ML14138A085

Forwards Draft Evaluation of SEP Topic III-4.C, Internally Generated Missiles. Facility Adequately Protected from Internally Generated Missiles

ML14138A085
Person / Time
Site:	San Onofre
Issue date:	10/12/1982
From:	Paulson W Office of Nuclear Reactor Regulation
To:	Dietch R Southern California Edison Co
References
TASK-03-04.C, TASK-3-4.C, TASK-RR LSO5-82-10-023, LSO5-82-10-23, NUDOCS 8210200023
Download: ML14138A085 (66)

Text

-.

t REG 1,49 UNITED-STATES C

NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 October 12, 1982 Docket No. 50-206 LS05-82 023 Mr. R. Dietch, Vice President Nuclear Engineering and Operations Southern California Edison Company 2244 Walnut Grove Avenue Post Office Box 800 Rosemead, California 91770

SUBJECT:

SEP TOPIC III-4.C, INTERNALLY GENERATED MISSILES SAN ONOFRE UNIT 1 Enclosed is a draft evaluation of SEP Topic III-4.C. It is based on a safety assessment report and responses to questions, which you sent by letters dated April 29, 1982 and September 17, 1982. The evaluation concludes that your facility is adequately protected from internally generated missiles, You are requested to examine the facts upon which the staff has based its evaluation and respond either by confirming that the facts are correct, or by identifying errors and supplying the corrected informa tion. We encourage you to supply any other material that might affect the staff's evaluation of this topic or be significant in the Integrated Assessment of your facility. Your response is requested as soon as possible, If no response is received by the time the integrated assessment of your facility begins, we will assume that you have no comments or corrections.

This evaluation will be a basic input to the integrated safety assessment for your facility unless you identify changes needed to reflect the as built conditions at your facility. This assessment may be revised in the future if your facility design is changed or if NRC criteria relating to this subject is modified before the integrated assessment is completed.

Sincerely, Walt Paulson, Project Manager Operating Reactors Branch #5 Division of Licensing

Enclosure:

As stated cc w/enclosure: See next page

Mr. R.*Dietch cc Charles R. Kocher, Assistant General Counsel James Beoletto, Esquire Southern California Edison Company Post Office Box 800 Rosemead, California 91770 David-R. Pigott Orrick, Herrington & Sutcliffe 600 Montgomery Street

• San Francisco, California 94111 Harry B. Stoehr San Diego Gas & Electric Company P. 0. Box 1831 San Diego, California 92112 Resident Inspector/San Onofre NPS c/o U. S. NRC P. 0. Box 4329 San Clemente, California 92672 Mayor City of San Clemente San Clemente, California 92672 Chairman Board of Supervisors County of San Diego San Diego, California 92101 California Department of Health ATTN:

Chief, Environmental Radiation Control Unit Radiological Health Section 714 P Street, Room 498 Sacramento, California 95814 U. S. Environmental Protection Agency Region IX Office ATTN:

Regional Radiation Representative 215 Freemont Street San Francisco, California 94111 Robert H. Engelken, Regional Administrator Nuclear Regulatory Commission, Region V 1450 Maria Lane Walnut Creek, California 94596

J ENCLOSURE SAFETY EVALUATION REPORT SAN ONOFRE UNIT 1 SYSTEMATIC EVALUATION PROGRAM TOPIC III-4.C INTERNALLY GENERATED MISSILES

1. INTRODUCTION Missiles which are generated internally to the reactor facility (inside or outside containment) may cause damage to structures, systems and components that are necessary for the safe shutdown of the reactor facility or accident mitigation and to the structures, systems and components whose failure could result in a significant release of radio activity. The potential sources of such missiles are valve bonnets, and hardware retaining bolts, relief valve parts, instruments wells, pressure containing equipment such as accumulators and high pressure bottles, high speed rotating machinery, and rotating segments (e.g., impellers and fan blades).

Scope of Review The scope of the review is as outlined in the Standard Review Plan (SRP)

Section 3.5.1.1, "Internally Generated Missiles (Outside Containment),"

and SRP Section 3.5.1.2, "Internally Generated Missiles (Inside Contain ment)." The review specifically excludes SRP Section 3.6.1, "Plant Design for Protection Against Postulated Piping Failures in Fluid Systems Outside Containment," 3.6.2, "Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping," as well as

• those SRP sections dealing with natural phenomena (including missiles generated by natural phenomena), missiles generated outside the facility, and turbine missiles.

-2 II. REVIEW CRITERIA The acceptability of the design of protection for facility structures, systems and components from internally generated missiles is based on meeting the following criteria:

1. General Design Criterion 4, "Environmental and Missile Design Bases" with respect to protecting structures, systems and components against the effects of internally generated missiles to maintain their essential safety functions.

2.

Regulatory Guide 1.13, "Spent Fuel Storage Facility Design Bases" as related to the spent fuel pool systems and structures being capable of withstanding the effects of internally generated missiles and preventing missiles from impacting stored fuel assemblies.

3.

Regulatory Guide 1.27, "Ultimate Heat Sink for Nuclear Power Plants" as related to the ultimate heat sink being capable of withstanding the effects of internally generated missiles.

III.

RELATED SAFETY TOPICS AND INTERFACES Review Areas Outside the Scope of this Topic As previously stated, this review specifically excludes the following:

1. SRP Section 3.6.1, "Plant Design for Protection Against Postulated Piping Failure in Fluid Systems Outside Containment" - This matter will be covered under Safety Topic III.5.B, "Piping Break Outside Containment."

-3

2.

SRP Section 3.6.2, "Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping" - This matter will be covered under Safety Topic III-5.A, "Effects of Pipe Break on Structures, Systems and Components Inside Containment."

3. Natural Phenomena - This matter will be covered under Safety Topics 111-6, "Seismic Design Considerations" and III-4.A, "Tornado Missiles."

4. Turbine Missiles - This matter will be covered under Safety Topic III-4.B, "Turbine Missiles."

Interfaces with Other SEP Safety Topics Satisfactory resolution of the following safety topics will depend, at least in part, on the satisfactory resolution of this topic:

1. Topic VII-3, "Systems Required for Safe Shutdown."

2.

Topic VII-4, "Effects of Failure in Non-Safety Related Systems On Selected Engineered Safety Features."

3. Topic IX-1, "Fuel Storage."

4. Topic IX-3, "Station Service ahd Cooling Water System."

5. Topic II-3.C, "Safety-Related Water Supply (Ultimate Heat Sink)."

IV. REVIEW GUIDELINES Systems and components needed to perform safety funcitons were identified as those listed in SRP Section 3.2.2, "Systems Quality Group Classification."

-4

1. Systems needed to perform safety functions (safe plant shutdown or accident mitigation) are:

a. Reactor Coolant System

b. Safety Injection System

c. Chemical and Volume Control System

d. Component Cooling Water System

e. Residual Heat Removal System

f. Portions of the Main Steam System

g. Portions of the Circulating Water System

h. Containment Spray System

i.

Plant Makeup Water System

j. Portions of Main Feedwater System

k. Compressed Air System

1. Air Conditioning and Ventilation Systems

m. Diesel Generators and Auxiliary Systems

n. Auxiliary Feedwater S.ystem

2. Systems whose failure may result in release of unacceptable amounts of radioactivity are:

a. Reactor Cycle Sampling System

b. Radioactive Liquid Waste System

c. Radioactive Gaseous Waste System

d. Radioactive Solid Waste System

e. Spent Fuel Cooling System

f. Containment Purge System

-5

3. Electrical and Instrumentation Systems to support safe shutdown operations Are:

a. 4160 Volt System (including associated switchgear and the emergency diesel generator system)

b. 480 Volt System (including associated switchgear)

c. 125 Volt D.C. System (including station batteries)

d. Control Room (including cable spreading area)

V. REVIEW AND EVALUATION

1. Systems needed to perform -safety functions:

a. Reactor Coolant System The reactor coolant system serves as the pressure retaining boundary for the primary coolant.

The system is comprised of a reactor pressure vessel and three parallel heat transfer loops.

Each loop contains one steam generator, one pump, connecting piping and instrumentation. A pressurizer and associated relief and safety valves are connected by the surge and spray lines to two of the reactor coolant lines. All components of the reactQr coolant system are located within the containment building.

The reactor vessel head is secured by 42 closure studs and nuts.

It is unlikely that any of the studs would become a missile because the pressurizer relief valves and the main steam pressure relief valves assure the coolant system pressure does not exceed design limits. Therefore, these studs are not subjected to enough stress to create an accelerating force sufficient to cause them to become missiles.

The pressurizer pressure relief valves have the potential for becoming missiles. Both the power operated relief valves and safety valves are mounted on top of the pressurizer. The position of the pressurizer is above the steam generator loops and is enclosed in a concrete compartment.

A valve failure could result in debris.

However, this debris would be expected to strike the overhead walls and would not be likely to result in.

damage-to other components or piping of the reactor coolant system.

The control rod drive mechanisms are mounted on the top, of the reactor vessel and are considered as an extension of the reactor vessel head.

Each module is attached to a threaded connection on the reactor vessel head and seal welded. The drive modules are further covered by a concrete cover.

The control rod drive module design and the associated missile cover will preclude safety system missile damage.

-7 Instrumentation generally requires some penetration into the reactor coolant system. These penetrations are usually small and take the form of welded wells.

Should a penetration well fail, it will not cause serious damage or compromise the safety of the reactor coolant system due to the well orientation and the small resulting opening in the pressure boundary.

The possibility that missiles could be generated due to destruc tive overspeeding of a primary coolant pump in the event of a pipe break in the pump discharge was considered by the licensee.

The ejection of a potentially damaging impeller missile is mini mized by the massive steel pump casing. Primary coolant pump flywheel integrity and resulting potential generation of missiles from overspeed of the flywheel has been considered under SEP Topic III-10.B, "Pump Flywheel Integrity."

The three steam generators are partiallyr-compartmehted in sefparate concrete enclosures and are therefore unTikely to be affected by missile from.outside the compartments. Steam generator manways are held in position by studs on'the primary and secondary sides of the shell.

These studs are not subjected to sufficient pressure to result in a significant missile source. In the event a stud were to become a missile, the location of the steam generators within concrete enclosures and the missile trajectory would preclude resulting missile damage.

e 8

In summary, we consider the likelihood of missile generation and resultant damage to the reactor coolant system to be acceptably low by virtue of equipment design features, component arrangement and compartmentalization. Further, should a missile create a break in the primary system, the safety injec tion system would operate effectively to mitigate the effects of the resulting LOCA.

b. Safety Injection System The safety injection system provides water to the reactor coolant system in the event of a loss of primary coolant.

The system consists of the refueling water storage tank, two safety injection pumps, two recirculation pumps, two feedwater pumps and associated piping and valves. Safety injection flow is directed to the reactor coolant system through three cold leg reactor inlet pipes. The equipment evaluated in this section is limited to the safety injection pumps and recirculation pumps.

The refueling water storage tank is evaluated in Section V.l.h and main feedwater pumps are evaluated in Section V.1.j.

The safety injection pumps are located outside and to the west of the turbine building next to the refueling water storage tank and service transformers. The licensee has provided a missile analysis

for these transformers which concludes that the enclosure around the bushings in the transformer will prevent the bushings (the only potential missile source) from becoming a missile.in the low probability of a transfor-mer explosion.

Thus, adequate protection is provided for the safety injection pumps.

The safety injection pumps have a thick steel casing, making it highly improbable that a missile, such as a broken impeller, would penetrate the casing and cause any damage.

The recirculation pumps are located next to each other in the containment sump. The most likely missile sources in this area are the sphere sump pumps.

However, the sphere sump pump casing should retain any impeller missiles. The recirculation pump casings should also retain any impeller missiles. Thus, it is highly improbable that missiles from or to the recirculation pumps can cause damage.

The safety injection lines within containment are routed separately to each of -the.-three reactor coolant..system cold leg penetrations. This separation precludes damage to more than one line due to an internal missile. Discussion of protection of the safety injection lines outside containment is contained in Section V.l.j.

-10 In summary, the safety injection system, because of its component design features, redundancy, and separation will be capable o'f performing its design function considering internally generated missiles sources as discussed above.

c. Chemical andiVolume Control System The chemical and volume control system (CVCS) controls and main tains reactor coolant system inventory and purity through the process of letdown, purification and charging (makeup). The system consists of a regenerative heat exchanger and an excess letdown heat exchanger which reduce the letdown flow temperature, orifices to reduce the letdown pressure, residual heat removal (RHR) heat exchanger to cool letdown water treatment ion exchangers a volume control tank which provides a reservoir for volume changes, chemical mixing equipment, charging pumps which return the treated water to the reactor coolant system, and a seal water heat exchanger which reduces the temperature of the reactor coolant pump seal water.

The charging pumps and seal -water heat exchanger are located in a separate room in the reactor auxiliary building which contain:

no equipment from other systems which might produce missiles.

The. most likely potential source of missiles in.

this room are the charging pumps themselves. The licensee performed an analysis and concluded that the charging pumps are not missile sources because the impellers will not penetrate the thick steel casing.

The regenerative heat exchanger is located inside the containment.

If it is damaged by a missile, charging could be accomplished by the reactor coolant pump seal water lines.

All other equipment in the CVCS is located on the reactor auxiliary bqilding roof. None of this equipment is required to safely shut down the plant, as the safety injection system, auxiliary feedwater system and residual heat removal system would be available to achieve safe shut down in the event of loss of CVCS letdown and charging.

In summary, we conclude that the possibility of internal missile damage to the CVCS will not result in an unacceptable release of radioactivity nor will it affect the safe shutdown of the facility.

d. Component Cooling Water System The component cooling water (CCW) system is designed to dissipate waste heat from various nuclear system components. The heat absorbed by the CCW System is transferred to the circulating water system via heat exchangers and released to the ultimate heat sink.

(See also SEP Topic IX-3, "Station Service and Cooling Water System.")

The component cooling water system is a closed system consisting of three pumps, two heat exchangers and a surge tank. This equipment is located on the reactor auxiliary building roof.

-12 The CCW System removes heat from the spent fuel pit heat exchanger, residual heat removal heat exchangers, residual heat removal pump bearing cooling heat exchangers, seal water heat exchanger, reactor coolant pump thermal barrier and bearing cooling heat exchangers, and charging pump oil cooling heat exchangers.

We conclude. that the system is an unlikely source of pressurized component missiles due to its low operating pressure and tempera ture. However, a potential pressurized missile source can result from failure of the high pressure nitrogen bottles or liquid nitrogen storage vessel which are located in the area of the component cooling water system equipment. The nitrogen bottles are restrained by a rack and partially enclosed by a concrete wall.

Therefore, it is unlikely that damage to the component cooling water system equipment can occur. In addition, further protection is provided by the orientation of the shutoff valves on the nitrogen bottles which is away from the component cooling water system equipment. Missiles generated from the liquid nitrogen vessel can -damagesthe CCW heat exchapgers. Should such a missile strike occur, it would be necessary to shut the reactor down since cooling water to the reactor coolant pumps is lost.

Residual heat could be removed via the auxiliary feedwater system and steam generators until repairs could be made to the com ponent cooling water system.

7:7,

-_:77

-13 The licensee's analysis of rotating components in the area of the CCW system concludes that the only potentially damaging missile source is a component cooling water pump impeller since it can penetrate the pump casing and damage other component cooling water pumps or the component cooling water surge tank. Such an occurrence would also result in reactor shutdown as previously discussed.

In summary, we conclude that there is potential for internal missile damage to the component cooling water system. However, in the event the system were disabled, decay heat would be removed from the steam generators by the auxiliary feedwater system.

It would also be necessary to make repairs to the CCW system to achieve cold shutdown via the residual heat removal system.

e. Residual Hjeat Remnval System The residual heat removal (RHR) system is designed to remove core decay heat during extended shutdown periods. The system is brought into use after the primary coolant temperature and pressure fall below 350 F and 350 psig respectively. The RHR system is composed of the two RHR heat exchangers, two RHR pumps and associated valves and piping.

To achieve cold shutdown, the RHR pumps take suction from the reactor coolant system and pump reactor coolant through the RHR heat exchangers where it is cooled by component cooling water. The cooled reactor coolant is then return to the reactor coolant system.

-14 The RHR heat exchangers are located inside containment. There are no credible missile sources in the area of the RHR heat exchangers.

The RHR pumps are located adjacent to each other, but the pump casings provide protection from potential impeller missiles. However, should a missile strike the system and cause damage, the plant could continue normal operation, 4or the auxiliary feedwater system can maintain the plant in hot shutdown until the RHR.system is repaired. We therefore conclude that the plant can be safely shutdown in the event of internal missile strikes to the RHR system.

f. Portions of the Main Steam System The main steam system consists of three steam generators and the steam lines which connect to the turbine.

The steam generators are located within the containment.

The steam generators discharge into a common header inside the containment.

The ends of the header form two steam lines which penetrate containment and have turbine stop, safety and atmospheric dump valves exterior to containment.

The main steam lines are of heavy walled construction and are unlikely to be damaged by internally generated missiles. Should a missile cause damage downstream of the turbine stop valves, the valves could close and the plant could be safely shutdown. SEP Topic XV-2, "Spectrum of Steam System Piping Failures Inside and Outside Containment," considered a break upstream 6f turbine-stop valves.

-15 The atmospheric dump and safety valves can produce missiles. How ever, the sphere enclosure building and the control building on one side and the spent fuel building on the other will contain any 4

missiles and direct them in a vertical direction. The probability that a missile could impact redundant safety related components is very low.

In summary, we conclude that the main steam system will be capable of performing its design function considering internally generated missiles and its failure is not likely to affect safe plant shutdown.

g. Portions of Circulating Water Systems The portions of the circulating water system which are used for safe shutdown or accident mitigation are the two salt water cooling pumps and the auxiliary salt water cooling pump which cool the com ponent cooling water heat exchangers. The auxiliary salt water cooling pump provides cooling if the salt water cooling pumps fail.

The auxiliary salt water cooling pump is located in a separate pit remote from the salt water cooling pumps.,This separation makes it unlikely that a missile could damage both the auxiliary salt water cooling pump and the salt watercooling pumps. Further, with the exception of a gasoline powered screen wash pump, there are no credible missile sources in the area of these pumps.

Missiles S

resulting from failure of the screen wash pump engine or its local fuel storage tank could damage both salt water cooling pumps and common piping necessary for utilizing the alternate auxiliary salt water cooling pump.

However, connections are provided to connect fire protection water to the component cooling water side of the component cooling water heat exchanger in the event that all salt water cooling capability is lost.

In summary, we conclude that the portion of the circulating water system which is used for safe shutdown or accident mitigation will be capable of performing its function considering internally generated missiles.

h. Containment Spray System The-.containment spray system is designed to remove heat from the containment during and after a LOCA or main steam line/feedwater line break. It consists of the refueling water storage tank, the refueling water pumps, the containment spray nozzles, the recirculation pumps, and the recirculation heat exchanger.

The recirculation pumps are discussed in.,Section V.1.b..

The refueling water pumps are located to the west of the turbine building and could be struck by missiles from the auxiliary cooling pump. However, loss of these pumps will not affect safe shutdown capability. The refueling water pump casino will prevent ejection of impeller missiles.

H

-17 The refueling water storage tank is located near the refueling water pumps and is subject to missiles from both the component cooling water pumps and the auxiliary cooling pump. However, because the containment spray system is only required under accident conditions, it is unlikely the refueling water storage tank would be damaged simultaneously with a system demand.

The containment spray nozzles are located at the top of the containment and are protected from damaging missiles by the concrete shielding around-the reactor, pressurizer, and steam generators.

In summary, we conclude that it is unlikely missile damage could occur to the containment spray system during the infrequent acci dent condition for which it is required, and therefore, the system is adequately protected against internally generated missiles.

Plant akeu Water System The plant makeup water system consists of the primary plant makeup tank, the primary plant makeup pumps and the condensate storage tank. The safety function of this system is to provide the primary 4

_77 77'

_7S

water source for the auxiliary feedwater pumps.

A separate backup water source to the auxiliary feedwater pumps is provided by means of a hose connection through the fire protection system from the service water reservoir. At least 30 minutes is available to realign the suction of the auxiliary feedwater pumps to the backup source.

The service water 1reservoir is remote from the condensate storage tank and the primary plant makeup tank and pumps. This separation assures a source of makeup to the auxiliary feedwater system.

We therefore conclude that the safety function of the plant makeup water system is assured because of separation when considering internally generated missiles.

j. Portions of the Main Feedwater System The. main feedwater system consists of two motor driven feedpumps which deliver water to the three steam generators. The feedwater system is arranged such that the main feedwater pumps are also used in conjunction with the safety injection pumps to provide flow to the reactor coolant system in the event of a safety injection system actuation. The safety injection pumps and main feedwater pumps are powered from the emer gency power supplies.

The essential portions of the feedwater system are the feedwater pumps and the main feedwater lines between the first check valves upstream of the containment and the steam generators.

This portion of the feedwater system is not located in an area of potential missile sources as described be ow.

The main feedwater pumps are located on opposite sides of the turbine building and could not be affected by a common m~issile, Either pump alone can provide sufficient safety injection or shutdown feedwater flow. The main feedwater pump casings prevent ejection of impeller missiles.

The valves used to realign the feedwater pump suction and discharge from feedwater to safety injection are located on opposite sides of the turbine building. Therefore, potential missiles from the valves in one train could. not affect the other train.

The AFW pumps are located in the vicinity of the valves; however, they are protected from missiles by a massive steel pipe whip barrier.

In summary, we conclude that the redundancy and separation of the feedwater system are such that damage due to internally generated missiles which results in loss of function of the system is unlikely.

k. Compressed Air System The compressed air system is designed to supply oil free air to the service air and instrument air systems.

The service air system consists of three service air compressors, three after coolers and three air receivers located in the turbine building.

The service air system

-20 provides compressed air to the instrument air system under normal con ditions.

During abnormal conditions instrument air can be provided by an emergency air compressor and receiver or by local accumulators.

Instrument air can also be provided by a portable diesel driven air compressor.

Backup nitrogen bottles are provided for the safety related instrumentation required for safe shutdown.

The backup nitrogen bottles are a source of internal missiles and their failure can cause missile impact against instrument air headers.

However, on loss of instrument air, the safety related equipment could be operated manually or by the nitrogen bottles on redundant components.

In summary, although missile damage to the instrument air system is possible, such damage will not prohibit safe shutdown of the plant.

1. Heating, Ventilation and Air Conditioning (HVAC)

Systems

a. Reactor Auxiliary Building Ventilation System

-The reactor auxiliary building ventilation system (RABVS) provides ventilation to the reactor auxiliary building.

The charging pumps are the only essential equipment required for safe shutdown which are located in the reactor auxiliary building.

Alternate-reactor coolant makeup can be provided by the safety injection pumps and feedwater pumps should the charging pumps be lost.

The RABVS air handling unit could generate missiles. However, no equipment required for shut down is in the vicinity, and thus these missiles will not impair the plant's ability to achieve safe shutdown.

Failure of the RABVS is discussed further in SEP Topic IX-5, "Ventilation Systems."

2. Control Room Heating, Ventilating and Air Conditioning System The control room HVAC (CRHVAC) system maintains a habitable environ ment in the control room under normal and accident conditions. The present system consists of a heat pump air conditioning unit, an emergency air intake unit, high efficiency and activated charcoal filters and exhaust fans. The system equipment is located on the second floor of the control and administration building.

Missiles generated by the CRHVAC system components can cause failure of the system. However, the licensee has stated that the.CRHYAC system-will be replaced as part of the TMI related requirements.

The new design will provide protection against the effects of missiles.

3. Diesel Generator Building Heating and Ventilating System The diesel generator building heating and ventilating system provides

.ventilation to the diesel generator building during normal and abnormal conditions.

The essential portions of this system consist of four fans for each separate diesel generator room.

Since each train of the system is separated from the other by the concrete walls of the diesel generator rooms, missiles affecting one train could not affect the other, thus assuring the function of the system.

4. 4160V Room Ventilating System The 4160V room ventilating system provides ventilation for the 4160V switchgear and consists of one exhaust fan. If the fan is damaged by a missile, sufficient time is available to arrange alternate cooling before excessive temperatures are reached.

The fan itself can fail and generate missiles, but is located away from equipment required for safe shutdown.

0g

'-22

5. 480V Room Ventilating System The 480V room ventilating system provides ventilation for the 480V switchgear and consists of one exhaust fan: If the fan is damaged by a missile, sufficient time is available to arrange alternate cooling before excessive temperatures are reached. The fan itself can fail and generated missiles, but is located away from equipment required for safe shutdown.

In summary, the ventilation systersare separated from essential systems and therefore, their failure will not affect safe shutdown.

While the systems can be damaged by missiles, the licensee stated that time is available for action to restore adequate ventilation.

There fore, we conclude that the ventilatioh systems for these areas will be capable of performing their design function considering internally generated missiles.

m. Diesel Generators and Auxiliary Systems The diesel generators and their auxiliaries provide a source of AC power when the turbine generator is not in operation and offsite power is not available, The two diesel generators and their auxiliaries are located in separate compartments within the diesel generator building. The diesel generators are low speed units. Potential missiles from one of the two diesel generators, such as the diesel pistons, would not affect the redundant unit as the diesel generators are separated by intervening walls.

Each diesel generator has its own separate buried fuel oil storage tank.

The pumps which supply fuel to the diesel

-23 generators are approximately 70' apart and this separation makes it unlikely that both could be disabled by a common missile source.

In summary, due to the separation, compartmentalization, and independence of the diesel generators and their associated auxiliary systems, the diesel generator meets the requirements for protection against internally-generated missiles.

n. Auxiliary Feedwater System The auxiliary feedwater system provides an assured source of feed water to the steam generators when the main feedwater pumps are not available. The system consists of one turbine driven pump and one electric motor driven pump. These pumps take suction from the condensate storage tank and inject water into the main feedwater lines immediately upstream of the containment penetrations.

Both auxiliary feedwater pumps are located in the turbine building.

The pumps are partially enclosed by a 1/8" thick steel enclosure designed for pipe whip and jet impingement but which also provides protection against missiles from components in othei'systems. The auxiliary feedwater pumps and turbine casings are thick enough to prevent ejection of missiles from the impellers or turbine rotor.

The turbine is also equipped with normal and emergency governors..

to prevent overspeed.

In summary, in considering the auxiliary feedwater system, its redundant features and protection against internally generated missiles provided by barriers and equipment design, we conclude that the system will be capable of performing its design function considering internally generated missiles.

-24

2.

Systems Whose Failure May Result in Release of Unacceptable Amounts of Radioactivity

a. Reactor Cycle Sampling System The reactor cycle sampling system provides samples for laboratory analyses which serve to guide the operation of the reactor coolant system and the chemical and volume control system.

The system consists of a delay coil, sample heat exchangers, and sample pressure vessels. Samples are obtained by conducting the sample through a heat exchanger into a sample pressure vessel.

The system is operated intermittently. Should a missile strike the system while it is not in operation, no significant release of radioactivity will result as there is no radioactive fluid in the system. Should a missile strike the system while it is in operation, the containment isolation valves provided will be manually closed and no signtficant release of radioactivity will result.

We conclude that the reactor cycle sampling system is sufficiently protected with respect to internally generated missiles such that its loss will not result in a significant radioactive release.

b. Radioactive Liquid Waste System The radioactive liquid waste system processes and stores liquid wastes for radioactive decay prior to discharging these wastes to the environment under controlled conditions.

The system con sists of a flash tank, flash tank pumps, radiochemistry laboratory

drain tank, radiochemistry laboratory drain tank pump, decon tamination drain tank,.decontamination drain tank pump, liquid radwaste holdup tanks, holdup tank pumps, circulating pump, radwaste ion exchangers, gas stripper, gas stripper pump,.

monitor tanks, and monitor tank pumps. All the radioactive liquid wastesystem equipment is located in the lower level of the reactor auxiliary building. If damaged by a missile, the liquid would be contained within the reactor auxiliary building by the' drainage system. Any gases or suspended particles would be con trolled by the containment sphere purging and exhaust system.

Thus, no significant release of radioactivity would occur.

We conclude that potential internally generated missile damage to the radioactive liquid waste system will not result in significant release of radioactivity.

c. Radioactive Gaseous Waste System The radioactive gaseous waste system holds gaseous wastes for radioactive decay prior to discharging to the environment under controlled conditions.,The system consists of a waste gas surge tank, waste Gas compressors, and waste gas decay tanks.

The waste gas surge tank and the waste gas decay tanks are located in a common shielded room at the lower level of the reactor auxiliary building. The shielding will prevent any missiles from entering the room. The tanks are equipped with relief valves

which are located outside the room and therefore can not damage the system should they become missile sources..

We conclude that the radioactive gaseous waste waste system is sufficiently protected from internally generated missiles to prevent significant radioactive release.

d. Radioactive Solid Waste System The radioactive solid waste systarholds and processes solid wastes for radioactive decay and preparation for shipping. The system consists of a baler and shipping drums. This equipment is located on the roof of the reactor auxiliary building. The system does not contain sufficient radioactivity to cause concern should it fail.

We conclude that missile damage to the radioactive solid waste system will not result in a significant release of radioactivity.

e. Spent*Fuel Cooling System The spent fuel cooling system is a closed loop system consisting of one full capacity pump, one full capacity heat exchanger, a filter, piping, valves and instrumentation.

Heat from the spent fuel pool is.transferred by the heat exchanger to the component cooling water system. The heat exchanger is located on the roof of the reactor auxiliary building and the spent fuel pump is located outside.

-27 The spent fuel pool cooling system is a low energy system which is unlikely to generated missiles. Should the equipment become in operable due to missile damage, there is sufficient time to effect repair or arrange for alternate fuel pool cooling.

We thus conclude that the spent fuel cooling system is capable of performing its'function considering internally generated missiles and that in the event'of a missile damage to the system there is sufficient time to initiate alternate means of spent fuel cooling or to perform. rpairs to the spent fuel cooling system and thus prevent significant release of radioactivity.

Containment Purge System The containment purge system is provided to periodically purge the containment prior to entry. The system consists of three air handling units, ductwork and isolation dampers. The air handling units are located in a room adjacent to the spent fuel building.

The licensee stated that the system is only operated with the reactor shut down. The system is only a potential missile source at that time since it is only pressurized during ihutdown.

The probability of this system producing missiles or being damaged by a missile is therefore, low. Should almissile damage the system, the damage would not interfere with safe shutdown.

We conclude that the containment purge system missile protection is acceptable.

-28

3.

Electrical and Instrumentation Systems to Support Safe Shutdown Operations

a. 4160 Volt System The 4160V system includes 4160V switchgears No.

1A, 1B, 1C and 2C and emergency diesel generators Nos. 1 and 2. For the review of the emergency iesel generator system, see Section V.1.m.

Switchgears No. 1A and 1B provide power to the reactor coolant pumps and generator exciter which are not required for safe shut down. Switchgears No. 1C and 2C are redundant and provide power to redundant equipment required for safe shutdown of the plant.

They are located in the 4 KV switchgear room in the separate cubicles facing each other..

With the exception of a small fan, no high energy or rotating equipment is located in the 4 KV switchgear room. The fan is not located near safe shutdown equipment. However, the licensee reported an occurrence at one of their other nonnuclear facilities where a failure in the cables, breaker or relays resulted in an over current condition which caused combustion of the cable material and generated gases from cable degradation. The gases can cause pressurization of the cubicles causing the cubicle doors to become missiles which could damage the adjacent switchgear, and thus impact the safe shutdown of the plant. This is not.considered likely however, as the door would not have sufficient energy after impacting the door of the redundant cubicle to cause damage.

-29 We consider it highly unlikely that the above events could cause damage to the redundant switchgear, and therefore the 4160"Volt System is adequately protected from internally generated missiles.

b. 480 Volt Switchgear The 480V System consists of 480V switchgears 1, 2 and 3.

480V switchgears 1 and 2 are redundant and provide power to redundant equipment required for a safe shutdown of the plant. 480V switchgear 3 serves only one safety related load; component..

cooling pump C. Switchgear No. 1 is located in the 4 KV switchgear room while switchgear No. 2 and 3 are located in thelse~barate 480V switchgear room. No high energy or rotating equipment is located near the switchgear in the 4 KV or 480 V switchgear rooms.

In summary, because of separation of the redundant 480V equipment, we conclude that a safe shutdown of the plant will not be impaired considering internally generated missiles.

c. 125 Volt DC System The 125 Volt DC system consist of two redundant battery systems.

provided at separate locations.

One battery set is located in the administration and control building, the other is located in the diesel generator building. Therefore, explosion of one battery would not generate missiles affecting the other battery system, nor would missiles from other sources.

-30 We conclude that due to the separation of the redundant 125V dc equipment, safe-shutdown of the plant would not be affected by internally generated missiles.

d.

Control Room The control room is located on the operating floor level of the turbine buil'ding.

No rotating machinery or pressurized sources (except ovygen bottles and-fire extinguisher) are located in the control room. The oxygen bottles and fire extinguishers are constructed such that they are not likely to become missile sources. The control room boundary is constructed of reinforced concrete walls which provide protection from potential missile sources outside the control room. However, the control room roof is subject to missiles generated from main steam system com ponents (safety valves, dump valves, etc.) The licensee indicates that these missiles are unlikely to impact safety related equip ment in the control room. Even if damage to safety related equip ment occurred, the control room could be evacuated and shutdown accomplished from the remote shutdown panel.

We conclude that loss of function of the control room due to internally generated missiles is highly unlikely. However, should missiles damage safety related equipment, safe shutdown can be achieved from the remote shutdown panel located outside and independent of the control room.

-31 VI.

CONCLUSIONS Based on our review of the systems and components needed to perform safety functions, we conclude that the design of protection from inter nally generated missiles meets the intent of the criteria listed in Section II -

REVIEW CRITERIA Of Standard Review Plan Sections 3.5.1.1 and 3.5.1.2.

October 12, 1982 rYA -C Docket No. 50-206 LS05-82 023 Mr. R. Dietch, Vice President Nuclear Engineering and Operations Southern California Edison Company 2244 Walnut Grove Avenue Post Office Box 800 Rosemead, California 91770

SUBJECT:

SEP TOPIC III-4.C, INTERNALLY GENERATED MISSILES SAN ONOFRE UNIT 1 Enclosed is a draft evaluation of SEP Topic II.I-4.C. It is based on a safety assessment report.and responses to questions, which you sent by letters dated April 29, 1982 and September 17, 1982. The evaluation concludes that your facility is adequately protected from internally generated missiles.

You are requested to examine the facts upon which the staff has based its evaluation and respond either by confirming that the facts are correct, or by identifying errors and supplying the corrected informa tion. We encourage you to supply any other material that might affect the staff's evaluation of this topic or be significant in the Integrated Assessment of your facility. Your response is requested as soon as possible. If no.response is received by the time the integrated assessment of your facility begins, we will assume that you have no comments or corrections.

This evaluation will be a basic input to the integrated safety assessment for your facility unless you identify changes needed to reflect the as built'conditions at your facility. This assessment may be revised in the future if your facility design is changed or if NRC criteria relating to this subject is modified before the integrated assessment is completed.

Sincerely,

1. 5:PM OR DL Walt Paulson, Project Manager

• NPaulson DC field lia Operating Reactors Branch #5 10//82 10//82 1

82 Division of Licen ing E

r ~~~~~

~

~

07 siyn e J

1

~

-- S'bEJ1BT 7

7 1JEBDff.4SE OFFICEk.TMTi'h'a Khires W.usl.l.

SoRN W lb 10/(/82 10/04/82 10/ /82 10/./82 NRC FORM 38 Z0-80Hu FO.

NRC FORM 318 (10-80) NHL;M- ~e

.-iFICIAL RECORD COPY USGPO: 1981-335-960

Mr. R. Dietch cc Charles R. Kocher, Assistant General Counsel James Beoletto, Esquire Southern California Edison Company Post Office Box 800 Rosemead, California 91770 David.R. Pigott Orrick, Herrington & Sutcliffe 600 Montgomery Street San Francisco, California 94111 Harry B. Stoehr San Diego Gas & Electric Company P. 0. Box 1831

.San Diego, California 92112 Resident Inspector/San Onofre NPS c/o U. S. NRC P. 0. Box 4329 San Clemente, California 92672 Mayor City of San Clemente San Clemente, California 92672 Chairman Board of Supervisors County of San Diego San Diego, California 92101 California Department of Health ATTN:

Chief, Environmental Radiation Control Unit Radiological Health Section 714 P Street, Room 498 Sacramento, California 95814 U. S. Environmental Protection Agency Region IX Office ATTN:

Regional Radiation Representative 215 Freemont Street San Francisco, California 94111 Robert H. Engelken, Regional Administrator Nuclear Regulatory Commission, Region V 1450 Maria Lane Walnut Creek, California 94596

IL ENCLOSURE SAFETY EVALUATION REPORT SAN ONOFRE UNIT 1 SYSTEMATIC EVALUATION PROGRAM TOPIC III-4.C INTERNALLY GENERATED MISSILES I. INTRODUCTION Missiles which are generated internally to the reactor facility (inside or outside containment) may cause damage to structures, systems and components that are necessary for the safe shutdown of the reactor facility or accident mitigation and to the structures, systems and components whose failure could result in a significant release of radio activity. The potential sources of such missiles are valve bonnets, and hardware retaining bolts, relief valve parts, instruments wells, pressure containing equipment such as accumulators and high pressure bottles, high speed rotating machinery, and rotating segments (e.g., impellers and fan blades).

Scope of Review The scope of the review is as outlined in the Standard Review Plan (SRP)

Section 3.5.1.1, "Internally Generated Missiles (Outside Containment),"

and SRP Section 3.5.1.2, "Internally Generated Missiles (Inside Contain ment)."

The review specifically excludes SRP Section 3.6.1, "Plant Design for Protection Against Postulated Piping Failures in Fluid Systems Outside Containment," 3.6.2, "Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping," as well as those SRP sections dealing with natural phenomena (including missiles generated by natural phenomena), missiles generated outside the facility, and turbine missiles.

0

-2 II. REVIEW CRITERIA The acceptability of the design of protection for facility structures, systems and components from internally generated missiles is based on meeting the following criteria:

1. General Design Criterion 4, "Environmental and Missile Design Bases" with saspect to protecting structures, systems and components against the effects of internally generated missiles to maintain their essential safety functions.

2.

Regulatory Guide 1.13, "Spent Fuel Storage Facility Design Bases" as related to the spent fuel pool systems and structures being capable of withstanding the effects of internally generated missiles and preventing missiles from impacting stored fuel assemblies.

3.

Regulatory Guide 1.27, "Ultimate Heat Sink for Nuclear Power Plants" as related to the ultimate heat sink being capable of withstanding the effects of internally generated missiles.

III.

RELATED SAFETY TOPICS AND INTERFACES Review Areas Outside the Scope of this Topic As previously stated, this review specifically excludes the following:

1. SRP Section 3.6.1, "Plant Design for Protection Against Postulated Piping Failure in Fluid Systems Outside Containment" - This matter will be covered under Safety Topic III.5.B, "Piping Break Outside Containment."

-3

2.

SRP Section 3.6.2, "Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping" - This matter will be covered under Safety Topic III-5.A, "Effects of Pipe Break on Structures, Systems and Components Inside Containment."

3.

Natural Phenomena - This matter will be covered under Safety Topics 111-6, "Seismic Design Considerations" and III-4.A, "Tornado Missiles."

4. Turbine Missiles.- This matter will be covered under Safety Topic.

III-4.B, "Turbine Missiles."

Interfaces with Other SEP Safety Topics Satisfactory resolution of the following safety topics will depend, at least in part, on the satisfactory resolution of this topic:

1.

Topic VII-3, "Systems Required for Safe Shutdown."

2.

Topic VII-4, "Effects of Failure in Non-Safety Related Systems On Selected Engineered Safety Features."

3. Topic IX-1, "Fuel Storage."

4. Topic IX-3, "Station Service and Cooling Water System."

5. Topic II-3.C, "Safety-Related Water Supply (Ultimate Heat Sink)."

IV. REVIEW GUIDELINES Systems and components needed to perform safety funcitons were identified as those listed in SRP Section 3.2.2, "Systems Quality Group Classification."

'77,*.*,-.--,

-4

1. Systems needed to perform safety functions (safe plant shutdown or accident mitigation) are:

a. Reactor Coolant System

b. Safety Injection System

c. Chemical and Volume Control System

d. Component Cooling Water System

e. Residual Heat Removal System

f.

Portions of the Main Steam System

g. Portions of the Circulating Water System

h. Containment Spray System

i.

Plant Makeup Water System

j.

Portions of Main Feedwater System

k. Compressed Air System

1.

Air Conditioning and Ventilation Systems

m. Diesel Generators and Auxiliary Systems

n. Auxiliary Feedwater System

2.

Systems whose failure may result in release of unacceptable amounts of radioactivity are:

a. Reactor Cycle Sampling System

b. Radioactive Liquid Waste System

c. Radioactive Gaseous Waste System

d. Radioactive Solid Waste Systei

e.

Spent Fuel Cooling System

f.

Containment-Purge System

-5

3. Electrical and Instrufientation Systems to support safe shutdown operations are:

a. 4160 Volt System (including associated switchgear and the emergency diesel generator system)

b. 480 Volt System (including associated switchgear)

c. 125 Volt D.C. System (including station batteries)

d. Control Room (including cable spreading area)

V. REVIEW AND EVALUATION

1. Systems needed to perform safety functions:

a. Reactor Coolant System The reactor coolant system serves as the pressure retaining boundary for the primary coolant.

The system is comprised of a reactor pressure vessel and three parallel heat transfer loops.

Each loop contains one steam generator, one pump, connecting piping and instrumentation. A pressurizer and associated relief and safety valves are connected by the surge and spray lines to two of the reactor coolant lines. All components of the reactqr coolant system are located within the containment building.

6 The reactor vessel head is secured by 42 closure studs and nuts.

It is unlikely that any of the studs would become a missile because the pressurizer relief valves and the main steam pressure relief valves assure the coolant system pressure does not exceed design limits. Therefore, these studs are not subjected to enough stress to create an accelerating force sufficient to cause them to become missiles.

The pressurizer pressure relief valves have the potential for becoming missiles.

Both the power operated relief valves and safety valves are mounted on top of the pressurizer.

The position of the pressurizer is above the steam generator loops and is enclosed in a concrete compartment. A valve failure could result in debris.

However, this debris would be expected to strike the overhead walls and would not be likely to result in.

damage to other components or piping of the reactor coolant system.

The control rod drive mechanisms are mounted on the top, of the reactor vessel and are considered as an extension of the reactor vessel head. Each module is attached to a threaded connection on the reactor vessel head and seal welded.

The drive modules are further covered by a concrete cover.

The control rod drive module design and the associated missile cover will preclude safety system missile damage.

-7 Instrumentation generally requires some penetration into the reactor coolant system. These penetrations are usually small and take the form of welded wells.

Should a penetration well fail, it will not cause serious damage or compromise the safety of the reactor coolant system due to the well orientation and the small resulting opening in the pressure boundary.

The possibility that missiles could be generated due to destruc tive overspeeding of a primary coolant pump in the event.of a pipe break in the pump discharge was considered by the licensee.

The ejection of a potentially damaging impeller missile is mini mized by the massive steel pump casing. Primary coolant pump flywheel integrity and resulting potential generation of missiles from overspeed of the flywheel has been considered under SEP Topic III-10.B, "Pump Flywheel Integrity."

The three steam generators are partially qompartmented in separate concrete enclosures and are therefore unTikely to be affected by'missile from outside the compartments.

Steam generator manways are held in position by studs on'the primary and secondary sides of the shell.

These studs are not subjected to sufficient pressure to result in a significant missile source. In the event a stud were to become a missile, the location of the steam generators within concrete enclosures and the missile trajectory would preclude resulting missile damage.

-8 In summary, we consider the likelihood of missile generation and resultant damage to the reactor coolant system to be acceptably low by virtue of equipment design features, component arrangement and compartmentalization. Further, should a missile create a break in the primary system, the safety injec tion system would operate effectively to mitigate the effects of the resulting LOCA.

b. Safety Injection System The safety injection system provides water to the reactor coolant system in the event of a loss of primary coolant.

The system consists of the refueling water storage tank, two safety injection pumps, two recirculation pumps, two feedwater pumps and associated piping and valves. Safety injection flow is directed to the reactor coolant system through three cold leg reactor inlet pipes. The equipment evaluated in this section is limited to the safety injection pumps and recirculation pumps.

The refueling water storage tank is evaluated in Section V.1.h and main feedwater pumps are evaluated in Section V.1.j.

The safety injection pumps are located outside and to the west of the turbine building next to the refueling water storage tank and service transformers. The licensee has provided a missile analysis

for these transformers which concludes that the enclosure around the bushings in the transformer will prevent the bushings (the only potential missile source) from becoming a missile.in the low probability of a transformer explosion.

Thus, adequate protection is provided for the safety injection pumps.

The safety injection pumps have a thick steel casing, making it highly improbable that a missile, such as a broken impeller, would penetrate the casing and cause any damage.

The recirculation pumps are located next to each other in the containment sump. The most likely missile sources in this area are the sphere sump pumps.

However, the sphere sump pump casing should retain any impeller missiles. The recirculation pump casings should also retain any impeller missiles. Thus, it is highly improbable that missiles from or to the recirculation pumps can cause damage.

The safety injection lines within containment are routed separately to each of the three reactor coolant*.system cold leg penetrations.

This separation precludes damage to more than one line due to an internal missile. Discussion of protection of the safety injection lines outside containment is contained in Section V.1.j.

-10 In summary, the safety injection system, because of its component design features, redundancy, and separation will be capable of performing its design function considering internally generated missiles sources as discussed above.

c. Chemical and, Volume Control System The chemical and volume control system (CVCS) controls and main tains reactor coolant system inventory and purity through the process of letdown, purification and charging (makeup). The system consists of a regenerative heat exchanger and an excess letdown heat exchanger which reduce the letdown flow temperature, orifices to reduce the letdown pressure, residual heat removal (RHR) heat exchanger to cool letdown water treatment ion exchangers

a.

volume control tank which provides a reservoir for volume changes, chemical mixing equipment, charging pumps which return the treated water to the reactor coolant system, and a seal water heat exchanger which reduces the temperature of the reactor coolant pump seal water.

The charging pumps and seal -water heat exchanger are located in a separate room in the reactor auxiliary building which contain:

no equipment from other systems which might produce missiles.

The most likely potential source of missiles in.

this room are the charging pumps themselves. The licensee performed an analysis and concluded that the charging pumps are not missile sources because-the impellers will not penetrate the thick steel casing.

The regenerative heat exchanger is located inside the containment.

If it is damaged by a missile, charging could.be accomplished by the reactor coolant pump seal water lines.

All other equipment in the CVCS is located on the reactor auxiliary bqilding roof. None of this equipment is required to safely shut down the plant, as the safety injection system, auxiliary feedwater system and residual heat removal system would be available to achieve safe shut down in the event of loss of CVCS letdown and charging.

In summary, we conclude that the possibility of internal missile damage to the CVCS will not result in an unacceptable release of radioactivity nor will it affect the safe shutdown of the facility.

d. Component Cooling Water System The component cooling water (CCW) system is designed to dissipate waste heat from various nuclear system components. The heat absorbed by the CCW System is transferred to the circulating water system via heat exchangers and released to the ultimate heat sink.

(See also SEP Topic IX-3, "Station Service and Cooling Water System.")

The component cooling water system is a closed system consisting of three pumps, two heat exchangers and a surge tank. This equipment is located on the reactor auxiliary building roof.

-12 The CCW System removes heat from the spent fuel pit heat exchanger, residual heat removal heat exchangers, residual heat removal pump bearing cooling heat exchangers, seal water heat exchanger, reactor coolant pump thermal barrier and bearing cooling heat exchangers, and charging pump oil cooling heat exchangers.

We conclude, that the system is an unlikely source of pressurized component missiles due to its low operating pressure and tempera ture. However, a potential pressurized missile source can result from failure of the high pressure nitrogen bottles or liquid nitrogen storage vessel which are Tucated in the area of the component cooling water system equipment. The nitrogen bottles are restrained by a rack and partially enclosed by a concrete wall.

Therefore, it is unlikely that damage to the component cooling water system equipment can occur. In addition, further protection is provided by the orientation of the shutoff valves on the nitrogen bottles which is away from the component cooling water system equipment. Missiles generated from the liquid nitrogen vessel can damage the CCW heat exchapgers. Should such a missile strike occur, it would be necessary to shut the reactor down since cooling water to the reactor coolant pumps is lost.

Residual heat could be removed via the auxiliary feedwater system and steam generators until repairs could be made to the com ponent cooling water system.

'S-S.

A, AX~

-~)

~."A

The licensee's analysis of rotating components in the area of the CCW system concludes that the only potentially damaging missile source is a component cooling water pump impeller since it can penetrate the pump casing and damage other component cooling water pumps or the component cooling water surge tank. Such an occurrence would also result in reactor shutdown as previously discussed.

In summary, we conclude that there is potential for internal missile damage to the component cooling water system.

However, in the event the system were disabled, decay heat would be removed from the steam generators by the auxiliary feed;ater system. It would also be necessary to make repairs to the CCW system to achieve cold shutdown via the residual heat removal system.

e.

Residual H4eat Removal System The residual heat removal (.RHR) system is designed to remove core decay heat during extended shutdown periods. The system is brought into use after the primary coolant temperature and pressurne fall below 350 F and 350 psig respectively. The RHR system is composed of the two RHR heat exchangers, two RHR pumps and associated valves and piping.

To achieve cold shutdown, the RHR pumps take suction from the reactor coolant system and pump reactor coolant through the RHR heat exchangers where it is cooled by component cooling water. The cooled reactor coolant is then return to the reactor coolant system.

-14 The RHR heat exchangers are located inside containment. There are no credible missile sources in the area of the RHR heat exchangers.

The RHR pumps are located adjacent to each other, but the pump casings provide protection from potential impeller missiles. However, should a missile strike the system and cause damage, the plant could continue normal operation, mor the auxiliary feedwater system can maintain the plant in hot shutdown until the RHR system is repaired. We therefore conclude that the. plant can be safely shutdown in the event of internal missile strikes to the RHR system.

f. Portions of the Main Steam System The main steam system consists of three steam generators and the steam lines which connect to the turbine.

The steam generators are located within the containment.

The steam generators-discharge into a common header inside the containment.

The ends of the header form two steam lines which penetrate containment and have turbine stop, safety and atmospheric dump valves exterior to containment.

The main steam lines are of heavy walled construction and are unlikely to be damaged by internally generated missiles. Should a missile cause damage downstream of the turbine stop valves, the valves could close and the plant could be safely shutdown. SEP Topic XV-2, "Spectrum of Steam System Piping Failures Inside and Outside Containment," considered a break upstream of turbine-stop valves.

The atmospheric dump and safety valves can produce missiles. How ever, the sphere enclosure building and the control building on one side and the spent fuel building on the other will contain any missiles and direct them in a vertical direction. The probability that a missile could impact redundant safety related components is very low.

In summary, we conclude that the main steam system will be capable of performing its design function considering internally generated missiles and its failure is not likely to affect safe plant shutdown.

g. Portions of Circulating Water Systems The portions of the circulating water system which are used for safe shutdown or accident mitigation are the two salt water cooling pumps and the auxiliary salt water cooling pump which cool the com ponent cooling water heat exchangers. The auxiliary salt water cooling pump provides cooling if the salt water cooling pumps fail.

The auxiliary salt water cooling pump is located in a separate pit remote from the salt water cooling pumps. This separation makes it unlikely that a missile could damage both the auxiliary salt water cooling pump and the salt water cooling pumps. Further, with the exception of a gasoline powered screen wash.pump, there are no credible missile sources in the area of these pumps. Missiles

resulting from failure of the screen wash pump engine or its local fuel storage tank could damage both salt water cooling pumps and common piping necessary for utilizing the altdrnate auxiliary salt water cooling pump. However, connections are provided to connect fire protection water to the component cooling water side of the component cooling water heat exchanger in the event that all salt water cooling capability is lost.

In summary, we conclude that the portion of the circulating water system which is used for safe shutdown or accident mitigation will be capable of performing its function considering internally generated missiles.

h. Containment Spray System The containment spray system is designed to remove heat from the containment during and after a LOCA or main steam line/feedwater line break. It consists of the refueling water storage tank, the refueling water pumps, the containment spray nozzles, the recirculation pumps, and the recirculation heat exchanger.

The recirculation pumps are discussed in.Section V.1.b..

The refueling water pumps are located to the west of the turbine building and could be styck by missiles from the auxiliary cooling pump.

However, loss of these pumps will not affect safe shutdown capability.

The refueling water pump casino will prevent ejection of impeller missiles.

y4 1. '-17 The refueling water storage tank is located near the refueling water pumps and is subject to missiles from both the component cooling water pumps and the auxiliary cooling pump. However, because the containment spray system is only required under accident conditions it is unlikely the refueling water storage tank would be damaged simultaneously with a system demand.

The containment spray nozzles are located at the top of the containment and are protected from damaging missiles by the concrete shielding around-the reactor, pressurizer, and steam generators.

In summary, we conclude that it is unlikely missile damage could occur to the containment spray system during the infrequent acci dent conditio-for which it is required, and therefore, the system is adequately protected against internally generated missiles.

Plant MakeuD Water System The plant makeup water system consists of the primary plant makeup tank, the primary plant makeup pumps and the condensate storage tank. The safety function of this system is to provide the primary P

7777

water source for the auxiliary feedwater pumps.

A separate backup water source to the auxiliary feedwater pumps is provided by means of a hose connection through the fire protection system from the service water reservoir.

At least 30 minutes is available to realign the suction of the auxiliary feedwater pumps to the backup source.

The service waterireservoir is remote from the condensate storage tank and the primary plant makeup tank and pumps. This separation assures a source of makeup to the auxiliary feedwater system.

We therefore conclude that the safety function of the plant makeup water system is assured because of separation when considering internally generated missiles.

j. Portions of the Main Feedwater System The main feedwater system consists of two motor driven feedpumps which deliver water to the three steam generators. The feedwater system is arranged such that the main feedwater pumps are also used in conjunction with the safety injection pumps to provide flow to the reactor coolant system in the event of a safety injection system actuation. The safety injection pumps and main feedwater pumps are powered from the emer gency power supplies.

The essential portions of the feedwater system are the feedwater pumps and the main feedwater lines between the first check valves upstream of the containment and the steam generators.

This portion of the feedwater system is not located in an area of potential missile.

sources as described berow.

The main feedwater pumps are located.on opposite sides of the turbine building and could not be affected by a comrmon missile.

Either pump alone can provide sufficient safety injection or shutdown feedwater flow. The main feedwater pump casings prevent ejection of impeller missiles.

The valves used to realign the feedwater pump suction and discharge from feedwater to safety injection are located on opposite sides of the turbine building. Therefore, potential missiles from the valves in one train could. not affect the other train.

The AFW pumps are located in the vicinity of the valves; however, they are protected from missiles by a massive steel pipe whip barrier.

In summary, we conclude that the redundancy and separation of the feedwater system are such that damage due to internally generated missiles which results in loss of function of the system is unlikely.

k. Compressed Air System The compressed air system is designed to supply oil free air to the service air and instrument air syster-s.

The service air system consists of three service air compressors, three after coolers and three air receivers located in the turbine building. The service air syste

provides compressed air to the instrument air system under normal con ditions.

During abnormal conditions instrument air can be provided by an emergency air compressor and receiver or by local accumulators.

Instrument air can also be provided by a portable diesel driven air compressor. Backup nitrogen bottles are provided for the safety related instrumentation required for safe shutdown.

The backup nitrogen bottles are a source of internal missiles and their failure can cause Missile impact against instrument air headers.

However, on loss.of instrument air, the safety related equipment could be operated manually or by the nitrogen bottles on redundant components.

In summary, although missile damage to the instrument air system is possible, such damage will not prohibit safe shutdown of the plant.

Heating, Ventilation and Air Conditioning (HVAC) Systems

a. Reactor Auxiliary Building Ventilation System

-The reactor auxiliary building ventilation system (RABVS) provides ventilation to the reactor auxiliary building.

The charging pumps are the only essential equipment required for safe shutdown which are located in the reactor auxiliary building.

Alternate-reactor coolant makeup can be provided by the safety injection pumps and feedwater pumps should the charging pumps be lost.

The RABVS air handling unit could generate missiles. However, no equipment required for shut down is in the vicinity, and thus these missiles will not impair the plant's ability to achieve safe shutdown.

Failure of the RABVS is discussed further in SEP Topic IX-5, "Ventilation Systems."

2. Control Room Heating, Ventilating and Air Conditioning System The control room HVAC (CRHVAC) system maintains a habitable environ ment in the control room under normal and accident conditions. The present.system consists of a heat pump air conditioning unit, an emergency air intake unit, high efficiency and activated charcoal filters and exhaust fans. The system equipment is located on the second floor of the control and administration building.

Missiles generated by the CRHVAC system components can cause failure of the system. However, the licensee has stated that the CRHYAC system-will be replaced as part of the TMI related requirements.

The new design will provide protection against the effects of missiles.

3. Diesel Generator Building Heating and Ventilating System The diesel generator building heating and ventilating system provides

.ventilation to the diesel generator building during normal and abnormal conditions. The essential portions of this system consist of four fans for each separate diesel generator room.

Since each train of thetsystem is separated from the other by the concrete walls of the diesel generator rooms, missiles affecting one train could not affect the other, thus assuring the function of the system.

4, 4160V Room Ventilating System The 4160V room ventilating system provides ventilation for the 4160V switchgear and consists of one exhaust fan.

If the fan is damaged by a missile, sufficient time is available to arrange alternate cooling before excessive temperatures are reached.

The fan itself can fail and generate missiles, but is located away from equipment required for safe shutdown.

S.u..

,...>>....7

'-22

5. 480V Room Ventilating System The 480V room ventilating system provides ventilation for the 480V switchgear.and consists of one exhaust fan: If the fan is damaged by a missile, sufficient time is available to arrange alternate cooling before excessive temperatures are reached. The fan itself can fail and generated missiles, but is located away from equipment required for safe shutdown.

In summary, the ventilation system are separated from essential systems and therefore, their failure will not affect safe shutdown.

While the systems can be damaged by missiles, the licensee stated that time is available for action to restore adequate ventilation.

There fore, we conclude that the ventilatioh systems for these areas will be capable of performing their design function considering internally generated missiles.

m. Diesel Generators and'Auxiliary Systems The diesel generators and their auxiliaries provide a source of AC power when the turbine generator is not in operation and offsite power is not available, The two diesel generators and their auxiliaries are located in separate compartments within the diesel generator building.

The diesel generators are low speed units. Potential missiles from one of the two diesel generators, such as the diesel pistons, would not affect the redundant unit as the diesel generators are separated by intervening walls.

Each diesel cenerator has its own separate buried fuel oil storage tank.

The pumps which supply fuel to the diesel

-;23 generators are approximately 70' apart and this separation makes it unlikely that. both could be disabled by a common missile source.

In summary, due to the -separation, compartmentalization, and independence of the diesel generators and their associated auxiliary systems, the diesel generator meets the requirements for protection against internally generated missiles.

n. Auxiliary Feedwater System The auxiliary feedwater system provides an assured source of feed water to the steam generators when the main feedwater pumps are not available. The system consists of one turbine driven pump and one electric motor driven pump. These pumps take suction from the condensate storage tank and inject water into the main feedwater lines immediately upstream of the containment penetrations.

Both auxiliary feedwater pumps are located in the turbine building.

The pumps are partially enclosed by a 1/8" thick steel enclosure designed for pipe whip and jet impingement but which also provides protection against missiles from ocomponents in othe?'systems.

The auxiliary feedwater pumps and turbine casings are thick enough to prevent ejection of missiles from the impellers or turbine rotor.

The turbine is also equipped with normal and emergency governors.

to prevent overspeed.

In summary, in considering the auxiliary feedwater system, its redundant features and protection against internally generated missiles provided by barriers and equipment design, we conclude that the system will be capable of performing its design function considering internally generated missiles.

~

~ ~"7' 77-7*.-

77 7il_

-24

2.

Systems Whose Failure May Result in Release of Unacceptable Amounts of Radioactivity

a. Reactor Cycle Sampling System The reactor cycle sampling system provides samples for laboratory analyses which serve to guide the operation of the reactor coolant system and the chemical and volume control system.

The system consists of a delay coil, sample heat exchangers, and sample pressure vessels. Samples are obtained by c6nducting the sample through a heat exchanger into a sample pressure vessel.

The system is operated intermittently. Should a missile strike the system while it is not in operation, no significant release of radioactivity will result as there is no radioactive fluid in the system. Should a missile strike the system while it is in operation, the containment isolation valves provided will be manually closed and no signtficant release of radioactivity will result.

We conclude that the reactor cycle sampling system is sufficiently protected with respect to internally generated missiles such that its loss will not result in a significant radioactive release.

b. Radioactive Liquid Waste System The radioactive liquid waste system processes and stores liquid wastes for radioactive decay prior to discharging these wastes to the environment under controlled conditions.

The system con sists of a flash tank, flash tank pumps, radiochemistry laboratory

drain tank, radiochemistry laboratory drain tank pump, decon tamination drain tank,.decontamination drain tank pump, liquid radwaste holdup tanks, holdup tank pumps, circulating pump, radwaste ion exchangers, gas stripper, gas stripper pump..

monitor tanks, and monitor tank pumps. All the radioactive liquid.wastesystem equipment is located in the lower level of the reactor auxiliary building. If damaged by a missile, the liquid would be contained within the reactor auxiliary building by the' drainage system. Any gases or suspended particles would be con trolled by the containment sphere purging and exhaust system.

Thus, no significant release of radioactivity would occur.

We conclude that potential internally generated missile damage to the radioactive liquid waste system will not result in significant release of radioactivity.

c. Radioactive Gaseous Waste System The radioactive gaseous waste system holds gaseous wastes for radioactive decay prior to discharging to the environment under controlled conditions. The system consists of a waste gas surge tank, waste gas com.pressors, and waste aas decay tanks.

The waste gas surge tank and the waste gas decay tanks are located in a common shielded room at the lower level of the reactor auxiliary building. The shielding will prevent any missiles from entering the room. The tanks are equipped with relief valves

-26 which are located outside the room and therefore can not damage the system should they become missile sources..

We conclude that the radioactive gaseous waste waste system is sufficiently protected from.internally generated missiles to prevent significant radioactive release.

d. Radioactive Solid Waste System The radioactivesolid waste sys tmbolds and processes solid wastes for radioactive decay and preparation for shipping. The system consists of a baler and shipping drums. This equipment is located on the roof of the reactor auxiliary building. The system does not contain sufficient radioactivity to cause concern should it fail.

We conclude that missile damage to the radioactive solid waste system will not result in a significant release of-radioactivity.

e. Spent Fuel Cooling System The spent fuel cooling system is a closed loop system consisting of one full capacity pump, one full capacity heat exchanger, a filter, piping, valves and instrumentation.

Heat from the spent fuel pool is transferred by the heat exchanger to the component cooling water system. The heat exchanger is located on the roof of the reactor auxiliary building and the spent fuel pump is located outside.

(1)

-LI-g The spent fuel pool cooling system is a low energy system which is unlikely to generated missiles.Should the equipment become in operable due to missile damage, there is sufficient time to effect repair or arrange for alternate fuel pool cooling.

We thus conclude that the spent fuel cooling system is capable of performing its function considering internally generated missiles and that in the event' of a missile damage to the system there is sufficient time to initiate alternate means of spent fuel cooling or to perfo.r repairs to the spent fuel cooling system and thus prevent significant release of radioactivity.

f. Containment Purge System The containment purge system is provided to periodically purge the containment prior to entry. The system consists of three air handling units, ductwork and isolation dampers. The air handling units are located in a room adjacent to the spent fuel building.

The licensee stated that the system is only operated with the reactor shut down. The system is only a potential missile source at that time since it is only pressurized during ihutdown. The probability of this system producing missiles or being damaged by a missile is therefore, low. Should a missile damage the system, the damage would not interfere with safe shutdown.

We conclude that the containment purge system missile protection is acceptable.

-28

3.

Electrical -and Instrumentation Systems to Support Safe Shutdown Operations

a. 4160 Volt System The 4160V system includes 4160V switchgears No.

1A, 1B, 1C and 2C and emergency diesel generators Nos. 1 and 2. For the review of the emergency diesel generator system, see Section V.1.m.

Switchgears No. 1A and 1B provide power to the reactor coolant pumps and generator exciter which are not required for safe shut down. Switchgears No. 1C and 2C are redundant and provide power to redundant equipment required for safe shutdown of the plant.

They are located in the 4 KV switchgear room in the separate cubicles facing each other.

With the exception of a small fan, no high energy or rotating equipment is located in the 4 KV switchgear room.

The fan is not located near safe shutdown equipment. However, the licensee reported an occurrence at one of their other nonnuclear facilities where a failure in the cables, breaker or relays resulted in an over current condition which caused combustion of.the cable material and generated gases from cable degradation.

The gases can cause pressurization of the cubicles causing the cubicle doors to become missiles which could damage the adjacent switchgear, and thus impact the safe shutdown of the plant.

This is not.considered likely however, as the door would not have sufficient energy after impacting the door of the redundant cubicle to cause damage.

-29 We consider it highly unlikely that the above events could cause damage to the redundant switchgear, and therefore the 4160"Volt System is adequately protected from internally generated missiles.

b.

480 Volt Switchgear The 480V System consists of 480V switchgears 1, 2 and 3. 480V switchgears 1 and 2 are redundant and provide power to redundant equipment required for a safe shutdown of the plant. 480V switchgear 3 serves only one safety related load; component cooling pump C. Switchgear No. 1 is located in the 4 KV switchgear room while switchgear No. 2 and 3 are located in the-seoarate 480V switchgear room. No high energy or rotating equipment is located near the switchgear in the 4 KV or 480 V switchgear rooms.

In summary, because of separation of the redundant 480V equipment, we conclude that a safe shutdown of the plant will not be impaired considering internally generated missiles.

c. 125 Volt DC System The 125 Volt DC system consist of two redundant battery systems.

provided at separate locations. One battery set is located in the administration and control building, the other is located in the diesel generator building. Therefore, explosion of one battery would not generate missiles affecting the other battery system, nor would missiles from other sources.

'-30 We conclude that due to the separation of the redundant 125V dc equipment, safe shutdown of the plant would not be affected by internally generated missiles.

d.

Control Room The control room is located on the operating floor level of the turbine building. No rotating machinery or pressurized sources (except oxygen bottles and fire extinguisher) are located in the control room.

The oxygen bottles and fire extinguishers are constructed such that they are not likely to become missile sources.

The control room boundary is constructed.of reinforced concrete walls which provide protection from potential missile sources outside the control room. However, the control room roof is subject to missiles generated from main steam system com ponents (safety valves, dump valves, etc.)

The licensee indicates that these missiles are Unlikely to impact safety related equip ment in the control room.

Even if damage to safety related equip ment occurred, the control room could be evacuated and shutdown accomplished from the remote shutdown panel.

We conclude that loss of function of the control room due to internally generated missiles is highly unlikely.

However, should missiles damage safety related equipment, safe shutdown can be achieved from the remote shutdown panel located outside And independent of the control room.

VI.

CONCLUSIONS Based on our review of the systems and components needed to perform safety functions, we conclude that the design of protection from inter nally generated missiles meets the intent of the criteria listed in Section II - REVIEW CRITERIA Of Standard Review Plan Sections 3.5.1.1 and 3.5.1.2.