proof hoist. The singlefailure proof hoist is used for handling new fuel and other loads, with the exception of

RAI-SRP9.1.4-SBPB-03 R1Westinghouse Page 1 of 4



spent fuel, throughout the fuel handling area. The single failure proof hoist inconjunction with the spent fuel handling tool is not capable of raising spent fuel to aheight that clears the spent fuel racks, fuel transfer system fuel basket, spent fuelshipping cask, or the new fuel elevator.

No additional DCD changes are provided in this response.

I Design Control Document (DCD) Revision: (Revision 0)

DCD Tier 2, Section 9.1.4.3.3, pg 9.1-34

Section 9.1.4.3.3 Fuel Handling Machine

The fulhandling machinehac the Game decign funcprtineps As the re-fuelIfing mnachino nincludoc i. thsam e fty foatu~roc.

The fuel handlinq machine desiqn includes the followinq provisions to provide for safe handlingof fuel assemblies and other components within the spent fuel handlinq area:

A. Safety Interlocks

Operations which could endanger the operator or damage the fuel, designated below byan asterisk (*), are prevented by mechanical or failure tolerant electrical interlocks or byredundant electrical interlocks. Other interlocks are intended to provide equipmentprotection and may be implemented either mechanically or by electrical interlock and arenot required to be fail safe.

Fail safe electrical desiqn of a control system interlock is applied according to thefollowing rules:

1. Fail safe operation of an electrically operated brake is such that the brake enqaqeson loss of power.

2. Fail safe operation of a relay is such that the de-energized state of the relay inhibitsunsafe operation.

3. Fail safe operation of a switch, termination, or wire is such that breakage or highre~sistance of the circuit inhibits uinsafe oneration_. . ........ . .. .... ... . ... ... ...... .... .. ..fe o .. ......

O WestinghouseRAI-SRP9.1.4-SBPB-03 R1

Page 2 of 4



Those parts of a control system interlock which are not or cannot be operated in a failsafe mode as defined in the precedinq rules are supplemented by a redundantcomponent or components to provide the requisite protection. Required fail safeoperations are:

*1. The fuel handling machine can only place a fuel assembly in the new fuel rack, spentfuel racks, fuel transfer system upender, new fuel elevator, spent fuel cask, fuelinspection/repair station or truck bay traveler.

*2. When the hoist load weighing system detects a load greater than the spent fuel

assembly handling tool, the machine cannot traverse unless the hoist is at the uplimit. For new fuel handling, the load is greater than a new fuel handling tool.

*3. Simultaneous traversing and hoisting operations are prevented.

*4. The fuel handlinq machine is restricted to raising a fuel assembly to a height at whichthe water provides a safe radiation shield.

*5. When a fuel assembly is raised or lowered, interlocks provide confidence that the

fuel handling machine can only apply loads which are within safe operating limits.

*6. Lowerina of the hoist is not permitted if slack cable exists.

*7. The fuel transfer system container is prevented from moving unless the fuel handlingmachine and the long handled tool and/or fuel assembly is out of the fuel transferzone. An interlock is provided from the fuel handling machine to the fuel transfersystem to accomplish this.

B. Bridge Hold-Down Devices

The fuel handling machine bridge is horizontally restrained on the rails by guide rollerson either side of the rail. Hold down devices are used to prevent the bridge from leavingthe rails in the event of a seismic event.

C. Hoist Braking SystemThe hoists are equipped with solenoid activated motor brake. Brake is rated at 125nercent of the hoist desion load.l ...... . ...... ...... ..... -i ..... ..


Page 3 of 4



D. Fuel Assembly Support System.The hoists are supplied with redundant paths of load support such that failure of any onecomponent will not result in free fall of the fuel assembly. When redundant paths are notpractical, conservative safety factors shall be applied.

PRA Revision:None

Technical Report (TR) Revision:None


Page 4 of 4


Response to Request For Additional Information (RAI)I

RAI Response Number: RAI-SRP9.1.5-SBPB-09Revision: 1

Question:

Section 9.1.5.1.2 "Codes and Standards" of the AP1 000 DCD Revision 16 states that, "the polarcrane and the cask handling crane are designed according to NUREG-0554 supplemented byASME NOG-1 for a Type 1 single failure proof crane." Section 9.1.5.2 "System Description," ofthe AP1 000 DCD Revision 16 states that, "the containment equipment hatch hoist and thecontainment maintenance hatch hoist incorporate single failure proof features based onNUREG-0612 guidelines." The AP1000 DCD/ Tier 1 Section 2.3.5 does not list "single failureproof' as certified design information with ITAAC for either the polar crane, the cask handlingcrane, the containment equipment hatch hoist or the containment maintenance hatch hoist. Thestaff believes that "single failure proof' design criteria for the above listed cranes and hoistsshould be listed in Tier 1 as described below.

One design criteria, among several design criteria for Tier 1 information, is that it should includefeatures and functions which could have a significant effect on the safety of a nuclear plant orare important in preventing or mitigating severe accidents. A drop of the reactor vessel head ora spent fuel cask could affect plant safety. Therefore, design features that reduce the riskand/or analyses that provide assurance of safety after a dropped load are important to safety.The staff considers "single failure proof" design criteria for the polar crane and the cask handlingcrane as Tier 1 safety significant design criteria. As a minimum, the following analyses wouldhave to be performed in order to not consider "single failure proof' design criteria as safetysignificant criteria for the polar crane and the cask handling crane:

* A heavy load analysis proving that a heavy load drop in safety related areas of the plantwill not be the cause any of Items I through IV of section 5.1 of NUREG 0612, "Control ofHeavy Loads at Nuclear Power Plants." [Section 9.1.5.3 of the AP1000 DCD clearlystates that no heavy load analyses were performed for critical loads carried by thecontainment polar crane, the cask handling crane, the containment equipment hatchhoist and the containment maintenance hatch hoist.]

* SRP 9.1.5, "Overhead Heavy Load Handling Systems," Section III. 4, states that without"single failure proof' design criteria, analyses are required for a dropped load on thereactor vessel, among other analyses. The DCD does not describe results of thisanalysis.

* Regulatory Guide 1.13, Regulatory Position C.5 states that an alternative to an "singlefailure proof' crane is that the spent fuel cask loading area be designed to withstand adrop of the heaviest load at the maximum height. Whereas, AP1 000 DCD Section 15.7.5states a Spent Fuel Cask Drop Accident Analysis was not performed.

RAI-SRP9.1.5-SBPB-09 R1Page 1 of 11



As a minimum, the following analysis would have to be performed in order to not consider"single failure proof' design criteria as safety significant criteria for the containment equipmenthatch hoist and the containment maintenance hatch hoist:

A heavy load analysis proving that a heavy load drop in safety related areas of the plantwill not be the cause any of Items I through IV of section 5.1 of NUREG 0612, "Control ofHeavy Loads at Nuclear Power Plants." [Section 9.1.5.3 of the AP1000 DCD clearlystates that no heavy load analyses were performed for critical loads carried by thecontainment polar crane, the cask handling crane, the containment equipment hatchhoist and the containment maintenance hatch hoist.]

Without the analyses and design criteria stated above, the "single failure proof' design feature ofthe polar crane, cask handling crane, containment maintenance hatch crane and containmentequipment hatch crane becomes safety significant design criteria.

The staff notes that the applicant prevents the cask handling crane from moving over the spentfuel pool because the crane rails do not extend over the pool. Mechanical stops prevent thecask handling crane from going beyond the end of the rails. However, Regulatory Guide 1.13,Regulatory Position C.5 specifies that the spent fuel cask loading area be designed towithstand, without significant leakage of the adjacent spent fuel storage, the impact of theheaviest load to be carried by the crane from the maximum height to which it can be lifted or thespent fuel storage facility should have cranes designed to single failure proof criteria. Since theDCD did not declare that the spent fuel cask loading area is designed to withstand the impact ofthe heaviest load to be carried from the maximum height to which it can be lifted, withoutsignificant leakage of the adjacent spent fuel storage, the single failure proof design criteria forthe cask handling crane is safety significant design criteria.

RAI SRP 9.1.5-SBPB-09Please justify why the applicant did not include "single failure proof' design criteria and ITAAC inTier 1 of the DCD, which are safety significant design criteria, for the polar crane, the caskhandling crane, the containment equipment hatch hoist and the containment maintenance hatchhoist.

Additional Question based on NRC comments at 3/18/09 meeting:

Based on its evaluation, the staff finds the applicant's response acceptable in that the applicanthas now included single failure proof design criteria and ITAAC in Tier 1 of the DCD for the fourload handling systems. However, the staff finds that the acceptance criteria for the proposedITAAC should include, not only a report that concludes the acceptability of the proposedinspections, tests, and analyses, but also a certificate of conformance from the vendor statingthat the crane/hoist is single failure proof.

RAI-SRP9.1.5-sBPB-09 R1Page 2 of 11



Westinghouse Response: (Revision 0)

Single failure proof criteria will be updated within the ITAAC Table 2.3.5-2 for components 3a,3b, 3c, and 3d.

Additional Westinghouse Response: (Revision 1)

Single failure proof criteria will be updated within the DCD Rev 17 ITAAC Table 2.3.5-2 forcomponents 3a, 3b, 3c, and 3d. The acceptance criteria for'the ITAAC is updated to include acertificate of conformance from the vendor stating that the crane/hoist is single failure proof. Aseparate DCD revision section is provided below.

Design Control Document (DCD) Revision: (Revision 0)

2.3.5 Mechanical Handling System

Design Description

The mechanical handling system (MHS) provides for lifting heavy loads. The MHS equipment can be operatedduring shutdown and refueling.

The component locations of the MHS are as shown in Table 2.3.5-3.

1. The functional arrangement of the MHS is as described in the Design Description of thisSection 2.3.5.

2. The seismic Category I equipment identified in Table 2.3.5-1 can withstand seismic design basis loadswithout loss of safety function.

3. The MHS components listed below are Single Failure Proof: pro-vides the following safety r.elated

a) The containment polar crane preventrb) The cask handling crane pre;ents thec) The equipment hatch hoist pr-e-en4s td) The maintenance hatch hoist pr-eent:

tMe unwconroniei -owenng or a neavy i"oaa.unc.oAnrolled lower.ing of a hea-"y lead.

he u"controlled loweFfig of a heaMv lead.s.the o of a heawy load.

4. The cask handling crane cannot move over the spent fuel pool.


Page 3 of 11



Table 2.3.5-2Inspections, Tests, Analyses, and Acceptance Criteria

Design Commitment Inspections, Tests, Analyses Acceptance Criteria

1. The functional arrangement of Inspection of the as-built system The as-built MHS conforms with thethe MHS is as described in the will be performed. functional arrangement as describedDesign Description of this in the Design Description of thisSection 2.3.5. Section 2.3.5.

2. The seismic Category Iequipment identified inTable 2.3.5-1 can withstand seismicdesign basis loads without loss ofsafety function.

i) Inspection will be performed toverify that the seismic Category Iequipment identified in Table2.3.5-1 is located on the NuclearIsland.

ii) Type tests, analyses, or acombination of type tests andanalyses of seismic Category Iequipment will be performed.

iii) Inspection will be performedfor the existence of a reportverifying that the as-installedequipment including anchorage isseismically bounded by the testedor analyzed conditions.

i) The seismic Category I equipmentidentified in Table 2.3.5-1 is locatedon the Nuclear Island.

ii) A report exists and concludes thatthe seismic Category I equipment canwithstand seismic design basis loadswithout loss of safety function.

iii) A report exists and concludesthat the as-installed equipmentincluding anchorage is seismicallybounded by the tested or analyzedconditions.


Page 4 of 11



3.a) The ccntaimment pola cr ean-1 I

prevents Mtne unoto epowerfingof a heavy-1ead. The Polar Crane isSingle Failure Proof.

Load testing of the main andau.iihary hoists that handle heavy

loads Aill be performed. The test

The .. r.ane -i-fis the test load, adlowers, steps, and holds the test load4Ait-h the heist holding br-akes. Areport exists and concludes that thePolar Crane is Single Failure Proofeight of the r-eactor- vessel headd

and integrated head package.Validation of redundant or doubledesign factors are provided forload bearing components such as:

* Hoisting ropes

* Sheaves

* Equalizer Assembly

* Hooks

* Holding brakes

The Polar Crane shall be static-load tested to 125% of the ratedload.

The Polar Crane shall lift a testload that is 100% of the ratedload. Then it shall lower, stop,and hold the test load.

* WestinghouseRAI-SRP9.1.5-SBPB-09 R1

Page 5 of 11



3.b) T.h. -e- al.k ha-n 1dling 1r.ane

pr-eve s 1. e unejntui~elle lewefnngef a heamy-lead. The Cask HandlingCrane is Single Failure Proof

Load testing of dhe main hoist -illbe peffenfned. ThP tA-.t load 10illbe at least equal to the weighttthe spent fuel shipping cask.Validation of redundant or doubledesign factors are provided forload bearing components such as:

" Hoisting ropes

* Sheaves

" Equalizer Assembly

" Hooks

* Holding brakes

The Cask Handling Crane shall bestatic-load tested to 125% of therated load.

The Cask Handling Crane shalllift a test load that is 100% of therated load. Then it shall lower,stop, and hold the test load.

I

wwer~~, ~ anU flQ11 ftlS tes IHwihtehiSt holdinig braes Areport exists and concludes that theCask Handling Crane is SingleFailure Proof

O Westinghouse

RAI-SRP9.1.5-SBPB-09 R1Page 6 of 11



3.c) The equipment hatch hoist lestmg Oith 0e10unsHIant h101Sthelding mechanisms for- the

Each hoist hcHin~ mechanism ~tanspr~event Sne UncOR46oued lo.er-Mgof a heav"y-ead The EquipmentHatch Hoist is Single Failure Proof

equipment hatch hoist that handlesan;d hclds the hatch. A report existsand concludes that the EquipmentHatch Hoist is Single Failure Proof.

lowering the hatch at themaximum cprating speed.

Validation of redundant or doubledesign factors are provided forload bearing components such as:

* Hoisting ropes

* Sheaves


* Hook

* Holding brakes

The Equipment Hatch Hoistholding mechanism shall stop andhold the hatch.

*WestinghouseRAI-SRP9.1.5-SBPB-09 R1

Page 7 of 11



3.d) The maintenance hatch heistpr-events the uncontrolled loweringofa heaNy . lead. The MaintenanceHatch Hoist is Single Failure Proof

+ ^1r4',P r-Pt4u;;k4;44# A^Iv

holding mccehanism's fer- themaintenance hatch heist thathandles heaTy loads will be

hacfl J181t ABolIMg M0clianiffmf stopsand. holds the hatch. A report existsand concludes that the MaintenanceHatch Hoist is Single Failure Proof

-at the maximum oprtn speed.Validation of redundant or doubledesign factors are provided forload bearing components such as:

* Hoisting ropes

* Sheaves


* Hook

* Holding brakes

The Maintenance Hatch Hoistholding mechanism shall stop andhold the hatch.

4. The cask handling crane cannot Testing of the cask handling crane The cask handling crane does notmove over the spent fuel pool. is performed. move over the spent fuel pool.

( WestinghouseRAI-SRP9.1.5-SBPB-09 R1

Page 8 of 11



Design Control Document (DCD) Revision: (Revision 1)

Table 2.3.5-2Inspections, Tests, Analyses, and Acceptance Criteria


1. The functional arrangement of Inspection of the as-built system The as-built MHS conforms with thethe MHS is as described in the will be performed. functional arrangement as describedDesign Description of this in the Design Description of thisSection 2.3.5. Section 2.3.5.

2. The seismic Category I i) Inspection will be performed to i) The seismic Category I equipmentequipment identified in verify that the seismic Category I identified in Table 2.3.5-1 is locatedTable 2.3.5-1 can withstand seismic equipment identified in Table on the Nuclear Island.design basis loads without loss of 2.3.5-1 is located on the Nuclearsafety function. Island.

ii) Type tests, analyses, or a ii) A report exists and concludes thatcombination of type tests and the seismic Category I equipment cananalyses of seismic Category I withstand seismic design basis loadsequipment will be performed. without loss of safety function.

iii) Inspection will be performed iii) A report exists and concludesfor the existence of a report that the as-installed equipmentverifying that the as-installed including anchorage is seismicallyequipment including anchorage is bounded by the tested or analyzedseismically bounded by the tested conditions.or analyzed conditions.

3.a) The polar crane is single Validation of redundant or double A report exists and concludes that thefailure proof. design factors are provided for polar crane is single failure proof. A

load bearing components such as: certificate of conformance from thevendor exists and concludes that the

* Hoisting ropes polar crane is single failure proof.* Sheaves* Equalizer assembly* Hooks* Holding brakes

The polar crane shall bestatic-load tested to 125% of therated load.

The polar crane shall lift a testload that is 100% of the ratedload. Then it shall lower, stop, andhold the test load.

OWestinghouseRAI-SRP9.1.5-SBPB-09 R1

Page 9 of 11



Table 2.3.5-2 (cont.)

Inspections, Tests, Analyses, and Acceptance Criteria


3.b) The cask handling crane is Validation of redundant or double A report exists and concludes that thesingle failure proof design factors are provided for cask handling crane is single failure

load bearing components such as: proof A certificate of conformancefrom the vendor exists and concludes

* Hoisting ropes that the cask handling crane is single* Sheaves failure proof* Equalizer assembly* Hooks* Holding brakes

The cask handling crane shall bestatic-load tested to 125% of therated load.

The cask handling crane shall lifta test load that is 100% of therated load. Then it shall lower,stop, and hold the test load.

3.c) The equipment hatch hoist is Validation of redundant or double A report exists and concludes that thesingle failure proof. design factors are provided for equipment hatch hoist is single

load bearing components such as: failure proof. A certificate ofconformance from the vendor exists

* Hoisting ropes and concludes that the equipment* Sheaves hatch hoist is single failure proof* Equalizer assembly* Hooks* Holding brakes

The equipment hatch hoistholding mechanism shall stop andhold the hatch.


Page 10 of 11



Table 2.3.5-2 (cont.)Inspections, Tests, Analyses, and Acceptance Criteria


3.d) The maintenance hatch hoist is Validation of redundant or double A report exists and concludes that thesingle failure proof. design factors are provided for maintenance hatch hoist is single

load bearing components such as: failure proof. A certificate of

conformance from the vendor exists* Hoisting ropes and concludes that the maintenance

E Sheaves hatch hoist is single failure proof.* Equalizer assembly

* Hooks* Holding brakes

The maintenance hatch hoistholding mechanism shall stop andhold the hatch.

4. The cask handling crane cannot Testing of the cask handling crane The cask handling crane does notmove over the spent fuel pool. is performed. move over the spent fuel pool.

PRA Revision:

None

Technical Report (TR) Revision:

None


Page 11 of 11

westinghouse electric co., response to request for ...section 9.1.4.3.3 states that the fuel...

Documents