Text

Redacted Updated Final Safety Analysis Report Chapter 9
	ML17033B540
Person / Time
Site:	North Anna
Issue date:	09/29/2016
From:	V Sreenivas; Plant Licensing Branch II
To:	Heacock D; Virginia Electric & Power Co (VEPCO)
	Sreenivas V, NRR/DORL/LPL2-1, 415-2597
Shared Package
ML17033B477	List: ML17033B480; ML17033B492; ML17033B500; ML17033B509; ML17033B515; ML17033B518; ML17033B525; ML17033B531; ML17033B533; ML17033B540; ML17033B545; ML17033B550; ML17033B570; ML17033B573; ML17033B575; ML17033B583; ML17033B585; ML17033B590; ML17033B591;
References
	Download: ML17033B540 (424)
	v • d • e

North Anna Power Station Updated Final Safety Analysis Report Chapter 9

Intentionally Blank Revision 5209/29/2016 NAPS UFSAR 9-i Chapter 9: Auxiliary Systems Table of Contents Section Title Page 9.1 FUEL HANDLING AND STORAGE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-1 9.1.1 New-Fuel Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-1 9.1.2 Spent-Fuel Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-2 9.1.3 Fuel Pit Cooling and Refueling Purification System . . . . . . . . . . . . . . . . . . . . . 9.1-6 9.1.3.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-6 9.1.3.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-7 9.1.3.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-9 9.1.3.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-13 9.1.3.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-14 9.1.4 Fuel Handling System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-14 9.1.4.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-15 9.1.4.2 System Design and Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-15 9.1.4.3 Fuel-Handling Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-16 9.1.4.4 Refueling Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-18 9.1.4.5 Refueling Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-27 9.1.4.6 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-29 9.1.4.7 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-32 9.1.4.8 Cask Handling Equipment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-32 9.1.4.9 Spent Fuel Storage at the Independent Spent Fuel Storage Installation (ISFSI) 9.1-33 9.1 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-34 9.1 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-34 9.2 WATER SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-1 9.2.1 Service Water System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-1 9.2.1.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-1 9.2.1.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-6 9.2.1.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-16 9.2.1.4 Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-20 9.2.1.5 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-21 9.2.1.6 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-21 9.2.2 Component Cooling System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-22 9.2.2.1 General Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-22 9.2.2.2 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-24 9.2.2.3 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-27 9.2.2.4 Components, Piping, and Valves. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-30

Revision 5209/29/2016 NAPS UFSAR 9-ii Chapter 9: Auxiliary Systems Table of Contents (continued)

Section Title Page 9.2.2.5 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-30 9.2.2.6 Minimum Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-33 9.2.2.7 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-33 9.2.2.8 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-34 9.2.3 Water Supply and Treatment Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-34 9.2.3.1 Domestic Water System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-34 9.2.3.2 Water Treatment System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-35 9.2.4 Condensate Storage Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-36 9.2.5 Ultimate Heat Sink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-37 9.2.5.1 Regulatory Position No. 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-37 9.2.5.2 Regulatory Position No. 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-37 9.2.5.3 Regulatory Position No. 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-37 9.2.5.4 Regulatory Position No. 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-38 9.2 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-38 9.2 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-39 9.3 PROCESS AUXILIARIES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-1 9.3.1 Compressed Air System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-1 9.3.1.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-1 9.3.1.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-1 9.3.1.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-4 9.3.1.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-6 9.3.1.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-6 9.3.2 Sampling Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-6 9.3.2.1 Sampling SystemNormal Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-7 9.3.2.2 High Radiation Sampling SystemPost-Accident . . . . . . . . . . . . . . . . . . . . . 9.3-11 9.3.3 Vent and Drain System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-18 9.3.3.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-18 9.3.3.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-19 9.3.3.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-22 9.3.3.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-22 9.3.3.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-23 9.3.4 Chemical and Volume Control System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-24 9.3.4.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-24 9.3.4.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-25

Revision 5209/29/2016 NAPS UFSAR 9-iii Chapter 9: Auxiliary Systems Table of Contents (continued)

Section Title Page 9.3.4.3 Safety Evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-45 9.3.4.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-47 9.3.4.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-47 9.3.5 Boron Recovery System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-48 9.3.5.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-48 9.3.5.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-49 9.3.5.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-51 9.3.5.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-51 9.3.5.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-51 9.3 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-52 9.3 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-52 9.4 AIR-CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4-1 9.4.1 Main Control Room and Relay Rooms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-1 9.4.1.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-1 9.4.1.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-2 9.4.1.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-3 9.4.1.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-4 9.4.1.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-5 9.4.1.6 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-5 9.4.2 Auxiliary Building. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-5 9.4.2.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-5 9.4.2.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-6 9.4.2.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-7 9.4.2.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-8 9.4.2.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-8 9.4.3 Decontamination and Waste Solidification Building . . . . . . . . . . . . . . . . . . . . . 9.4-8 9.4.3.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-8 9.4.3.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-9 9.4.3.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-9 9.4.3.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-9 9.4.3.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-9 9.4.4 Turbine Building . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-9 9.4.4.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-9 9.4.4.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-10

Revision 5209/29/2016 NAPS UFSAR 9-iv Chapter 9: Auxiliary Systems Table of Contents (continued)

Section Title Page 9.4.4.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-10 9.4.4.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-10 9.4.4.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-10 9.4.5 Fuel Building. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-11 9.4.5.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-11 9.4.5.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-11 9.4.5.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-11 9.4.5.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-12 9.4.5.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-12 9.4.5.6 Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-13 9.4.5.7 Auxiliary Monitoring Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-13 9.4.6 Engineered Safety Features Areas. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-14 9.4.6.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-14 9.4.6.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-15 9.4.6.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-15 9.4.6.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-16 9.4.6.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-16 9.4.7 Service Building . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-16 9.4.7.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-16 9.4.7.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-16 9.4.7.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-16 9.4.7.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-17 9.4.7.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-17 9.4.8 Auxiliary Building HEPA/Charcoal Filter Loops. . . . . . . . . . . . . . . . . . . . . . . . 9.4-17 9.4.8.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-17 9.4.8.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-18 9.4.8.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-18 9.4.8.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-19 9.4.8.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-19 9.4.9 Containment Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-19 9.4.9.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-19 9.4.9.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-20 9.4.9.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-21 9.4.9.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-22 9.4.9.5 Instrumentation Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-22

Revision 5209/29/2016 NAPS UFSAR 9-v Chapter 9: Auxiliary Systems Table of Contents (continued)

Section Title Page 9.4.10 Service Water, Auxiliary Service Water, and Auxiliary Feedwater Ventilating System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-23 9.4.10.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-23 9.4.10.2 System Description and Evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-23 9.4 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-24 9.5 OTHER AUXILIARY SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-1 9.5.1 Fire Protection System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-1 9.5.1.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-1 9.5.1.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-4 9.5.1.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-20 9.5.1.4 Evaluation of Postulated Fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-33 9.5.1.5 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-35 9.5.1.6 Technical Requirements, Required Actions, and Surveillance Requirements 9.5-36 9.5.2 Communication Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-37 9.5.2.1 Communication Systems Within the Station. . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-38 9.5.2.2 Offsite Communication Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-40 9.5.2.3 Communication System Reliability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-40 9.5.3 Lighting Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-41 9.5.4 Emergency Diesel Generator Fuel-Oil Storage and Transfer System. . . . . . . . . 9.5-42 9.5.4.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-42 9.5.4.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-42 9.5.4.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-44 9.5.4.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-45 9.5.5 Diesel-Generator Cooling Water System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-45 9.5.5.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-45 9.5.5.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-46 9.5.5.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-47 9.5.6 Diesel-Generator Starting System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-48 9.5.6.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-48 9.5.6.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-48 9.5.6.3 System Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-50 9.5.7 Diesel-Generator Lubrication System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-50 9.5.7.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-50 9.5.7.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-50

Revision 5209/29/2016 NAPS UFSAR 9-vi Chapter 9: Auxiliary Systems Table of Contents (continued)

Section Title Page 9.5.7.3 System Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-53 9.5.8 Diesel-Generator Ventilation and Combustion Air Intake and Exhaust System 9.5-53 9.5.8.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-53 9.5.8.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-53 9.5.8.3 System Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-55 9.5.9 Decontamination Facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-56 9.5.9.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-56 9.5.9.2 Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-57 9.5.9.3 Design Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-58 9.5.9.4 Tests and Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-58 9.5.10 Primary Plant Gas Supply System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-58 9.5.10.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-58 9.5.10.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-58 9.5.10.3 System Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-59 9.5.11 Alternate AC (AAC) Diesel and its Supporting Systems . . . . . . . . . . . . . . . . . . 9.5-61 9.5.11.1 Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-61 9.5.11.2 System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-61 9.5.11.3 Engine Cooling and Keep Warm Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-61 9.5.11.4 Lubrication and Pre-Lube Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-62 9.5 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-63 9.5 Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-64 9.6 CONTROL OF HEAVY LOADS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-1 9.6.1 Introduction/Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-1 9.6.2 Heavy Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-2 9.6.3 Overhead Heavy Load Handling Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-2 9.6.4 NUREG-0612, Section 5.1.1 Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-3 9.6.4.1 Safe Load Paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-3 9.6.4.2 Load Handling Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-4 9.6.4.3 Crane Operators Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-4 9.6.4.4 Special Lifting Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-5 9.6.4.5 Lifting Devices Not Specially Designed (Slings) . . . . . . . . . . . . . . . . . . . . . . 9.6-7 9.6.4.6 Cranes (Inspections Testing, and Maintenance) . . . . . . . . . . . . . . . . . . . . . . . 9.6-8 9.6.4.7 Crane Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-8 9.6.5 Reactor Vessel Head Drop Analysis and Lifting Procedures . . . . . . . . . . . . . . . 9.6-8

Revision 5209/29/2016 NAPS UFSAR 9-vii Chapter 9: Auxiliary Systems Table of Contents (continued)

Section Title Page 9.6 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-9 Appendix 9A Structural Analysis of the Spent-Fuel Pool . . . . . . . . . . . . . . . . . . . . . . . 9A-i 9A.1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-1 9A.2 DESCRIPTION OF THE FUEL BUILDING . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-1 9A.3 DESCRIPTION OF THE DEFICIENCY. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-2 9A.4 ANALYSIS OF SAFETY IMPLICATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-3 9A.5 CORRECTIVE ACTION TAKEN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-3 9A.5.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-3 9A.5.2 Design Loads. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-4 9A.5.2.1 Hydrostatic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-4 9A.5.2.2 Thermal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-4 9A.5.2.3 Seismic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-4 9A.5.3 Design Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-5 9A.5.4 Design Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-6 9A.5.5 Results of Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-6 9A.6 CONCLUSION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-9 9A References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-9 9A Reference Drawings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-11 Appendix 9B Fuel Pool Separating Wall Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-i 9B.1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-1 9B.2 CASKS EVALUATED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-1 9B.3 ACCIDENTS CONSIDERED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-1 9B.3.1 Failure or Disengagement of One Trunnion or One-Half of the Lifting Yoke . . 9B-2 9B.3.2 Failure in Crane Cable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-2 9B.3.3 Cask Tip Due to Seismic Event. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-3

Revision 5209/29/2016 NAPS UFSAR 9-viii Chapter 9: Auxiliary Systems Table of Contents (continued)

Section Title Page 9B.4 SEPARATING WALL ANALYSIS AND DESIGN . . . . . . . . . . . . . . . . . . . . . . . 9B-3 9B.4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-3 9B.4.2 Analysis Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-4 9B.4.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-6 9B.5 CONCLUSION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-6 9B References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-7

Revision 5209/29/2016 NAPS UFSAR 9-ix Chapter 9: Auxiliary Systems List of Tables Table Title Page Table 9.1-1 Fuel Pit Cooling and Refueling Purification System Design Data . . . . 9.1-35 Table 9.1-2 Malfunction Analyses of Spent-Fuel Pit Cooling and Refueling Purification System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-37 Table 9.2-1 Typical Service Water Equipment Flow Rates (gpm)a,b . . . . . . . . . . . . 9.2-41 Table 9.2-2 Automatic Operation of Service Water System Valves. . . . . . . . . . . . . 9.2-43 Table 9.2-3 Service Water System Failure Modes and Effects Analysis . . . . . . . . . 9.2-44 Table 9.2-4 Service Water System Component Design Data . . . . . . . . . . . . . . . . . . 9.2-45 Table 9.2-5 Component Cooling Water Subsystem Component Design Data . . . . . 9.2-48 Table 9.2-6 Chilled Water Subsystem Component Design Data . . . . . . . . . . . . . . . 9.2-49 Table 9.2-7 Neutron Shield Tank Cooling Subsystem Component Design Data . . . 9.2-52 Table 9.2-8 Reliance of Interconnected Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-53 Table 9.2-9 Consequence of Component Malfunctions . . . . . . . . . . . . . . . . . . . . . . 9.2-54 Table 9.2-10 Domestic Water Supply Component Design Data. . . . . . . . . . . . . . . . . 9.2-56 Table 9.3-1 Compressed Air System Design Data . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-55 Table 9.3-2 Sampling System Sample Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-58 Table 9.3-3 Vent and Drain System Component Design Data . . . . . . . . . . . . . . . . . 9.3-60 Table 9.3-4 Chemical and Volume Control System Design Parameters. . . . . . . . . . 9.3-64 Table 9.3-5 Principal Component Data Summary . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-65 Table 9.3-6 Chemical and Volume Control System Code Requirements . . . . . . . . . 9.3-71 Table 9.3-7 Boron Recovery System Component Design Data . . . . . . . . . . . . . . . . 9.3-72 Table 9.3-8 Boron Recovery System Malfunction Analysis. . . . . . . . . . . . . . . . . . . 9.3-85 Table 9.3-9 High Radiation Sampling System Sample Points . . . . . . . . . . . . . . . . . 9.3-87 Table 9.3-10 Chemical Analysis Panel Instrumentation . . . . . . . . . . . . . . . . . . . . . . . 9.3-87 Table 9.3-11 High Radiation Sampling System Waste Tank . . . . . . . . . . . . . . . . . . . 9.3-88 Table 9.3-12 High Radiation Sampling System Waste Tank Pumps . . . . . . . . . . . . . 9.3-88 Table 9.3-13 High Radiation Sampling System Evacuating Bellows Compressor. . . 9.3-88 Table 9.3-14 High Radiation Sampling System Sampling Panel Design Conditions. 9.3-89 Table 9.4-1 Outside Design Temperatures for Heating, Ventilation, and Air-Conditioning Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-26 Table 9.4-2 Main Control and Relay Room Area Air-Conditioning and Ventilation Systems

- Design Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4-27

Revision 5209/29/2016 NAPS UFSAR 9-x Chapter 9: Auxiliary Systems List of Tables (continued)

Table Title Page Table 9.4-3 Auxiliary Building Ventilation Filter Specifications . . . . . . . . . . . . . . . 9.4-28 Table 9.4-4 Containment Ventilation System Principal Component Data . . . . . . . . 9.4-29 Table 9.5-1 Fire Protection System Component Design Data . . . . . . . . . . . . . . . . . 9.5-65 Table 9.5-2 Emergency Diesel-Generator Fuel-Oil System Design Data. . . . . . . . . 9.5-67 Table 9.5-3 Buoyancy Calculation Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-69 Table 9.5-4 Summary of Buoyancy Calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-69 Table 9.5-5 Decontamination Facility Component Data. . . . . . . . . . . . . . . . . . . . . . 9.5-70 Table 9.5-6 Primary Plant Gas Supply System Code Requirements. . . . . . . . . . . . . 9.5-71 Table 9.5-7 Changes to Fire Protection Safety Evaluation Reports . . . . . . . . . . . . . 9.5-72 a.

Table 9.6-1 Heavy Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.6-10 Table 9A-1 Comparison of Ultimate Flexural Capacity as Calculated by NEWSECT vs. Hand Computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-12 Table 9A-2 Revised Analysis Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-13 Table 9B-1 Governing Design Conditions for Casks at Impact . . . . . . . . . . . . . . . . 9B-8

Revision 5209/29/2016 NAPS UFSAR 9-xi Chapter 9: Auxiliary Systems List of Figures Figure Title Page Figure 9.1-1 Fuel Pit Cooling and Refueling Purification System . . . . . . . . . . . . . . 9.1-38 Figure 9.1-2 Ion-Exchanger Capacity Loss vs. Temperature . . . . . . . . . . . . . . . . . . 9.1-41 Figure 9.1-3 Fuel Pit Area; Plan and Elevation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-42 Figure 9.1-4 Reactor Vessel Stud Tensioner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-43 Figure 9.1-5 Reactor Vessel Head Lifting Device . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-44 Figure 9.1-6 Reactor Internals Lifting Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-45 Figure 9.1-7 Manipulator Crane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-46 Figure 9.1-8 Movable Platform With Hoists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-47 Figure 9.1-9 Fuel Transfer System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-48 Figure 9.1-10 New Fuel Crane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-49 Figure 9.1-11 Rod Cluster Control Changing Fixture . . . . . . . . . . . . . . . . . . . . . . . . 9.1-50 Figure 9.1-12 Rod Cluster Control Changing Tool . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-51 Figure 9.1-13 Fuel Building Trolley. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-52 Figure 9.1-14 Reactor Containment Polar Crane . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1-53 Figure 9.2-1 Service Water System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-57 Figure 9.2-2 Component Cooling Water System . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-59 Figure 9.2-3 Mechanical Chilled Water Unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2-60 Figure 9.2-4 Chilled Water Steam Vacuum Refrigeration Unit . . . . . . . . . . . . . . . . 9.2-61 Figure 9.2-5 Neutron Shield Tank Cooling Water System. . . . . . . . . . . . . . . . . . . . 9.2-62 Figure 9.3-1 Compressed Air System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-90 Figure 9.3-2 Sampling System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-91 Figure 9.3-3 Vent and Drain System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-103 Figure 9.3-4 Diesel Generator Floor Drainage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-108 Figure 9.3-5 Chemical and Volume Control System . . . . . . . . . . . . . . . . . . . . . . . . 9.3-109 Figure 9.3-6 Boron Recovery System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3-111 Figure 9.4-1 Ventilation Arrangement: Control Room . . . . . . . . . . . . . . . . . . . . . . 9.4-30 Figure 9.4-2 Ventilation Arrangement: Auxiliary Building, Sheet 1 . . . . . . . . . . . . 9.4-31 Figure 9.4-3 Ventilation Arrangement: Auxiliary Building, Sheet 2 . . . . . . . . . . . . 9.4-33 Figure 9.4-4 Ventilation Arrangement: Decontamination Building. . . . . . . . . . . . . 9.4-35 Figure 9.4-5 Potentially Contaminated Exhaust System . . . . . . . . . . . . . . . . . . . . . 9.4-36

Revision 5209/29/2016 NAPS UFSAR 9-xii Chapter 9: Auxiliary Systems List of Figures (continued)

Figure Title Page Figure 9.4-6 Ventilation Arrangement: Primary Plant . . . . . . . . . . . . . . . . . . . . . . . 9.4-37 Figure 9.5-1 Fire Protection System Arrangement . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-78 Figure 9.5-2 High Pressure Carbon Dioxide System . . . . . . . . . . . . . . . . . . . . . . . . 9.5-79 Figure 9.5-3 Halon 1301 System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-80 Figure 9.5-4 Buried Fuel Oil Tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-81 Figure 9.5-5 Diesel Air Cooler Schematic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-82 Figure 9.5-6 Diesel Jacket Coolant Schematic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-83 Figure 9.5-7 Emergency Diesel Air Start System. . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-84 Figure 9.5-8 Emergency Diesel Lube Oil System . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-85 Figure 9.5-9 Diesel Cubicle Ventilation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5-86 Figure 9A-1 Three-Dimensional Mathematical Model of the Spent-Fuel Pit Structure 9A-14 Figure 9A-2 Counterfort Detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-15 Figure 9A-3 Fuel Pool - Mat Slab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-16 Figure 9A-4 Fuel Pool - North Wall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-17 Figure 9A-5 Fuel Pool - South Wall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-18 Figure 9A-6 Fuel Pool - Short East Wall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-19 Figure 9A-7 Fuel Pool - West Wall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-20 Figure 9A-8 Fuel Pool - East Wall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9A-21 Figure 9B-1 NLI - 10/24 Rail Cask . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-9 Figure 9B-2 NLI - 1/2 Truck Cask . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-10 Figure 9B-3 Failure of Lifting Yoke or Trunnion . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-11 Figure 9B-4 Failure in Crane Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-12 Figure 9B-5 Cask Tip Due to Cable Break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-13 Figure 9B-6 Cask Tip Due to Seismic Motion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-14 Figure 9B-7 Elasto-Plastic Response & Available Strain Energy of the Wall. . . . . 9B-15 Figure 9B-8 Cask Impact Locations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9B-16

Revision 5209/29/2016 NAPS UFSAR 9.1-1 CHAPTER 9 AUXILIARY SYSTEMS 9.1 FUEL HANDLING AND STORAGE Note: As required by the Renewed Operating Licenses for North Anna Units 1 and 2, issued March 20, 2003, various systems, structures, and components discussed within this chapter are subject to aging management. The programs and activities necessary to manage the aging of these systems, structures, and components are discussed in Chapter 18.

9.1.1 New-Fuel Storage New fuel assemblies are trucked to the station in new-fuel containers. The new-fuel containers are unloaded from the truck. The containers are subsequently moved into the new-fuel-unloading area of the fuel building by the new-fuel crane. The new-fuel assemblies are upended and transported to storage by the motor-driven platform with hoists. The fuel building is shown in Reference Drawings 5 and 6.

The new-fuel storage area is located in the fuel building and is designed to hold 126 new-fuel assemblies in specially constructed, Seismic Class I racks. The new fuel storage area is located in the fuel building and is shared between Units 1 and 2. The area is completely isolated from either unit and cannot impair any safety-related equipment operation of either unit.

Section 1.2.11 contains additional information on safety implications of the sharing of this area. It is used primarily for the storage of approximately one-third of a replacement core plus 10% for each of the two units. The new-fuel assemblies are stored in subcritical array racks in parallel rows with a minimum center-to-center distance of 21 inches. The loads used in the design of these racks are those due to the combination of normal and seismic loading. These racks consist of 126 square guide tubes, open at both ends, supported in a structural steel network at the top and restrained in the horizontal direction at the bottom. The fuel assemblies are inserted in these guide tubes and are supported by the concrete floor of the new-fuel storage area.

The new-fuel storage area is dry and any water that may enter this area drains to the fuel building sump. However, even if the area were filled with unborated water, the minimum 21-inch center-to-center storage distance between the fuel assemblies assures a k eff of 0.95; for fuel of highest anticipated enrichment, assuming optimum moderation (e.g., aqueous foam), the keff will be 0.98.

The new-fuel storage vault and racks also meet the intent of General Design Criterion 61, Fuel Storage Handling and Radioactivity Control, as follows:

1. Capability to permit an appropriate periodic inspection and testing of components important to safety. The new-fuel storage area does not require periodic inspection and testing.

However, its design does not preclude random visual inspection of the area. Also,

Revision 5209/29/2016 NAPS UFSAR 9.1-2 abnormalities in this area would become evident during fuel handling and appropriate corrective action will be taken. The cranes that handle fuel will receive periodic lubrication and inspection.

2. Suitable shielding for radiation protection. Fuel stored in the new fuel area does not require shielding for radiation protection; therefore, this subpart does not apply.

3. Appropriate containment, confinement, and filtering systems. The new fuel is contained in the new-fuel racks and is appropriately confined. Section 9.4.5 describes the fuel building ventilation system.

4. A residual heat removal capability having reliability and testability that reflect the importance to safety of decay heat and other residual heat removal. The new fuel does not generate decay heat or other residual heat; therefore, this subpart does not apply.

5. Capability to prevent significant reduction in fuel storage coolant inventory under accident conditions. The new fuel is stored dry and requires no coolant; therefore, this subpart does not apply.

As described in UFSAR Section 4.3.2.7, the new-fuel storage area meets the applicable criteria of 10 CFR 50.68 to preclude a nuclear criticality accident, as required by General Design Criteria (GDC) 62. In addition, radiation monitors are installed in the fuel storage and handling areas, as required by GDC 63.

9.1.2 Spent-Fuel Storage Spent fuel is stored in the spent-fuel pit in the fuel building, which is shared by Units 1 and 2. The fuel building is shown in Reference Drawings 5 and 6, and discussed in Section 3.8.1.

The spent-fuel pit is a reinforced concrete, Seismic Class I structure lined with stainless steel plate a minimum of 0.25-inch thick, and is designed for the underwater storage of spent-fuel assemblies, control rods, and burnable poison rods after their removal from the reactor. It is designed to accommodate 1737 fuel assemblies.

Sharing of the spent-fuel pit by both units does not impair the spent-fuel pit safety function nor is it affected by an accident to either of the units. The pit is completely isolated from either unit when at power and is completely independent of the capability related to an orderly shutdown and cooldown of either unit. During the normal operation of both units, the pit is isolated by a double-barrier fuel transfer tube with a bolted flange on the reactor cavity side and a gate valve on the pit side, as described in Section 9.1.3.3.3. Isolation between the containment and the fuel pit is broken only after the reactor is shut down and prepared for refueling. The other unit may be operating normally at this time and is isolated from the fuel pit.

Free standing neutron absorber storage racks erected on the pit floor are provided to hold the spent-fuel assemblies. Fuel assemblies are placed in vertical cells in parallel rows with a 10-9/16-inch pitch between adjacent assemblies. The racks are designed so that it is impossible to

Revision 5209/29/2016 NAPS UFSAR 9.1-3 insert fuel assemblies in other than the safety lattice spacing, thereby ensuring the necessary spacing between assemblies to ensure k eff < 1.0 even if the pit were inadvertently filled with unborated water. Irradiated components (but not fuel) otherwise, not stored in the spent fuel assemblies, are stored, on the floor of the spent fuel pool, between the storage racks and the spent fuel pool wall. The irradiated components stored in this area shall not be re-used in any future core.

Shielding provided by the spent-fuel pit is discussed in Section 12.1.2, radiation monitors for this area are discussed in Section 12.1.4, and the ventilation system is discussed in Section 9.4.5.

The neutron absorber spent-fuel storage racks are classified Seismic Class I and are designed to withstand the effects of the design-basis earthquake (DBE) and yet remain functional and maintain subcriticality. Details of the seismic design are presented in Section 3.7.

Each rack array consists of a welded assembly of individual storage cells. The storage cells are comprised of double wall Type 304 stainless steel boxes welded to each other with tie plates to maintain the cell pitch of 10-9/16 inches. Each storage cell has an interior height of 168 inches to ensure that the top nozzle and core components do not extend above the top of the spent fuel rack when the fuel assembly is fully inserted. The storage cells are designed to provide lateral support for the Westinghouse 17 x 17 or 15 x 15 assembly array design and are capable of storing any fuel assembly which has been evaluated to be similar in weight and dimensions. The cells are flared at the top to permit easy storage and retrieval of the spent fuel assemblies and to be compatible with the fuel handling equipment. The double wall construction of the storage cells provides four vented (open to the pool) compartments in which B4C (Boraflex) neutron absorber elements are placed. The neutron absorber elements are positioned on each side of the storage cell at an elevation corresponding to the fuel region of an assembly placed within the cell. The bottom opening of each storage cell sits on and is welded to the rack base which is comprised of the fuel assembly support plate and support feet. The fuel assembly support plate provides the level seating surface required for each fuel assembly and also contains the openings necessary for adequate natural circulation cooling flow within the spent fuel pool. The rack support feet raise the racks above the pool floor to the height required to provide an adequately sized cooling water supply plenum. The support feet contain remotely adjustable jackscrews to facilitate and ensure proper support for the vertical loads and to achieve the required levelness.

One of the operational aspects of the neutron absorber spent fuel storage racks is that the neutron absorber material (boraflex) offgases with exposure to radiation. To accommodate this offgassing the fuel racks are designed with holes in the stainless steel sleeve which holds the neutron absorber in place. The offgassing is visible from poolside as occasional bubbles rising from the racks. The offgassing is most prominent in fuel locations containing freshly discharged fuel. As the fuel decays, this offgasing will subside.

Revision 5209/29/2016 NAPS UFSAR 9.1-4 The gas makeup is as follows:

Hydrogen 60%

Hydro-Carbons 24%

O2, CO2, CO 6%

Six different rack cell arrays are used to maximize use of the available storage space in the pool. The six arrays are:

One 11 x 11 rack (121 assemblies)

Six 10 x 12 racks (120 assemblies)

Four 10 x 11 racks (110 assemblies)

One 10 x 11 rack (105 assemblies)

One 9 x 12 rack (108 assemblies)

Three 9 x 9 racks (81 assemblies)

In May 1976, the original structural design computations for the reinforced concrete spent-fuel pool were reviewed to determine how much additional load from the high-density spent-fuel racks could be carried by the walls. A detailed analysis indicated that the original design would not satisfy structural design criteria, and that the best structural solution to the problem would be the addition of a stainless-steel-lined, reinforced-concrete counterfort against the interior north wall of the spent-fuel pool. This counterfort extends from the top of the mat at Elevation 249 ft. 4 in. to the top of the north wall at Elevation 291 ft. 10 in. Details of the analysis and counterfort design, especially regarding hydrostatic, thermal, and seismic criteria, can be found in Appendix 9A. The pool structure was analyzed again in 1982 for the addition of neutron absorber spent fuel storage racks. No additional structural modifications were required as a result of that review.

The movable platform crane, shown on Figure 9.1-8, is used to move the three SFP gates.

Reference Drawing 5 shows each gate with its storage and installed positions. The gates are located at each units transfer canal and one near the spent fuel cask separating wall. These gates are periodically (1) moved between their storage and installed positions and (2) removed from the pool at the cask handling area for inspection and maintenance. Gate rigging and movement over irradiated fuel is controlled by procedure to restrict the gate lift height, use redundant rigging, and control fuel inserts in order to establish a load path in compliance with the Technical Requirements Manual. The purpose of these controls is to preclude damage to either irradiated fuel or the spent fuel pool and to maintain fuel spacing in the event that a gate handling accident were to occur.

Revision 5209/29/2016 NAPS UFSAR 9.1-5 Cranes carrying all other heavy objects, such as a spent-fuel cask, are prevented from passing over stored fuel as shown on Reference Drawings 5 and 6. A spent-fuel cask drop analysis has been performed and is included as Appendix 15A. As a result of this analysis, a separating wall was placed between the fuel-cask-loading area and the spent-fuel storage area of the spent-fuel pool. The wall acts as a barrier to prevent a cask from falling on spent fuel in the fuel storage area of the fuel pool.

The wall separating the fuel-cask-loading area from the spent-fuel storage area is a 3-ft.

6-in. thick concrete wall 21-ft. 4-in. wide by 42-ft. 6-in. high, with a 3-ft. wide by 25-ft. 10-in.

high slot in the top to allow the transfer of spent fuel from the fuel storage area to the fuel-cask-loading area. It is reinforced with bundled (two bars per bundle) No. 8 reinforcing bars at 12-inch center-to-center spacing both horizontally and vertically in each face. These bars are anchored into the existing concrete fuel pool walls and mat by drilling and grouting. Embedments are designed to develop the ultimate tensile strength of the bars. The wall is lined on both sides with a 0.25-inch-thick ASTM A-240 Type 304 stainless steel liner. The presence of the liner on the spent-fuel storage side of the wall guarantees that if there is damage to the floor or wall liners in the cask-loading area due to a cask drop accident, there will still be a continuous, intact liner around the stored spent fuel to ensure adequate water over the fuel. However, the structural benefits of the liner were conservatively neglected.

Appendix 9B presents a detailed cask drop accident analysis and design analysis for the separating wall.

The ability to ensure the continuous cooling of spent-fuel assemblies and to prevent the loss of water from the spent-fuel pit is discussed in Section 9.1.3.

The fuel building is discussed in Section 3.8.1. Stored fuel in the spent-fuel pit is protected from horizontal missiles by the 6-foot-thick reinforced-concrete walls of the pit which extend 20 ft. 10 in. above grade.

D. R. Miller and W. A. Williams, in a paper entitled Tornado Protection of a Spent Fuel Storage Pool No. APED-5696, dated November 1968, and P. L. Doan, in a paper entitled Tornado Considerations for Nuclear Power Plant Structures, published in July 1970, state that large missiles such as utility poles and automobiles, which are the design tornado missiles (Section 3.3.2), lack sufficient lift or velocity to clear a height of 25 feet. These could not, therefore, impinge on the fuel elements. The spent-fuel elements would also be protected by the water that covers the storage racks in the pool from other lighter missiles resulting from damage to adjacent building superstructures. As discussed in the paper by P. L. Doan, small, fast-moving missiles traveling downward would impact only one fuel assembly. The radiological impact of this occurrence is evaluated in Section 15.4.5.

Analyses and field observations suggest that large missiles may be able to clear a height of greater than 25 feet VEPCO consequently requested that Dr. Lawrence A. Twisdale, Jr., of

Revision 5209/29/2016 NAPS UFSAR 9.1-6 Research Triangle Institute perform a new analysis of the tornado missile risk to the spent-fuel pool. The analysis used a method described in a report for the Electric Power Research Institute entitled Tornado Missile Risk Analysis (EPRI NP-768 and NP-769, Project 616, May 1978).

The analysis concludes that the probability of a tornado-generated missile entering the spent-fuel pool and directly hitting the spent fuel assemblies (or the interior pool wall just above the top of the assemblies) is estimated as 2.37 x 10-12 per year. For the entire population of postulated missiles, the combined probability of at least one tornado-generated missile directly hitting the assemblies is estimated as 4.34 x 10-8 per year.

These low probabilities demonstrate that the spent fuel is adequately protected against the effects of tornado-generated missiles.

9.1.3 Fuel Pit Cooling and Refueling Purification System The fuel pit cooling and refueling purification system, shown on Figure 9.1-1 and Reference Drawing 1, removes residual heat from spent fuel stored in the spent-fuel pit. This system is also used to purify and maintain optical clarity of the spent-fuel pit water, the water in either reactor refueling cavity, and the refueling-water storage tanks.

This system is common to both units and normally serves only the spent-fuel pit. During and immediately after refueling, the system also performs a purification function of the refueling water. Although shared by both units, the safety function is not affected by an accident in either unit. The spent-fuel coolers, part of the component cooling water system, are supplied by a common header connected to both units by isolation valves and a return header also connected to both units by isolation valves. This arrangement allows common equipment to be operated from either or both units component cooling water supply. In the event of an accident, cooling water can be provided to the non-accident plant and to the common equipment by the system supplying the plant not involved in the accident.

9.1.3.1 Design Basis The fuel pit cooling and refueling purification system has the capability to:

1. Maintain the temperature of the fuel pit water at or below 140°F during a normal core offload condition commencing 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months after shutdown. A normal core offload condition is a planned offload of up to a full core. The most limiting condition for normal core offload is a full core offload following refueling of the other unit. Section 9.1.3.3.1 provides a description of the limiting design heat load assumptions used in determining capability of cooling system.

2. Maintain the temperature of the fuel pit water at or below 170°F during an abnormal core offload condition commencing 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months after shutdown. An abnormal core offload condition is an unplanned offload of up to a full core. The most limiting condition for an

Revision 5209/29/2016 NAPS UFSAR 9.1-7 abnormal core offload is an unplanned full core offload following back-to-back refueling of both units. Section 9.1.3.3.1 provides a description of the limiting design heat load assumptions for determining capability of cooling system

3. Remove soluble and particulate impurities from the water in the spent-fuel pit, either reactor refueling cavity, and either refueling-water storage tank, to maintain the cavity water optically clear and radiation levels within acceptable limits.

4. Dewater a reactor refueling cavity to the associated refueling-water storage tank, through filters and an ion exchanger, if necessary.

5. Provide a path for the makeup and boration of the spent-fuel pit water and both refueling-water storage tanks.

6. Maintain a minimum water level in the spent-fuel pit to provide adequate radiation protection from irradiated fuel.

The fuel pit cooling piping and equipment are designed to Seismic Class I requirements.

Portions of the refueling purification piping and equipment are not designed to Seismic Class I requirements. Operating procedures provide contingency actions to assure that the design basis of adjacent systems are maintained in the event of a seismic event with the refueling purification system aligned to Seismic Class I piping or equipment.

9.1.3.2 System Description The portion of the fuel pit cooling and refueling purification system used to cool the spent-fuel pit water has two shell-and-tube coolers and two circulating pumps in the fuel building.

The coolers and pumps are arranged for cross-connected operation, if necessary. The coolers are cooled by component cooling water, with service water available as an emergency supply of cooling water.

All fuel pit piping penetrations are located so that at least 23 ft. 1 in. of water would remain above the active portions of the spent-fuel assemblies stored in the pit even if the water should drain through the penetrations, thus ensuring adequate shielding for the spent-fuel assemblies.

Shielding for spent fuel assemblies is further discussed in Section 12.1.2.5.

The component cooling water radiation monitor and service water discharge monitor discussed in Section 11.4.2 provide indication of any radioactive inleakage to the component cooling water system or the service water system. Local sampling points on the discharge line from each fuel pit cooler permit identification of the leaking cooler.

The system also includes three refueling purification pumps, two filters, and an ion exchanger. The filter design retention capability is controlled by administrative processes that provide a filter change-out strategy that includes different particle retention sizes dependent on plant conditions (outage or non-outage) and the amount of cleanup required.

Revision 5209/29/2016 NAPS UFSAR 9.1-8 The fuel pit water purity requirements related to fission and corrosion products are: (1) that the water turbidity be sufficiently low to provide optical clarity and (2) that the radiation levels at the surface of the water not exceed the acceptable level of 50 mrem/hour based on a combined source of the spent fuel, radioactive corrosion, and fission products in the water.

The potential sources of suspended matter that affect the spent fuel pit water turbidity include the initial fill water, the boric acid, the corrosion products from the stored spent-fuel assemblies, the fuel storage racks, the fuel pit liner, the spent-fuel pit cooling system, and the corrosion and fission products from the refueling cavity. The suspended matter is maintained below a maximum of 1.0 ppm.

Spent-fuel pit water can be purified, if required, by pumping a portion of the fuel pit cooling loop flow through the refueling purification filters and ion exchanger with the refueling purification pumps. The refueling purification pumps take suction from the cooling system loop flow downstream from the coolers and return it to the pit. The filters and ion exchanger are operated in series as a filter/ion exchanger/filter arrangement, or either of the filters may be used alone. Flow through the ion exchanger and filters provides adequate purification of the water to permit access to the working area and to maintain optical clarity of the pit water. The refueling purification pumps can be run to purify the pit water independently of cooling pump operation.

The water surface of the spent-fuel pit is maintained free of floating material (e.g., dust) by two permanently installed skimmers connected to the suction of the spent-fuel pit cooling pumps.

The fuel pool skimmers are also provided with a pump which allows the skimmers to be operated when the fuel pool cooling pumps are not in operation.

The water in the reactor refueling cavity is purified by circulating it through the refueling purification filters and ion exchanger with one or two refueling purification pumps. The system can be lined up using one pump through a filter/ion exchanger/filter combination, two pumps in parallel through the filter downstream from each pump, or two pumps in parallel with one pumping through a filter and one through an ion exchanger/filter combination. The system lineup used will be that necessary to reduce the radiation levels at the surface of the water to an acceptable level of 50 mrem/hour or less and maintain the necessary water clarity. The refueling purification pumps take suction from the bottom of the refueling canal and from the residual heat removal system downstream from the residual heat exchangers and return the purified water to the reactor refueling cavity. A skimmer assembly similar to those used in the spent-fuel pit joins the suction line from the bottom of the refueling canal to maintain the water surface free of floating material.

A reactor refueling cavity can be dewatered at an initial flow rate of approximately 800 gpm by using two refueling purification pumps in parallel. The water is pumped through the refueling purification filters, which remove suspended crud particles, to the respective refueling-water storage tanks. This filtration reduces the radioactivity of the water input into the refueling-water

Revision 5209/29/2016 NAPS UFSAR 9.1-9 storage tank. In the event a reactor refueling cavity is dewatered by pumping its contents directly to the respective refueling-water storage tank using the residual heat removal pumps, this tank can be purified at approximately 400 gpm using a refueling purification pump and filter.

Because portions of the refueling purification system are not Seismic Class I piping, administrative controls are established to allow timely isolation of these portions of the refueling purification system when the system is being used to purify the refueling water storage tank.

Non-seismic portions of this system may be used to make up to the refueling water storage tank via the opposite units blender. If the non-seismic portions are used during these makeup evolutions, administrative controls are established to enable the non-seismic portions to be isolated promptly, if required.

Makeup water, borated and unborated, is supplied to the spent-fuel pit and the refueling-water storage tanks from the boric acid blender in either of the Chemical and Volume Control Systems. The Seismic Class I source of makeup water is the fire protection system (Section 9.5.1), a permanently piped path. The service water system serves as the Seismic Class I backup water source. Service water can be supplied to the spent-fuel pit through a connection on the cooling water lines to the fuel pit coolers.

The spent-fuel pit is founded on solid rock, and makeup requirements to the fuel pit are anticipated to be minimal, as discussed in Section 9.1.3.3.3. The fire protection system is capable of supplying 400 gpm to the spent-fuel pit and will be capable of meeting any anticipated leakage.

All parts of equipment and piping in contact with water that has been borated to a refueling-water concentration are constructed of austenitic stainless steel.

The design data for the fuel pit cooling and refueling purification system components are given in Table 9.1-1.

9.1.3.3 Design Evaluation 9.1.3.3.1 Availability and Reliability Two fuel pit cooling pumps and two fuel pit coolers are provided to ensure cooling requirements are met. Redundant piping is provided from the spent-fuel pit through the pumps and coolers to the main return header located above pool water levels. Based on conservative design basis assumptions, the fuel pool temperatures are calculated to be less than 140°F for a normal core off-load case and 170°F for an abnormal full-core off-load case, if one cooling pump and two coolers are used. The design-basis evaluation also assumes a bounding tube-plugging scenario of 48 tubes plugged per cooler, 96 tubes plugged total.

At North Anna a single spent fuel pit provides storage of irradiated fuel assemblies for both units. Under this arrangement a back-to-back refueling scenario at the time of completion of full core offload for the second unit will present the most limiting SFP heat load under normal

Revision 5209/29/2016 NAPS UFSAR 9.1-10 conditions. For the back-to-back refueling condition the assumption is made that as soon as one unit has completed refueling, the second unit begins its refueling outage. This results in the most recently discharged batch of fuel prior to the current refueling having a decay time of 25 days.

The transfer of the core to the spent fuel pit is assumed to begin at 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months after shutdown and finish at 120 hours0.00139 days 0.0333 hours 1.984127e-4 weeks 4.566e-5 months after shutdown. The 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months assumed for transfer of the core is conservative with respect to actual practice and assumes a transfer rate of approximately eight assemblies per hour.

The heat load from the irradiated fuel in the pit prior to the back-to-back and non back-to-back refuelings is accounted for through a cumulative decay heat load determined from successive refueling discharges decayed for 1.5 to 18 years; and for 0.3 to 17.8 years, respectively. Following the back-to-back refuelings the pit is assumed to be full except for a full core discharge capability (157 storage cells).

The above back-to-back refueling scenario results in a heat load on the spent fuel pit cooling system of 46.8 x 106 Btu/hr. At this heat load the spent fuel pit cooling system can maintain the pit temperature at or below 140°F with one pump and two coolers in operation and the component cooling water supply temperature at a maximum of 76.7°F.

For a non back-to-back design condition where the previous refueling has not occurred within the previous 120 days (or approximately 0.3 years), the additional cooling time for the previously discharged fuel would result in a reduced heat load of 44.0 x 106 Btu/hr. At this heat load the spent fuel pit cooling system can maintain the pit temperature at or below 140°F with one pump and two coolers in operation and the component cooling water supply temperature at maximum of 80.7°F.

A limiting abnormal heat load for North Anna is determined by assuming an unscheduled shutdown of one unit which requires a full core offload after the other unit has gone back on-line following back-to-back refuelings. The heat load is conservatively determined assuming the most recently discharged fuel batch has a decay time of 25 days, the next most recently discharged batch has a decay time of 50 days, and the core being offloaded to have operated for a sufficient length of time to produce maximum decay heat prior to being transferred to the pit by 120 hours0.00139 days 0.0333 hours 1.984127e-4 weeks 4.566e-5 months after shutdown of the unit. The heat load from the irradiated fuel in the pit prior to the refueling is accounted for through a cumulative decay heat load determined from successive refueling discharges decayed for 1.5 to 18 years. The abnormal condition also assumes that the unscheduled full core offload completely fills the pit. This results in a heat load of 53.1 x 106 Btu/hr placed on the spent fuel pit cooling system.

The capability of the spent fuel pit cooling system is more than sufficient to maintain the pit temperature below 170°F with the component cooling water supply temperature at its maximum expected temperature, 100°F, through the use of one pump and two coolers. During the design basis conditions discussed above and for the limiting normal core off-load condition with one

Revision 5209/29/2016 NAPS UFSAR 9.1-11 pump and one cooler in service, the maximum calculated temperature remains below the temperature (177.5°F) at which the structural analysis of the fuel pool was performed. Loss of cooler function need not be postulated for the limiting abnormal off-load condition.

Assuming all normal cooling capacity is lost, the length of time before the fuel pit water temperature reaches 200°F is approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months with maximum possible decay heat load from nominal conditions. Six hours should be adequate to make necessary repairs to reinstate normal fuel pit cooling capability. Should the repair effort exceed this time limit, makeup water to the spent fuel pit is available from a permanently piped flow path from the fire protection system, as described in Section 9.1.3.2.

Three refueling purification pumps are provided. A maximum of two pumps (Section 9.1.3.2) are in use at once, with the other pump serving as an installed spare. Two refueling purification filters are provided, thus ensuring at least partial system-filtering capacity if one filter is out of service. The filters are subjected to the greatest use during and after refueling.

The filter cartridges are renewed, if necessary, prior to refueling to ensure maximum capacity for retention of particles during refueling.

9.1.3.3.2 Purification of Water The refueling water purification system contains a mixed bed H-OH resin. Normally these resin beds are operated at 125°F or lower. At water temperatures greater than 140°F, time dependent thermal degradation is characterized by a loss of anion exchange capability, release of organic substances (generally trimethylamine) and finally an evolution of ionic material previously absorbed at available anion sites. Figure 9.1-2 plots the time required for a strong base Type 1 anion resin to lose half of its absorption capacity, versus elevated operating temperature. A similar plot is applicable to strong acid cation resin except that the initiation temperature for thermal degradation is 250° to 350°F rather than 140°F.

The decontamination factor in this temperature range will not appreciably change until a significant portion of the resin capacity is affected by the elevated operating temperature.

Particulate matter absorbed (physically) on a resin bed is generally not affected by the decomposition of the resin, and subsequently little, if any, increase in the particulate activities is observed.

Should the allowable temperature of the inlet water to the ion exchanger exceed 140°F, the ion exchanger may be isolated and bypassed until a lower temperature is obtained.

The 400 gpm filtration rate for one refueling purification pump and filter results in a turnover time of about 27 hours3.125e-4 days 0.0075 hours 4.464286e-5 weeks 1.02735e-5 months for the spent-fuel pit. The fuel pit water may also be pumped through a path consisting of a refueling purification filter, the ion exchanger, and the other filter at a rate of about 130 gpm. These purification rates will keep the water clear and remove radioactive

Revision 5209/29/2016 NAPS UFSAR 9.1-12 impurities in the spent-fuel pit. The two skimmer assemblies in the spent-fuel pit remove particles that float on the water surface.

The purification rates provided by the system for a reactor refueling cavity range from 760 to 175 gpm, depending on the number of refueling purification pumps used and the system lineup.

Coupled with the 120 gpm rate of purification available through the Chemical and Volume Control System (Section 9.3.4) during refueling, these rates result in turnover times of a reactor refueling cavity from 5 to 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months . This purification reduces radiation from the reactor cavity water to acceptable levels and keeps the water clear. The skimmer assembly in each reactor cavity removes floating particles.

The arrangement of inlet and outlet piping, the high cooling flow rate, and the thermal currents set up within the fuel pit by the spent fuel keep the water mixed.

9.1.3.3.3 Spent-Fuel Pit Water Leakage Control No means exist for completely draining the spent-fuel pit using installed systems and equipment. Figure 9.1-3 shows all piping connections to the spent-fuel pit, including any pipes that dip into the pool that can act as siphons, and the internal weir. The water level could be lowered to Elevation 285 ft. 9 in., which is 4 ft. 1 in. below the normal water level and 23 ft. 1 in.

above the fuel, by incorrect operation of, or a failure in, the fuel pit cooling and refueling purification system. In these instances, detailed below, an adequate water level would exist over the fuel to provide for cooling and radiation protection.

A credible improper operation could be an open line during maintenance in the refueling purification system with an inadvertent opening of a valve along this open line, or improper valve alignment where spent-fuel pit water could be pumped to the refueling-water storage tank. In this event, an insufficient amount of water would be returned to the pool. However, the design of the fuel pit is such that the water level can only be lowered 4 ft. 1 in. below the normal water level in this event. The elevation at which the 10-inch spent-fuel pit pump suction lines FC-1-152-Q3 and FC-2-152-Q3 penetrate the spent-fuel pit prevents a lowering of the water level below 285 ft. 9 in.

Also, the siphoning of the pool through the 6-inch line RP-1-152-Q3 and the 12-inch line FC-8-152-Q3 is not credible because of the siphon breaker hole in the 12-inch line FC-8-152-Q3.

Should conditions exist for siphoning the pool via the 4-inch line RP-28-152 by improper operation of the refueling purification system, such as described above, siphoning the water is only possible to Elevation 288 ft. 4 in. or 1 ft. 6 in. below the normal water level.

The spent-fuel pit water level could be lowered to Elevation 287 ft. 3 in. by a failure in either of the 1-inch lines FC-10-152-Q3 or FC-11-152-Q3 between the skimmers and the spent-fuel pit penetration while the spent-fuel pit water is being circulated for cooling and purification.

Revision 5209/29/2016 NAPS UFSAR 9.1-13 The spent-fuel pit water level can be lowered to Elevation 264 ft. 1 in., which is 1 ft. 5 in.

above the stored fuel during refueling, by incorrect operation of the reactor cavity drain. During refueling, the refueling cavity water can be circulated for purification using the refueling purification pump, the refueling purification filter, and the refueling purification ion exchanger.

This system takes suction from the reactor cavity drain and returns the water to the cavity following purification. With an erroneous system lineup, purified water is returned to the refueling-water storage tank instead of the reactor cavity.

The spent-fuel pit level could also be lowered to Elevation 264 ft. 1 in. by an erroneous system lineup of the reactor cavity drain and the gate valve on the fuel transfer tube. This tube connects the reactor refueling cavity to the spent-fuel pit. The spent-fuel pit water level cannot be lowered below Elevation 264 ft. 1 in. because of a 14 ft. 9 in. high concrete barrier between the pit and fuel transfer canals to Units 1 and 2, as shown in Reference Drawings 5 and 6.

The operating procedures used during refueling ensure that the fuel transfer tube gate valve is closed before the draining of the reactor refueling cavity commences. In addition, the procedures require placing the bolted blank flange on the fuel transfer tube as soon as the reactor refueling cavity is drained. After the completion of refueling the transfer canal gate is installed if the transfer canal will be drained.

If the spent-fuel pit level were inadvertently lowered via the reactor refueling cavity drain, this condition would be detected before the level reached Elevation 264 ft. 1 in., either by an excessive refueling-water storage tank level if the water level were lowered by pumping, or by a containment sump level alarm if the water were lowered by draining. The operator would then take action to correct the condition.

The solid rock foundation and reinforced concrete structure of the spent-fuel pit will prevent leakage from the pit should a heavy object such as a spent-fuel cask be dropped in the pit; however, the integrity of the stainless steel liner could be violated. Water could then enter the channels behind the liner seams that were used for testing during construction. These channels are interconnected in four zones with a 0.5-inch line from each zone to the fuel building sump. These lines are plugged and thus no water will be lost from the pit. If the puncture is at a point other than the channels and the fuel pit water passes through the liner and concrete structure, the founding material below is virtually impenetrable.

9.1.3.3.4 Malfunction Analyses Malfunction analyses of the individual components of the spent-fuel pit cooling and purification system are presented in Table 9.1-2.

9.1.3.4 Tests and Inspections Periodic visual inspections and preventative maintenance are conducted on all system components. Periodic sampling of the spent-fuel pit water is conducted.

Revision 5209/29/2016 NAPS UFSAR 9.1-14 9.1.3.5 Instrumentation Application Instrumentation provided gives local indication in the fuel building and the auxiliary building and remote indications and alarms in the main control room. Unit 1 control board indication and alarms include:

1. Fuel pit temperature indication.

2. Spent-fuel pit temperature alarm at > 140°F, and > 170°F.

3. Spent-fuel pit high/low-water level with the low-level alarm 6 inches below normal water level (Elevation 289 ft. 4 in.).

4. Start/stop switch for spent-fuel pit cooling pumps with run indication on both main control boards.

5. High differential pressure alarm for the refueling purification filters.

Local indications include various flows, temperatures, pressures, and differential pressures.

The system instrumentation, including the spent-fuel pit level and temperature instrumentation, are calibrated on a periodic basis.

In addition, wide range level instrumentation provides remote indication of spent fuel pit level. The instrumentation measures spent fuel pit water level from 7 inches above the top of the fuel racks to 10 inches above normal water level.

9.1.4 Fuel Handling System The fuel handling system provides a safe, effective means of transporting and handling fuel from the time it reaches the station in an unirradiated condition until it leaves the station after postirradiation cooling.

The system is designed to minimize the possibility of mishandling that could cause fuel damage and potential fission product release.

The fuel handling system consists basically of the following:

1. A refueling cavity in each units containment structure, which is flooded only during unit shutdown for refueling, and a manipulator crane and control rod assembly changing fixture for each unit.

2. The spent-fuel storage pit, which is maintained full of borated water after initial plant fuel loading and is accessible to operating personnel, and a movable platform with hoists. The pit and platform are shared by both units.

3. The fuel transfer system for each unit, which consists of an underwater conveyor that carries the fuel from the refueling cavity through the containment wall and into the spent-fuel

Revision 5209/29/2016 NAPS UFSAR 9.1-15 storage pit, and the new-fuel elevator, which is located in the spent-fuel pit and is shared by the two units.

9.1.4.1 Design Basis The fuel handling system consists of equipment and structures used for handling new- and spent-fuel assemblies in a safe manner.

The following design bases apply to the fuel handling system:

1. Fuel-handling devices have provisions to avoid the dropping or jamming of fuel assemblies during transfer operation.

2. Fuel lifting and handling devices are capable of supporting maximum loads under design-basis earthquake conditions.

3. The fuel transfer system, where it penetrates the containment, has provisions to preserve the integrity of the containment pressure boundary.

4. Cranes and hoists used to lift spent fuel have a limited maximum lift height so that the minimum required depth of water shielding is maintained.

9.1.4.2 System Design and Operation The fuel handling system consists of the equipment needed for the initial plant fueling and the refueling of the reactor core. Basically, this equipment is comprised of cranes, handling equipment, and a fuel transfer system. The structures associated with the fuel-handling equipment are the refueling cavity, the refueling canal, the spent-fuel storage pit, the movable platform, and the new-fuel storage area.

After receipt, new-fuel assemblies are removed one at a time from the shipping cask. New fuel is delivered to the reactor by placing a fuel assembly into the new-fuel elevator, lowering it into the spent-fuel pit, and taking it through the fuel transfer system. The spent-fuel pit, new-fuel elevator, and movable platform with hoist are shared by both units.

The reactor is refueled with fuel-handling equipment designed to handle the spent fuel under water from the time it leaves the reactor vessel until it is placed in a cask for shipment from the site. Underwater transfer of spent fuel provides an effective, economic, and optically transparent radiation shield, as well as a reliable cooling medium for the removal of decay heat.

Boric acid is added to the water to ensure subcritical conditions.

The associated fuel-handling structures may be generally divided into three areas: the refueling cavity and refueling canal, which are flooded only during plant shutdown for refueling; the spent-fuel pit, which is kept full of water after initial fuel loading and is always accessible to operating personnel; and the new-fuel storage area, which is separate and protected for dry storage. The refueling cavity and the spent-fuel pit are connected by a fuel transfer tube. This tube

Revision 5209/29/2016 NAPS UFSAR 9.1-16 is fitted with a blind flange on the refueling cavity end and a gate valve on the spent-fuel pit end.

The blind flange is in place except during refueling to ensure containment integrity. Fuel is carried through the tube on an underwater transfer car.

Fuel is moved between the reactor vessel and the refueling canal by the manipulator crane.

A portable rod cluster control change tool is utilized in the spent fuel pit for transferring control elements from one fuel assembly to another. The rod cluster control changing fixture is located on the refueling canal wall. Storage of irradiated fuel assemblies or control rods in the rod cluster control changing fixture is not allowed, as in the event of a loss of refueling canal water level, the fuel assemblies and/or control rods would be exposed thereby creating a radiation hazard.

The upender at either end of the fuel transfer tube is used to pivot a fuel assembly to the horizontal position for passage through the transfer tube. After the transfer car transports the fuel assembly through the transfer tube, the upender at that end of the tube pivots the assembly to a vertical position so that it can be lifted out of the fuel container.

In the spent-fuel pit, fuel assemblies are moved about by the movable platform with hoist.

When lifting the spent-fuel assemblies, the hoist uses a long-handled tool to ensure that sufficient radiation shielding is maintained. A shorter tool is used to handle new fuel, but the new-fuel elevator must be used to lower the assembly to a depth at which the hoist, using the long-handled tool, can place the new assembly into the fuel transfer container in the upending device.

Decay heat generated by the spent-fuel assemblies in the spent-fuel pit is removed by the spent-fuel pit cooling system. After a suitable decay period, spent fuel can be moved from storage in the spent fuel pool and loaded into casks for storage at the North Anna ISFSI, or loaded into casks for shipment off the site.

9.1.4.3 Fuel-Handling Structures 9.1.4.3.1 Refueling Cavity Each refueling cavity is a reinforced-concrete structure that forms a pool above the reactor when filled with borated water for refueling. The walls and floor of the refueling cavity are lined with 0.25-inch stainless steel plate. The cavity is filled to a depth that limits the radiation at the surface of the water to 50 mrem/hour during those brief periods when a fuel assembly is transferred to the fuel upender and is at the closest approach to the surface of the water.

The refueling cavity provides storage space for the reactor upper and lower internals, the control rod drive shafts, and miscellaneous refueling tools.

The reactor vessel flange is sealed to the bottom of the refueling cavity by a bolted, gasketed seal ring that prevents the leakage of refueling water from the cavity. This seal is fastened and closed after reactor cooldown before the flooding of the cavity for refueling operations. During reactor operation, the seal is removed.

Revision 5209/29/2016 NAPS UFSAR 9.1-17 Reference Drawings 2 and 3 depict the refueling cavity water seal arrangement and details.

Reference Drawing 3 also includes a listing of all materials used in the construction of the water seal.

The water seal is a 2-inch-thick carbon steel annular plate provided with bolt holes adjacent to both the inner and outer peripheries. The inner edge rests on a flange of the reactor vessel and is secured to this flange by 36 equally spaced 0.75-inch diameter bolts. Alignment is provided by two diametrically opposed 1-3/16 inch-diameter guide pins. Redundant neoprene gaskets are used between the water seal and the flange on the reactor vessel and the seal ring lower assembly. The gaskets are deformed by the water hydrostatic load and the torquing of the water seal bolts. The combination of the bolting arrangement and the deformation of these gaskets provides for leaktight integrity.

The refueling cavity water seal has been designed to retain integrity under the hydrostatic load imposed by 30 feet of refueling cavity water. This integrity will also be retained under a simultaneous hydrostatic loading and seismic event.

The seal ring will not structurally fail and the bolting arrangement will keep the seal ring in position. As shown in Reference Drawing 2, the gaskets have a wedge-shaped cross section and are firmly held in place by a bolted seal spacer.

In a postulated accident consisting of a complete loss of all gaskets, the hydrostatic pressure of the refueling water will force the water seal against the reactor vessel flange and the seal ring lower assembly. In this event, some leakage from the refueling cavity to the reactor cavity is credible, due to minor seal plate flatness irregularities. However, this leakage would be minor.

During a postulated leak, water leaking past the water seal would flood the lower reactor cavity and incore instrumentation tunnel to a maximum elevation of 241 ft. 6 in. The water would then drain to the lower containment floor elevation at 216 ft. 2 in.

All electrical equipment, motors, switches, and connectors essential in maintaining a safe shutdown are not within reach of flood water. The lowest elevation of equipment essential to maintaining a safe shutdown is that of the residual heat removal pumps located at Elevation 234 ft. 1 in. The residual heat removal flat on which these pumps are located allows water accumulation to flow to the containment floor.

9.1.4.3.2 Fuel Transfer Canal and Fuel Transfer Tube A fuel transfer canal in each reactor containment extends from the refueling cavity to the inside surface of the reactor containment wall. The canals are formed by two concrete shielding walls, which extend upward to the same elevation as the top of the refueling cavity. The walls and floors of the canals are lined with 0.25-inch stainless steel plate. The floor of the canal is at a lower elevation than the refueling cavity to provide the greater depth required for the fuel transfer

Revision 5209/29/2016 NAPS UFSAR 9.1-18 system upending device and the rod control cluster changing fixture, which is located in an alcove off the canal.

A fuel transfer tube provides a connecting passage between the end of the fuel transfer canal in each reactor containment and the spent-fuel pit. A blind flange is bolted onto the refueling cavity end of the transfer tube to seal the reactor containment penetration. The transfer tube also has a gate valve on the spent-fuel pit end to prevent the leakage of water into the refueling cavity during the times when the cavity is empty of water and the refueling cavity end of the tube is unblocked. This valve provides a mechanism to isolate the fuel transfer tube in the event of a loss of spent fuel pool level or reactor cavity level during refueling operations. This gate valve is not required to be leak tested. The fuel transfer tube is designed as Seismic Class I; no other portion of the fuel transfer system is so designated.

9.1.4.3.3 Decontamination Facility The decontamination facility is described in Section 9.5.

9.1.4.4 Refueling Equipment 9.1.4.4.1 Reactor Vessel Stud Tensioners Stud tensioners are used to makeup the reactor vessel head closure joint. During this process all studs are stressed sufficiently to hold the closure heads seated and maintain leaktightness during operation.

The stud tensioner (Figure 9.1-4) is a hydraulically operated device provided to permit the preloading and unloading of the reactor vessel closure studs at cold shutdown conditions. Stud tensioners minimize the time required for the tensioning or unloading operations, minimize thread damage, and permit precision stud tensioning. Three tensioners are provided for each unit, and they are applied simultaneously to three studs 120 degrees apart. One hydraulic pumping unit operates the tensioners, which are hydraulically connected in parallel. The studs are tensioned to their operational load in two steps to prevent high stresses in the flange region and unequal loadings in the studs. Procedural guidance is used to prevent the overtensioning of the studs.

9.1.4.4.2 Reactor Vessel Head Lifting Device The reactor vessel head lifting device (Figure 9.1-5) consists of a welded and bolted structural steel frame with suitable rigging to enable the crane operator to lift the head and store it during refueling operations. The lifting device remains permanently attached to the intermediate lift ring. Attached to the head lifting device are the monorail and hoists for the reactor vessel stud tensioners.

Revision 5209/29/2016 NAPS UFSAR 9.1-19 9.1.4.4.3 Reactor Internals Lifting Device The reactor internals lifting device (Figure 9.1-6) is a structural frame which is suspended from the reactor containment polar crane, when needed. One lifting device is provided for each unit. The frame is lowered onto the guide support plate of the internals and manually bolted to the support plate by three bolts. Bushings on the frame engage guide studs in the vessel flange to provide close guidance during removal and replacement of the internals package.

9.1.4.4.4 Manipulator Crane The manipulator crane (Figure 9.1-7) is a rectilinear bridge and trolley crane with a vertical mast extending down into the refueling cavity water. A manipulator crane is provided for each unit. The bridge spans the refueling cavity and runs on rails set into the floor along the edges of the refueling cavity. The bridge and trolley motions are used to position the vertical mast over a fuel assembly in the core. A long tube with a pneumatic gripper on the end is lowered down from the mast to grip the fuel assembly. The gripper tube is a telescopic device that is long enough so the upper end is still contained in the mast when the gripper end contacts the fuel. A winch mounted on the trolley raises the gripper tube and fuel assembly up into the mast tube. The fuel, while inside the mast tube, is transported to its new position.

The manipulator crane has been equipped with In-Mast Sipping (IMS) capability. The IMS system is a set of hardware that provides a means of performing quantitative leak testing of fuel assemblies in the manipulator mast during fuel handling on the core offload. Units 1 and 2 have Westinghouse and AREVA IMS systems installed on the fixed mast tube. The Westinghouse IMS equipment weighs approximately 125 lbs. and the AREVA equipment weighs approximately 100 lbs. In operation, the change in elevation of the fuel assembly from its in-core position to the full-up position in the mast results in a reduction of external pressure on the fuel rods of about 15 psi. This pressure differential is sufficient to cause fission gases (specifically Krypton and Xenon) to expand and migrate out through any open defects in the fuel cladding. These escaped gases are then detected by the IMS system detectors.

All controls for the manipulator crane are mounted on a console located on the bridge. The bridge is positioned on a coordinate system laid out on one rail. With the aid of a scale, the trolley is positioned on the bridge structure. The scale is read directly by the operator at the console. An auxiliary load cell meter enables the crane operator to continuously monitor elevation and load and minimizes the potential for operator distractions during refueling operations.

The drives for the bridge, trolley, and winch are variable speed, including a separate inching control on the winch. Electrical interlocks and limit switches on the bridge and trolley drives protect the equipment. In an emergency, the bridge, trolley, and winch can be operated manually using handwheels on the motor shafts. The main and auxiliary hoists each have two independent load-holding brakes: a disk-type, electrically energized to release, spring-set brake; and a

Revision 5209/29/2016 NAPS UFSAR 9.1-20 mechanical-type brake. The bridge and trolley brakes are of the shoe type, electrically energized to release, and spring set.

Even though the crane is not Seismic Class I, suitable restraints are provided between the bridge and trolley structures and their respective rails to prevent derailing due to the design-basis earthquake. The manipulator crane is designed to prevent the disengagement of a fuel assembly from the gripper under the design-basis earthquake. The manipulator crane is parked to one side of the reactor and secured when not in use.

The manipulator crane structure is designed in accordance with Electric Overhead Industrial Crane Specification 61. The design load is specified as the weight of three fuel assemblies at 4725 lb plus the gripper tube weight of 900 lb, or a total of 5625 lb. Note that the 5625 lb design load neglects the 125 lb weight of the Westinghouse IMS equipment and the 100 lbs. weight of the AREVA equipment. All load-supporting members are designed with a 5 to 1 safety factor at this design load. The normal operating load for the crane is approximately 2700 lbs. including the gripper weight and IMS equipment. The maximum loading for the crane is 6000 lb. Seismic loads used by the vendor for design are based on 1.5-g horizontal and 1.0-g vertical accelerations.

9.1.4.4.5 Movable Platform with Hoists The movable platform with hoists in the fuel building (Figure 9.1-8) is a wheel-mounted motor-driven platform with two overhead electric hoists for lifting new and spent-fuel assemblies.

The platform spans the spent-fuel pit and may be maneuvered over the fuel pit, the fuel transfer canals, and the new-fuel handling and storage area in the fuel building. The hoist travel and the length of the long fuel-handling tool is designed to limit the maximum lift of a spent-fuel assembly to ensure that the water above the fuel provides a safe shielding depth. The movable platform is a Seismic Class I component. Suitable restraints are provided between the bridge and the rails to prevent derailing during an earthquake. Each hoist is equipped with a load-sensing device to detect any binding that may occur during fuel handling. These hoists have dynamic braking and two independent load-holding brakes, each with the capability to hold the rated hoist load. One holding brake is a Weston ratchet type and the other is a multiple-disk-type that is spring set and electrically released. The trolley drive consists of a worm gear speed reducer that acts as a brake when the motor is stopped. The platform drive also has a worm gear reducer and, in addition, a single disk brake that is spring set and electrically energized to release.

The design of the motor-driven platform includes the following additional provisions to ensure the safe handling of the fuel elements:

1. All portions of the driveline are capable of withstanding sudden stops of rated load up to 150% of rated speed.

Revision 5209/29/2016 NAPS UFSAR 9.1-21

2. An unobstructed perpendicular view into the water surface is provided along the entire length of the platform to ensure that the fuel assembly remains in the operators view during handling.

3. An interlock is provided to prevent the platform and trolley from moving while the hook is being operated. The interlocks provided are fail-safe; that is, most common failures will leave the interlock features intact, preventing operation of the equipment unless the interlock is manually bypassed. The less likely failure of an interlock in the permissive condition, caused by a short circuit around a switch or by a relay sticking in the closed position, must be followed by an operator error for a possible accident situation to exist.

4. Each hoist is provided with a resolver which inputs to the Programmable Logic Controller (PLC) to stop the hook in its highest and lowest positions. The PLC allows the drive motor to be energized in the reverse direction after the hooks highest and lowest positions have been reached. The resolver PLC limit settings are set so as to stop hoist motion under all conditions of hoist load and hoist speeds and in sufficient time to prevent the contact of the upper and lower blocks.

5. The hoist is provided with redundant upper limits (a block operated switch and a PLC upper limit setting). The failure of either one of these devices will not affect the operation of the other.

6. Failure of the lower limit switch will not cause an accident.

7. The motor-driven platform hoists are provided with a load readout device and a load-limiting feature that stops hoist motion if a preset weight is exceeded. The setpoint of the load limiter is adjustable. Failure of this interlock will not cause an accident.

The movable platform with hoists is located within the fuel building and is shared by Units 1 and 2. However, it serves only one unit at a time. Being shared has no effect on its ability to function safely nor does it affect the ability for an orderly shutdown or cooldown of the operating unit.

The movable platform with hoists was built according to the following codes and regulations:

1. Department of Labor Occupational Safety and Health Standards, 29 CFR 1910, Chapter XVII.

2. ANSI Standard Safety Code for Overhead and Gantry Cranes, ANSI B30.2.0-1967.

3. Crane Manufacturers Association of America, Specification No. 70, Service Class Al.

4. American Welding Society, Specification for Welded Highway and Railway Bridges D2.0-69.

Revision 5209/29/2016 NAPS UFSAR 9.1-22

5. American Institute of Steel Construction, Inc., Specification for the Design, Fabrication and Erection of Structural Steel for Buildings, AISC, 7th Edition, Part 5, February 12, 1969.

6. National Electrical Code, 1971 Edition, NFPA 70-1971, ANSI Cl-1971, Article 610.

The crane is retrofitted to the 1999 edition of the National Electric Code.

7. National Electrical Manufacturers Association NEMA Section II, Parts 10, 12, and 14.

8. American Society of Nondestructive Testing, ANSI SNT-TC-lA.

9. Steel Structure Painting Council, Standard SSPC-SP-6-63, Commercial Blast Finish.

9.1.4.4.6 Fuel Transfer System The fuel transfer system (Figure 9.1-9) consists of a winch/cable system which drives the transfer car that runs on tracks extending from the refueling canal through the transfer tube and into the spent-fuel pit, and an upender lifting frame at each end of the transfer tube. The upender in the refueling canal receives a fuel assembly in the vertical position from the manipulator crane.

The fuel assembly is then lowered to a horizontal position for passage through the transfer tube and raised to a vertical position by the upender in the spent-fuel pit. The hoist on the movable platform over the spent-fuel pit then takes the fuel assembly to a position in the spent-fuel racks.

During reactor operation the transfer car is stored in the fuel transfer canal inside containment and a blind flange is bolted on the transfer tube to seal the reactor containment penetration.

9.1.4.4.7 New-Fuel Elevator The new-fuel elevator (Reference Drawing 4) lowers new-fuel assemblies from the top to the bottom of the spent-fuel pit so that the new-fuel-handling tool and the hook and cable of the traveling platform hoist do not become contaminated by immersion in the pit water. The transfer of the fuel assembly from the elevator at the bottom of the pit to the upending frame is accomplished with the long fuel-handling tool, which is also used for transferring spent fuel. The fuel elevator is a Seismic Class I component.

Although the new-fuel elevator is shared by Units 1 and 2, a malfunction of this item has no effect on the orderly shutdown and cooldown of the operating unit.

The design of the fuel elevator includes the following provisions to ensure the safe handling of the fuel elements:

1. A stop is provided to prevent the elevator from moving above the 293 ft. 0 in. elevation upon failure of the upper-limit switch.

2. The winch is provided with limit switches that are activated at the full up and full down positions of the elevator carriage.

Revision 5209/29/2016 NAPS UFSAR 9.1-23

3. The cable and winch are capable of holding the elevator carriage against the stop without failure of equipment in case of a failure of the limit switch.

4. A failure of the lower-limit switch will not cause an accident.

5. The winch is equipped with an electromagnetic brake of fail-safe design (being spring applied and electrically released). The brake is applied upon the loss of any phase from the power source. This brake is mounted on the motor shaft and is capable of stopping 150% of rated load at any speed up to 200% of full speed.

6. A slack cable limit switch is also provided to stop the motor if the carriage is hung up during lowering.

7. All portions of the driveline from the first brake to the lifting clevis are capable of withstanding any sudden stop of the rated load at 150% of rated speed.

9.1.4.4.8 New-Fuel Crane The new-fuel crane (Figure 9.1-10) is a toprunning bridge crane with a 5-ton capacity hoist.

The crane is capable of transferring new-fuel containers from a truck into the fuel building and positioning them at the 272 ft. 0 in. elevation. The crane is designed for outside service, for operation in 35-mph winds, and for making capacity lifts at temperatures down to -20°F. The new-fuel crane is built according to the following codes:

1. ANSI Safety Code for Overhead and Gantry Cranes, ANSI B30.2.0-1967.

2. Crane Manufacturers Association of America, Inc., CMAA Specification No. 70 Service Class A.

The new-fuel crane is not seismically designed; however, it is equipped with safety lugs to prevent the bridge or trolley from jumping off the rails.

This hoist has two independent load brakes, a Weston ratchet-type and an electrically energized to release, spring-set, shoe-type brake. Each brake has the capacity to hold the rated hoist load. Both the bridge and trolley are electrically energized to release, spring-set, shoe-type brakes.

The new-fuel crane is provided with an interlock circuit that prevents the closing of the main-line circuit breakers unless all individual motor controls are in the off position. This interlock is fail-safe; that is, the most common modes of failure, an open circuit and burned-out relay coils, leave the interlock feature intact, preventing the operation of the equipment unless the interlock is manually bypassed. The less likely failure of an interlock circuit in the permissive condition, caused by a short circuit around a switch or by a relay sticking in the closed position, must be followed by an operator error for a possible accident situation to exist.

Revision 5209/29/2016 NAPS UFSAR 9.1-24 All crane controls are of the dead-man type, with spring return to the off position. The hoist is also provided with limit switches to stop the hook in its highest and lowest positions. There are two independent upper-limit switches. The failure of any one of the upper-limit switches will not affect the operation of the other.

9.1.4.4.9 Rod Cluster Control (RCC) Change Tool The rod cluster control (RCC) change tool (Figure 9.1-12) is a device used to remove an RCC from one fuel assembly and transfer it to another in the spent fuel pit. During use, this tool is suspended from the spent fuel pit bridge hoist and is operated from the bridge walkway.

The RCC change tool is portable and functions in a manner similar to the RCC change fixture. The tool is lowered by the bridge hoist until it rests upon the nozzle of the desired fuel assembly. The gripper actuator is then lowered and latched onto the RCC spider which allows the entire RCC to be drawn up inside the guide tube of the tool. Once this operation is completed, the tool may be repositioned over another fuel assembly. The above process is then reversed for reinsertion of the RCC.

The tool consists of three basic assemblies: the guide tube, the support tube, and the drive mechanism.

The guide tube is similar to that in the new RCC change fixture. It is the square cross-sectioned tube at the bottom of the tool. Guide plates are provided over the entire length of the tube to prevent damaging the control rods and to properly align the gripper. The gripper actuator is also contained within the guide tube. It is a pneumatic device which operates the gripper from an air hose reaching through the support tube to the drive mechanism. Two limit switches provide upper and lower limits for the motion of the unit. The bottom of the guide tube is equipped with guide pins to insure alignment of the tool with the fuel assembly.

Above the guide tube is the support tube which gives the proper length to the tool, provides support for the gripper actuator, and supplies protection for the lift cable. Also enclosed within the support tube are the air hose for the gripper and the electrical cable for connection of the limit switch. To prevent tangling of the hose and cable, the cable has been placed inside the coiled air hose with seals at each end to allow separation of the two.

The drive mechanism, at the top of the tool, consists of a winch powered by an AC electric motor, the operators panel, and four limit switches. One of the limit switches provides overload protection in the event of an RCC hang-up. The other three are geared limit switches, two providing upper and lower limits and the last providing control for the pneumatic system.

9.1.4.4.10 Rod Cluster Control Changing Fixture The RCC-changing fixture is designed to transfer RCC elements from one fuel assembly to another inside containment (Figure 9.1-11). However, use of the changing fixture is prohibited by

Revision 5209/29/2016 NAPS UFSAR 9.1-25 procedure because of concerns related to potential loss of refueling cavity level. Five major subassemblies are comprised in the changing fixture: (1) a frame and track structure, (2) a carriage, (3) a guide tube, (4) a gripper, and (5) a drive mechanism. The carriage is a movable container supported by the frame and track structure. The tracks provide a guide for the four flanged carriage wheels and allow horizontal movement of the carriage during changing operations. Positioning stops on both the carriage and frame locate each of the three carriage compartments directly below the guide tube. Two of these compartments are designed to hold individual fuel assemblies while the third is made to support a single RCC element.

The guide tube is situated above the carriage and mounted on the refueling canal wall. This assembly provides for the guidance and proper orientation of the gripper and RCC element as they are being raised or lowered.

The gripper is a pneumatically actuated mechanism responsible for engaging the RCC element. It has two flexure fingers that can be inserted into the top of the RCC element when air pressure is applied to the gripper position. Normally the fingers are locked in a radially extended position. The design of the RCC-changing fixture includes the following provisions to ensure the safe handling of fuel elements:

1. The air system that actuates the gripping mechanisms is a fail-safe design, in that air is required to disengage the gripper and a loss of air will not cause the gripper to fail.

2. The gripper air valve is fitted with a handle lock that must be disengaged before the air valve can be operated. This prevents accidental operation of the air valve.

3. A limit switch is provided to prevent the gripper from extending past the prescribed limits.

The drive mechanism assembly is mounted on the operating deck. Its components include:

(1) a manual carriage drive mechanism, (2) a revolving stop-operating handle, (3) a pneumatic selector valve for actuating the gripper piston, and (4) an electric hoist for elevation control of the gripper.

9.1.4.4.11 Refueling-Water Storage Tank The refueling-water storage tank of each unit, described in detail in Section 6.2.2, provides the water for filling the reactor cavity and for certain engineered safety features systems.

9.1.4.4.12 Fuel Building Trolley The crane for handling the spent-fuel cask (Figure 9.1-13) is a trolley of 125-ton capacity running on fixed rails. The rails span the west end of the spent-fuel pit in an area where no spent-fuel storage racks are installed. While inside of the fuel building, the trolley is supported on an NSQ, seismic rail support structure. The rails run south, through the inside roll-up door of the fuel building and into the upper bay of the decontamination building, where the rail support structure is classified non-safety-related, non-seismic. The rails continue south, through the

Revision 5209/29/2016 NAPS UFSAR 9.1-26 outside roll-up door, over the low bay of the decontamination building, and under the fuel building trolley enclosure. The fuel building trolley enclosure provides nominal protection for the trolley while it is outside over the roadway and railroad to help control the spread of weather-driven contamination. The fuel building trolley is designed as a Seismic Class I component. The fuel building trolley is built in accordance with the following codes:

1. ANSI Safety Code for Overhead and Gantry Cranes, ANSI B30.2.0-1967.

2. Electric Overhead Crane Institute, Inc., Specification for Electric Overhead Traveling Cranes for EOCI Service Class A.

Restraints are provided to prevent displacement of the trolley from the rails during the design-basis earthquake.

The possibility of the cask falling from the trolley is minimized since the trolley is equipped with eddy current brakes, dual-load holding brakes, and dead-man motor controls with spring return to the off position. These brakes and controls prevent the cask from falling freely while hanging from the trolley. The motor controls can be operated by levers and switches in the cab or remotely by radio control. The cask-lifting rig is conservatively designed so that the cask is securely locked to the rig, thereby preventing the cask from slipping from the trolley hook. The main and auxiliary hoists have regenerative control braking and two spring-set, electrically energized to release, load-holding brakes. The trolley is equipped with hydraulic-electric braking, which is spring set on loss of power and is operated by a foot pedal in the cab or a lever on the radio control unit when the crane is in use.

The fuel building trolley is provided with an interlock circuit that prevents the closing of the main-line circuit breakers unless all individual motor controls are in the off position. This interlock is fail-safe; that is, the most common modes of failure, an open circuit and burned-out relay coils, leave the interlock feature intact, preventing the operation of the equipment unless the interlock is manually bypassed. The less likely failure of an interlock circuit in the permissive condition, caused by a short circuit around a switch or by a relay sticking in the closed position, must be followed by an operator error for a possible accident situation to exist.

Each hoist is provided with limit switches to stop the hook in its highest and lowest positions. Each limit switch is wired so that the drive motor can be energized in the reverse direction after its limit switch has been actuated. The actuating mechanism of the limit switch is positioned so that it will trip the limit switch under all conditions of hoist load and hoist speed and in sufficient time to prevent the contact of the upper drum and lower blocks. There are two independent upper-limit switches. The failure of any one of the upper-limit switches will not affect the operation of the other.

Revision 5209/29/2016 NAPS UFSAR 9.1-27 9.1.4.4.13 Polar Crane The overhead crane in the containment (Figure 9.1-14) is of the polar configuration and is supported on the circular crane wall. The crane has two main hooks, each with a normal capacity of 140 tons and an intermittent capacity of 195 tons. These hooks are used during the installation of major components. One of the two main hook trollies also has an auxiliary hook with a 15-ton normal capacity and a 30-ton intermittent capacity when specially rigged for the installation of major components. The maximum hook elevation is approximately 51 feet above the operating floor. The polar crane has access to the entire area within the crane wall. The auxiliary hook, rigged for its normal 15-ton capacity, has access to the area inside and outside the crane wall. The polar crane and auxiliary hook are designed as Seismic Class I components.

The reactor containment polar crane is designed and constructed to comply with the following codes:

1. ANSI Safety Code for Overhead and Gantry Cranes, ANSI B30.2.0-1967.

2. Electric Overhead Crane Institute, Inc., Specification for Electric Overhead Traveling Cranes for Class A Service.

The main and auxiliary hoists have regenerative control braking and two double-shoe-type, spring-set, electrically energized to release brakes. The trolley has a multiple-disk-type, spring-set, electrically released brake.

The bridge brake is a hydraulic-electric model that is spring set on loss of power and operated by a foot pedal in the cab when the crane is in use.

Restraints are provided between the trolley and bridge and between the bridge and rails to prevent derailing during a design-basis earthquake.

9.1.4.5 Refueling Procedure The refueling operation follows a detailed procedure that provides a safe, efficient refueling operation. The following significant points are ensured by the refueling procedure:

1. The refueling water and the reactor coolant contains approximately 2600 ppm of boron. This concentration, together with the negative reactivity of the control rods, is sufficient to keep the core approximately 5% k/k subcritical during the refueling operations. It is also sufficient to maintain the core subcritical if all of the rod cluster control assemblies were removed from the core.

2. The water level in the refueling cavity is high enough to keep the radiation levels within acceptable limits when the fuel assemblies are being removed from the core. This water also provides adequate cooling for the fuel assemblies during transfer operations.

Revision 5209/29/2016 NAPS UFSAR 9.1-28 The refueling operation is divided into four major phases: (1) preparation, (2) reactor disassembly, (3) fuel handling, and (4) reactor assembly. A general description of a typical refueling operation through the four phases is given below:

1. Phase I - Preparation The reactor is shut down and cooled to cold-shutdown conditions in accordance with Technical Specifications. The coolant level in the reactor vessel is lowered to a point slightly below the vessel flange. The fuel transfer equipment and manipulator crane are checked for proper operation before the movement of any fuel.

2. Phase II - Reactor Disassembly All cables, air ducts, and insulation are removed from the vessel head. The refueling cavity is then prepared for flooding by installing the reactor cavity seal; checking the underwater lights, tools, and fuel transfer system; closing the refueling canal drain holes; and removing the blind flange from the fuel transfer tube. With the refueling cavity prepared for flooding, the vessel head is unseated, raised and taken to its storage stand. Refueling cavity flood up is initiated during this evolution if required for personnel shielding; otherwise, the flood up is initiated upon completion of the head lift. Water from the refueling-water storage tank is pumped into the reactor coolant system by the safety injection pumps, causing the water to overflow into the refueling cavity. The control rod drive shafts are disconnected and, with the upper internals, are removed from the vessel. The fuel assemblies and RCC assemblies are now free from obstructions and the core is ready for refueling.

3. Phase III - Fuel Handling The refueling sequence is started with the manipulator crane. As determined in the Reload Safety Evaluation, which is prepared before each refueling, all irradiated fuel assemblies are removed from the core to the spent fuel pool. Partially spent assemblies and new assemblies are returned to and repositioned in the core. The sequence of fuel assembly movements is designed to maintain a safe, reliable, and efficient operation.

The general fuel-handling sequence is as follows:

a. The manipulator crane is positioned over the fuel assembly to be moved.

b. The fuel assembly is lifted by the manipulator crane to a predetermined height sufficient to clear the reactor vessel and still leave a water covering sufficient to eliminate any radiation hazard to the operating personnel.

c. The fuel transfer car is moved into the refueling canal from the spent fuel pit.

d. The fuel assembly container is pivoted to the vertical position by the upender.

e. The manipulator crane is moved to line up the fuel assembly with the fuel transfer system.

Revision 5209/29/2016 NAPS UFSAR 9.1-29

f. The manipulator crane loads a fuel assembly into the fuel assembly container of the fuel transfer car.

g. The container is pivoted to the horizontal position by the upender.

h. The fuel container is moved through the fuel transfer tube to the spent-fuel pit by the transfer car.

i. The fuel assembly container is pivoted to the vertical position. The fuel assembly is unloaded by the spent-fuel-handling tool attached to the movable platform and hoists.

j. The fuel assembly is placed in the spent-fuel storage rack.

This procedure is repeated until all exposed fuel assemblies are located in the spent fuel pit storage racks.

k. If time permits, prior to the refueling outage, new-fuel assemblies are brought from dry storage, lowered into the spent-fuel pit with the new-fuel elevator, and loaded into the fuel storage racks by the movable platform and hoist, otherwise, they may be loaded into the fuel storage racks during refueling.

l. If the removed assemblies contain control rod clusters, the RCC change tool is used to remove the RCC from the assembly to another assembly while both are under water in the storage racks. Burnable poison rod and thimble plug shuffle occurs here also. The new fuel assembly is loaded into the fuel assembly container by the movable platform and hoist.

m. The fuel assembly container is pivoted to the horizontal position and the transfer car is moved back into the refueling canal.

n. Core on-load is accomplished by using the reverse of the core off-load sequence.

o. This procedure is continued until refueling is completed.

4. Phase IV - Reactor Assembly Reactor assembly, following refueling, is essentially performed by reversing the operations given in Phase II, Reactor Disassembly.

9.1.4.6 Design Evaluation 9.1.4.6.1 Safe Handling 9.1.4.6.1.1 Manipulator Crane. The manipulator crane design includes the following provisions to ensure safe handling of fuel assemblies.

1. Bridge, trolley, and winch drives are mutually interlocked, using redundant interlocks, to prevent the simultaneous operation of any two drives.

Revision 5209/29/2016 NAPS UFSAR 9.1-30

2. Bridge and trolley drive operation is prevented except when both gripper tube up-position switches are actuated.

3. An interlock prevents the opening of a solenoid valve in the air line to the gripper except when zero suspended weight is indicated by a force gauge. As backup protection for the interlock, the mechanical weight-actuated lock in the gripper prevents operation of the gripper under load even if air pressure is applied to the operating cylinder.

4. An excess-suspended-weight switch opens the hoist drive circuit in the up direction when the loading is in excess of 110% of a fuel assembly weight.

5. An interlock of the hoist drive circuit in the up direction permits the hoist to be operated only when either the open or closed indicating switch on the gripper is actuated.

6. An interlock of the bridge and trolley drives prevents the bridge drive from traveling beyond the edge of the core unless the trolley is aligned with the refueling canal centerline. The trolley drive is locked out when the bridge is beyond the edge of the core.

7. Suitable restraints are provided between the bridge and trolley structures and their respective rails to prevent derailing due to the design-basis earthquake. The manipulator crane is designed to prevent disengagement of a fuel assembly from the gripper under the design-basis earthquake.

8. The main and auxiliary hoists are equipped with two independent braking systems. A solenoid-release, spring-set electric brake is mounted on the motor shaft. This brake operates in the normal manner to release upon the application of current to the motor and to set when current is interrupted. The second brake is a mechanically actuated load brake internal to the hoist gearbox that sets if the load starts to overhaul the hoist. It is necessary to apply torque from the motor to raise or lower the load. In raising, the motor cams the brake open; in lowering, the motor slips the brake, allowing the load to lower. This brake actuates upon loss of torque from the motor for any reason and is not dependent on any electrical circuits. On the main hoist the motor brake is rated at 350% operating load and the mechanical brake at 300%.

The working load of the fuel assembly, gripper, and IMS equipment is approximately 2700 lbs. The gripper itself has four fingers gripping the fuel, any two of which will support the fuel assembly weight. The gripper and hoist system is load tested in accordance with the Technical Requirements Manual.

Within the spent fuel pool, the new and spent fuel assemblies are handled by the long handling tool suspended from an overhead hoist on the fuel building movable platform. The grippers on the long handling tool are designed to engage the fuel element and, because of its geometry and operation, cannot grip onto any part of the fuel racks. When the lifting tool has gripped onto the fuel element, the suspended weight is monitored by a load cell indicator and is limited to the full capacity of the hoist (4000 lb). The weight and arrangement of the fuel racks

Revision 5209/29/2016 NAPS UFSAR 9.1-31 within the spent fuel pool are sufficient to prevent any motion or tipping of the rack itself, thereby, maintaining the subcritical array.

9.1.4.6.1.2 Fuel Transfer System. The following safety features are provided for in the fuel transfer system control circuit:

1. Transfer car operation is possible only when both lifting arms are in the down position, as indicated by the limit switches.

2. The remote-control panels have a permissive switch in the transfer car control circuit that prevents operation of the transfer car in either direction when either switch is open; that is, with two remote control panels, one in the refueling canal and one in the spent-fuel pit, the transfer car cannot be moved until both go switches on the panels are closed.

3. One interlock allows upender operation only when the transfer car is at either end of its travel.

4. Transfer car operation is possible only when the transfer tube gate valve position switch indicates that the valve is fully open.

5. The refueling canal upender in containment is interlocked with the manipulator crane. The upender cannot be operated unless the manipulator crane gripper tube is in the fully retracted position or the crane is not in the area of the upender.

6. All fuel-handling tools and equipment used over an open reactor vessel are designed to prevent the inadvertent decoupling of the crane hooks (i.e., lifting rigs are pinned to the crane hook and safety latches are provided on hook-supporting tools).

Tools required for handling internal reactor components are designed with fail-safe features that prevent disengagement of the component in the event of operating mechanism malfunction.

This applies to the control rod drive shaft unlatching tool. The air cylinders actuating the gripper mechanism are equipped with backup springs that close the gripper in the event of loss of air to the cylinder. Air valves are equipped with safety locking rings to prevent inadvertent actuation.

9.1.4.6.2 Seismic Considerations The maximum design stress for the structures and for all parts involved in gripping, supporting, or hoisting the fuel assemblies is 20% of ultimate strength of the material. This requirement applies to normal working loads and emergency pullout loads, when specified, but not to earthquake loading. The equipment is designed to limit the stress in the load-bearing parts to 0.9 times the ultimate stress for a combination of normal working loads plus design-basis earthquake forces.

Revision 5209/29/2016 NAPS UFSAR 9.1-32 9.1.4.6.3 Containment Pressure Boundary Integrity The fuel transfer tube, which connects the refueling canal (inside the reactor containment) and the spent-fuel pit (outside the containment), is closed on the refueling canal side by a blind flange at all times except during refueling operations. Two seals are located around the periphery of the blind flange, with leak-check provisions between them. The tube is closed on the spent-fuel pit side by a gate valve. The blind flange o-ring seals provide two barriers between the containment atmosphere and the outside atmosphere.

9.1.4.6.4 Radiation Shielding During all phases of spent-fuel transfer, the gamma dose rate at the surface of the water is 50 mrem/hour or less. This is accomplished by maintaining a minimum of 7 feet of water above the top of the fuel assembly during all handling operations.

The two cranes used to lift spent-fuel assemblies are the manipulator crane and the movable platform with hoists. The manipulator crane contains positive stops that prevent the top of a fuel assembly from being raised to within a minimum of 7 feet of the normal water level in the refueling cavity. The hoist on the spent-fuel pit platform moves spent-fuel assemblies with a long-handled tool. Hoist height and tool length likewise limit the maximum lift of an active fuel assembly to within a minimum of 7 feet of the normal water level in the spent-fuel pit.

9.1.4.7 Tests and Inspections As part of normal plant operations, the fuel-handling equipment is inspected for operating conditions before each refueling operation. During the operational testing of this equipment, procedures are followed that will affirm the correct performance of the fuel-handling system interlocks.

Before refueling operations, pre-operational checkouts of the fuel-handling equipment are performed to ensure the proper performance of the fuel-handling equipment and to familiarize operating personnel with the operation of the equipment. A dummy fuel assembly is used for this purpose.

9.1.4.8 Cask Handling Equipment The loading of storage and transport casks and the unloading of storage casks take place within the Fuel and Decontamination Buildings. These operations are conducted in a manner that ensures that the capability to safely operate Units 1 and 2 is not jeopardized. The Fuel Building and its systems are described in Section 3.8.1.1.4 and Section 9.1. The Decontamination Building and its systems are described in Sections 3.8.1.1.6 and 9.5.9.

Revision 5209/29/2016 NAPS UFSAR 9.1-33 Station systems and other components used during the loading and unloading of casks include the following:

Fuel Building trolley crane that services the Fuel and Decontamination Buildings

Movable platform with hoists and long handling tool that are used to load or unload fuel assemblies

Cask lift beam

Tools or slings for lifting cask lids and covers

Vacuum drying system used to remove any water remaining in the cask cavity after pumping water from the cavity back to the spent fuel pool

Specialized leak detection equipment used for seal testing.

9.1.4.9 Spent Fuel Storage at the Independent Spent Fuel Storage Installation (ISFSI)

As described in Section 9.1.2, spent fuel assemblies are stored in the spent fuel pool to allow post-irradiation cooling of the spent fuel. With construction of the North Anna ISFSI, dry storage provides additional capacity for on-site interim storage of spent fuel. The North Anna ISFSI is licensed for dry storage systems under 10 CFR 72 (License No. SNM-2507). North Anna has also selected the NUHOMS-HD spent fuel storage system under the 10 CFR 72 general license issued to Transnuclear, Inc. (Certificate of Compliance #1030).

Pad 1 at the ISFSI is designed for vertical, metal dry storage systems, and the NRC, as part of the site license, has approved one storage system (TN-32). The design and operation of the ISFSI and the approved storage systems are described in the ISFSI Safety Analysis Report (SAR)

(Reference 1) and the storage system Topical Safety Analysis Reports (TSARs) referenced in the SAR. Pad 2 at the ISFSI is designed for storage using the NUHOMS-HD system. The design and operation of this system are described in the NUHOMS FSAR (Reference 2).

Handling of dry storage systems in the North Anna Station for loading or unloading must meet the requirements of Section 9.6, Control of Heavy Loads.

Revision 5209/29/2016 NAPS UFSAR 9.1-34 9.1 References

1. Dry Cask Independent Spent Fuel Storage Installation (ISFSI) Safety Analysis Report.

2. Final Safety Analysis Report, Horizontal Modular Storage System for Irradiated Nuclear Fuel (NUHOMS).

9.1 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FM-088A Flow/Valve Operating Numbers Diagram: Fuel Pit Cooling and Refueling Purification System, Unit 1

2. 11715-FV-12A Refueling Cavity Water Seal, Arrangement and Details, Sheet 1

3. 11715-FV-12B Refueling Cavity Water Seal, Arrangement and Details, Sheet 2

4. 11715-FV-11A Fuel Elevator, Spent Fuel Pit

5. 11715-FM-3A Arrangement: Fuel Building, Sheet 1

6. 11715-FM-3B Arrangement: Fuel Building, Sheet 2

Revision 5209/29/2016 NAPS UFSAR 9.1-35 Table 9.1-1 FUEL PIT COOLING AND REFUELING PURIFICATION SYSTEM DESIGN DATA Fuel Pit Coolers Number 2 Design duty per cooler (with tube 56,800,000 Btu/hr inlet 210°F and shell inlet 105°F)

Shell Tube Fluid flowing Component cooling or service water Fuel pit water Design pressure 150 psig 100 psig Design temperature 150°F 212°F Operating pressure 110 psig 45 psig Material Carbon steel SS 304 Design Code ASME VIII, ASME VIII, Division 1, 1968 Division 1, 1968 Spent-Fuel Pit Cooling Pumps Number 2 Type Horizontal centrifugal Motor horsepower 100 Seals Mechanical Capacity per pump 2750 gpm Head at rated capacity 80 ft Design pressure 125 psig Design temperature 250°F Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Refueling Purification Pumps Number 3 Type Vertical centrifugal Motor horsepower 20 Capacity per pump 400 gpm Seals Mechanical Head at rated capacity 99 ft Design pressure 185 psig Design temperature 200°F Materials Pump casing SS 316 Shaft SS 316

Revision 5209/29/2016 NAPS UFSAR 9.1-36 Table 9.1-1 (continued)

FUEL PIT COOLING AND REFUELING PURIFICATION SYSTEM DESIGN DATA Impeller SS 316 Refueling Purification Filters Number 2 Material SS 304 Design pressure 150 psig Design temperature 250°F Refueling Purification Ion Exchanger Number 1 Active resin volume 45 ft3 Design pressure 200 psig Design temperature 250°F Ion Exchanger resin 50/50 anion-cation Material SS 316L Design flow rate 200 gpm Design Code ASME VIII, Division 1, 1968 Skimmer Assemblies Number 4 - two in spent-fuel pit, one in each reactor cavity Debris basket 1/8 x 1/4 in. openings Design temperature 210°F Flow rate per assembly (approximate) 25 gpm (minimum) to 55 gpm (maximum)

Materials Housing Base High-impact grade Cycolac Deck plate (acrylo-nitrile-buta-diene-styrene)

Frame Debris basket - polypropylene Gasket - Buna-N Screws SS 300 Series 18-8 Springs Piping, Valves, and Fittings Materials Austenitic stainless steel Design Code ANSI B31.7 and ANSI B31.1

Revision 5209/29/2016 NAPS UFSAR 9.1-37 Table 9.1-2 MALFUNCTION ANALYSES OF SPENT-FUEL PIT COOLING AND REFUELING PURIFICATION SYSTEM Component Malfunction Comments and Consequences Spent fuel pit cooling Pump fails to start or The standby pump will be started manually.

pumps fails during operation If the operating pump should stop, over 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months exists to start the standby pump before the pit heats up approximately 12.9°F at the maximum abnormal heat load.

Pit temperature will not exceed 170°F with only one pump and two coolers in service for the maximum abnormal heat load.

Fuel pit coolers Loss of function The standby exchanger will be used. Over 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months exists to realign the piping system because of the slow heatup rate of the pool.

The realignment is effected by operating manual valves.

For conditions up to the limiting core off-load, with only one pump and one cooler in service, the maximum calculated temperature remains below the temperature at which the structural analysis of the fuel pool was performed.

Pumps, coolers, piping, Leaks of any size A slow leak (less than 100 gpm) will permit valves, and other over 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to isolate the leak before loss of components 1 foot of water in the spent-fuel pit. A large leak can only reduce water to the lowest pool penetration, which is at a high enough level to ensure adequate shielding.

Refueling purification Pump fails to start or The standby pump will be started manually.

pumps fails during operation

Figure 9.1-1 (SHEET 1 OF 3)

FUEL PIT COOLING AND REFUELING PURIFICATION SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.1-38

Figure 9.1-1 (SHEET 2 OF 3)

FUEL PIT COOLING AND REFUELING PURIFICATION SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.1-39

Figure 9.1-1 (SHEET 3 OF 3)

FUEL PIT COOLING AND REFUELING PURIFICATION SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.1-40

Revision 5209/29/2016 NAPS UFSAR 9.1-41 Figure 9.1-2 ION-EXCHANGER CAPACITY LOSS VS. TEMPERATURE

Figure 9.1-3 FUEL PIT AREA; PLAN AND ELEVATION Revision 5209/29/2016 NAPS UFSAR 9.1-42

Revision 5209/29/2016 NAPS UFSAR 9.1-43 Figure 9.1-4 REACTOR VESSEL STUD TENSIONER

Revision 5209/29/2016 NAPS UFSAR 9.1-44 Figure 9.1-5 REACTOR VESSEL HEAD LIFTING DEVICE

Figure 9.1-6 REACTOR INTERNALS LIFTING DEVICE Revision 5209/29/2016 NAPS UFSAR 9.1-45

Revision 5209/29/2016 NAPS UFSAR 9.1-46 Figure 9.1-7 MANIPULATOR CRANE

Figure 9.1-8 MOVABLE PLATFORM WITH HOISTS Revision 5209/29/2016 NAPS UFSAR 9.1-47

Revision 5209/29/2016 NAPS UFSAR 9.1-48 Figure 9.1-9 FUEL TRANSFER SYSTEM

Revision 5209/29/2016 NAPS UFSAR 9.1-49 Figure 9.1-10 NEW FUEL CRANE

Figure 9.1-11 ROD CLUSTER CONTROL CHANGING FIXTURE Revision 5209/29/2016 NAPS UFSAR 9.1-50

Revision 5209/29/2016 NAPS UFSAR 9.1-51 Figure 9.1-12 ROD CLUSTER CONTROL CHANGING TOOL

Revision 5209/29/2016 NAPS UFSAR 9.1-52 Figure 9.1-13 FUEL BUILDING TROLLEY

Figure 9.1-14 REACTOR CONTAINMENT POLAR CRANE Revision 5209/29/2016 NAPS UFSAR 9.1-53

Revision 5209/29/2016 NAPS UFSAR 9.1-54 Intentionally Blank

Revision 5209/29/2016 NAPS UFSAR 9.2-1 9.2 WATER SYSTEMS 9.2.1 Service Water System The sources of service water for North Anna Units 1 and 2 are the North Anna reservoir and the service water reservoir. These two independent sources of water form the ultimate heat sink for North Anna Power Station. Service water is used as cooling water for heat exchangers that remove heat from the component cooling system (Section 9.2.2), the recirculation spray subsystem (Section 6.2.2), and other station applications such as main control room air-conditioning condensers, charging pump lubricating-oil and instrument air compressors. In addition, service water is provided as a backup supply to the steam generator feed system, the fuel pit coolers, and the recirculation air cooling coils.

9.2.1.1 Design Basis The service water system is a common system and is designed for the removal of heat resulting from the simultaneous operation of various systems and components of two units based on an accident condition service water temperature of 110°F. Untreated water, supplied from the North Anna reservoir, or treated water from the service water reservoir, is circulated by pumps through the systems and components that require an ensured supply of service water under accident conditions and other systems and components denoted in this section. The accident design basis for the pumping requirements of the service water system is the simultaneous loss-of-coolant accident (LOCA) for one unit and loss of offsite power for both units. During this accident, the intact unit will be placed in hot standby operation or will be cooled down by dumping steam followed by the use of the residual heat removal (RHR) system after approximately the fourth hour. See Section 9.2.1.2 for system operation during accident conditions.

For less restrictive accident conditions, such as a small-pipe break or small-steam-line break with no loss of station power, the service water system will allow continued operation of the unaffected unit.

The service water system consists of two loops (Loop A and Loop B), and most components can be aligned to operate on either loop. During a design basis accident (DBA) the two loops are cross connected at the recirculation spray heat exchanger (RSHX) supply and return headers of the accident unit. Loop A consists of the #1 supply header and the #4 return header.

Normally, pumps aligned to Loop A are powered by the 1H and 2J emergency buses. Loop B consists of the #2 supply header and the #3 return header, and normally pumps aligned to Loop B are powered by the 1J and 2H emergency buses.

The recirculation spray heat exchangers (RSHXs), charging pump coolers, and instrument air compressor coolers have normally aligned parallel supply and return lines from both Loop A and Loop B. During normal operation, the Unit 1 component cooling heat exchangers (CCHXs)

Revision 5209/29/2016 NAPS UFSAR 9.2-2 are aligned to Loop A and the Unit 2 CCHXs are aligned to on Loop B. The control room chillers can be manually aligned to operate on either service water loop.

During a safety-injection (SI), all four main service water pumps automatically start and both loops are automatically realigned for spray array operation. During a containment depressurization actuation (CDA) the supply to the CCHXs for the accident unit automatically isolate and its RSHXs are automatically placed in service. During a CDA lineup, service water acts as a single system because of the cross-connections between Loop A and Loop B at the accident unit RSHXs. The CCHXs on the non-accident unit act as a parallel flow path to the accident unit RSHXs, so that throttling the service water flow through the non-accident unit CCHXs affects service water flow through the accident unit RSHXs. No single active failure during a DBA will prevent the service water system from performing its safety-related functions, even though it acts as a single system.

The total service water requirements are dependent on the mode of operation of each reactor unit. Various modes of operation are analyzed below and are presented in Table 9.2-1 with respect to typical service water flow rates.

1. Normal operation: Loop A and Loop B act as mostly independent systems, but with minor cross connections through the charging pump coolers and instrument air compressor coolers.

The CCHXs constitute the major system load during normal operation. Generally, only one CCHX (or its flow equivalent as throttled CCHXs) is in service on a loop per running service water pump on that loop. As a minimum, each loop is capable of supplying cooling flow for one CCHX, as well as for both units instrument air compressors, charging pumps, and control room air conditioners. The service water system also provides backup for the containment recirculation air cooling coils and the spent fuel pool coolers. Similar to the fire protection system, the service water system can be used as a backup water supply for the auxiliary feedwater pumps.

Service water system alignment changes may be required in the event of inoperable main service water pumps or inoperable emergency power supplies for the service water system to perform its design function during a DBA. The most frequently used changes are:

Throttling service water flow to the CCHXs.

Selection of different main service water pumps as the running pumps.

Three running service water pumps (between Loop A and Loop B) are capable of supplying both the normal and backup loads for both units, with sufficient reserve capacity to support a CDA on one unit coincident with the loss of off-site power on both units. Two running service water pumps are also capable of supporting the design basis accident, if the service water system is throttled to ensure that adequate flow will be delivered to the RSHXs. Flow balancing and system throttling requirements are established by periodic testing that simulates CDA flow conditions in the service water system. Flow balancing is generally

Revision 5209/29/2016 NAPS UFSAR 9.2-3 achieved by throttling flow to the CCHXs and RSHXs when only two main service water pumps are running (minimum configuration). System throttling during normal operation is generally performed by throttling the service water flow through the operating CCHXs to duplicate conditions established by the periodic flow balance. System throttling requirements are imposed when less than four service water pumps are operable.

The two loops of the service water system have distinct differences from typical safety systems that are divided into Train A and Train B. In particular, the two loops are cross-connected during a DBA (at the accident units RSHXs) into a single system which serves both units. Although isolated from the main service water headers, the RSHX cross-tie valves between Loop A and Loop B are normally open. The RSHXs are maintained in dry layup to prevent fouling that could affect heat transfer effectiveness.

The service water is not a two train system, but it is designed so that no single active component failure will prevent it from performing its design function. This is illustrated by the following examples:

Two running service water pumps on a single loop will support a DBA if system throttling (as described above) is established.

If flow is lost to the loop supplying the non-accident units CCHXs, the other loop is sufficient to support the accident unit. However, manual CC and SW realignments will be required to restore CC cooling on the non-accident unit. This is acceptable because the temperature increase in the CC system will be relatively slow due to its large heat capacity from its contained water mass (the CC system does not support DBA safety functions).

Two operable loops are required during normal operation so that the failure of a single active component will not prevent the service water system from performing its design function.

Assuming no single active component failure occurs, one service water loop with two running pumps is capable of supporting design basis accident flow requirements. When only one loop is in service, the service water system can be reconfigured to improve the margin of safety. For example, a single loop that has three operable main service water pumps aligned to it will tolerate most single active component failures (except for check valves), and will supply adequate RSHX and charging pump cooler flows, when the CCHXs are throttled and the two running service pumps receive autostart signals from different SI trains.

The service water system can be operated in the unthrottled condition when four main service water pumps and their emergency power supplies are operable. However, the autostart features must be considered when establishing alignment for this mode of operation as follows:

Revision 5209/29/2016 NAPS UFSAR 9.2-4 The following occurs with four main service water pumps and their associated emergency power supplies operable:

All four pumps receive an autostart on loss of offsite power

All four pumps receive an autostart from the solid state protection system during a safety injection. Train specific autostart signals for the pumps are shown in Section 9.2.1.2.5.

The service water system is normally operated with at least two running pumps. When four pumps are operable and at least two pumps are running, at least two pumps will always operate in the event of any single failure during a DBA. If four pumps are operable and two of the already running pumps receive autostarts from different solid state protection trains, then three pumps will always operate during a DBA in the event of any single failure. The additional capacity provided by a third pump makes service water system throttling unnecessary since piping and component losses through the CCHX flow paths are sufficient to ensure adequate RSHX service water flow for accident conditions.

When either unit is in Modes 1, 2, 3, or 4, the operable service water loops use a reservoir-to-reservoir flow path. A lake-to-lake flow path can be used for the functional loops when both units are in Modes 5 or 6. The service water system is designed to support a DBA, while remaining capable of withstanding a single active component failure without requiring operator action, only when operating in the reservoir-to-reservoir mode. Lake-to-lake operation serves as a backup. Makeup to the Service Water Reservoir is performed using a lake-to-reservoir flow path.

2. Emergency operation, loss-of-coolant accident (LOCA) resulting in SI on one unit coincident with loss of offsite power on both units: In anticipation of a CDA, a SI signal starts all four service water pumps and automatically realigns the service water system motor-operated valves (MOVs) to place all spray arrays in service and stop flow through the spray array bypass lines.

3. Emergency operation, LOCA resulting in a CDA, coincident with a loss of off-site power to both units: Service water valves automatically operate to place the accident units RSHXs in service and stop flow to the accident units CCHXs. The containment air recirculation fan chilled water containment isolation trip valves secure service water or chilled water flow through the accident units containment recirculation air cooling coils. Based on periodic flow balance tests, the RSHX supply MOVs will open to a predetermined throttled position.

A typical time sequence example of service water system operation under these conditions is given below; actual operation will depend on accident conditions:

Revision 5209/29/2016 NAPS UFSAR 9.2-5 For initial period up to 1/2 hour: 4 recirculation spray heat exchangers on the unit with loss of coolant; 3 charging pump lube-oil and gearbox coolers per unit; 1 air compressor per unit; 1 main control room air-conditioning condenser per unit; and component cooling heat exchangers for the unit without loss-of-coolant accident.

For period 1/2 to 1 hour: 4 recirculation spray heat exchangers on the unit with loss of coolant; 3 recirculation air cooling coils on the other unit (if required); 3 charging pump lube-oil and gearbox coolers per unit; 1 air compressor per unit; 1 main control room air-conditioning condenser per unit; and component cooling heat exchangers for the unit without loss-of-coolant accident. During a loss of offsite power, the non-accident unit will lose chilled water cooling to the containment recirculating air cooling coils. Establishing service water flow to the containment air recirculation cooling coils may be required to maintain average containment temperature within specified limits. During the recovery phase after a CDA, the reduction in service water flow to the accident units RSHXs is small and is acceptable because of the decreasing decay heat production with time.

For the period 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s: 2 recirculation spray heat exchangers on the unit with loss of coolant; 3 recirculation air cooling coils on the unit without loss of coolant; 3 charging pump lube-oil and gearbox coolers per unit; 1 air compressor per unit; 1 main control room air-conditioning condenser per unit; and component cooling heat exchangers for the unit without loss-of-coolant accident. Two of the accident units RSHXs may be removed from service after subatmospheric conditions are established so that more service water flow is available to the unaffected unit.

For the period after 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s: 2 recirculation spray heat exchangers on the unit with loss of coolant; 3 recirculation air cooling coils on the unit without loss of coolant; 3 charging pump lube-oil and gearbox coolers per unit; 1 air compressor per unit; 1 main control room air-conditioning condenser per unit; and the component cooling heat exchanger(s) for the unit without loss-of-coolant accident.

4. Emergency operation, loss of station power: Loop A and Loop B act as mostly independent systems, but with minor cross connections through the charging pump coolers and instrument air compressor coolers. All four main service water pumps receive an autostart from loss of reserve station service voltage. The containment air recirculation coils lose chilled water system cooling due to loss of station power and service water may be manually realigned to the containment recirculation air cooling coils, creating additional cross connections between Loop A and Loop B. The CCHXs constitute the major system load, no automatic valve realignments occur. Loop A supplies service water to the Unit 1 CCHXs and Loop B supplies the Unit 2 CCHXs. Generally, only one CCHX (or its flow equivalent as throttled CCHXs) is in service on a loop per running service water pump on that loop. With one main service water pump running per loop, each loop is capable of supplying cooling flow for one

Revision 5209/29/2016 NAPS UFSAR 9.2-6 CCHX and the cooling loads for both units instrument air compressors, charging pumps, control room air conditioners, and containment recirculation air cooling coils (if a CDA were to occur, the service water flow through the accident units containment recirculation air cooling coils and CCHXs is automatically secured).

During other emergency conditions, the service water system is also designed to provide backup cooling water to the fuel pit coolers and the recirculation air cooling coils, and to provide a source of backup feedwater for the steam generators. The service water system is designed so that no single active failure during a DBA will prevent the system from performing all of its safety-related functions. The system is designed to tolerate passive failures during the long-term recovery period, but manual operation is required to realign the system.

The entire service water system, including the Service Water Reservoir, service water pump house, service water valve house, service water tie-in vault, and service water traveling water screens, is designed in accordance with Seismic Class I criteria.

The service water pump house provides tornado protection for the pumps and related equipment. The main intake structure provides tornado protection for the auxiliary service water pumps. The service water headers are buried for seismic and tornado protection. Essential service water lines off the headers are missile protected.

The service water valve house is a nuclear safety-related and Seismic Class I structure. The service water valve house provides tornado protection for the motor-operated valves, their electrical power equipment, the transition of the two 32-1/4-inch buried service water headers to the eight 18-inch spray array supply headers and two 24-inch bypass headers in the Service Water Reservoir and other related equipment. The two 32-1/4-inch service water headers that enter the valve house are buried outside the valve house for seismic and tornado protection.

The service water tie-in vault is a nuclear safety-related and Seismic Class I structure. The vault provides tornado protection for the four service water headers and access ports located in the tie-in vault.

The auxiliary service water pumps and the screen wash pumps are within an enclosed area, and are therefore protected from adverse environmental effects such as freezing or icing. The piping to and from these pumps and the discharge nozzles are redundantly heat traced. The motors are equipped with heaters.

Redundant service water supply and return headers are provided. All components or systems using service water are capable of operation from either supply header to either return header. Also, redundant spray systems are provided in the Service Water Reservoir.

9.2.1.2 System Description 9.2.1.2.1 Service Water Piping and Pumping Systems The service water system is shown in Figure 9.2-1 and Reference Drawings 1 through 7 and 16. Service water system piping layouts and supports are shown in Reference Drawings 8

Revision 5209/29/2016 NAPS UFSAR 9.2-7 through 15 and 17. One service water pump is normally used to supply water to one loop at a nominal rate of 11,500 gpm (Two pumps per loop may be required during hot weather). Each pump takes suction from its own screenwell in the service water pump house and discharges back to the Service Water Reservoir via the spray and bypass system. The pumps can be cross connected so that each pump can supply either of the two headers. Two auxiliary service water pumps are installed in the main intake structure at the North Anna Reservoir and are able to supply service water at a nominal rate of 11,500 gpm each. The auxiliary service water pumps provide an alternate supply of service water to the service water supply headers. An alternate return path is also provided to the circulating water discharge tunnel from the service water return headers.

Motor-operated valves are installed in the major supply and/or return lines and crossovers for systems or components that are not normally operating and/or that must be opened or closed in the event of an accident. These valves are operated automatically in the event of an accident condition but are also capable of remote manual operation. Power for these valves is supplied from the emergency bus. Valve operation is shown in Table 9.2-2.

The service water supply to the charging pump lube-oil and gearbox coolers is normally lined up from both supply headers. Therefore, the failure of a single supply will not result in a loss of cooling to the coolers. The size of the inlet and outlet lines to the coolers precludes a major loss of fluid from one header through the cooler to the other return header in the event of a header rupture. Check valves on the inlet lines prevent a loss of water from one header to the other supply header. These check valves are periodically tested in accordance with Inservice Inspection (ISI) program requirements.

The component cooling water system has sufficient volume such that loss of one service water supply header will result in a 3°F/min rise in component cooling water temperature for that plant. Since the valves are readily accessible, this will allow more than enough time to change the component cooling heat exchanger supply and return to the other service water header. The service water system normally has two pumps lined up to each header with one operating on each header. Station procedures exist that address the possible loss of the service water system and provide appropriate recovery actions. Because of the design of the service water system, the loss of a supply or discharge header is not considered likely.

Two service water loops are in service during power operation. Two 36-inch main supply and two return headers consisting of 36-inch and 32-1/4-inch pipe are used to distribute service water to both units. Reduced-size branches, which are double connected to the mains, form cross circuits that serve the systems and components being cooled by the service water system.

High-point vents, low-point drains, and expansion joints are provided as required by the piping configuration.

Each service water outlet line from a piece of equipment contains a valve for controlling flow. The valves are either manually operated globe valves, manually operated butterfly valves, manually operated ball valves, motor-operated butterfly valves, air-operated trip valves, or

Revision 5209/29/2016 NAPS UFSAR 9.2-8 air-operated control valves. Check valves for the service water system meet the criteria specified in NUREG-0578, Section 2.1.6.b, for increased cumulative radiation resistance.

Each piece of equipment is provided with valves for isolation purposes. Each charging pump service water supply line will have a check valve and manual valve for isolation.

Containment isolation valves are also provided as described in Section 6.2.4.

The service water spray system including the 18-inch and 20-inch headers is constructed of ASTM A106 carbon steel and consists of four pairs (eight total) of individually controlled spray arrays. Two 24-inch bypass headers are provided for low heat load winter operations. The carbon steel piping is protected from external corrosion by an organic coating system. Each pair of arrays is capable of handling 100% of the flow and heat load generated by one unit during normal operation. Normally, three spray arrays are required to remain operable on each loop to support DBA conditions. However, two operable arrays on each loop is sufficient, providing the associated spray array supply MOVs are secured in the open position. The spray system supply headers are constructed of 18-inch and 20-inch pipe that is reduced through various sizes to 3-inch spray risers with spray nozzles threaded to 2-inch spray arms. Each pair of spray arrays corresponds to operation of one service water pump and is designed for a nominal flow of 11,500 gpm (5750 gpm per array).

The spray system is supported on the Service Water Reservoir bottom and consists of reinforced concrete foundations and braced frame superstructures of galvanized ASTM A36 carbon steel. Individual galvanized steel pipe restraints are attached to the braced frame support structures.

A multi-chemical corrosion control program is used in the service water system for the protection of the piping and components. Chemicals are added from several different sites, and additions are to different locations in the SW system.

Backup service water is supplied from the North Anna Reservoir by one auxiliary service water pump per unit. They take suction from the main intake screenwells and discharge to the North Anna Reservoir via the discharge tunnel. Each auxiliary service water pump is connected to a 36-inch service water header. A discharge cross connect is also provided. The auxiliary pumps can be used as a normal source of supply to the service water system, if desired, in lieu of the service water pumps if both units are in cold shutdown or refueling. After any use of the auxiliary service water pumps, the untreated North Anna Reservoir water is flushed from the piping and replaced by treated Service Water Reservoir water by circulation through small piping installed to bypass valves MOV-SW-115B and MOV-SW-215A and cross tied with the system discharge piping. The pressure differential between the supply and discharge piping provides the motive force necessary to create this circulation. Manual valves are installed in each line to provide a means of halting circulation flow if required for any reason. This feature aids in the control of internal corrosion of the buried auxiliary service water supply piping. Main control room

Revision 5209/29/2016 NAPS UFSAR 9.2-9 instrumentation associated with the auxiliary service water pumps and the discharge to the discharge tunnel is provided as follows:

1. Pump pressure and flow indicators.

2. Pump low-flow alarm.

3. High-radiation alarm and indicator on discharge to the discharge tunnel.

Local and other remote instrumentation is provided on a general basis.

Descriptions of the service water screen wash system and the service water air system are given in Section 9.2.1.2.4.

The chemicals and equipment for treatment of the service water system are housed in the service water chemical addition building. The system and structure are non-safety-related, non-seismic. Dilution water is provided by service water supply header 36"-WS-1-151-Q3 in the service water pump house expansion joint enclosure. The piping from the tie-in to the service water supply header through the first manual isolation valve is safety related, seismic. The dilution water supply line is seismic to a buried concrete anchor outside the chemical addition building. The service water chemical addition system discharges into the service water supply headers in the service water pump house expansion joint enclosure. The piping from the tie-in to the service water supply headers through the second isolation valve (check valve) is safety related, seismic.

9.2.1.2.2 Service Water Reservoir Design The Service Water Reservoir was originally designed to provide service water for the operation of a potential four units with a total maximum calculated rating of 11,354 MWt. The storage capacity of the reservoir is approximately 22.5 million gallons at Elevation 313 ft. This capacity is reduced as organic decay products, atmospheric dust, and other particles accumulate in the bottom of the Service Water Reservoir. A sludge depth of up to four feet can be tolerated without impacting the thermal performance or 30-day cooling water inventory of the Service Water Reservoir. The sludge depth is monitored every 5 years. Following the first twenty years of operation, only one foot of sludge buildup occurred in the Service Water Reservoir. Since implementing a continuous blowdown in 2001, the sludge depth has remained below six inches.

The maximum rate of heat transfer with maximum safeguards available to the service water system occurs early during the first hour following a loss-of-coolant accident when approximately 875 x 106 BTU/hr will be transferred to the service water flowing at approximately 30,000 gpm for two units. The maximum safeguards heat transfer rate to the service water is reduced to approximately 205 x 106 BTU/hr by the end of the first hour.

The service water temperature will be maintained at no greater than 110°F by spray cooling during the 30-day period following a loss-of-coolant accident. The predicted maximum Service Water Reservoir temperature following a DBA is 99.8°F. The maximum water loss that can be

Revision 5209/29/2016 NAPS UFSAR 9.2-10 expected over a 30-day period after the occurrence of the aforementioned incident, considering no makeup to the Service Water Reservoir, would be as follows:

Evaporation (spray and surface), and:

Spray drift, Mgal 10.2 Seepage, Mgal 0.7 Total, Mgal 10.9 Two 100% spray systems are used for Units 1 and 2. The spray loading on the reservoir is less than 1.0 gpm/ft2 of sprayed surface area. The predicted low water level 30 days after a DBA, assuming no reservoir makeup, is at the 309' elevation.

Spray drift is conservatively evaluated based on the maximum 30-day water loss conditions.

The spray systems are located such that the spray pattern is a sufficient distance from the edge of the pond to minimize drift losses. Actual spray losses are estimated to be much less than 1% of spray rate.

The service water spray system consists of four pairs (eight total) of individually controlled spray arrays. Each pair of arrays is capable of handling 100% of the flow and heat load generated by one unit during normal operation. Normally, three spray arrays are required to remain operable on each loop to support DBA conditions. However, two operable arrays on each loop is sufficient, providing the associated spray array supply MOVs are secured in the open position. Additionally, either of the two main headers can handle 100% of the flow and heat load generated by both units during normal operation and DBA conditions. Therefore, even with the loss of a complete header, 100% capacity remains available.

Under the most limiting conditions, a single SW supply and return header will meet the SW system accident design basis requirements of a simultaneous loss-of-coolant accident (LOCA) for one unit and loss of offsite power for both units. Assuming the most limiting single failure, the minimum design basis requirements for the SW system reservoir spray array are met with either one or both SW headers in operation as long as a minimum of three spray arrays remain operable following the failure. Three out of four spray arrays are required with only one SW header (supply and return) in operation or three out of eight spray arrays with both SW return headers in operation.

The service water spray array MOVs open automatically on a Safety Injection (SI) signal.

Each spray array receives an SI signal from its associated train as well as a redundant signal from the opposite train. If a spray array is inoperable solely due to the inability of its associated MOV to automatically open, the array may be considered operable if the MOV is administratively maintained in the open position.

The system has a total area of spray coverage of nearly 100,000 square feet. The individual nozzle to nozzle spacing is 10 feet in the east-west direction with the individual risers on 7-foot centers in the north-south direction. The center line of each of the eight arrays is a minimum of 75 feet apart, providing increased fresh air flow between arrays which enhances cooling.

Revision 5209/29/2016 NAPS UFSAR 9.2-11 A winter bypass system is provided. This design provides complete bypassing of the spray arrays during the low flow, low heat load periods experienced in the winter months. Additionally, the winter bypass may be throttled or used in conjunction with the spray arrays to suit conditions present during unit operation.

During operation of the winter bypass system when no spraying is desired, all eight of the spray array header MOVs can be closed and all four of the bypass header MOVs (two in series per header) can be opened to allow flow through each winter bypass header. Upon receipt of a safety injection signal from either or both Units 1 and 2, the MOVs in the winter bypass headers receive a signal to close automatically, simultaneous to the spray array header MOVs receiving a signal to open automatically. The winter bypass header MOVs in series in each header provide redundancy which ensures isolation of the header in the event of a single failure of a winter bypass header MOV.

The Service Water Reservoir spray system has been designed and analyzed for operation of two units based on the occurrence of a loss-of-coolant accident on one unit with cooldown of the non-accident unit and simultaneous loss of offsite power to both units. The computer modeling and analysis techniques outlined in NUREG-0733 (Analysis of Ultimate-Heat-Sink Spray Ponds) were used to model the system under meteorological conditions leading to worst case heat transfer and water loss phenomena.

The NUREG-0733 methodology first develops spray performance models based on system geometry and heat and mass transfer phenomena of spray droplets in an environment influenced by the spray system. Drift loss fractions as a function of wind speed are also developed using spray drop ballistics. Results from these analyses form a basis for the spray performance model which is used to scan a long term (on the order of tens of years) weather record for a nearby meteorological station. In this case, data from Byrd Airport weather station in Richmond, Virginia was used. This scan identifies worst case periods for heat transfer (cooling and evaporation) and water loss which are used to estimate maximum pond temperature following the design basis accident. Correction factors are applied to correlate available on-site meteorological data with the weather station data. Estimates of recurrence intervals of the design basis meteorology are also developed.

The major loads reflected in the total auxiliary heat rate are listed below. It should be noted that several of these loads are not cooled directly by service water during normal operation (i.e.,

service water is a back-up supply to component cooling or chilled water systems for containment recirculation air coolers and spent-fuel pit coolers). However, these loads were considered in the Service Water Reservoir performance analysis for conservatism:

1. Charging pump lube-oil and gearbox coolers.

2. Instrument air compressors.

3. Control and relay room air conditioners.

Revision 5209/29/2016 NAPS UFSAR 9.2-12

4. Containment recirculation air coolers.

5. Spent-fuel pit coolers.

6. Component cooling water pumps.

7. Reactor coolant pumps.

8. Residual heat removal pumps.

As discussed in Section 3.8.4, the Service Water Reservoir was constructed by a combination of earth dike and cut. The reservoir has a surface area of about 9.0 acres. The bottom and side slopes are provided with 2-foot-thick compacted impervious earth liner. Dikes are of the zoned-rock-fill type having a compacted impervious core separated from the rock fill by graded filters of sand and gravel. The compacted impervious lining has a permeability of about 1 x 10-6 cm/sec.

The dikes are designed as Seismic Class I structures and a minimum freeboard of 3 feet. is maintained between the top of the compacted impervious core and the maximum water level in the Service Water Reservoir.

Makeup for the Service Water Reservoir from the North Anna Reservoir is supplied by two nominal 910-gpm circulating water screenwash pumps or by the auxiliary service water pumps.

The makeup pumps are located in the circulating water intake structure, discussed in Section 10.4.2. The water stored in the Service Water Reservoir can provide service water for extended periods should the normal makeup pumps be nonfunctional. Enough water is available to guarantee 30 days of operation without makeup.

To reduce undesirable concentrations of contaminants, periodic SW reservoir blowdown can be performed through a six inch line. This line allows blowdown of SW at a rate of approximately 900 gpm from the SW return header into the Unit 2 circulating water discharge tunnel. One circulating water screen wash pump normally operates during blowdown through the six inch line to provide makeup from Lake Anna. While blowdown occurs through this line, the SW reservoir level will be administratively controlled to be greater than or equal to El. 314 ft. to ensure sufficient time (e.g., greater than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) exists to manually isolate the blowdown flowpath in the event of a design basis accident without impacting the required 30-day supply of water.

There is insufficient head available to cause overfilling of the Service Water Reservoir while the auxiliary service water pumps are in operation, discharging to the discharge tunnel, and while the motor-operated valves in the discharge header to the spray arrays are open.

The discharge valves to the North Anna Reservoir have alarms to indicate that the valves are open. These valves also have indicating lights on the main control board to indicate open and closed positions. High- and low-level alarms and level indication are provided on the main control board for the Service Water Reservoir. Flow instrumentation is provided on both the discharge to the Service Water Reservoir and the discharge from the auxiliary service water pumps.

Revision 5209/29/2016 NAPS UFSAR 9.2-13 In order to either overfill the Service Water Reservoir or to drain it, an operator would have to make an erroneous lineup and then ignore for several hours alarms associated with the discharge valves to the North Anna Reservoir, the flow indication on the discharge headers, low-flow alarms, the level indications in the Service Water Reservoir, and the level alarm in the Service Water Reservoir. This is not considered credible.

9.2.1.2.3 North Anna Reservoir Design The North Anna Reservoir is impounded by an earth dam. The design and construction of this dam is discussed in Section 2.4. The auxiliary service water pumps are located in screenwells in the main intake structure of the North Anna Reservoir. The water to the pump suctions is strained by the traveling water screens for those screenwells. Tornado missile protection is provided for the two auxiliary service water pumps, two makeup pumps, and the discharge valving and piping. See Section 10.4.2 for further details of the intake structure.

9.2.1.2.4 Service Water Pump House Design The service water pump house is shown in Reference Drawings 24 and 25. The service water pump house is designed in accordance with Seismic Class I criteria and provides tornado protection for the equipment located within.

The primary purpose of the service water pump house is to provide the structure and equipment necessary to support the service water pumps both structurally and operationally. Each service water pump is located in its own screenwell at the proper depth to ensure the required suction head even if the Service Water Reservoir level were drawn down to Elevation 309 ft. Each screenwell is equipped with a trash rack and with a traveling water screen. Two service water screen wash pumps are also located in two of the four screenwells. Other equipment located within the service water pump house is as follows:

1. Screen wash system differential level control equipment, screen wash strainers, piping, and valves.

2. Two service water air compressors and one receiver tank.

3. One diesel-driven fire pump.

4. Service water pump discharge piping and valves.

5. Two sump pumps.

6. Necessary ventilation, accesses, etc.

The service water air system consists of two 14.7 cfm air compressors, one 126-gallon receiver tank, and associated piping, valves, and instrumentation. The compressors operate in parallel to supply 100-psig air via an after cooler and an air dryer to the receiver tank where it is stored for use by the traveling water screen differential level control system and the Service Water Reservoir level indicating and alarm system. One compressor starts when the receiver pressure

Revision 5209/29/2016 NAPS UFSAR 9.2-14 drops to 75 psig and the other starts when the receiver pressure drops to 65 psig. Each air compressor (1A and 1B) is supplied 480V power from an emergency bus MCC (1H1-3 and 1J1-3, respectively). The after cooler and air dryer are supplied power from a 480V/120V transformer that receives power from a manual transfer switch (break-before-make), which has input power from the power feeds of each compressor.

The traveling water screen differential level control system monitors the level on either side of the traveling water screen by detecting a change in air pressure maintained on a bubbler located on each side of the screen. When the air pressure differential across the screen rises to a preset point, indicating a partially clogged screen, the traveling water screen and the screen wash system can be automatically set in motion by a signal from the differential level control system when the screen wash system is operated in automatic. The traveling water screens are immediately preceded in the screenwell by trash racks with 4-inch openings. As the screens and screen wash systems start, an alarm is also sounded. When the screens have been cleaned, the system shuts down automatically.

Each screen wash system consists of one nominal 500-gpm pump, motorized strainer, and associated piping, valves, and instrumentation for each unit. The two systems are cross connected.

A signal from the differential level control system starts the screen wash pump and sets the motorized strainer into operation. The strainer is designed to provide continuous strainer backwash flow whenever the screenwash system is operating. The system is equipped with the necessary isolation and drain valves. The isolation valves are normally left open so that the system will operate immediately when the pump is actuated. The screen wash pumps and traveling water screens are powered from the emergency bus.

9.2.1.2.4.1 Service Water Valve House Design. The service water valve house is shown in Reference Drawings 26 and 27. The service water valve house is designed in accordance with Seismic Class I criteria and provides tornado protection for the equipment located within.

The primary purpose of the service water valve house is to provide the structure and equipment necessary to support the service water spray and bypass system both structurally and operationally. Reference Drawings 26 and 27 show the buried piping entering the valve house through the north wall and branching to eight 18-inch spray headers and two 24-inch bypass headers, all of which exit the valve house through the south wall to serve the spray and bypass piping in the Service Water Reservoir. Equipment located within the service water valve house is as follows:

1. Piping, valves, and expansion joints for the Service Water Reservoir spray and bypass system including instrumentation for measuring flow, pressure and temperature at various locations.

2. Radiation-monitoring equipment for discharge to the service water spray and bypass system.

3. Heating and ventilating equipment.

4. Electrical motor control centers, distribution panels, etc.

Revision 5209/29/2016 NAPS UFSAR 9.2-15

5. Four sump pumps and associated piping.

6. Various platforms, ladders, grating, etc.

9.2.1.2.4.2 Service Water Tie-In Vault Design. The service water tie-in vault is shown in Reference Drawing 28. The service water tie-in vault is designed in accordance with Seismic Class I criteria and provides tornado protection for the equipment located within.

The primary purpose of the service water tie-in vault is to house the pipe access hatches, v-cone flow measurement devices, and the associated cathodic protection equipment. Blind flange access covers are provided in both return headers and both supply headers (on access tees) in order to provide personnel access into the 36-inch and 32-inch pipe for inspection activities.

Platforms for gaining access to the pipe access hatches are provided. A 36-inch-diameter, 3-inch-thick steel manhole is located in the vault roof for personnel access into the tie-in vault. A 9-foot by 20-foot (approx.) four-piece removable equipment hatch is provided for construction and permanent access for equipment installation and removal.

A floor sump is located on the south side of the pit. A sump pump and discharge line are installed to allow drainage of the tie-in vault. The sump pump discharge piping is embedded in the tie-in vault wall and discharges to grade outside the vault.

Connections between the chemical addition subsystem and the supply headers are also located in the tie-in vault.

9.2.1.2.5 Emergency Operation of Service Water During normal operation, one or two service water pumps operate on each loop (Two pumps per loop may be required during hot weather). The auxiliary service water pumps located at the North Anna Reservoir can be used to supply backup water. During loss of offsite power accident conditions, four service water pumps can be powered by the emergency diesel generators. Service water pumps can be started manually or are started automatically with the occurrence of either of the following:

1. Loss of reserve station power.

2. Safety injection actuation signal from affected train on either unit, or opposite train of the same unit.

After the occurrence of a safety injection system actuation signal (SIS), any of the service water pumps may be stopped by manual switching if the SIS is reset, or the pumps can be stopped automatically by motor electrical fault (see Section 7.3).

If a service water pump needs to be taken out of service for maintenance, one of the remaining service water pumps would normally be used and throttling requirements would be imposed on the service water system as described in Section 9.2.1.1.

The component cooling water heat exchanger motor-operated service water isolation valves for the accident unit shut on receipt of a containment depressurization actuation signal and the

Revision 5209/29/2016 NAPS UFSAR 9.2-16 recirculation spray cooler header isolation valves for the accident unit open on receipt of a containment depressurization actuation signal. The individual isolation valves for each RSHX on the accident unit also open on receipt of a containment depressurization actuation signal.

The Unit 1 and Unit 2 H bus is the power source for their respective auxiliary service water pumps. These pumps can be started manually, but can be stopped manually or stopped automatically with the occurrence of a motor electrical fault or undervoltage on the pumps respective H bus. The auxiliary service water pumps will restart automatically when voltage is returned to the respective H bus if they were running prior to an undervoltage condition.

Operation of the auxiliary service water pumps locks out the corresponding main service water pump powered from the same emergency bus. Operators must assess the impact on Technical Specification Limiting Conditions for Operation (LCO) requirements with respect to the main pumps before starting an auxiliary pump.

9.2.1.3 Design Evaluation The service water system uses machinery and equipment of conventional and proven design. All components are specified to provide maximum safety and reliability.

The entire service water system, with the exception of the service water air compressor, including equipment, piping, valves, structures, and reservoir, is designed in accordance with Seismic Class I criteria. All equipment, piping, and valves are tornado missile-protected, with the exception of the spray piping.

Representative total service water equipment flow rates for the various modes of operation of two reactor units are shown in Table 9.2-1. Actual values depend on service water temperature, system flow balancing, and system throttling.

North Anna Units 1 and 2 service water requirements for the loss-of-coolant and loss of offsite power accidents are approximately 30,000 gpm for the first hour. The submergence for the pump during the first hour and at all other times is adequate to ensure that the system required flow is provided. Six pumps (four main service water pumps and two auxiliary service water pumps) are provided for both units. Four pumps can be powered by the diesel generators during an accident with a simultaneous loss of station power. Two pumps are required during an accident resulting in containment depressurization to support the RSHXs on the accident unit and the CCHXs for the non-accident unit.

The maximum net positive suction head (NPSH) required by the service water pump manufacturer is 34.5 feet and occurs at a run-out flow rate of 16,585 gpm. This is less than the minimum available NPSH of 36.9 feet for all modes of pump operation. Using the following conservative assumptions, it can be shown that the available NPSH exceeds that required by the pump manufacturer.

1. Submergence - 6.8 ft

Revision 5209/29/2016 NAPS UFSAR 9.2-17

2. Maximum temperature service water pump suction - 100°F (not including instrument uncertainty)

3. Atmospheric pressure - 33.66 ft

4. Suction losses assuming 35% clean screens - 1.4 ft NPSH = h + Pa - Pv - h1 where:

h = static head of water (6.8 ft)

Pa = atmospheric pressure (33.7 ft)

Pv = vapor pressure (2.2 ft) h1 = suction loss (1.4 ft)

NPSH = 6.8 + 33.7 - 2.2 - 1.4 = 36.9 Net positive suction head available is 36.9 ft One of the two supply headers is required during a loss-of-coolant accident.

All components or systems using service water are capable of operation from either supply header and to either discharge header.

No single failure of a component using service water during the design basis accident, or in a vital system cooled by service water, will render the system inoperative, nor defeat the capability to meet minimum safeguards requirements.

Four pairs of above water spray arrays (each pair with a nominal capacity of 11,500 gpm) are provided within the Service Water Reservoir. The spray arrays are designed such that even with the loss of a complete return header (i.e., four spray arrays) sufficient spray capacity remains to cool both the loss-of-coolant accident unit and the non-accident unit concurrent with the loss of offsite power event. The spray piping supports are designed to withstand the design-basis earthquake loadings. Loss of the spray arrays will not jeopardize the supply of service water, but will affect the heat removal capability of the system. Even with the loss of a spray array, the service water system will still meet minimum safeguards requirements during long term recovery from a design basis accident.

The service water system is designed to operate so as not to exceed the exposure limits of 10 CFR 20 at the site boundary during normal operation. Radiation monitors are provided on the service water discharge of systems that are potentially radioactive on the process side and on the discharge to the Service Water Reservoir and the discharge tunnel.

Revision 5209/29/2016 NAPS UFSAR 9.2-18 All electrical power for operation of the service water system during a loss-of-coolant and/or a loss-of-station-power accident is supplied from the emergency buses as listed below:

Pump Emergency Bus 1-SW-P-1A 1H 1-SW-P-1B 1J 2-SW-P-1A 2H 2-SW-P-1B 2J 1-SW-P-4 (auxiliary) 1H 2-SW-P-4 (auxiliary) 2H The auxiliary service water pump 1-SW-P-4 is interlocked with pump 1-SW-P-1A to prevent running both a main service water pump and an auxiliary service water pump on the same bus at one time. Pumps 2-SW-P-4 and 2-SW-P-1A are similarly interlocked on Unit 2.

A loss of service water flow is detected by means of flow alarms on the service water headers or on the auxiliary service water pumps discharges.

Service water to the component cooling water heat exchanger of a non-accident unit is considered economically necessary during a design basis accident for the other unit. The motor-operated valves in the supply lines to these coolers can be opened from the main control room if pumping capacity and emergency power is available. The motor-operated valves in the supply line to the component cooling water heat exchanger for the accident unit close on containment depressurization.

The service water system operates automatically on a loss-of-coolant or loss of offsite power accident. The valves will operate as indicated in Table 9.2-2.

9.2.1.3.1 System Reliability Pairs of motor-operated valves in series control the service water supply to the component cooling water heat exchangers, the supply from the auxiliary service water pumps, and the discharge to the discharge tunnel, thereby providing positive assurance that service water flow will be controlled when required by the various accident conditions in the event of one malfunctioning valve.

A pair of normally closed motor-operated valves in parallel control both the service water supply to, and the return from, the recirculation spray heat exchangers, thus providing positive assurance that cooling water can reach the heat exchangers in the event of a malfunctioning valve.

In addition, the motor-operated isolation valves to the individual supply and return service water lines for the recirculation spray heat exchangers are closed. Since the cross-connect motor-operated valves for the service water supply and return headers to the recirculation spray heat exchangers are controlled open, any decrease in system reliability due to the isolation

Revision 5209/29/2016 NAPS UFSAR 9.2-19 motor-operated valves being closed is offset by the cross-connect motor-operated valves being open.

A single motor-operated valve from each service water header and a common air-operated valve to the containment recirculation air cooling coils are provided. Electrical power to the solenoid valves in the air line to the valve operator is supplied from vital power for reliable operation even during a loss of offsite power condition. The isolation of this service is provided by these two series valves. Isolation valves are also provided in the chilled water system for the lines to the individual recirculation air cooling coils. On a loss of instrument air and a single failure of an emergency bus, the common air-operated valve will fail as-is. However, service water flow to the cooling coils will be isolated by the closure of the chilled water trip valves on a loss of instrument air.

Sufficient pumping capacity is available via power from the emergency bus to control any accident that may occur. Sufficient service water is available in the Service Water Reservoir to guarantee a minimum of 30 days operation without makeup. Backup is available from the North Anna Reservoir if the auxiliary service water pumps are functional.

A failure mode and effects analysis is presented in Table 9.2-3. The consideration of a failure of major valves and components in the service water system has been taken into account in Table 9.2-3. Major valves and components that must operate for safe shutdown and cooldown have been addressed.

Two recirculation spray heat exchangers are required for containment depressurization.

Four recirculation heat exchangers are initially placed in service for a loss-of-coolant accident.

This is to account for possible single failure of a pump, header, heat exchanger, or emergency bus.

The service water spray system consists of eight spray arrays (four pairs) interconnected to four pumps. Three of the spray arrays can dissipate the heat output following a loss-of-coolant accident in one unit and a shutdown in the other unit. Due to the seismic design of the spray system and redundancy, a loss of the entire spray system capability is not considered credible. The winter bypass system contains redundant isolation valves in series in each header. Therefore, a single failure of a motor-operated valve cannot prevent isolation of the winter bypass system and subsequent return to the spray arrays following the safety injection signal.

9.2.1.3.2 Compliance with General Design Criterion 5 Service water is normally supplied from the Service Water Reservoir by any two of the four service water pumps located at the Service Water Reservoir. Any service water pump may be aligned to either supply header. Service water may be alternately supplied by the auxiliary service water pumps from the North Anna Reservoir. Flow paths are provided by separate redundant supply and return headers. Pumps powered from the 1H and 2J emergency buses are normally aligned to Loop A, while pumps powered from the 1J and 2H emergency buses are normally aligned to Loop B.

Revision 5209/29/2016 NAPS UFSAR 9.2-20 Two of the recirculation spray heat exchangers in each unit are supplied from one header, the remaining two from the other header. Cross-tie valves between the two loops are normally open. Since the recirculation spray heat exchangers are 100% redundant, failure of one supply header would not be detrimental. There are two valves in the cross-tie between the two loops.

Each valve is provided with a motor operator. Each motor is powered from separate emergency buses, thereby providing redundant isolation in the unlikely event of a header failure. The remaining components may be supplied from either header with isolation valves for each component.

Eight spray arrays are located in the Service Water Reservoir, two pairs connected to each return header. Normally, three spray arrays are required to remain operable on each loop to support DBA conditions. However, two operable arrays on each loop is sufficient, providing the associated spray array supply MOVs are secured in the open position. This provides redundancy for protection against the loss of a spray array or a return header. The winter bypass system contains redundant isolation valves in series in each header. Therefore, a single failure of a motor-operated valve cannot prevent isolation of the winter bypass system and subsequent return to the spray arrays following the safety injection signal.

Due to the redundancy of water sources, service water pumps, supply, return and spray headers, and recirculation spray heat exchangers, sharing of service water components between units does not impair the ability of the service water system to perform its safety functions. The design of the service water system meets the intent of General Design Criteria 5.

9.2.1.4 Components Service water system component design data are presented in Table 9.2-4.

9.2.1.4.1 Piping and Valves Carbon steel pipe is used throughout the system with the exception of: portions that have been replaced with high-corrosion resistant alloy steel, AL-6XN; portions of the charging pump cooler piping, the RSHX and CCHX radiation monitoring piping, and the instrument air compressors piping, which are stainless steel; and the service water chemical addition piping which is polyvinyl chloride, stainless steel, and Hastelloy C276. Also 4-inch diameter lines from 24-inch diameter headers to isolation valves of the Unit 1 and Unit 2 control room chillers are stainless steel. The joints in steel piping are welded except where flanges are used at connections to equipment butterfly valves, check valves, and expansion joints. The majority of the valves are of steel material with the exception of the valves in the service water chemical addition system building. Expansion joints are provided as required. The steel piping conforms to the requirements of the Code for Nuclear Power Piping, ANSI B31.7-1969, with the 1970 Addendum.

Rattle spaces are provided as necessary at locations where pipe runs pass through building or valve pit walls to backfilled or encased sections. Carbon steel pipe with a protective external organic coating is used for the spray and bypass system in the Service Water Reservoir.

Revision 5209/29/2016 NAPS UFSAR 9.2-21 The spray array piping is supported by galvanized ASTM A36 structural members erected as braced frames on concrete footings founded at the top of the Service Water Reservoir clay liner.

The support structures are Seismic Class I structures and are designed in accordance with the load combinations and stress limits set forth in Section 3.8.4 of the Standard Review Plan, NUREG-0800.

All steel service water pipe that is underground is either coated or coated and wrapped in accordance with the Recommended Practice Control of External Corrosion on Underground or Submerged Metallic Piping Systems, Standard RP-01-69. In addition, insulating flanges and a dedicated impressed current cathodic protection system is in place to protect each section of buried service water piping. See UFSAR Section 3.11.3 for more information. The interior of the buried and encased 36-inch pipe, and the 24-inch pipe from the auxiliary supply pumps to the first isolation butterfly valves, have a corrosion-preventing coating. The interior of the 24-inch piping to the Unit 1 RSHXs (up to MOVs in the Quench Spray Pump House (QSPH)), the Unit 2 RSHXs (up to the MOVs in the QSPH), the Auxiliary SW supply and the return lines and Unit 1 and 2 CCHXs lines (up to MOVs in the Auxiliary Building) were not coated during initial plant construction. A 100% solids, multifunctional epoxy coating has been applied to these sections of piping as part of the Service Water Preservation Project.

Biocides and corrosion inhibitors are used in the Service Water Reservoir to minimize corrosion and biological fouling. These treatments are normally added with the chemical addition subsystem.

9.2.1.5 Tests and Inspections The service water system piping, valves, and components can be readily inspected at periodic intervals except for that portion of the main header piping that is buried under 10 feet of backfill or is encased in concrete for missile protection.

The service water system is tested periodically as required by the Technical Specifications and the Inservice Testing Program. The service water flow balance is verified periodically and adjusted as required to compensate for pump wear.

As part of the Service Water piping preservation project implemented in 1985 and 1986, corrosion rate test specimens (coupons) have been installed in diverse locations of the service water system piping. The coupons are inserted into the service water flow path and are removed periodically to empirically determine the actual corrosion being experienced by the service water piping and valves.

9.2.1.6 Instrumentation Application The service water system is monitored from the main control room by indicators and alarms as follows:

1. Pump discharge pressure and temperature indicators.

Revision 5209/29/2016 NAPS UFSAR 9.2-22

2. Temperature indicators on the discharge from the recirculation spray heat exchangers and the discharge to the service water spray system.

3. Low-flow alarms on the recirculation spray heat exchanger radiation monitoring pump discharge, the charging pump (gearbox water lines), and the discharge to the service water spray system.

4. Temperature alarms on the charging pump lubricating-oil cooler outlet lines.

5. Flow indicators on the recirculation spray heat exchanger outlet.

6. Service Water Reservoir high- and low-level alarms and indicators.

7. High-radiation alarm and indication from the radiation monitors located in the discharge to the service water spray system, from the recirculation spray heat exchangers, and from the component cooling heat exchangers.

8. Position indication for all motor-operated valves.

9. Service water air compressor low discharge pressure alarm.

10. Flow indication for discharge lines from charging pump lube oil cooler and gearbox and temperature indication from the discharge of the recirculation air cooling coils are available on CRT.

The flow instrumentation on the pump discharges and service water headers are accurate for major changes such as those caused by a loss of a pump or erroneous valve lineup. The associated alarms are to detect a complete or major loss of service water flow. There are no automatic devices to mitigate a rupture or leakage of the service water system. Operator action to switch headers or pump source would provide adequate response. Leakage in any of the buildings in which a service water pipe is located will cause sump-level alarms.

Local and remote instrumentation is also provided for other equipment on a general basis.

Local flow indication for the two main supply headers is located in the service water pump house.

9.2.2 Component Cooling System 9.2.2.1 General Description The component cooling system consists of the component cooling water, chilled water, and neutron shield tank cooling water subsystems. These subsystems are used individually or in combination with each other to provide cooling water for the removal of heat from components in the station. The component cooling system, including subsystems, is shown in Reference Drawings 18 through 22.

Revision 5209/29/2016 NAPS UFSAR 9.2-23 9.2.2.1.1 Component Cooling Water Subsystem The component cooling water subsystem, which serves two reactor units, is shown in Figure 9.2-2 and is designed to:

1. Provide cooling water for the removal of residual and sensible heat from the reactor coolant systems during unit cold shutdown and cooldown.

2. Cool the spent-fuel pit water.

3. Cool the reactor coolant pump motors.

4. Cool the letdown flow in the Chemical and Volume Control Systems.

5. Cool the reactor coolant pump sealwater return flow.

6. Supply cooling water for the neutron shield tank coolers.

7. Provide makeup water for the neutron shield tank cooling subsystem.

8. Cool the control rod drive mechanism cooling system.

9. Provide cooling to dissipate heat from other reactor and station components.

10. Provide cooling to primary sample coolers for steam generator blowdown samples.

9.2.2.1.2 Chilled Water Subsystem A chilled water subsystem is provided for each reactor unit and is designed to provide low-temperature cooling water to the containment recirculation air cooling coils, gas stripper vent chillers, some of the sampling coolers (some of the sample coolers have been abandoned in place), and refueling-water storage tank coolers (after a refueling operation). The chilled water subsystem can also be aligned to the Unit 1 isolated phase bus duct air cooler as an alternate cooling supply. The chilled water system is shown in Figures 9.2-3 and 9.2-4.

The chilled water system is used only to initially bring the refueling water storage tank down to operating temperature. Redundant mechanical refrigeration units are then used to maintain the tank temperature during plant operation. The RWST coolers are not used during normal operation; therefore, loss of the chilled water will not affect refueling water storage tank temperature during plant operation.

The chilled water subsystem does not supply water to equipment that is required to operate to maintain the plant in a safe condition. There are no provisions to use chilled water for reactor cooling pump or motor-bearing cooling.

9.2.2.1.3 Neutron Shield Tank Cooling Water Subsystem The neutron shield tank cooling water subsystem is designed to circulate and cool the water in the neutron shield tank and is shown in Figure 9.2-5.

Revision 5209/29/2016 NAPS UFSAR 9.2-24 9.2.2.2 Design Basis 9.2.2.2.1 Component Cooling Water Subsystem The component cooling water subsystem is an intermediate cooling system and transfers heat from heat exchangers containing reactor coolant or other radioactive liquids to the service water system (Section 9.2.1). The Component Cooling Water Subsystem (CCWS) itself consists of four subsystems shared between units, with each subsystem containing one pump and one heat exchanger. The maximum heat load occurs during the initial stages of residual heat removal during a reactor unit cooldown. The design basis of the component cooling water subsystem is a fast cooldown of one unit while maintaining normal loads on the other unit. Three component cooling water subsystems are required to accomplish this function. The fourth subsystem is a spare and may be out of service indefinitely. With only two component cooling water subsystems available, a slow cooldown on one unit while maintaining normal loads on the opposite unit can be accomplished. The component cooling water subsystem is designed to reduce the temperature of the reactor coolant from 350°F to 140°F within 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months based on a service water temperature of 95°F and on having two component cooling water subsystems in service for the unit being cooled down. Therefore, to ensure cooldown of one unit within 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months and maintain the other unit in normal full power operation three of the four subsystems are required. Because subsystems are placed in standby by shutting down pumps and isolating heat exchangers and this system serves no accident mitigation functions, the subsystem is considered operable in standby conditions since it can be easily placed in service quickly by manual operator actions. The CCWS is not a system which functions to mitigate the failure of or presents a challenge to the integrity of a fission product barrier. Complete redundancy to meet single failure criteria is not a design basis feature of this system. The CCWS supports operation of the RHR system. The RHR system does not perform a design basis accident mitigation function.

During normal full-power operation, the CCWS is cross-connected between the two units with two component cooling pumps and four component cooling heat exchangers in service.

CCWS common loads are also cross-connected normally.

However, one component cooling pump and one component cooling heat exchanger can accommodate the heat removal loads for each reactor unit. Operation of two pumps and two heat exchangers for the unit being cooled down is the standard procedure during the removal of residual and sensible heat during unit cooldown. One pump and one exchanger per unit may be safely used under these conditions, although cooldown will extend longer than 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months . During periods when both units are in cold shutdown or refueling, two component cooling water subsystems are required to ensure an adequate heat sink is maintained for the residual heat removal system.

Each of the four component cooling heat exchangers is designed to remove the entire heat load from one unit plus half of the heat load common to both units during normal operation. Each

Revision 5209/29/2016 NAPS UFSAR 9.2-25 heat exchanger is also capable of removing half of the heat load occurring 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after a shutdown of one unit under conditions representing the maximum allowable cooldown rate.

The presence of radioactivity in the component cooling water subsystem is detected by a radiation monitor. A high-radiation signal from this detector is indicated and alarmed locally and in the main control room, and the radiation level is recorded in the main control room. The detector monitors the component sample line from all four component cooling heat exchangers.

The detector is located in the auxiliary building. Operation of the detector is described in Section 11.4.2.7.

Component cooling water subsystem component design data are given in Table 9.2-5.

9.2.2.2.2 Chilled Water Subsystem The chilled water subsystem includes one 750-ton (at 60°F chilled water) steam vacuum refrigeration chiller for each unit and a 1000-ton (at 42°F chilled water) mechanical chiller that provides additional capacity for either or both units.

The chillers and associated circulating pumps normally provide water to the containment recirculation air cooling coils, gas stripper vent chillers, and some of the sampling coolers (some of the sample coolers have been abandoned in place). Chilled water can also be used as an alternate cooling water supply to the Unit 1 isolated phase bus duct air cooler (see Section 9.2.2.3.2).

Chilled water is also used to cool the 450,000 gallons of water in the refueling water storage tank from approximately 115°F to 45°F in 106 hours0.00123 days 0.0294 hours 1.752645e-4 weeks 4.0333e-5 months after a refueling operation, if necessary.

A steam vacuum refrigeration unit, consisting of an air ejector condenser, a flash tank, a surface condenser, three booster ejectors, and two chilled water circulating pumps, is provided for the chilled water subsystem of each reactor unit.

Each steam vacuum refrigeration unit has three booster ejectors (one 375-ton, one 125-ton, and one 250-ton) capable of independent or concurrent operation. The air ejector condenser is provided with two 100%-capacity, two-stage, air ejectors. Two 50%-capacity chilled water circulating pumps are also provided. The boosters exhaust to a surface condenser that is equipped with two 100%-capacity condensate pumps. The cooling water to the surface condenser is provided from the corresponding units bearing cooling water system. Steam for the operation of the boosters and ejectors is provided from the corresponding units auxiliary steam system.

The mechanical chilled water unit, consisting of an evaporator, a condenser, and a compressor, is capable of providing chilled water to either reactor units chilled water subsystem independently, or to both units in parallel.

The parallel combination of the mechanical chilled water unit and the two steam vacuum refrigeration units is capable of providing up to 1600 tons of refrigeration (800 per unit) at 47°F chilled water temperature.

Revision 5209/29/2016 NAPS UFSAR 9.2-26 The mechanical chilled water unit has R-134a refrigerant to cool the chilled water to 42°F at a flow rate of 2400 gpm. The chilled water is circulated by two of three 50%-capacity chilled water circulating pumps. A chilled water surge tank is provided to permit independent operation of the mechanical chilled water unit. The mechanical chilled water unit condenser is cooled by the Unit 2 bearing cooling water system (see Section 10.4.7).

Chilled water subsystem component design data are given in Table 9.2-6.

9.2.2.2.3 Neutron Shield Tank Cooling Water Subsystem The neutron shield tank cooling water subsystem is designed to remove heat from the neutron shield tank. Two neutron shield tank coolers, a neutron shield surge tank, two neutron shield tank cooling pumps, and all necessary piping and valves comprise the subsystem serving a reactor unit. Each neutron shield tank cooler is a 100%-capacity cooler and each neutron shield tank pump is a 100%-capacity pump. The second cooler and the second pump are spares that can be placed in operation by means of remote manual switches. If both pumps are nonfunctional for some reason, the system will function by natural circulation using both coolers. Component cooling water to the neutron shield tank coolers is controlled by means of a trip valve on the inlet and the outlet. Makeup water to the neutron shield tank coolers from the component cooling water system is controlled by means of a solenoid pilot air-operated valve.

Neutron shield tank cooling water subsystem component design data are given in Table 9.2-7.

9.2.2.2.4 System Failures The component cooling water subsystem is designed as Seismic Class I (Section 3.7),

except certain isolable branches serving systems that are not Seismic Class I.

Pipes that do not have Q2 or Q3 designations or are not otherwise denoted as seismic, are non-seismic. The equipment common to Units 1 and 2 shown in Reference Drawing 20 is non-seismic.

The failure of any of the equipment common to Units 1 and 2 could result in losing water from the system. However, all of the piping connecting to common equipment is seismically designed and all equipment is provided with inlet and outlet isolation valves. In addition, all headers are provided with isolation valves. If it were necessary to isolate the common equipment, an alternate supply of cooling water is available to the fuel pit coolers from the service water system.

The chilled water system provides cooling water to the containment recirculation air cooling coils. A failure of the chilled water system will result in a loss of cooling water to these coolers. In this event, service water provides an alternate source of cooling water. The remotely operated trip valves provide isolation of chilled water. Motor-operated valves and trip valves can be manipulated to provide the alternate supply from the service water system.

Revision 5209/29/2016 NAPS UFSAR 9.2-27 If necessary, makeup can be provided to the component cooling system from the service water system by throttling the component cooling water supply valve to the fuel pit coolers and opening the service water supply valve to the fuel pit coolers, thus providing service water to the component cooling pump suctions through the fuel pit coolers. The service water system and all piping and components on the headers to and from the fuel pit coolers are Seismic Class I.

9.2.2.3 System Description 9.2.2.3.1 Component Cooling Water Subsystem During operation, component cooling water is pumped through the shell side of the component cooling water heat exchangers, where it is cooled by service water, and then through parallel circuits to cool the following components:

1. Reactor coolant pump thermal barriers, bearing oil coolers, and motor-stator outlet air.

2. Excess-letdown heat exchangers (intermittent heat load).

3. Nonregenerative heat exchangers.

4. Various primary sample coolers (intermittent heat load).

5. Seal-water heat exchangers.

6. Residual heat removal pump seal coolers (during second phase of unit cooldown).

7. Residual heat removal heat exchangers (during second phase of unit cooldown).

8. Boron recovery system equipment (intermittent heat load).

9. Fuel pit coolers.

10. Control rod drive mechanism air coolers.

11. Liquid waste disposal system equipment (intermittent heat load).

12. Gaseous waste disposal system equipment.

13. Neutron shield tank coolers.

14. Steam generator blowdown sample coolers. 1

15. Steam generator blowdown tank vent condenser.

16. Primary drain transfer tank cooler.

17. Containment vacuum pump seal water heat exchangers.

The component cooling water subsystem is designed as a closed system, with a surge tank at the pump suctions. The tank is the high point of the system, with the exception of the

1. Some of the secondary-side sample system coolers have been abandoned in place. The abandoned portions of the system have been functionally replaced by the Steam Generator On-Line Chemistry Monitoring System.

Revision 5209/29/2016 NAPS UFSAR 9.2-28 blowdown tank vent condenser, and provides the required net positive suction head for proper operation of the pumps. The component cooling water heat exchangers, pumps, and surge tank are located in the auxiliary building.

Most equipment cooled by the system is installed in either the reactor containments or the auxiliary building. Two 24-inch main supply and return headers are used to distribute cooling water to both units. Two 18-inch supply and return headers distribute cooling water to each units residual heat removal heat exchangers that are located in the reactor containments. Reduced-size branches connected to the mains form cross circuits that serve the remainder of the apparatus being cooled. Equipment that is common to both reactor units is supplied from headers that can be cross connected between the main supply and return headers for both units. High-point vents and low-point drains are provided as required by the piping configuration.

Each cooling water outlet line from a piece of equipment contains a valve for controlling flow; the valve is either a manually operated globe, a butterfly, or an automatic air-operated valve positioned by pressure or temperature control signals originating in the cooled systems.

Check valves for the component cooling water system meet the criteria specified in NUREG-0578, Section 2.1.6.b, for increased cumulative radiation resistance capability.

The system is provided with valves for isolating the containment structures in accordance with the requirements of the containment isolation system (Section 6.2.4).

Thermal relief valves are installed around equipment with a significant potential for overpressurization by a combination of closed component cooling water inlet and outlet valves and heat input from the isolated equipment. The boron stripper, boron evaporator, containment vacuum pump heat exchanger, waste gas compressor, reactor coolant pump upper stator cooler, and containment penetration coolers are examples of equipment not requiring thermal relief protection, since their overpressurization potential is insignificant.

The component cooling surge tank will accommodate expansion and contraction of the component cooling water subsystem. It will also ensure a supply of water until a leaking component cooling water system line can be isolated. The surge tank is generally about half full and will normally be vented to the process vent system. There is sufficient volume available in the surge tank to ensure no credible temperature increase could overflow the tank. The makeup line is supplied by both main condensate-systems. The level in the surge tank is manually maintained via a bypass valve to prevent water hammer. When a low level alarm is received in the Control Room, this bypass valve is opened to allow condensate to enter the tank. An isolated automatic makeup valve is provided with a hand jack for local manual positioning of the valve in emergencies.

Chemical addition is accomplished through a funnel and valve at the top of the surge tank.

The desired water chemistry is obtained by the addition of potassium chromate for corrosion inhibition and potassium hydroxide or potassium dichromate for pH control. The design objective of the chemical treatment is to minimize system corrosion by maintaining 150-500 ppm of chromate at 8-11 pH. Control within these parameters may be adjusted according to industry good

Revision 5209/29/2016 NAPS UFSAR 9.2-29 practice. A maximum specification of 500 ppm is in place to minimize the potential for damage to carbon based mechanical seals. The 500 ppm maximum chromate limit is not applicable to subsystems that either do not contain carbon-based seals or typically operate without pumps in service. Sampling is performed at the central station in the auxiliary building. Several local sample points are also provided.

9.2.2.3.2 Chilled Water Subsystem A chilled water subsystem is provided to supply chilled water to the containment recirculation air cooling coils, the gas stripper vent chiller, some of the sampling coolers (some of the sample coolers have been abandoned in place), and refueling water storage tank coolers. The chilled water subsystem is also available to provide cooling water to the Unit 1 isolated phase bus duct air cooler. The chilled water system consists of a mechanical chiller water unit (common to both units) and two steam vacuum refrigeration units (one for each unit). The mechanical chilled water unit water is circulated through the system by two of the three 50% capacity mechanical chilled water circulating pumps. The chilled water is cooled in the units evaporator section by R-134a refrigerant. Refrigerant is condensed by water from the bearing cooling water system.

Chilled water is also normally produced in the steam vacuum refrigeration unit, which is a flash tank with three boosters (ejectors). Auxiliary steam at 110 psig is used to operate the boosters.

The boosters are rated at 125 tons, 250 tons, and 375 tons, respectively. The chilled water return temperature is indicative of the units heat load, and from this the operator will determine the number of boosters required. The booster produces a vacuum in the flash tank that causes a portion of the water inside to flash and lower the temperature of the remaining water. The boosters discharge to the chilled water condenser where the steam is condensed. The chilled water in the flash tank is circulated through the system by two 50%-capacity chilled water circulating pumps.

Chilled water returns to the flash tank at an elevated temperature.

Normal makeup for the chilled water subsystem is from the chilled water condenser.

Makeup can also be provided from the water treatment system and/or the main condensate system if required. Cooling water for the chilled water condenser and the air ejector condenser is supplied from the bearing cooling water system. Automatic controls are provided to maintain level in the flash tank.

The mechanical chilled water unit can be operated in parallel with both steam vacuum refrigeration units to provide additional refrigeration capacity.

9.2.2.3.3 Neutron Shield Tank Cooling Water Subsystem A neutron shield tank cooling water subsystem is provided for each reactor unit to cool the water in the neutron shield tank that is heated by neutron and gamma radiation from the reactor.

The heated water in the neutron shield tank is cooled by being pumped through one of the two neutron shield tank coolers by one of the two neutron shield tank pumps or by natural circulation using both neutron shield tank coolers. A surge tank accommodates thermal expansion of the neutron shield water. A level sensor on the surge tank sends a signal to the main control room to

Revision 5209/29/2016 NAPS UFSAR 9.2-30 indicate a low subsystem level. A solenoid pilot air-operated valve is actuated from the main control room to replenish the subsystem from the component cooling water subsystem. There is a chemical addition connection for the manual addition of corrosion inhibitor when the reactor is shut down.

9.2.2.4 Components, Piping, and Valves 9.2.2.4.1 Component Cooling and Chilled Water Subsystems Carbon steel pipe is used throughout these systems; stainless steel, flexible metal pipe has been added to the reactor coolant pump air and oil cooler inlet and outlet piping where necessary.

All valve bodies are of steel material. Components, piping, valves, and supports in the component cooling water subsystem are designed to Seismic Class I criteria except for certain isolable branches serving systems that are not Class I. The component cooling water subsystem and the portions of the chilled water subsystem that serve the containment recirculation air cooling coils and can be supplied from the service water system (e.g., between valves TV-CC115 A & C), are of Seismic Class I design. Piping in these subsystems conforms to the requirements of the Code for Nuclear Power Plant Piping, ANSI B31.7. Expansion joints are provided in accordance with the technical requirements of the original procurement/design specification, NAS-279. These expansion joints are located at the suction and discharge of the component cooling water pumps and the chilled water pumps. The remainder of the chilled water subsystem piping conforms to ANSI B31.1.

9.2.2.4.2 Neutron Shield Tank Cooling Water Subsystem The 300 series stainless steel pipe is used throughout this system and the joints are welded except where flanges are used for connection to components. Valves are also of stainless steel material, with the exception of 2-CC-229, which is carbon steel. Portions of the piping system conform to the requirements of the code for Nuclear Power Piping, ANSI B31.7, and other portions to ANSI B31.1.

9.2.2.5 Design Evaluation 9.2.2.5.1 Availability and Reliability The component cooling water subsystem uses machinery and equipment of conventional and proven design. All components are specified to provide maximum safety and reliability.

The component cooling water subsystem meets the requirements of General Design Criterion 5. Component cooling water may be either cross-connected to supply both units or it may supply each unit independently. Cross connections are provided between the pump suctions and discharges and the heat exchanger outlets. Each cross connection is provided with an isolation valve to allow a separate supply of component cooling water to each unit. Of the common components, only the spent-fuel pit coolers are safety-related. These are supplied by a common header connected to both units by isolation valves. This arrangement allows common equipment

Revision 5209/29/2016 NAPS UFSAR 9.2-31 to be operated from either or both units component cooling water supply. In the event of an accident, cooling water can be provided to the non-accident plant and to the common equipment by the system supplying the plant not involved in the accident. In the event of an accident, no component cooling water is required for the accident plant. All component cooling water is secured to this plant. Each plant has sufficient cooling capacity to supply its equipment and all common components.

Table 9.2-8 shows how the interconnected systems rely upon each other, and evaluates the consequences should that interconnection be lost.

The installation of four pumps and four heat exchangers for two reactor units provides 100% backup during normal operation of the two units. During cooldown of one reactor unit, there is 100% backup if the other unit is in normal operation. If only one pump is available for cooldown of a reactor unit, the cooldown time is extended without equipment damage or hazard to the public or operating personnel.

Most of the piping, valves, and instrumentation in the reactor containment are located outside the reactor primary shield wall and above the water level that would exist in the bottom of the containment under post-accident conditions. The equipment in the containment is protected against credible missiles and flooding during post-accident operations. Also, shielding is provided to allow limited maintenance and inspection during power operation.

Equipment not located inside the crane wall in the containment may be inspected and maintained during power operation.

The system is of Seismic Class I design. System branches that supply cooling water to equipment in systems that are not Seismic Class I design are readily available.

The following components are located inside the containment: the excess-letdown heat exchanger; reactor coolant pump thermal barrier, oil coolers, and motor stators; neutron shield tank coolers; rod-drive mechanism cooling coils; residual heat removal heat exchangers; recirculation air cooling coils; primary drain transfer tank cooler; and residual heat removal pump seal coolers. The isolation of flow from the component cooling water subsystem to the containment is provided as described in Section 6.2.4.

An air-operated trip valve or motor-operated valve is installed in the outlet cooling water headers from all reactor coolant pump coolers, the rod-drive mechanism cooling coil outlet, and the outlet cooling water line from the residual heat removal heat exchanger. A check valve is installed in the inlet cooling water header to thermal barriers and in the inlet cooling water line to the excess-letdown heat exchanger.

In the event that a leak occurs in the thermal barrier cooling coil, a high cooling water outlet temperature alarm annunciates in the main control room. The high pressure reactor coolant is contained by closing the appropriate trip valve. An air-operated trip valve is provided on the outlet from each reactor coolant pump thermal barrier. Each valve can be manually tripped, if necessary, and will automatically close on an excessive high flow in its discharge line. The

Revision 5209/29/2016 NAPS UFSAR 9.2-32 automatic closure circuitry contains a ten-second delay to prevent unnecessary closures during short duration transients of the component cooling water system.

An air-operated trip valve is provided on the common inlet and outlet for each reactor coolant pump motor cooler. These valves can be manually tripped if necessary. The air-operated trip valves in the common cooling water outlet header from the thermal barriers, in the main cooling water lines leaving the containment, and the containment air recirculation cooler outlet lines leaving the containment close on a high-high containment pressure signal.

9.2.2.5.2 Leakage Provisions The component cooling water heat exchangers are located in the auxiliary building.

Provisions are made to preclude the possible spread of radioactive contamination even though this system is not normally expected to contain radioactive water. These provisions include isolating any heat exchanger, in or served by the component cooling water system, by shutoff of the inlet and outlet component cooling water valves. Auxiliary building floor drainage is processed through the liquid waste disposal system (Section 11.2).

Welded construction is used almost exclusively throughout the system to minimize the possibility of leakage from pipes, valves, and fittings.

Minor leakage inside the containment is not considered to be objectionable. Contamination of the system could result from the following: tube leakage in a heat exchanger in the chemical and volume control, residual heat removal, or sampling systems, or a leak in the thermal barrier of a reactor coolant pump. Leakage from the system is primarily detected by a change in the surge tank level. Temperature, level, and flow indicators in the main control room may be used to detect leakage at certain points. Elsewhere, leaks can be located by inspection or isolation.

9.2.2.5.3 Incident Control The piping mains have the following valves at the containment walls: shutoff on outside and check on either inside or outside in supply lines, trip on outside in all return lines, and trip on inside for reactor coolant pump and shroud return lines. The trip valves close on receiving the containment isolation phase B signal. The recirculation air cooling coils contain shutoff and check valves on the inlet lines outside the containment and contain trip valves inside and outside the containment on the outlet lines.

Chilled water supply and return for the recirculation air cooling coils can be manually switched to the service water system if necessary to control containment temperature and therefore pressure.

9.2.2.5.4 Malfunction Analysis A failure analysis of equipment and components is presented in Table 9.2-9.

A specific assessment for the failure of the component cooling water supply or return lines has been performed, although, as stated in Table 9.2-9, this failure is not considered likely. The

Revision 5209/29/2016 NAPS UFSAR 9.2-33 hydraulic section of the reactor coolant pump can operate without component cooling water as long as seal injection water is supplied to the pump. The pump motor, however, cannot operate for longer than 10 minutes without component cooling water based on the following assumptions:

1. Approximately 7 minutes after loss of component cooling water, the motor bearing temperature alarms will be actuated. Bearing temperature will then be approximately 185°F.

2. At approximately 10 minutes, the bearing oil temperature is assumed to reach 200°F (the maximum recommended oil temperature). This would occur if the motor had not been shut off when the bearing temperature alarm was actuated.

3. The above oil temperatures are based on rate of rise of 5°F/min and an initial operating temperature of approximately 150°F. The above assumptions are based on the results of shop tests of typical motor bearing oil temperatures under simulated conditions.

After approximately ten minutes from loss of component cooling water, it is assumed that the hydrodynamic lubrication of bearings is degraded and ultimately lost. It is expected that some degree of boundary lubrication will occur after loss of hydrodynamic oil film. Eventual melting of the babbit bearings, however, will occur. When the bearing material melts, rubbing of the rotor, and possibly the impeller, will follow. However, seizure does not necessarily occur.

In addition to the lube oil temperature alarm, the following data are displayed in the main control room:

1. Component cooling water pump discharge pressure.

2. Temperature and flow in the component cooling water supply headers from the component cooling heat exchangers.

3. Flow from the reactor coolant pump thermal barriers and motor coolers.

4. Temperature in the component cooling water return headers from the reactor coolant pumps.

The above data display should alert the operator to any problem in the component cooling water system. If, for any reason, appropriate measures are not taken within approximately 7 minutes, the reactor coolant pump motor oil temperature alarms will actuate. If the operator then shuts down the pump(s) within 3 minutes, the possibility of damage to the motor bearing is minimized.

9.2.2.6 Minimum Operating Conditions Minimum operating conditions for the component cooling system are given in the Technical Specifications and the Technical Requirements Manual.

9.2.2.7 Tests and Inspections The component cooling system is tested periodically as required by the Technical Specifications and the Inservice Testing Program. Standby pumps are rotated in service on a

Revision 5209/29/2016 NAPS UFSAR 9.2-34 scheduled basis to obtain even wear. Following installation of spare parts or piping modifications, visual inspections are conducted to confirm normal operation of the system.

9.2.2.8 Instrumentation Application The system is monitored from the main control room by indicators that display the following data:

1. Pump discharge pressure.

2. Temperature and flow in the supply headers from the component cooling heat exchangers.

3. Temperature in the return headers from the residual heat removal heat exchangers.

4. Flow from the reactor coolant pump thermal barriers.

5. Temperature in the return headers at the pump suction.

6. Radioactivity in the component cooling water heat exchanger constant-flow vents.

Local indicators for pressure, temperature, level, and flow are provided on a general basis.

Certain selected temperatures are sensed by thermocouples whose output signals are fed into the computer system, thus providing full-time scanning and alarming.

Air-operated trip or motor-operated valves are installed on the outlet headers from those components served in the reactor containment. A check valve or air-operated trip valve is installed in the inlet header at the containment for the components served in the reactor containment.

9.2.3 Water Supply and Treatment Systems 9.2.3.1 Domestic Water System The domestic water system consists of ground wells dug at various locations on site.

Periodic samples are collected at the discharge of each well pump to ensure that the wells provide a safe and approved water supply to the station facilities. Domestic water supply component design data is provided in Table 9.2-10.

Each well has its own structure, hydropneumatic tank, pump, and compressor. Pressure is sustained in the system by maintaining the proper water to air ratio in the individual hydropneumatic tank via pressure and level controllers. Well pumps are sized to provide adequate make-up to the system without excessive draw down to its respective well. As an added protection, well level is ensured via level switches, to mitigate the chances of pumping a well dry and damaging the submersible pump. Water is supplied from each well to its respective hydropneumatic tank, which acts as a surge volume and pressure source for the header. Each hydropneumatic tank discharges to a common header. For maintenance evolutions, each hydropneumatic tank is isolable and bypassable to allow service directly from the well pump. The

Revision 5209/29/2016 NAPS UFSAR 9.2-35 common underground piping is regionally isolable to allow for isolation of any well house from the system without isolating water supply to the facilities in that area.

The system supplies cold water for all domestic applications in the plant from toilets and sinks to drinking fountains and eyewash stations. The water is heated electrically and is not interconnected to any potentially radioactively contaminated system.

9.2.3.2 Water Treatment System Water treatment is provided by the reverse osmosis system. The flash evaporator system is obsolete and no longer used with the exception of the flash evaporator distillate pumps which are used for water transfer.

9.2.3.2.1 Reverse Osmosis (RO) SystemVendor-supplied The reverse osmosis (RO) system produces high-purity makeup water. The system is housed in shipping containers and mobile trailers located in the North yard, just west of the water treatment building. The system uses a reverse osmosis process to do the major portion of the water treatment effect. In the final stages, the treated water is passed through ion exchange beds and pumped into the 100,000-gallon RO product storage tank. The treated water is pumped by one of two RO product water transfer pumps to the 300,000-gallon condensate storage tanks described in Section 9.2.4 for secondary plant makeup. The pumps are located in the water treatment building.

The RO system is designed to supply 450 gpm (continuous) and 600 gpm (peak) makeup water to the station secondary system. The RO system raw water is supplied by a dedicated vertical pump located on the intake structure near the fire pump house. The RO system water pump is designed to supply up to 1200 gpm of raw water at no less than 80 psig at inlet to the RO trailers.

The complete reverse osmosis system installation performs no safety-related functions.

9.2.3.2.2 Flash Evaporator System This system is the permanent originally installed method of water treatment, however, it has not been used since the reverse osmosis system was installed. With the use of the outlet filters as proportional samplers on the high capacity blowdown system, the outlet piping has been capped and the system decommissioned.

The flash evaporator system is shown in Reference Drawing 23. The flash evaporator distillate pumps take suction on the header from the 300,000-gallon condensate storage tank, and can supply the primary grade (PG) water system and the water treatment (WT) system.

The flash evaporator system performs no safety-related functions.

Revision 5209/29/2016 NAPS UFSAR 9.2-36 9.2.4 Condensate Storage Facilities Two aboveground vertical storage tanks are provided.

One tank has a capacity of 300,000 gallons and serves as a surge tank for the condensate system (Section 10.4.3). On low level in the condenser hotwell, condensate is drained from the 300,000-gallon storage tank to the condenser. On high level in the condenser hotwell, the excess condensate is returned to the storage tank by the condensate pumps. The condensate stored in this tank is normally nonradioactive.

The 300,000-gallon storage tank is designed in accordance with API Standard 650. The design includes a corrosion allowance of 1/16 inch on both shell and heads. Both inside and outside surfaces are painted. This tank or its contents are not required for the safe operation of the station.

The other condensate storage tank (emergency) has a capacity of 110,000 gallons and serves as the source of condensate for the auxiliary feedwater system. The auxiliary feedwater pumps, drives, piping, and the 110,000-gallon emergency condensate tank are all designed as Seismic Class I (Section 10.4.3). This tank is safety-related. The tank is designed in accordance with API Standard 650. The design includes a corrosion allowance of 1/16 inch on both shell and heads. The tank is insulated and surrounded by a concrete envelope for missile protection. The tank holds a sufficient quantity of condensate to maintain station operation in a hot standby condition for a period of eight hours with steam discharge to the atmosphere concurrent with total loss of off-site power.

The 110,000-gallon storage tank was not designed to cool down the plant by itself to a cold shutdown condition. Should the original 110,000 gallons be exhausted, safe cooldown can be achieved by transferring to one of the following sources:

1. 300,000-gallon storage tank via an interconnection (non-seismic system).

2. Unlimited supply of service water via an interconnection (Seismic Class I system).

3. Unlimited supply of fire protection water via an interconnection (Seismic Class I system).

Levels in the 300,000-gallon condensate storage tank and 110,000-gallon emergency condensate storage tank are monitored in the main control room. Annunciator displays are provided for high and low levels in the 300,000-gallon tank and two redundant low level, Lo-Lo level and 20-minutes-remaining alarms in the 110,000-gallon tank.

Both units 300,000 gallon tanks are located in the north yard. No safety-related equipment is adjacent to these tanks. Deflection of leaking water would be provided by the turbine building, office building, and the normal station service transformer walls. Water released from the tanks would be accommodated by the drainage ditches and yard storm drains, or by runoff directly to the lake to the north. Failure of these tanks would not result in incapacitation of any safety-related equipment.

Revision 5209/29/2016 NAPS UFSAR 9.2-37 9.2.5 Ultimate Heat Sink The ultimate heat sink, consisting of the North Anna Reservoir and the Service Water Reservoir, is described in Section 9.2.1 (service water system).

The design of the ultimate heat sink complies with Regulatory Guide 1.27, March 1974. A discussion of each of these positions is given below.

9.2.5.1 Regulatory Position No. 1 The ultimate heat sink consists of the Service Water Reservoir and the North Anna Reservoir and their associated retaining structures. The normal source of service water for Units 1 and 2 is the Service Water Reservoir. The Service Water Reservoir is adequate to provide sufficient cooling for at least 30 days: (a) to permit simultaneous safe shutdown and cooldown of two units, then maintain them in a safe-shutdown condition, and (b) in the event of an accident in one unit, to permit control of that accident safely and permit simultaneous safe shutdown and cooldown of the remaining unit and maintain them in a safe-shutdown condition. After 30 days, makeup to the Service Water Reservoir is provided from the North Anna Reservoir as necessary to maintain cooling water inventory, ensuring a continued cooling capability.

9.2.5.2 Regulatory Position No. 2 The design of the Service Water Reservoir is described in Section 3.8.4. The design of the North Anna dam has been discussed in a report submitted as Amendment 15 to the North Anna Units 1 and 2 PSAR, entitled, Report on Design and Stability of the North Anna Dam for Virginia Electric and Power Company. The ultimate heat sink satisfies the requirements of Regulatory Position No. 1 when both the Service Water Reservoir and the North Anna Reservoir are operable. In the event one of the water sources is lost due to natural phenomena or single failure of man-made structural features, the other source has the capability to provide cooling for safe shutdown and cooldown of both units. If there is a LOCA on one unit and a simultaneous loss of station power to both units with the most limiting single failure, there are four service water pumps located in the service water pump house on the Service Water Reservoir that can provide the required cooling.

9.2.5.3 Regulatory Position No. 3 The two sources that comprise the ultimate heat sink each have the capability to provide cooling for safe shutdown and cooldown of both units. The Service Water Reservoir provides the primary water source and the North Anna Reservoir provides the backup water source. If there is a design basis accident, the Service Water Reservoir can satisfy the cooling requirements of both units. There is no canal between the intake structure of either portion of the ultimate heat sink and the service water system, as the service water pumps take suction directly from the heat sink (either the North Anna Reservoir or the Service Water Reservoir). The service water system, including equipment, piping, valves, and structures, is designed in accordance with Seismic Class I criteria (see Sections 9.2.1 and 3.2.1).

Revision 5209/29/2016 NAPS UFSAR 9.2-38 The two sources of water are separate, and each has separate, redundant supply and discharge headers. The only common point is the main redundant supply and discharge headers in the service building where distribution to the components takes place. These common headers are encased in concrete.

9.2.5.4 Regulatory Position No. 4 Technical Specifications and the Technical Requirements Manual have been established to cover the minimum availability of the ultimate heat sink.

9.2 REFERENCES

1. Attachment to letter from S.C. Brown, VEPCO, to E.G. Case, NRC, Serial No. 237, Ford, Bacon & Davis Utah, Inc., The North Anna Power Station Ultimate Heat Sink, Description of the Proposed Testing Program and Design Verification, May 3, 1978.

2. Attachment to letter from S.C. Brown, VEPCO, to E.G. Case, NRC, Serial No. 237A, MIT Ralph M. Parsons Laboratory, Calculation of Time Varying Intake Temperatures for North Anna Power Station Service Water Reservoir Following a LOCA on Unit 1, Dr. E. Eric Adams, June 2, 1978.

3. Attachment to letter from S.C. Brown, VEPCO, to E.G. Case, NRC, Serial No. 237B, Ford, Bacon & Davis Utah, Inc., The North Anna Power Station Ultimate Heat Sink, Interim Report of Design Verification Testing, September 25, 1978.

4. Attachment to letter from S.C. Brown, VEPCO, to H.R. Denton, NRC, Serial No. 237D, Ford, Bacon & Davis Utah, Inc., Service Water Reservoir and Spray System, Performance Testing and Evaluation, March 8, 1979.

Revision 5209/29/2016 NAPS UFSAR 9.2-39 9.2 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FM-078A Flow/Valve Operating Numbers Diagram: Service Water System, Units 1 & 2

2. 11715-FM-078B Flow/Valve Operating Numbers Diagram: Service Water System, Units 1 & 2

3. 11715-FM-078C Flow/Valve Operating Numbers Diagram: Service Water System, Units 1 & 2

4. 11715-FM-078G Flow/Valve Operating Numbers Diagram: Service Water System, Units 1 & 2

5. 11715-FM-078H Flow/Valve Operating Numbers Diagram: Service Water System, Units 1 & 2

6. 11715-FM-078J Flow/Valve Operating Numbers Diagram: Service Water System, Units 1 & 2

7. 11715-FM-078K Flow/Valve Operating Numbers Diagram: Service Water System, Units 1 & 2

8. 11715-FM-22F Flow Diagram: Service Water, Chemical Addition System, Units 1

&2

9. 11715-FP-5A Service Water Lines, Yard, Sheet 1

10. 11715-FP-5B Service Water Lines, Yard, Sheet 2

11. 11715-FP-5C Service Water Lines, Yard, Sheet 3

12. 11715-FP-5E Service Water Lines, Reactor Containment, Sheet 1, Unit 1 12050-FP-5A Service Water Lines, Reactor Containment, Sheet 1, Unit 2

13. 11715-FP-5J Service Water Lines, Auxiliary Building, Sheet 1

14. 11715-FP-5L Service Water Lines, Intake Structure to Auxiliary Building Tunnel, Sheet 1

15. 11715-FP-5M Service Water Lines, Intake Structure to Auxiliary Building Tunnel, Sheet 2

16. 11715-FP-5N Service Water Lines, Intake Structure to Auxiliary Building Tunnel, Sheet 3

17. 11715-FP-5AB Service Water Reservoir Spray Piping, Pipe Support Details, Sheet 1

Revision 5209/29/2016 NAPS UFSAR 9.2-40

18. 11715-FM-079A Flow/Valve Operating Numbers Diagram: Component Cooling Water System, Unit 1 12050-FM-079A Flow/Valve Operating Numbers Diagram: Component Cooling Water System, Unit 2

19. 11715-FM-079B Flow/Valve Operating Numbers Diagram: Component Cooling Water System, Unit 1 12050-FM-079B Flow/Valve Operating Numbers Diagram: Component Cooling Water System, Unit 2

20. 11715-FM-079C Flow/Valve Operating Numbers Diagram: Component Cooling Water System, Unit 1 12050-FM-079C Flow/Valve Operating Numbers Diagram: Component Cooling Water System, Unit 2

21. 11715-FM-079D Flow/Valve Operating Numbers Diagram: Component Cooling Water System, Unit 1

22. 12050-FM-079D Flow/Valve Operating Numbers Diagram: Mechanical Chiller, Units 1 & 2

23. 11715-FM-28A Flow Diagram: Flash Evaporator System

24. 11715-FM-8A Arrangement: Service Water Pump House, Sheet 1

25. 11715-FM-8B Arrangement: Service Water Pump House, Sheet 2

26. 11715-FP-5AM Service Water Valve House Piping, Plan and Sections, Units 1 & 2

27. 11715-FP-5AN Service Water Valve House Piping, Plan and Sections, Units 1 & 2

28. 11715-FP-5AK Service Water, Buried Piping Tie-In, Units 1 & 2

Revision 5209/29/2016 NAPS UFSAR 9.2-41 Table 9.2-1 TYPICAL SERVICE WATER EQUIPMENT FLOW RATES (gpm)a,b Design Basis: DBA, Unit 1; Cooldown, Unit 2 Unit 1 Unit 2 28 hr to Initial 1 hr to After First Initial to 1/2 hr Cooldown System to 1 hr 24 hr 24 hr 1/2 hr to 28 hr Complete Recirculation spray 18,000 9000 9000 0 0 0 Recirculation air cooling 0 0 0 0 2100c 2100c coils Component cooling 0 0 0 10,500 10,500 10,500 Chemical and volume 75 75 75 75 75 75 control (charging pump lube-oil and gearbox coolers)

Instrument air 42 42 42 42 42 42 Air conditioning 237 237 237 237 237 237 Total 18,354 9354 9354 10,854 12,954 12,954 Units 1 and 2 Combined Service Water Flowsd Normal operation, both units 21,708 Normal operation, Unit 1; slow cooldown, Unit 2 21,708 Normal operation, Unit 1; fast cooldown, Unit 2 32,208 Fast cooldown, both units 42,708 Loss of coolant, loss of offsite power Initial 21,708 Initial to 1/2 hr 29,208

a. Actual total service water system flow rate may exceed the sum of the individual equipment flow rates because of the intentional addition of nonessential equipment to the system.

b. Table 9.2-1 is for example only. Dynamic effects from shifting loads are not shown (i.e., isolating two recirculation spray heat exchangers after a DBA will increase flows to the remaining RSHXs above 9000 gpm as well as increase component cooling heat exchanger flows.

c. Only required for loss of offsite power.

d. For each mode of operation using emergency power, except fast cooldown, two or three service water pumps are nor-mally operating and the others are backups. Two of the backups (auxiliary service water pumps) are in the main intake.

This arrangement provides adequate spares during the long-term recovery period for maintenance and failure to func-tion.

e. Requires component cooling heat exchanger throttling per service water flow balancing requirements, see Section 9.2.1.1.

Revision 5209/29/2016 NAPS UFSAR 9.2-42 Table 9.2-1 (continued)

TYPICAL SERVICE WATER EQUIPMENT FLOW RATES (gpm)a,b Units 1 and 2 Combined Service Water Flowsd (continued)

Loss of coolant, loss of offsite power (continued) 1/2 hr to 1 hr 31,308 1 hr to 24 hr 22,308 24 hr to 28 hr 22,308 More than 28 hr 22,308 Loss of station power, slow cooldown, both units 25,908 The service water pump requirements for various modes of operation of two units are listed below:

Normal operation both units 2 pumps (min)

Normal operation, Unit 1; slow cooldown, Unit 2 2 pumps Normal operation, Unit 1; fast cooldown, Unit 2 3 pumps Fast cooldown, both units 4 pumps DBA, Unit 1; cooldown, Unit 2 Initial to 1/2 hr 2 pumpse 1/2 hr to 1 hr 2 pumpse 1 to 24 hr 2 pumps 24 to 28 hr 2 pumps After 28 hr to 2 pumps cooldown completion If unit without accident is cooled down at maximum rate, a third pump is used.

Loss of offsite power, both units 2 pumps

a. Actual total service water system flow rate may exceed the sum of the individual equipment flow rates because of the intentional addition of nonessential equipment to the system.

b. Table 9.2-1 is for example only. Dynamic effects from shifting loads are not shown (i.e., isolating two recirculation spray heat exchangers after a DBA will increase flows to the remaining RSHXs above 9000 gpm as well as increase component cooling heat exchanger flows.

c. Only required for loss of offsite power.

d. For each mode of operation using emergency power, except fast cooldown, two or three service water pumps are nor-mally operating and the others are backups. Two of the backups (auxiliary service water pumps) are in the main intake.

This arrangement provides adequate spares during the long-term recovery period for maintenance and failure to func-tion.

e. Requires component cooling heat exchanger throttling per service water flow balancing requirements, see Section 9.2.1.1.

Revision 5209/29/2016 NAPS UFSAR 9.2-43 Table 9.2-2 AUTOMATIC OPERATION OF SERVICE WATER SYSTEM VALVES Accident Service Water Valves Action Safety injection Discharge tunnel MOVs, both units Remain as is actuation signal Auxiliary service water pump discharge valves, Remain as is both units Service water spray array MOVs Open Containment recirculation air cooling coils Remain closed supply and return, both units Service water winter bypass MOVs Close Containment Recirculation spray heat exchangers, affected Open or throttled depressurization signal unit Recirculation spray heat exchanger supply and Remain as is return cross-tie MOVs Discharge tunnel MOVs, both units Remain as is Recirculation air cooling coils supply and return, Close if open affected unit Auxiliary service water pump discharge valves, Remain as is both units Component cooling heat exchangers, affected All close unit Service water spray array and winter bypass Remain as is MOVs Loss of offsite power Recirculation spray heat exchangers, both units Remain closed Discharge tunnel MOVs, both units Remain as is Recirculation air cooling coils supply and return, Remain as is both units Auxiliary service water pump discharge valves, Remain as is both units Component cooling heat exchangers, both units Remain open Service water spray array and winter bypass Remain as is MOVs

Revision 5209/29/2016 NAPS UFSAR 9.2-44 Table 9.2-3 SERVICE WATER SYSTEM FAILURE MODES AND EFFECTS ANALYSIS Component Malfunction Consequences Service water pump Failure of an operating pump Each supply header has two pumps normally connected.

The second pump will be manually started on failure of an operating pump.a Supply header and discharge Rupture of main header All components can be header connected to either set of headers. Failure of a header is discussed in Section 9.2.1.2.1.

Service Water Reservoir Rupture of header to spray Loss of spray header is spray header piping discussed in Section 9.2.1.2.2.

Recirculation spray heat Failure of isolation valve to The recirculation spray heat exchangers open exchangers are 100%

redundant and failure of a single isolation valve to open will not affect safe operation of the system.

Recirculation spray heat Failure of recirculation spray Refer to Table 6.2-41.

exchangers heat exchangers Component cooling Failure of heat exchanger Refer to Table 9.2-9.

Service water screen wash Failure of pump The second screen wash pump pump can be used to wash any of the four screens.

Service Water Reservoir level Loss of instrumentation Service water reservoir level instrumentation instrumentation is redundant.

Traveling waters screens Loss of flow through a screen Same consequences as failure of a service water pump.

a. If the redundant pump on that loop is out of service, sufficient time is available to re-align CCHXs to the other service water loop. No operator action is required for DBA loads because the headers to critical components are cross-connected. The control room chillers can be manually aligned to operate on either service water loop.

Revision 5209/29/2016 NAPS UFSAR 9.2-45 Table 9.2-4 SERVICE WATER SYSTEM COMPONENT DESIGN DATA Parameter Data Service Water Pumps Number 4 Type Vertical turbine, 2 stage Motor horsepower 500 hp Capacity 11,500 gpm 15,000 gpm Head at rated capacity 135 ft 89 ft Design pressure 150 psig Design temperature 35 to 110°F Materials Pump Casing ASTM-A-27 GR 70-40 Shaft ASTM-A479-XM19A Impeller ASTM-A-743-CF3M Submergence 6.8 ft Auxiliary Service Water Pumps Number 2 Type Vertical turbine, 2 stage Motor horsepower 500 hp Capacity 11,500 gpm 15,000 gpm Head at rated capacity 135 ft 89 ft Design pressure 150 psig Design temperature 35 to 110°F Materials Pump Casing ASTM-A-27 Gr 70-40 Shaft ASTM-A479-XM19A Impeller ASTM-A743-CF3M Submergence 9 ft Service Water Screen Wash Pumps Number 2 Type Vertical turbine, 6 stage Motor horsepower 40 hp Capacity 500 gpm (nominal)

Head at rated capacity 85 psi Design pressure 360 psig Materials Pump Casing ASTM-A-27 Shaft ASTM-A-276, type 416 Impeller ASTM-B-62 Minimum submergence 36 inches

Revision 5209/29/2016 NAPS UFSAR 9.2-46 Table 9.2-4 (continued)

SERVICE WATER SYSTEM COMPONENT DESIGN DATA Parameter Data Screen Wash Strainer Number 2 Type Motor-operated, self-cleaning Particle size, max 0.125 in.

Backwash flow 49 gpm Backwash source Strainer effluent Pressure drop, clean 0.6 psi Pressure drop, 2/3 clogged 1.0 psi Gross strainer area 400 in2 Net strainer face area 160 in2 Inlet and outlet nozzle size 6 in.

Design pressure 150 psi Materials Body Steel Straining media Monel Frame Bronze Traveling Water Screens Number 4 Screen capacity 16,000 gpm Differential head across screen 0.2/100, 0.8/50 in/% clean Well width/submergence 5-2/13-0 ft-in/ft-in Screen travel speed 12 fpm Time for one complete revolution 5.8 min Materials Head shaft CR steel Foot shaft 1040 steel Screen guides CI Spray nozzles SS Spray headers Steel Screen panels Steel Splash plates Steel Drive housing, front/rear Fiberglass/steel Head sprocket Steel Foot sprocket CI Service Water Air Compressor Capacity (each) 14.7 cfm Motor horsepower 5.0 Design pressure 100 psig Number 2 Type Air cooled, non-lubricated, scroll

Revision 5209/29/2016 NAPS UFSAR 9.2-47 Table 9.2-4 (continued)

SERVICE WATER SYSTEM COMPONENT DESIGN DATA Parameter Data Service Water Air Dryer Type Desiccant Capacity 25 scfm Dewpoint -40°F or better Number 1 Service Water Air Compressor Receiver Tank Number 1 Capacity 126 gal Design pressure 150 psig Design temperature 200°F Materials Head ASTM A516 Gr 70 Shell ASTM A516 Gr 70 Design code ASME Section VIII Div. 1, A99 Add.

Revision 5209/29/2016 NAPS UFSAR 9.2-48 Table 9.2-5 COMPONENT COOLING WATER SUBSYSTEM COMPONENT DESIGN DATA Parameter Data Pumps Number 4 (two required for normal operation of two reactor units)

Type Horizontal centrifugal single stage Motor horsepower 600 Seal Single mechanical Capacity 8000 gpm Head at rated capacity 190 ft Design pressure 150 psig Design temperature 212°F Materials Pump Casing Nodular iron (ASTM A-48)

Shaft Carbon steel (AISI-C-1045)

Stainless Steel (ASTM A276 410 SS) for 2-CC-P-1A only Impeller Bronze (ASTM B143)

Design code None Heat Exchangers Number 4 (two required for normal operation of two reactor units)

Duty (each) 52 x 106 Btu/hr Shell Tube Design pressure 150 psig 150 psig Design temperature 150°F 150°F Operating pressure 125 psig 50 psig Operating temperature, 116.5/105°F 95.0/104.9°F in/out Materials Carbon steel SA213TP316L for Unit 1 SB338, Grade 2 for Unit 2 Fluids Component cooling water Service water Design code ASME VIII-1968, TEMA ASME VIII-1968, TEMA Class R for Unit 1 Class R for Unit 1 ASME III-1989, TEMA ASME III-1989, TEMA Class R for Unit 2 Class R for Unit 2 Surge Tank Number 1 (common to both units)

Type Cylindrical, vertical Capacity 3120 gal Design pressure 40 psig Design temperature 150°F Material Carbon steel Design code ASME VIII-1968

Revision 5209/29/2016 NAPS UFSAR 9.2-49 Table 9.2-6 CHILLED WATER SUBSYSTEM COMPONENT DESIGN DATA Parameter Data Chilled Water Condenser Number 2 (one for each unit)

Type Shell and tube Duty (each) 32,080,000 Btu/hr Steam condensed (each) 29,170 lb/hr Circulating water flow (each) 4000 gpm Waterbox design pressure 50 psig Circulating water inlet/outlet temperature 93/109°F Materials Shell Steel Water Box Steel Tube sheets SS 304 Tubes SS 304 Design code ASME VIII-1968 Chilled Water Flash Tank Number 2 (one) for each unit)

Flash tank design temperature 150°F Flash tank operating temperature 60°F Makeup water temperature 109°F Flash tank material Steel Flash tank design pressure Full vacuum to 15 psig Design code ASME VIII-1968 Chilled Water Booster Ejectors Number 6 (three per chilled water unit)

Operating temperature 344°F Steam pressure required for boosters 110 psig Steam flow per booster 375 ton 10,350 lb/hr 250 ton 6900 lb/hr 125 ton 3450 lb/hr Capacity, tons of refrigeration 60°F water 750 per unit 38°F water 112 per unit Chilled Water Air Ejectors and Condenser Stream pressure required 110 psig Inlet pressure 3.64 in Hg abs.

Air-vapor mixture removed 87.4 lb/hr Cooling water (minimum) 50 gpm Steam use, 1-element/stage at normal pressure 260 lb/hr Water box design pressure 150 psig

Revision 5209/29/2016 NAPS UFSAR 9.2-50 Table 9.2-6 (continued)

CHILLED WATER SUBSYSTEM COMPONENT DESIGN DATA Parameter Data Chilled Water Air Ejectors and Condenser (continued)

Shell design pressure 75 psig Materials Shell Steel Tubes SS 304 Tubesheets SS 304 Chilled Water Circulating Pumps Number 4 (two for each unit)

Type Horizontal centrifugal, single stage Motor horsepower 125 Seal Single mechanical Capacity (each) 1220 gpm Head at rated capacity 230 ft Design pressure 400 psig Design temperature 600°F Materials Pump casing Steel Shaft Carbon steel, AISA C-1045 Impeller Bronze Design code None Chilled Water Condensate Pumps Number 4 (two for each unit)

Type Vertical in-line, single stage centrifugal Motor horsepower 5 Capacity (each) 60 gpm Head at rated capacity 125 ft Design pressure 100 psig Design temperature 250°F Materials Pump casing Cast iron Shaft SS Impeller Bronze Design code None Mechanical Chilled Water Unit Number 1 Type Centrifugal liquid chiller Capacity 1000 tons Refrigerant R-134a Motor horsepower 1043 kW Design code ASME VIII, Division I, 1977

Revision 5209/29/2016 NAPS UFSAR 9.2-51 Table 9.2-6 (continued)

CHILLED WATER SUBSYSTEM COMPONENT DESIGN DATA Parameter Data Evaporator Flow rate 2400 gpm Enter/leave water temperature 52/42°F Passes 2 Design pressure 150 psig Fluid Chilled water Condenser Flow rate 1500 gpm Enter/leave water temperature 95/116°F Passes 4 Design pressure 250 psig Fluid Bearing cooling water Mechanical Chilled Water Surge Tank Number 1 Type Cylindrical, vertical Capacity 420 gal Design pressure 150 psig /full vacuum Design temperature 105°F Material Carbon steel Design code ASME VIII-1968 Mechanical Chilled Water Circulating Pumps Number 3 (two normal, one spare)

Type Horizontal centrifugal, single stage Motor horsepower 125 Seal Mechanical, single Capacity 1220 gpm each Head at rated capacity 230 ft Design pressure 400 psig Design temperature 600°F Materials Pump casing Carbon steel Shaft Steel Impeller Bronze Design code None

Revision 5209/29/2016 NAPS UFSAR 9.2-52 Table 9.2-7 NEUTRON SHIELD TANK COOLING SUBSYSTEM COMPONENT DESIGN DATA Parameter Data Neutron Shield Tank Cooler Number 4 (two for each unit, one required)

Duty (each) 80,000 Btu/hr Shell Tube Design pressure 150 psig 150 psig Design temperature 150°F 200°F Operating pressure 100 psig 5 psig Operating temperature, in/out 105/110°F 120/115°F Materials SS 304 SS 304L Fluids Component cooling water Shield tank water Design code ASME VIII-1968 ASME VIII-1968 Neutron Shield Tank Surge Tank Number 2 (one for each unit)

Type Cylindrical, vertical Capacity 1300 gal Design pressure 25 psig Design temperature 160°F Material Carbon steel Design code ASME VIII-1968 Operating pressure Containment atmospheric psig Operating temperature 120°F Neutron Shield Tank Cooling Pumps Number 4 (two for each unit)

Type Horizontal centrifugal, single stage Motor horsepower 0.5 Seal Single mechanical Capacity (each) 30 gpm Head at rated capacity 4.2 ft Design pressure 200 psig Design temperature 300°F Materials Pump casing SS 316 Shaft Steel Impeller SS 316 Design code None

Revision 5209/29/2016 NAPS UFSAR 9.2-53 Table 9.2-8 RELIANCE OF INTERCONNECTED SYSTEMS Interconnected System Purpose of Interconnection Consequence if Interconnection is Lost Main condensate Makeup for component The makeup line is connected to Units cooling surge tank 1 and 2 condensate systems. If both units are not operating, a condensate pump can be started to provide makeup.

Boron recovery Signals to automatic None. Use of equipment is control valves in intermittent.

component cooling water subsystem piping Sampling Conducts sample to central None. Samples at all important points sampling station may be collected at local sampling connections in the piping.

Vent and drain Disposal of equipment Since lines are open, without valves or vents and piping drains other devices, loss of the inter connections is not considered credible.

Containment Signals to trip valves for Valves fail safe (to closed position) on isolation isolation purposes, under loss of control.

accident conditions

Revision 5209/29/2016 NAPS UFSAR 9.2-54 Table 9.2-9 CONSEQUENCE OF COMPONENT MALFUNCTIONS Components Malfunction Comments and Consequences Component Pump-casing The casing is designed for 212°F temperature; standard cooling water ruptures test pressure is 225 psig. These conditions exceed those pumps that could occur during any operating conditions. The casings are made from nodular iron; this metal has corrosion-erosion resistance and produces sound casings.

The pumps are designed as Seismic Class I. Pumps are missile protected and may be inspected at any time.

Rupture by missiles is not considered credible. All units can be isolated by valves and the standby pump can carry full load.

Original pump Standby pump for that reactor unit can be used.

fails to start Standby pump Standby pump for other reactor unit can be started fails to start manually in main control room; may require manually repositioning valves at the pumps.

Manual valve at Prevented by prestartup and operational checks. During a pump suction normal operation, each pump is checked periodically, closed together with its valves.

Check valve at a Pumps are checked periodically during normal pump discharge operation.

sticks closed Check valves in Sticks closed The valves are spring loaded swing checks and sticking supply mains to closed is not considered credible.

RHR system at containment inlet penetrations Component Tube or shell Because of the system low operating pressure and cooling water ruptures temperature and Seismic Class I design, rupture is heat exchanger considered unlikely. Each heat exchanger can be isolated and full load carried by the standby heat exchanger. The standby heat exchanger intended for one reactor unit may be used for the other unit by repositioning valves. The exchangers are protected from missiles.

Condensate Sticks open Level control valve is normally isolated by closed makeup line manual valves. Since makeup is controlled by valve manipulating the manual valves, there are no consequences for the level control valve sticking open.

Revision 5209/29/2016 NAPS UFSAR 9.2-55 Table 9.2-9 (continued)

CONSEQUENCE OF COMPONENT MALFUNCTIONS Components Malfunction Comments and Consequences Component Left open Prevented by prestartup and operational checks. On a cooling water unit in service, this condition would be observed by heat exchanger operating personnel during routine observation. On vent and drain activation of a standby unit, the condition would be valves observed by personnel engaged in manually positioning valves at the exchanger. Note: Branching-off the vent line is a flow path that returns to the component cooling surge tank and is normally left open for radiation monitoring.

Supply and Rupture or Failure of this line is not considered likely. The headers return line to damage are seismically designed and located within RHR heat missile-protected areas.

exchangers and RC pumps Component Rupture Failure of this pipe section in not considered credible.

cooling surge The single-standpipe section is less than 2 feet long and tank branches into nearby isolation valves, which are under single-supply administrative control on the two 4-inch, one 11/2-inch, standpipe and one 1-inch surge lines. Pressure in this line will not exceed 10 psig because of the vented tank configured.

The line is seismically designed. It is in a missile-protected area and is located directly beneath the surge tank, providing additional protection from exterior damage.

Revision 5209/29/2016 NAPS UFSAR 9.2-56 Table 9.2-10 DOMESTIC WATER SUPPLY COMPONENT DESIGN DATA Parameter Data Well Pumps Well No. 7 Well No. 8 Well No. 6 Type Submersible Submersible Submersible Motor horsepower 15 hp 10 hp 10 hp Capacity 40 gpm 50 gpm 50 gpm Design pressure 925 ft TDH 527 ft TDH 500 ft TDH Well depth 730 ft 400 ft 375 ft

Figure 9.2-1 (SHEET 1 OF 2)

SERVICE WATER SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.2-57

Figure 9.2-1 (SHEET 2 OF 2)

SERVICE WATER SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.2-58

Figure 9.2-2 COMPONENT COOLING WATER SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.2-59

Figure 9.2-3 MECHANICAL CHILLED WATER UNIT Revision 5209/29/2016 NAPS UFSAR 9.2-60

Figure 9.2-4 CHILLED WATER STEAM VACUUM REFRIGERATION UNIT Revision 5209/29/2016 NAPS UFSAR 9.2-61

Figure 9.2-5 NEUTRON SHIELD TANK COOLING WATER SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.2-62

Revision 5209/29/2016 NAPS UFSAR 9.3-1 9.3 PROCESS AUXILIARIES 9.3.1 Compressed Air System The compressed air system includes a service air subsystem, an instrument air subsystem, and a containment instrument air subsystem for each unit. The compressed air system is shown in Figure 9.3-1 and Reference Drawings 1 through 13.

9.3.1.1 Design Basis The design objective of the compressed air system is to ensure the availability of sufficient quantities of compressed air of suitable quality and at the pressures required for station operation.

Design pressures are dictated by the expected uses of instrument or service air. Design temperatures are those resulting from extreme ambient conditions and are based on 95°F cooling water. The instrument air dewpoint for indoor air lines has been selected to be below the lowest indoor temperature expected (50°F) at the station location. The instrument air dewpoint for outdoor air lines has been selected to be below the lowest outdoor temperature expected (-15°F).

Design data for components of the compressed air system are given in Table 9.3-1.

The instrument air compressors, instrument air receivers, bypass piping at the drier, and piping, valves, and supports for critical instruments and controls are designed to conform with Seismic Class I criteria (Section 3.7). The driers in the auxiliary building (1/2-IA-D-1) are designed to Seismic Class criteria.

All piping is designed in accordance with ANSI B31.1, 1967, except at containment penetrations, where it is designed in accordance with ANSI B31.7, 1969.

The containment instrument air compressors, receivers, and air driers are not designed to Seismic Class I criteria.

9.3.1.2 System Description The service and instrument air subsystems consist of four (two per unit) air compressors.

The two (one per unit) service air compressors are located in the transformer yard outside of the Unit 2 Turbine Building bay doors. Each service air compressor is sized for the instrument and service air requirements of both units and are capable of providing air at 125 psig. The service air compressors are the normal supply to the service air, instrument air, and containment instrument air subsystems, with one compressor in normal operation and the other in automatic. The two (one p e r u n i t ) i n s t r u m e n t a i r c o m p r e s s o r s a re l o c a t e d i n A u x i l i a r y B u i l d i n g i n t h e tornado-missile-protected area. The two instrument air compressors normally provide a standby air supply to the instrument air subsystem as required for instruments and controls associated with both units. These instrument and service air compressors can be placed on line for automatic operation remotely from the control room. Each instrument air compressor is capable of providing air at 118 psig. The instrument air subsystem, fed by the service air subsystem, is the normal

Revision 5209/29/2016 NAPS UFSAR 9.3-2 supply to the containment instrument air subsystem, with the containment instrument air compressors providing backup capability. The normal operating pressure of the instrument and service air systems is 110 psig. The air pressure in the headers is reduced to the pressure required by instruments and controls at the point of use. In addition, service air is available at hose connections in each unit for operating equipment and tools during normal operation and refueling.

Each service air receiver is cross-connected to the instrument air receivers to allow service air to be used as the normal supply for the instrument air subsystem. Valves in the cross-connect piping are fully open to allow air to flow from the service air receivers to the instrument air receivers. Therefore, each instrument air receiver can receive air from either service air receiver at all times. In addition, the internals of the check valves located in the lines from each service air tank to the service air header, were previously removed to allow the service air system to be supplied from the construction air system. The construction air source was subsequently removed, due to air quality, and the check valve modification was retained by the compressed air system upgrade.

A 1005-ft3 service air receiver is installed between the service air compressor and the smaller (96-ft 3 ) service and instrument air receivers. The larger air receiver is also cross connected directly into the instrument air header in the Unit 2 turbine building with the tie in including a desiccant air dryer. The larger air receiver is installed to increase the air storage capacity of the system and thus reduce the frequency of the instrument air compressors loading cycle.

The desiccant air dryer in line from the 1005-ft3 receiver to the Unit 2 instrument air header includes a bypass line with a normally closed automatic bypass valve. A pressure switch is installed downstream of the dryer which is set to actuate the automatic valve (i.e., to the open position) when low air pressure is sensed in the instrument air header. This provides a flow path to the instrument air header in the event of a dryer malfunction therefore preventing depressurization of the header.

The instrument air receivers of each unit are connected to a common instrument air header.

One instrument air compressor is normally in HAND, in standby condition, running, but unloaded unless the instrument air supply pressure drops below a preset value. The second instrument air compressor is in auto-start condition. The loading and unloading setpoints for the instrument air compressors are staggered when one compressor is in HAND and the second compressor is in AUTO. This arrangement is used since both compressors are not needed to start at the same time.

Both compressors can run at the same time by manual control in the control room or as needed based on system pressure.

The service air receivers of each unit are connected to a common service air header. One service air compressor is normally in continuous service and the other on standby. A means of periodically alternating the service air compressors is provided.

Revision 5209/29/2016 NAPS UFSAR 9.3-3 The air compressors of the service and instrument air subsystems are of the nonlubricated rotary screw type to eliminate oil contamination of the instrument air. Each service air compressor is capable of providing approximately 660 scfm of compressed air at 125 psig, and each instrument air compressor is capable of providing approximately 440 scfm of compressed air at 118 psig.

The containment instrument air subsystem consists of two 100% capacity air-cooled compressors and driers. This equipment is located in each containment structure and provides instrument air to all pneumatically operated instruments and controls located inside the containment and are normally secured and used for backup. The normal supply is the instrument air system.

The two compressors in each containment instrument air subsystem are sized to have one in service and the other on standby. A means of periodically alternating the compressor in service is provided.

The instrument air compressors are cooled by a closed loop system which transfers the heat load to the service water system through a series of heat exchangers. Service water (Section 9.2.1) is available during normal unit operation and after a loss-of-power accident. The containment instrument air compressors inside containment are air-cooled. The service air compressors located in the yard near the main transformers are air cooled. The instrument air compressors and the containment instrument air compressors are connected to the emergency power system (Section 8.3) so that continuous power will be supplied to the instrument air compressors.

Following the occurrence of a loss-of-coolant-accident, the containment instrument air compressors will be rendered nonfunctional due to their submergence in containment. The electrical power is designed to accommodate this occurrence (Section 6.3.3.10). Additionally, the control room operators are directed to place the control switch for the affected units H bus compressor (1/2-IA-C-2A) in the off position during a CDA to minimize H bus loading.

Seismically supported air bottles have been provided for all safety related air-operated valves which may be operated during accident conditions. The air bottles are of sufficient capacity to allow time for the operator to isolate the affected portion of the system and return the air system to manual operation.

Station instrument air and service air lines penetrating the containment structures are provided with Phase B containment isolation valves located outside the containment to seal the containment internal atmosphere from the outside atmosphere during an accident. Instrument and service air line penetrations are isolated as described in Section 6.2.4.

Revision 5209/29/2016 NAPS UFSAR 9.3-4 9.3.1.3 Design Evaluation The following devices are provided to preserve an adequate instrument air supply under abnormal conditions and to ensure system reliability:

1. Check valves protect the instrument air system from a rupture in the service air system by preventing instrument air from feeding into the service air system. A bypass line is provided around the instrument air receivers, which permits the instrument air subsystem to be supplied directly from the service air receivers in the event of instrument air receiver failure.

2. Instrument air backup between the two units is provided by means of connecting the instrument air receivers to a common header.

3. All safety-related, air-operated valves that may be operated during accident conditions have air available from air storage bottles. The capacity of the storage bottles is sufficient to allow the operator to isolate the affected portion of the system and return the air system to manual operation.

4. The containment instrument air subsystem can be supplied from the containment instrument air compressors and receivers or from the instrument air system.

5. The instrument air compressors, the containment instrument air compressors, and the containment instrument air driers are connected to the emergency power system.

6. There are no pneumatic reactor system instruments.

An evaluation has been performed concerning the failure mode for air-operated valves required for safe shutdown.

9.3.1.3.1 Identification of Cause and Accident Description In the event of a loss of the instrument air system, all pneumatic instruments and air-operated control valves will be affected; however, such a condition will not prohibit the achievement of a safe-shutdown condition. Section 7.4 identifies instruments, controls, and monitoring features required to achieve and maintain a safe-shutdown condition. Most of this equipment is electrical or electronic and is powered from the emergency onsite power system.

The following are the air-operated instruments and valves required for a safe shutdown:

1. Auxiliary feed-pump discharge pressure controllers and valves, and the auxiliary feedwater isolation valves.

2. The charging flow control valve.

3. Atmospheric steam dump valves.

4. Containment isolation valves.

Auxiliary feed-pump discharge pressure controllers and valves, auxiliary feedwater isolation valves, and atmospheric steam dumps will remain capable of operation.

Revision 5209/29/2016 NAPS UFSAR 9.3-5 In addition to the instruments and controls provided on the main control board and auxiliary shutdown panel, a telephone network exists between critical equipment areas and control board areas, thereby allowing manual control coordination using local indication.

A loss of instrument air can only occur from a rupture of the main instrument air headers or major subheaders.

Loss of instrument air due to equipment failure or loss of offsite power is not credible for the following reasons:

1. Sufficient equipment redundancy has been incorporated into the instrument air subsystem design with regard to compressors and receivers.

2. The instrument air compressors are powered from the emergency onsite power system (refer to Section 8.3).

3. All safety-related, air-operated valves that may be operated during accident conditions will have air available from air storage bottles. The capacity of the storage bottles is sufficient to allow the operator to isolate the affected portion of the system and return the air system to manual operation.

9.3.1.3.2 Analysis of Effects and Consequences The initial loss of the air pressure will be detected and alarmed in the main control room.

Redundant indication of instrument air header pressure is also provided in the main control room.

If the rupture of a main instrument air header does initiate a complete loss of air, operator action is required to locate and isolate the pipe break using the local pressure indication provided.

In the event of a loss of instrument air to pneumatic instruments (Section 3.1.19.2) or valves required to achieve a safe- shutdown condition, the following will occur:

1. Auxiliary feed pump discharge pressure control valves and isolation valves will remain capable of operation, allowing complete and uninterrupted control of the auxiliary feedwater system.

2. Redundant motor-operated valves powered from the emergency onsite power system will work in parallel with the air-operated auxiliary feedwater hand control valves to ensure an uninterrupted supply of auxiliary feedwater.

3. The charging flow control valve will fail open on loss of instrument air, thus ensuring a continuous supply of charging flow.

4. The atmospheric steam dump valves will remain capable of operation and will be used to dissipate the core sensible and residual heat as required.

5. All air-operated containment isolation valves will fail closed on loss of instrument air.

Revision 5209/29/2016 NAPS UFSAR 9.3-6 Following a complete loss of instrument air, the following events will occur:

1. All valves required for safe shutdown will remain capable of operation. All other pneumatic instruments and valves will fail in the safe position.

2. A turbine trip-reactor trip will occur if main steam trip valves trip closed.

3. The atmospheric steam dump valves will discharge to the atmosphere to dissipate the core sensible and residual heat as required.

4. The auxiliary feedwater system will start automatically as a result of the loss of normal feedwater. This system, in conjunction with the atmospheric steam dump valves, will maintain the unit in a hot shutdown condition.

9.3.1.3.3 Conclusion Results of this analysis show that a loss of instrument air can only occur from a main header or major subheader rupture and will not prevent the plant from achieving a safe-shutdown condition.

9.3.1.4 Tests and Inspections Testing of this system is unnecessary because of its normal day-to-day operation. Inspection is performed in accordance with normal station maintenance procedures.

9.3.1.5 Instrumentation Application Hand-off-auto selector switches for operation of the instrument and service air compressors are located in the control room.

Hand-off-auto selector switches for operation of the containment instrument air compressors are located in the control room.

Instrument, containment instrument, and service air header pressures are monitored both locally and in the main control room.

Alarms indicating instrument or service air compressor trouble are provided both locally and in the main control room.

Alarms indicating containment instrument air compressor trouble and low containment instrument air pressure are provided in the control room only.

9.3.2 Sampling Systems Sampling systems include a normal operations sampling system and a post-accident sampling system.

Revision 5209/29/2016 NAPS UFSAR 9.3-7 9.3.2.1 Sampling SystemNormal Operations 9.3.2.1.1 Design Basis The sampling system, shown in Figure 9.3-2 and Reference Drawings 14 through 17, is designed to provide a means of obtaining representative primary and secondary liquid and gaseous samples as required to effectively monitor the operation of both units. The system provides samples from numerous different sources, which can be sampled either locally or at sample sinks in the auxiliary building and service building.

Certain samples are continuously monitored, such as the steam generator blowdown for radioactivity, pH, conductivity, and sodium, and the condensate pump discharge for conductivity, pH, and dissolved oxygen and sodium. Continuous sample monitoring can also be used on the feedwater pump discharge and the condensate system downstream from the chemical feed connections. High-temperature samples, with the exception of the pressurizer vapor space sample, are cooled with sample coolers to a temperature of approximately 150°F. Sample points that are continuously monitored are further cooled to approximately 80°F by aftercoolers. Radioactive samples are delayed to allow for sufficient decay of short-lived isotopes and/or shielded from the sample sink in order to protect the personnel handling the samples.

Sample lines penetrating the containment have isolation valves designed in accordance with the criteria in Section 6.2.4 for containment isolation valves.

When appropriate, samples originating within the containment are joined into a common header before penetrating the containment wall in order to limit the number of penetrations.

Air-operated valves inside the containment are used to select and control the appropriate sample.

All other samples are manually controlled at one of the sample sinks or a local sample point.

The auxiliary building sample sinks are behind a concrete wall, shielding personnel from radioactive sample lines and cooling coils. A sample purging arrangement is provided in order to ensure a representative sample.

9.3.2.1.2 System Description Representative process liquids and gases are sampled for testing to obtain data from which the performance of equipment and systems may be determined and properly regulated. Samples at various temperatures and levels of radioactivity are drawn from numerous different primary and secondary systems throughout each unit. The various samples taken are categorized in Table 9.3-2. They are listed as high-temperature samples (greater than 150°F) or low-temperature samples (less than 150°F), and the radioactive samples are so labeled.

All high-temperature samples, except the pressurizer vapor space sample, are cooled to approximately 150°F or less by sample cooling coils located in the auxiliary building sample room. These coolers are cooled by the component cooling system (Section 9.2.2) and are manually throttled to reduce the sample temperature to a safe handling level. Samples leaving the

Revision 5209/29/2016 NAPS UFSAR 9.3-8 coolers can be directed either to a purge line or to the sample sink. The pressurizer vapor space samples are bled through capillary tubes and collected in a sample vessel. Samples of low-temperature liquids or gases, such as the high-level waste drain tank, are not cooled further.

Although all samples can be drawn periodically, depending on laboratory analysis and station operation requirements, several samples are continuously monitored. These samples include steam generator blowdown, feedwater, and condensate. The steam generator blowdown samples are continuously monitored for radiation, pH, cation conductivity, and sodium. Although these samples are not normally radioactive, each steam generator is continuously monitored during normal operation for reactor coolant leakage from the primary to the secondary side. Any primary-to-secondary leak would be detected by one of three radiation monitors (one for each steam generator) that are used to continuously monitor steam generator blowdown.

The nonradioactive feedwater pump discharge and condensate pump discharge samples are continuously monitored for pH, conductivity, and dissolved oxygen and sodium in the condensate pump discharge. The monitoring of the condensate pump discharge is required for detecting tube leaks in the condenser.

Samples may be continuously monitored for pH and conductivity in the condensate system downstream from the chemical addition connections to monitor the chemistry in the feedwater heaters.

The steam generator on-line chemistry monitoring system provides continuous monitoring from four main sample locations in the secondary system: (1) final feedwater, (2) steam generator blowdown, (3) main steam, and (4) condensate. There are also two supplemental sample locations: (1) condensate make-up effluent, and (2) heater/moisture separator reheater drains.

Samples are cooled by primary coolers which receive their cooling water supply from the bearing cooling water and component cooling water system. Samples flow to their respective conditioning, monitoring, and recording panels located on the ground floor in the turbine buildings. Steam Generator feedwater dissolved oxygen and corrosion product samples are analyzed locally in the Mechanical Equipment Room. Output signals from the chemical monitoring panels are fed to an I/O data controller for input to on-site computers.

A hydrogen analyzer is provided in the auxiliary building sample room for determining the hydrogen content of the reactor coolant system.

All samples from within the containment are high-temperature samples, with the exception of the pressurizer relief tank sample. Where two or more containment samples join into a common header, such as the reactor coolant cold-leg samples, each individual sampling line has an air-operated valve in the line that can be remotely operated from a control panel located in the auxiliary building sampling room. The reactor coolant hot-leg and cold-leg samples flow through delay coils before penetrating the containment. The delay coils, plus long runs of sample line, permit sufficient decay of nitrogen-16, so that these samples can be safely handled in the auxiliary

Revision 5209/29/2016 NAPS UFSAR 9.3-9 building sampling room. All sample lines penetrating the containment have containment isolation valves as described in Section 6.2.4.

With the exception of local samples, which are not considered part of the sampling system, samples from systems located in each containment and in the auxiliary building are collected in the auxiliary building sampling sinks. Similarly, samples from each of the turbine buildings and the service building are collected in a common sampling sink located in the service building. The high-temperature samples pass through sample cooling coils and are manually throttled. The main steam samples also pass through capillary tubes. In general, samples can either be directed to a purge line or to the sampling sink. When a line has been sufficiently purged, a sample is obtained by diverting the flow to the sample sink.

Purge headers are located near the auxiliary building sample sink to permit purging each sample line before collecting a sample. Purging up to the sampling tap may be accomplished by purging into the hooded sampling sink or by connecting the tap back into the purge header by means of a purge line tap located in each sampling sink.

The following purge headers are available:

1. Hydrogenated gaseous purge.

2. Aerated low-activity liquid purge.

3. Aerated high-activity liquid purge.

4. Hydrogenated liquid purge.

5. Gaseous purge.

The hydrogenated gaseous purge header is discharged to the gas stripper in the boron recovery system (Section 9.3.5). The aerated low- and high-activity liquid purge headers are discharged to the low- and high-level waste drain tanks, respectively. The hydrogenated liquid purge header may be discharged into either the Unit 1 or Unit 2 volume control tank or the gas stripper. The gaseous purge header is discharged into the waste gas charcoal filters (Section 11.3).

Primary-grade water is supplied to flush and clean the sample sinks and sampling utensils.

All drains from the auxiliary building sample sinks flow to the vent and drain system (Section 9.3.3). Drains from the service building sample sink flow to the low-level-waste disposal system. Local instrumentation is provided to ensure that samples are at suitable temperatures and pressures before diverting the flow to the sampling taps in the sampling sink. Purging flow rates are shown by a flow indicator.

9.3.2.1.3 Design Evaluation If a critical sampling line becomes nonfunctional as a result of some malfunction, there is at least one alternative path that can be used to obtain a similar sample, either for continuous or periodic monitoring. For example, if the condensate pump discharge sample line becomes

Revision 5209/29/2016 NAPS UFSAR 9.3-10 nonfunctional, condensate can be monitored continuously for conductivity using the local condensate hotwell sampling lines. If one of the steam generator blowdown radiation monitors malfunctions, valving exists to permit the use of one of the two remaining radiation monitors. If one of the steam generator blowdown sampling lines become nonfunctional, alternate means to provide indication of a steam generator primary-to-secondary-side leak are available (e.g., the condenser air ejector radiation monitor).

Purge line connections to the purge headers are provided in each sampling sink in the auxiliary building to allow purging directly from the sampling tap. The aerated low-activity liquid purge header, aerated high-activity liquid purge header, and hydrogenated liquid purge header have interconnecting lines to allow purging to any of the three headers, depending upon the type of sample being purged and the availability of the purge header. The hydrogenated liquid-purge header may be discharged to the gas stripper in a situation when neither the Unit 1 nor Unit 2 volume control tank can accommodate the quantity of sample liquid discharged as a result of a lengthy purge. The use of the purge headers greatly reduces the volume of contaminated liquid that would otherwise be discharged to the liquid waste disposal system (Section 11.2).

The auxiliary building sample sinks are located behind a concrete shield wall in order to protect personnel from exposed radioactive sampling lines and cooling coils. Instrumentation and valve stem extensions to control valves behind the shield wall are located near the sampling sink wherever possible in order to limit radiation exposure to sample-handling personnel. Positive ventilation of the hooded sample sinks ensures that any possible contamination is trapped by the auxiliary building ventilation system (Section 9.4.2).

Sample-cooling coils can be regulated by throttling either the coolant or the sample itself, in order to lower the high-temperature sample to a reasonable temperature. Aftercoolers are provided for those systems that continuously monitor temperature-sensitive parameters such as pH or conductivity. The coolers automatically maintain sample temperatures at approximately 80°F.

The steam generator on-line chemistry monitoring system samples from the various sample locations are cooled within 5 feet of the sample tap locations by primary coolers which use either bearing cooling water or component cooling water. The temperature of the sample exiting the primary coolers is regulated by throttling the cooling water flow rate with a temperature control valve located in the cooling water line to the primary coolers.

From the primary coolers, samples flow through 1/4 inch or 3/8 inch 316 stainless steel tubing to their respective conditioning, monitoring, and recording panels. The panels are packaged systems containing components to regulate sample temperature, pressure, and flow rate and analyzers, monitors, and recorders for various chemical parameters.

The sample panels are freestanding, closed panels provided with air-conditioning to control environmental conditions. The sample panel secondary temperature control system refrigeration

Revision 5209/29/2016 NAPS UFSAR 9.3-11 units are freestanding units. These units are located close to the sample panels. Cooling water to these units is supplied from the bearing cooling water system.

All sample panel drains are collected in a holding tank and are normally drained to the turbine building sump but can be pumped to the auxiliary building for radwaste processing if required.

9.3.2.1.4 Tests and Inspections Most components are used regularly during power operations, cooldown, and/or shutdown, thus ensuring the availability and performance of the system. The continuous monitors are periodically tested, calibrated, and checked to ensure the proper instrument response and operation of alarm functions.

9.3.2.1.5 Instrumentation Application The continuous blowdown radiation monitors are recorded in the main control room. The on-line chemistry monitoring system (OLCMS) monitors may be recorded at the OLCMS panels or observed on computer in the chemistry lab. Alarms at the OLCMS panels or chemistry lab can alert plant staff when continuously monitored parameters exceed preset limits.

A valve control panel located in the sample area operates the trip valves used to select the source of a given sample. Some of these trip valves are in the containment structures. Additional trip valves in the system are used for containment isolation only (Section 6.2.4).

9.3.2.2 High Radiation Sampling SystemPost-Accident 9.3.2.2.1 Design Basis The post-accident sampling system design basis was formulated through NUREG-0578, Section 2.1.8a, with clarifications provided by NUREG-0737, Item II.B.3. The system is designed to obtain and analyze representative samples of reactor coolant, containment atmosphere and containment sump in a timely fashion after the occurrence of an accident. The system is no longer required for post-accident sampling and has been removed from the North Anna Technical Specifications but is maintained to provide contingency measures in accordance with Reference 1. North Anna Power Station contingency measures are being provided by maintaining portions of the HRS system to facilitate acquiring diluted and non-diluted samples of the reactor coolant system (RCS), containment sump, and the containment atmosphere. These samples can then be analyzed on site or sent off site for analysis. Station procedures control the sampling evolutions. The in-line analysis capability of the HRS system is no longer required for timely analysis of post-accident samples and will not be maintained with the exception of the gas chromatograph portion of the chemical analysis panel (CAP). The CAP will be maintained as needed to provide a means of analyzing containment atmospheric samples during normal operation. The system provides the ability to obtain grab samples from each reactor coolant hot leg, each reactor coolant cold leg, the residual heat removal system, the containment sump, and

Revision 5209/29/2016 NAPS UFSAR 9.3-12 the containment atmosphere. The system has the capability to cool and depressurize liquid samples at high temperature and high pressure to allow grab sampling and in-line chemical analysis, however in-line chemical analysis is no longer performed.

The system also provides the means to remotely dilute reactor coolant and containment sump samples by a factor of 1000 to reduce the personnel exposure levels that would otherwise be associated with post-accident sampling. This initial dilution also reduces the exposure that would be associated with subsequent manual dilutions, if required.

The diluted and undiluted liquid grab samples are put into specially designed transfer carts with integral shielding. Placement of the samples inside the shields can be accomplished with minimal operator exposure because the cart is integrally designed to nest within the sample panel.

The transfer carts facilitate movement to designated areas for isotopic or chemical analysis with low operator exposure.

The sampling system has the ability to strip reactor coolant of dissolved gases for grab sampling and analysis.

An in-line chemical analysis panel was originally included to facilitate remote measurement of important chemical parameters with a minimum of manual action or exposure to the operator.

This chemical analysis panel has the capability to measure primary coolant pH, boron, oxygen concentration, and hydrogen concentration, as well as containment hydrogen concentration. The capability for in-line chloride measurement utilizing a portable ion chromatograph is also provided. Each parameter is either indicated or recorded on a remote-control panel located in a separate area of the station. The in-line chemical analysis panel is no longer required for post-accident sampling.

The high radiation sampling system panels are located within existing space in the auxiliary building. The reactor coolant is drawn from sample system lines outside of containment, upstream of the normal sample system coolers.

Controls are provided to prevent post-accident samples from being inadvertently introduced to the normal sample room.

Sample liquid resulting from recirculation, purging, and drainage can be routed to the high radiation sampling system waste tank, from which the fluid can be pumped or displaced with nitrogen back to the containment sump. Connections are provided to recirculate, purge, and drain non-accident liquid samples via normal sample system flow paths for purposes of operator training and periodic equipment testing.

The containment atmosphere sample panel has the capability to take suction from within the hydrogen monitor system. Motive force for the containment atmosphere sample panel is provided by an integral nitrogen eductor. The discharge of the containment atmosphere panel is routed back to the containment via the high radiation sampling system waste tank, and evacuating compressor.

Revision 5209/29/2016 NAPS UFSAR 9.3-13 The high radiation sampling system and components are designated nonsafety-related, and are considered Quality Group D and non-seismic, as defined in Regulatory Guide 1.26.

9.3.2.2.2 High Radiation Sampling System Description Representative post-accident liquid and gas samples from either reactor unit can be routed to one common high radiation sample system. Samples can be received from the sources listed in Table 9.3-9. The tie-in locations for all reactor coolant samples are outside the containment, upstream of the sample system coolers. Since the reactor coolant sample lines are combined into common headers inside containment, one common hot-leg sample and one common cold-leg sample for each unit is routed to the high radiation sampling system liquid sample panel.

The motive force for all reactor coolant samples is primary system pressure. A containment sump pump, appropriate for its service duty, is provided to obtain containment sump samples. The motive force for a containment atmosphere sample is provided by a nitrogen eductor contained within the containment air sample panel.

The high radiation sampling system is designed so that incoming liquid sample lines are purged to ensure that the grab samples are representative. The line volumes will be purged several times during this operation. During post-accident conditions, primary system liquid samples are purged directly to the high radiation sampling system waste tank. The associated waste pumps can then transfer the accumulated liquid waste to the appropriate containment sump. For system test and operator training, liquid samples can be recirculated via the normal sample pathways to the appropriate volume control tank or high-level drain tank purge headers.

The high radiation sampling system is comprised of five subsystems. These are:

1. Liquid sample panel and coolers.

2. Containment atmosphere sample panel.

3. Chemical analysis panel.

4. Waste tank and pump.

5. Process control panel.

9.3.2.2.2.1 Liquid Sample Panel and Coolers. The liquid sample panel and coolers perform multiple functions:

1. Sample cooling to about 135°F during the recirculation mode and about 120°F during the grab sample mode.

2. Sample depressurization.

3. Liquid degassing to obtain a representative dissolved gas sample.

4. Liquid degassing to the extent necessary to allow in-line chemical analysis downstream in the chemical analysis panel. (not used)

Revision 5209/29/2016 NAPS UFSAR 9.3-14

5. Provides undiluted liquid grab sample inside a shielded transfer cask.

6. Provides diluted (1000 to 1) liquid grab sample inside a shielded transfer cask.

7. Provides diluted dissolved gas grab sample inside a shielded syringe.

8. Provides integral shielding to minimize operator exposure while working in front of the panel.

9. Provides a ventilated cabinet, held below atmospheric pressure, to contain potential subsystem leakage. Cabinet ventilation is connected to the auxiliary building HVAC system.

The liquid sample subsystem is divided into three modules, based upon the pressure of the incoming liquid. A reactor coolant module handles hot-leg, cold-leg, and residual heat removal system samples. A demineralizer module handles the chemical volume and control system mixed-bed demineralizer effluent samples. A radwaste module handles the containment sump samples.

The in-line liquid sample coolers are cooled by the components cooling system (Section 9.2.2).

The liquid sample subsystem contains provisions for flushing with station primary-grade water. The flush water is routed to the high radiation sampling system waste tank.

9.3.2.2.2.2 Containment Air Sample Panel. The containment air sample panel performs the following functions:

1. Provides the motive force to obtain a representative grab sample of containment atmosphere.

A nitrogen eductor is provided that is capable of operation when the containment pressure is either slightly negative or at the maximum post-accident pressure.

2. Provides three shielded sample bombs and a gas partitioner device to obtain containment atmosphere samples on a preprogrammed timer sequence. The gas partitioner is independently controlled and separates the containment air sample for particulate, iodine, and noble gas determination.

3. Provides a motive force by a nitrogen eductor to deliver containment air sample flow to the chemical analysis panel for atmospheric analysis to determine the hydrogen concentration.

4. Provides a means to purge and backflush containment air sample lines back to the affected containment.

5. Provides an integrally shielded panel front to minimize post-accident operator dose rates.

6. Provides a ventilated cabinet held below atmospheric pressure to contain potential subsystem leakage. Cabinet ventilation is connected to the auxiliary building HVAC system.

Revision 5209/29/2016 NAPS UFSAR 9.3-15 9.3.2.2.2.3 Chemical Analysis Panel. The chemical analysis panel is no longer used but was designed to perform the following functions:

1. Accepts a preconditioned, cooled, depressurized and degassed, liquid sample from the liquid sample subsystem for post-accident chemical analysis for boron, pH, dissolved hydrogen and dissolved oxygen, and hydrogen concentration in post-accident containment atmosphere samples.

2. Provides remote readout of chemical analysis panel parameters on the remote process control panel of the high radiation sampling system.

3. Provides an integrally shielded panel front to minimize post-accident operator dose rates.

4. Provides a ventilated cabinet held below atmospheric pressure to contain potential subsystem leakage. Cabinet ventilation is connected to the auxiliary building HVAC system.

5. Provides the necessary connections to connect a portable ion chromatograph for in-line chloride analysis of the reactor coolant.

Table 9.3-10 lists the types of instrumentation that may be used for determination of post-accident chemical parameters. Instrumentation has been selected based upon the following criteria:

1. The ability to measure accurately the full anticipated range of parameters.

2. The ability to withstand high radiation fields.

3. The ability to reproduce results after calibration.

4. The ability to measure chemical parameters with small sample volumes.

The chemical analysis panel is designed with built-in instrument calibration equipment.

Instrument calibration will be performed by station personnel on a periodic basis to maintain a ready condition and to minimize instrument drift.

9.3.2.2.2.4 Waste Tank, Pumps, and Evacuating Compressor. The waste tank and pumps have the ability to collect and return system purge and flush liquids to either containment or to the unit high level waste drain tank. The liquid sample purge return lines to the containment are routed to the containment sump.

Two 100%-capacity waste tank pumps are provided to pump the tank contents back to the containment. A nitrogen purge connection is provided to force the contents of the tank back to the containment in the event of pump failure, and also to maintain a nitrogen blanket in the waste tank to preclude accumulation of hydrogen.

The waste tank will be held under a slight vacuum at all times by an evacuating compressor, and will be nitrogen-blanketed. The evacuating compressor also discharges containment air samples which enters the waste tank from the containment air sample panel. A bleed and feed

Revision 5209/29/2016 NAPS UFSAR 9.3-16 system will control the evacuating compressor and nitrogen purge flow. The evacuating compressor discharges can be directed to either containment.

Tables 9.3-11, 9.3-12, and 9.3-13 provide design data for the waste tank, the waste tank pumps, and the evacuating compressor, respectively.

9.3.2.2.2.5 Process Control Panel. The process control panel performs the following functions:

1. Provides remote location in the service building in a low dose rate area for operation of all high radiation sampling system remotely operated valves, with the exception of the routine sample system containment isolation valves, which are operated from the control room.

2. Provides space for chemical analysis panel instrument indicators and recorders.

The process control panel contains a complete system graphic display for the other four subsystems. A communication system is provided between the sample panel area in the auxiliary building, the process control panel in the service building, and the control room.

9.3.2.2.2.6 Instrumentation Application. The chemical analysis panel measured parameters are indicated and recorded on the remote process control panel. Parameters measured are boron concentration, pH, dissolved oxygen, chloride, dissolved hydrogen, and containment air hydrogen concentration. Local flow and pressure indication are on the face of the liquid sample, containment atmosphere, and chemical analysis panels to enable the operator to manually align and adjust system flows.

The process control panel permits remote operation of all high radiation sampling system automatic valves, including those routine containment sample system valves, which are normally operated from a panel in the routine sample room.

Isotopic analysis of reactor coolant or containment atmosphere samples will be available if required. The maximum postulated activity concentration of post-accident samples is far in excess of the capabilities of normal counting equipment and geometries. Thus, sample dilution will be required prior to analysis. The liquid sample subsystem provides a 1000 to 1 dilution of reactor coolant samples. However, depending upon the accident condition, additional final dilution can be accomplished in a shielded fume hood. The diluted sample can then be analyzed by existing laboratory counting equipment.

The liquid sample subsystem can provide a shielded syringe sample of diluted reactor coolant gases that can also be further diluted, if necessary, in the adjacent shielded fume hood.

These samples can then be analyzed in existing laboratory counting equipment.

Design conditions of the various sampling panels are given by Table 9.3-14.

Revision 5209/29/2016 NAPS UFSAR 9.3-17 9.3.2.2.3 High Radiation Sampling System-Design Evaluation The high radiation sampling system equipment is designated Quality Group D, non-seismic, as defined in Regulatory Guide 1.26. Seismic failure will not damage station safety-related equipment or the building structures.

Electrical power supply is from the station service buses. In the event of a loss of normal power, a throw-over switch is provided to allow power from the opposite unit.

The air-operated trip valves in the residual heat removal sample lines and the reactor coolant system hot-leg and cold-leg sample lines have been replaced with direct-acting solenoid valves. This ensures that the valves can be reopened to draw the sample, under the single-failure criterion after an accident.

The air-operated valves that are required to operate in order to obtain the reactor coolant sample are furnished with dedicated instrument air accumulators so that the ability to open the valves remotely will be available in the event that the station instrument air system is temporarily nonfunctional. System interlocks are provided throughout to perform the following basic functions:

1. To ensure that samples obtained after an accident can only be returned to the affected containment. A similar philosophy is applied to system purge and flush fluids.

2. To ensure that post-accident sample fluid cannot inadvertently enter the routine sample system.

Permanent system connections to the station nitrogen system are provided, along with a nitrogen bottle backup system.

Redundant waste tank pumps are provided to pump post-accident samples back to the affected containment. Nitrogen can be used to empty the waste tank in the event of dual pump failure or loss of electric power.

System flush water is obtained from the stations primary-grade water system.

Primary-grade water connections to the system are quick-disconnect type. After each use of flush water, the system will be disconnected to minimize the possibility of primary-grade water contamination by postaccident samples. Each sample acquisition will be followed by a flush to keep background radiation levels to a minimum, in accordance with the as low as reasonably achievable (ALARA) concept.

A shielding analysis has been performed to ensure that operator exposure while obtaining and analyzing a post-accident sample will be less than 5 rem whole-body and 75 rem to the extremities. Operator exposure will be accumulated while entering and exiting the sample panel area, operating sample panel manual valves, positioning the grab sample into the shielded transfer

Revision 5209/29/2016 NAPS UFSAR 9.3-18 carts, and performing additional manual sample dilutions, if required, for isotopic analysis. The major sources of operator exposure are from:

1. General auxiliary building background from components not associated with the high radiation sampling system. Operator exposure is limited by the stay time associated with sample panel manual operations, and by selecting entrance and exit routes to the sample room via the lowest dose rate paths.

2. Direct radiation from sample lines that are routed behind the shielded sample and analysis panels. Operator exposure is limited by the integral shielding located in the front of each of the system sample analysis panels. This shielding consists of up to 6 inches of lead shot poured into panel front sections.

3. Backscatter from the walls and roof behind and above the shielded sample and analysis panels. Operator exposure is limited by positioning the panel in an orientation such that the distance from the back of the panel to the nearest wall is maximized to the greatest extent practicable. A shadow shield is provided above the normal operator area.

9.3.2.2.4 High Radiation Sampling SystemTests and Inspections The high radiation sampling system is no longer required for post-accident sampling and the system has been removed from North Anna Technical Specifications. However, the system remains in place and available, and portions of the system will be maintained to provide contingency sampling measures. Therefore, applicable portions of the system will be maintained as required to ensure that contingency sampling measures remain available. Station personnel will undergo training sessions to ensure familiarity with functions and operations of the system that are required for use as contingency sampling measures. The chemical analysis instrumentation will not be used for post-accident sample analysis, therefore regular calibration and testing is no longer required. Instrumentation required for containment atmospheric analysis will be maintained as necessary to support containment atmospheric analysis during normal operation.

9.3.3 Vent and Drain System The vent and drain system collects potentially radioactive fluids and gases from various systems and discharges them either to the waste disposal systems liquid or gaseous (Chapter 11) or to the boron recovery system (Section 9.3.5).

9.3.3.1 Design Basis The-vent and drain system is shown in Figure 9.3-3 and Reference Drawings 18 through 20.

The drains are separated into those carrying waste fluids to the waste drain tanks for processing and disposal, and those carrying reactor coolant fluids to the primary drain transfer tank for processing and recovery. The vents are separated into aerated vents in which air is the predominant gas (filtered and discharged to the atmosphere via the process vent), and gaseous

Revision 5209/29/2016 NAPS UFSAR 9.3-19 vents in which hydrogen and radioactive gases such as argon, krypton, and xenon are predominant (discharged to the gaseous waste disposal system).

The design data for the vents and drain system components are given in Table 9.3-3.

Seismic Category I piping in the vent and drain system is shown in Reference Drawings 18 through 20 and is identified as those lines containing Q1, Q2, or Q3 as part of the line identification. The Seismic Category I components in the vent and drain system are the primary drain transfer tank, the primary drain transfer tank cooler, and the primary drain transfer pumps.

9.3.3.2 System Description Liquids from potentially contaminated sources, other than those originating in the reactor coolant system (Chapter 5), are transferred to the high-level waste drain tanks in the liquid waste disposal system (Section 11.2) via the high-level-waste drain header. Liquids collected in the high level waste drain tanks are processed through filters and demineralizers, pumped to the low level waste drain tanks, and then released if they meet release limits as specified in the Offsite Dose Calculation Manual (ODCM). If the liquids do not meet release limits, then they are reprocessed.

Both containment structures, the auxiliary building, the fuel building, the decontamination building, both safeguards areas, the valve pit areas, and both incore instrumentation areas have been provided with sumps for collecting drainage. The drainage is transferred by sump pumps to either the high- or low-level-waste drain tank, depending on the activity level, from all the sumps except the decontamination building sump, which is pumped to the fluid waste treatment tank.

Duplicate sump pumps are located in the following areas containing essential equipment:

Pump Capacity (gpm) Unit Safeguard area sump pumps 25 (each) 1&2 Fuel building sump pumps 25 (each) 1 Auxiliary building sump pumps 50 (each) 1 Reactor containment sump pumps 25 (each) 1&2 Emergency switchgear and 40 (each) 1&2 relay room sump pumps Chiller room sump pumps 100 (each) 1&2 The chiller room sump pumps are Seismic Class I and are designed to handle the maximum expected flows. The other pumps are not classified as Seismic Class I, as they are not required to perform safety functions.

Ground-water seepage into the above sump pump equipped buildings is minimal, as extensive construction and design efforts and inspections are expended to prevent leakage. The

Revision 5209/29/2016 NAPS UFSAR 9.3-20 capacities of the pumps are much greater than the ground-water leakage rate experienced at similar operating reactor plants.

Of the areas where the pumps listed above are located, only the auxiliary building and fuel building have fire protection water available. Fire protection is in the form of man-operated fire hoses and/or automatic sprinkler activation. Water required to extinguish a small fire can be controlled by the sumps and sump pumps. A large fire is not credible because of the lack of combustible materials in these areas, as discussed in Section 9.5.

Of the areas where the pumps listed above are located, high-energy lines are present only in the containment and auxiliary buildings. The sump pumps in these areas are designed with sufficient capacity for packing leaks and miscellaneous minor leakages. A high-energy pipe break of small flow will be handled by the sump pumps. Larger breaks, which exceed the capacity of the pumps, will set off high-level alarms. The elevation of essential equipment in these areas, in relation to their respective sumps, allows more than adequate time to stop the flow from a postulated pipe break before the water could reach a level capable of endangering essential equipment.

Arrangement drawings of the floor-drain system are shown on Reference Drawings 21 through 23 (auxiliary building); 24 and 25 (fuel building); 26 and 27 (turbine building); 28 and 29 (service building); 30 and 31 (reactor containment); 32 (decontamination building); 33 (spillway control house); and Figure 9.3-4 (emergency diesel generator room).

Non-seismic fluid lines in the auxiliary building, the fuel building, the turbine building, and the spillway control house are of small diameter and will not overload the floor drainage systems should they rupture. The emergency switchgear and relay rooms have independent floor drainage systems. All drainage is collected in a sump and then pumped through the missile wall at a high elevation. Redundant sump pumps connected to emergency power are used.

The emergency diesel generator room floor drainage system, as shown in Figure 9.3-4, is designed for general housekeeping purposes as well as to collect rainwater at the building air intake louvers in the event driving rain occurs during diesel operation.

A maximum depth of 7.5 inches of water may accumulate on the site, produced by the localized probable maximum precipitation. The ground floor of the emergency generator rooms is at Elevation 271 ft. 6 in. and the grade is at Elevation 271 ft. 0 in. Therefore, under the local probable maximum precipitation condition, water could accumulate to a depth of 1.5 inches above the floor. This amount of flooding would not have an adverse effect on diesel generator operation.

The only area containing essential equipment where the floor drainage system is not connected to the liquid waste disposal system is the emergency switchgear and relay room area.

The floor drainage system is shown on Reference Drawings 28 and 29. There are no high-energy lines or fire protection lines in this area.

Revision 5209/29/2016 NAPS UFSAR 9.3-21 The effect of turbine building flooding has been eliminated by the construction of barriers around the chiller room doors and relay room doors.

The floor drainage system handles normal drainage from the air-conditioning and chiller rooms and is designed to handle the maximum expected flow from normal drainage. Drain plugs are provided in the Unit 1 Air Handling Room floor drains, and backflow preventers are provided in Unit 2 Air Handling Room floor drains. These drain plugs and backflow preventers were added as a risk reduction modification to prevent flooding in the chiller room from impacting safety related equipment located in the emergency switchgear room. The redundant Chiller Room sump pumps are each capable of handling this flow. Each pump is connected to an emergency power source.

The low-head safety injection and recirculation spray pump motors and discharge lines are each located in separate cubicles at approximately the 256-foot floor elevation of the safeguards building.

Two sumps are located within the safeguards building. They are the safeguards building sump and the valve pit sump (Reference Drawings 43 through 46).

Each sump has alarms to indicate a high water level. These alarms, as explained in Section 6.2.2.6, combined with other system instrumentation, supply indication to the control room to initiate isolation of the water source.

Furthermore, the piping within the safeguards building is seismically designed. A pipe break is not considered credible.

The containment sump collects all drains in the containment that do not originate from the reactor coolant system. The auxiliary building sump collects floor drains, equipment drains, ion exchanger drains, and filter drains. The fuel building sump, decontamination building sumps, safeguards area sumps, incore instrumentation sumps, and valve pit sumps collect floor drains in their respective areas.

Drain liquids originating from the reactor coolant system, during maintenance for example, are discharged to a primary drain transfer tank through a high-pressure drain header. The high-pressure drain header permits the high- or low-pressure gravity draining of individual reactor coolant loops, the pressurized relief tank, or the complete reactor coolant system, except for the reactor vessel. An alternate use of the high-pressure drain header is to provide a path for excess letdown. Letdown can be drained through the high-pressure drain header to the excess-letdown heat exchanger. After being cooled, the letdown is sent to the volume control tank or diverted to the primary drain transfer tank.

The vent headers collect gases vented from various pieces of equipment and discharge the gases to the gaseous waste disposal system and the low-level-waste tanks of the liquid waste disposal system, which ultimately vent to the process vent blowers of the gaseous waste disposal system. The vent stream is monitored for radioactivity.

Revision 5209/29/2016 NAPS UFSAR 9.3-22 The vent lines that will contain hydrogen are listed below and are shown on Reference Drawings 19 and 20 for Unit 1; the corresponding Unit 2 lines are shown on Reference Drawing 19.

Line No. Source VG-1-152-Q3, 3/4 in. Pressurizer relief tank VG-2-152-Q3, 2 in. Volume control tank and hydrogen-contaminated gaseous purge header VG-3-152-Q3, 1-1/2 in. Primary drain transfer tank VG-4-152-Q3, 3/4 in. Volume control tank VG-5-152-Q3, 1-1/2 in. Volume control tank VG-6-153A-Q2, 1-1/2 in. Primary drain transfer tank VG-7-152-Q3, 1-1/2 in. Primary drain transfer tank VG-8-152-Q3, 1 in. Primary drain transfer tank cooler VG-9-152-Q3, 3/4 in. Volume control tank and hydrogen-contaminated gaseous purge header All vent lines that contain hydrogen are Seismic Class I pipes. These pipes collect gas only from hydrogenated vent sources and are maintained at a positive pressure in relation to the surrounding atmosphere. These arrangements and operating conditions preclude the admittance of oxygen to these vent lines. No combustible mixtures are possible as these lines contain only hydrogen; therefore, no hydrogen detectors are necessary.

9.3.3.3 Design Evaluation The vent and drain system is sized to handle the maximum amounts of liquids and gases expected during station operation. Sizing the equipment for these maximum values results in design parameters shown in Table 9.3-3.

Annual gaseous and liquid activity releases are given in Sections 11.2.5 and 11.3.5, respectively.

Austenitic stainless steel piping in the vent and drain system is used to transfer contaminated liquids and radioactive gaseous waste; carbon steel piping is used for noncontaminated liquids and nonradioactive gases.

The primary drain transfer tanks and interconnecting piping, valves, and supports conform to Seismic Class I criteria.

9.3.3.4 Tests and Inspections The formal testing of this system is unnecessary, since it is in normal day-to-day operation.

Revision 5209/29/2016 NAPS UFSAR 9.3-23 9.3.3.5 Instrumentation Application The auxiliary building, fuel building, and decontamination building sump pumps are duplex arrangements. The incore instrument room sump pumps are single pump arrangements. All these pumps are full sized and are controlled by float switches that cycle them on and off. Alternators provide equal wear on duplex pumps. Two additional float switches are provided to (1) start the standby pump in the event the operating pump fails and (2) sound an alarm in the main control room on high sump level. The above pumps may also be operated manually.

Each containment has a duplex sump pump arrangement. Each pump is full sized and independently controlled. One pump is in automatic service and the other in standby.

When the water level in the sump reaches a specified height, the pump starts. If the sump level continues to rise, an alarm sounds in the main control room and the operator starts the standby pump. The pumps stop automatically upon emptying the sump. Containment isolation valves are provided in the discharge piping and are interlocked with the pump controllers. The isolation valves open and close on pump start and stop. When initiated, the containment isolation Phase A signal applied to the isolation valves overrides the pump start signal and keeps the isolation valves closed.

The containment sump pump is intended to pump out minor leakage from pump glands, valve packing, etc. The layout of the containment is such that safeguards equipment is not susceptible to local flooding. All areas of the containment drain by gravity to the lowest level, at which elevation the water required to reach safeguards equipment would be in excess of the volume contained in the quench spray system. A design-basis earthquake (DBE) would not cause significant volumes of water to be released in the containment, as all major pipe systems in the containment are seismically designed. Therefore, the loss of the small sump pumps would not contribute to a flooding problem.

The containment design is such that safety-related areas are located at elevations that require a quantity of water in excess of the refueling water storage tank to cause damage.

The primary drain transfer pumps are full sized and independently controlled. Two pumps are provided for each unit. When the water level in the tank reaches a specified height, an alarm sounds in the main control room and the operator starts the pump. Containment isolation valves are provided in the discharge piping and are interlocked with the pump controllers. The isolation valves open and close on pump start and stop. When initiated, the containment isolation Phase A signal applied to the isolation valves overrides the pump start signal and keeps the isolation valves closed.

Revision 5209/29/2016 NAPS UFSAR 9.3-24 9.3.4 Chemical and Volume Control System 9.3.4.1 Design Basis The Chemical and Volume Control System design is described in the following sections.

Table 9.3-4 provides the system design parameters.

The only portion of the Chemical and Volume Control System that is not designed to Seismic Class I is the chemical mixing tank, the zinc injection skids and attached piping. The chemical mixing tank has a 5-gallon capacity and is normally isolated from any source of water; thus it does not present a flooding hazard to any safety-related equipment. The zinc injection skids are seismically restrained and separated by safety related check and manual isolation valves from the Seismic Class I portions of the charging system and does not present a hazard to any safety-related equipment.

The Unit 2 Normal Charging header is equipped with a normally closed piping connection that can be used with a portable pump to supply water to either Unit's RCS if needed during a Beyond Design Basis Event.

9.3.4.1.1 Reactivity Control The Chemical and Volume Control System regulates the concentration of chemical neutron absorber in the reactor coolant to control reactivity changes resulting from the change in reactor coolant temperature between cold shutdown and hot full-power operation, the burn-up of fuel and burnable poisons, and xenon transients.

Reactor makeup control includes the following:

1. The Chemical and Volume Control System is capable of borating the reactor coolant system through either one of two flow paths and from either one of two boric acid sources.

2. The amount of boric acid stored in the Chemical and Volume Control System always exceeds the amount required to borate the reactor coolant system to cold-shutdown concentration, assuming that the control assembly with the highest reactivity worth is stuck in its fully withdrawn position. This amount of boric acid also exceeds the amount required to bring the reactor to hot shutdown and to compensate for subsequent xenon decay.

3. The Chemical and Volume Control System is capable of counteracting inadvertent positive reactivity insertion caused by the maximum boron dilution accident (see Chapter 15).

9.3.4.1.2 Regulation of Reactor Coolant Inventory The Chemical and Volume Control System maintains the proper coolant inventory in the reactor coolant system for all normal modes of operation, including start-up from cold shutdown, full-power operation, and plant cooldown. This system also has sufficient makeup capacity to maintain the minimum required inventory in the event of minor reactor coolant system leaks. The Chemical and Volume Control System flow rate is based on the requirement that it permit the

Revision 5209/29/2016 NAPS UFSAR 9.3-25 reactor coolant system to be heated to or cooled from hot-standby condition at the maximum allowable rate and to maintain proper coolant level.

9.3.4.1.3 Reactor Coolant Purification The Chemical and Volume Control System removes fission products and corrosion products from the reactor coolant during the operation of the reactor and maintains these within acceptable levels. The Chemical and Volume Control System can also remove excess lithium ions from the reactor coolant, keeping the lithium concentration within the desired limits for pH control (see Table 5.2-25).

The Chemical and Volume Control System is capable of removing fission and activation products, in ionic form or as particulates, from the reactor coolant in order to provide access to those process lines carrying reactor coolant during operation and to reduce activity releases due to leaks.

9.3.4.1.4 Chemical Additions The Chemical and Volume Control System provides a means of adding chemicals to the reactor coolant system that control the pH of the coolant during initial start-up and subsequent operation, scavenge oxygen from the coolant during start-up, raise the oxygen level of the coolant during shutdown to chemically shock the piping and components by adding hydrogen peroxide, and control the oxygen level of the reactor coolant due to radiolysis during all operations subsequent to start-up.

The Chemical and Volume Control System is capable of maintaining the oxygen content and pH of the reactor coolant within limits specified in Table 5.2-25.

9.3.4.1.5 Seal-Water Injection The Chemical and Volume Control System is able to continuously supply filtered water to each reactor coolant pump seal, as required by the reactor coolant pump design.

9.3.4.1.6 Emergency Core Cooling The centrifugal charging pumps in the Chemical and Volume Control System also serve as the high-head safety injection pumps in the emergency core cooling system. Other than the centrifugal charging pumps and associated piping and valves, the Chemical and Volume Control System is not required to function during a loss-of-coolant accident. During a loss-of-coolant accident, the Chemical and Volume Control System is isolated except for the centrifugal charging pumps and the piping in the safety injection path.

9.3.4.2 System Description The Chemical and Volume Control System is shown in Figure 9.3-5 and Reference Drawing 34 through 36 with system design parameters listed in Table 9.3-4. The Chemical and

Revision 5209/29/2016 NAPS UFSAR 9.3-26 Volume Control System consists of two subsystems: the charging, letdown, and seal-water system; and the chemical control, purification, and makeup system.

9.3.4.2.1 Charging, Letdown, and Seal-Water System The charging and letdown functions of the Chemical and Volume Control System maintain a programmed water level in the RCS pressurizer, thus maintaining proper reactor coolant inventory during all phases of plant operation. This is achieved by means of a continuous feed and bleed process during which the feed rate is automatically controlled based on the pressurizer water level. The bleed rate can be chosen to suit various plant operational requirements by selecting the proper combination of letdown orifices in the letdown flow path.

Reactor coolant is discharged to the Chemical and Volume Control System from the reactor coolant loop piping downstream from the reactor coolant pump; it then flows through the shell side of the regenerative heat exchanger where its temperature is reduced by heat transfer to the charging flow passing through the tubes. The coolant then experiences a large pressure reduction as it passes through a letdown orifice and flows through the tube side of the nonregenerative heat exchanger, where its temperature is further reduced to the operating temperature of the mixed-bed demineralizers. Downstream from the nonregenerative heat exchanger a second pressure reduction occurs. This second pressure reduction is performed by the low-pressure letdown valve, the function of which is to maintain upstream pressure, which prevents flashing downstream from the letdown orifices.

The coolant then normally flows through the letdown filter bypass and one of the mixed-bed demineralizers. Flow may be directed through the letdown filter if filtration prior to the demineralizers is desired. A portion of the coolant may then pass through the cation-bed demineralizer that is used intermittently when additional purification of the reactor coolant is required.

The coolant then flows through the reactor coolant filter and into the volume control tank through a spray nozzle in the top of the tank. The gas space in the volume control tank is filled with hydrogen. The partial pressure of hydrogen in the volume control tank determines the concentration of hydrogen dissolved in the reactor coolant.

The charging pumps normally take suction from the volume control tank and return the cooled, purified reactor coolant to the reactor coolant system through the charging line. Normal charging flow is handled by one of the three charging pumps. The bulk of the charging flow is pumped back to the reactor coolant system through the tube side of the regenerative heat exchanger. The letdown flow in the shell side of the regenerative heat exchanger raises the charging flow to a temperature approaching the reactor coolant temperature. The flow is then injected into a cold leg of the reactor coolant system. A flow path is also provided from the regenerative heat exchanger outlet to the pressurizer spray line. An air-operated valve in the spray line is employed to provide auxiliary spray to the vapor space of the pressurizer near the end of plant cooldown, when the reactor coolant pumps are not operating.

Revision 5209/29/2016 NAPS UFSAR 9.3-27 A portion of the charging flow is directed to the reactor coolant pumps through a seal-water injection filter. It is directed down to a point between the pump shaft bearing and the thermal barrier cooling coil. Here the flow splits and a portion enters the reactor coolant system through the labyrinth seals and thermal barrier. The remainder of the flow is directed up the pump shaft, cooling the lower bearing, and to the No. 1 seal. The No. 1 seal leakoff flow discharges to a common manifold, exits from the containment, and then passes through the seal-water return filter and the seal-water heat exchanger to the suction side of the charging pumps. A very small portion of the seal flow leaks through to the No. 2 seal. A No. 3 seal provides a final barrier to leakage to the containment atmosphere. The Nos. 2 and 3 seal leakoff flows are discharged to the primary drain transfer tank in the waste disposal system.

An alternative letdown path from the reactor coolant system is provided in the event that the normal letdown path is nonfunctional and for draining an isolated reactor coolant loop. Reactor coolant can be discharged from a cold leg and flows through the tube side of the excess-letdown heat exchanger. Downstream from the heat exchanger, a remote-manual control valve controls the excess-letdown flow. The flow normally joins the No. 1 seal discharge manifold and passes through the seal-water return filter and heat exchanger to the suction of the charging pumps. The excess-letdown flow can also be directed to the primary drain transfer tank. When the normal letdown line is not available, the normal purification path is also not in operation. Therefore, this alternative condition would allow continued power operation for limited periods of time dependent on reactor coolant system chemistry and activity.

Surges in RCS inventory due to load changes are accommodated for the most part in the pressurizer. The volume control tank provides surge capacity for reactor coolant expansion not accommodated by the pressurizer. If the water level in the volume control tank exceeds the normal operating range, a proportional controller modulates a three-way valve downstream from the reactor coolant filter to divert a portion of the letdown to the boron recovery system. If the high-level limit in the volume control tank is reached, an alarm is actuated in the main control room and the letdown is completely diverted to the boron recovery system (Section 9.3.5).

A low level in the volume control tank initiates makeup from the reactor makeup control system. If the reactor makeup control system does not supply sufficient makeup to keep the volume control tank level from falling to a lower level, a low-low level signal causes the suction of the charging pumps to be transferred to the refueling-water storage tank.

Both the chemical addition tanks and refueling water storage tanks are protected from adverse environmental conditions such as freezing or icing that might affect their capability in attaining or maintaining a safe shutdown. The tanks are recirculated as necessary to prevent freezing, although they are insulated and of such size and volume that freezing is not anticipated to be a problem. All exposed piping to and from these tanks is redundantly heat traced.

Revision 5209/29/2016 NAPS UFSAR 9.3-28 9.3.4.2.2 Chemical Control, Purification, and Makeup System 9.3.4.2.2.1 pH Control. The pH control chemical employed is lithium hydroxide. This chemical is chosen for its compatibility with the materials and water chemistry of borated water/stainless steel/zirconium/Inconel systems. In addition, lithium-7 is produced in the core region as a result of the irradiation of the dissolved boron in the coolant.

The concentration of lithium-7 in the reactor coolant system is maintained in the range specified for pH control (Table 5.2-25). If the concentration exceeds this range, as it may during the early stages of core life, the cation-bed demineralizer is employed in the letdown line in series operation with a mixed-bed demineralizer. Since the amount of ionic lithium to be removed is small and its buildup can be determined by analysis, the flow through the cation-bed demineralizer is not required to be the full letdown flow. If the concentration of lithium-7 is below the specified limits, lithium hydroxide can be introduced into the reactor coolant system via the charging flow. The solution is prepared in the laboratory and poured into the chemical mixing tank. Primary-grade water is then used to flush the solution to the suction manifold of the charging pumps.

9.3.4.2.2.2 Oxygen Control. During reactor start-up from the cold condition, hydrazine is employed as an oxygen-scavenging agent. The hydrazine solution is introduced into the reactor coolant system in the same manner as described above for the pH control agent. Hydrazine is not employed at any time other than start-up from the cold shutdown state.

Dissolved hydrogen is employed to control and scavenge oxygen produced by the radiolysis of water in the core region. Sufficient partial pressure of hydrogen is maintained in the volume control tank such that the specified equilibrium concentration of hydrogen is maintained in the reactor coolant.

Hydrogen peroxide is added to the reactor coolant during shutdown for refueling to permit a rapid and extensive oxygenation of the reactor coolant system. This allows additional time for the mixed bed demineralizers to reduce the solubilized activity prior to cavity flooding for plant refueling or maintenance.

9.3.4.2.2.3 Reactor Coolant Purification. Mixed-bed demineralizers are provided in the letdown line to provide cleanup of the letdown flow. The demineralizers remove ionic corrosion products and certain fission products. One demineralizer is usually in continuous service and can be supplemented intermittently by the cation-bed demineralizer, if necessary, for additional purification. Both mixed-bed demineralizers can be removed from service if the primary coolant activity is within normal limits. The cation resin removes principally cesium and lithium isotopes from the purification flow. The second mixed-bed demineralizer serves as a standby unit for use if the operating demineralizer becomes exhausted during operation.

A further cleanup feature is provided for use during cold shutdown and residual heat removal. A remotely operated valve admits a bypass flow from the residual heat removal system

Revision 5209/29/2016 NAPS UFSAR 9.3-29 into the letdown line upstream from the nonregenerative heat exchanger. The flow passes through the heat exchanger, the letdown filter, a mixed-bed demineralizer, and the reactor coolant filter to the volume control tank. The fluid is then returned to the reactor coolant system via the normal charging route.

Filters are provided at various locations to ensure the filtration of particulate and resin fines and to protect the seals on the reactor coolant pumps. The filter design retention capability is controlled by administrative processes that provide a filter change-out strategy that includes different particle retention sizes dependent on plant status (e.g., shutdown, startup, or normal operations) and the amount of cleanup required.

Fission gases and hydrogen are removed from the system for plant shutdown by venting the volume control tank to the gaseous waste disposal system (Section 11.3).

9.3.4.2.2.4 Chemical Shim and Reactor Coolant Makeup. The soluble neutron absorber (boric acid) concentration and the reactor coolant inventory are controlled by the reactor makeup control system.

For emergency boration, the capability exists to provide water of at least 7.4 weight percent boric acid (12,950 ppm boron) to the suction of the charging pump. For emergency makeup, refueling water can be provided to the suction of the charging pumps.

The boric acid is stored in three boric acid storage tanks (shared between both units). Four boric acid transfer pumps are provided, two per unit. One pump per unit is normally aligned with one boric acid storage tank. This pump runs continuously at low speed to provide recirculation between the boric acid storage tank and the boron injection tank of the emergency core cooling system (Section 6.3). The second pump per unit is normally used for boric acid batching and transfer and serves as a standby for the normally running pump. Manual or automatic initiation of the reactor makeup control system activates the continuously running pump to a higher speed to provide the makeup of boric acid solution as required.

The primary-water pumps, taking suction from the primary grade water tank, are employed for various makeup and flushing operations throughout the systems. One of these pumps is in continuous operation and provides flow to the boric acid blender when a demand from the reactor makeup control system opens the primary-makeup-water flow control valve.

The flow from the boric acid blender is directed to either the suction manifold of the charging pumps or the volume control tank through the letdown line and spray nozzle.

During reactor operation, changes are made in the reactor coolant boron concentration for the following conditions:

1. Reactor start-upthe boron concentration must be decreased from the shutdown concentration to achieve criticality.

Revision 5209/29/2016 NAPS UFSAR 9.3-30

2. Load followthe boron concentration must be either increased or decreased to compensate for the xenon transient following a change in load.

3. Fuel burn-upthe boron concentration must be decreased to compensate for fuel burn-up.

4. Cold shutdownthe boron concentration must be increased to the cold-shutdown concentration.

The reactor makeup control system is designed to provide a manually preselected makeup composition to the charging pump suction header or the volume control tank. The makeup control functions are those of maintaining the desired operating fluid inventory in the volume control tank and adjusting the reactor coolant boron concentration for reactivity control.

1. Automatic Makeup The automatic makeup mode of operation of the reactor makeup control system provides boric acid solution preset to match the boron concentration in the reactor coolant system. The automatic makeup compensates for minor leakage of reactor coolant without causing significant changes in the coolant boron concentration.

Under normal plant operating conditions, the mode selector switch and makeup stop valves are set in the automatic makeup position. A preset low-level signal from the volume control tank level controller causes the automatic makeup control action to increase the speed of the normally running boric acid transfer pump, open the makeup stop valve to the charging pump suction, and modulate closed the concentrated boric acid control valve and modulate open the primary water makeup control valves. The flow controllers then blend the makeup stream according to the preset concentration. Makeup addition to the charging pump suction header causes the water level in the volume control tank to rise. At a preset high-level point, the makeup is stopped, the primary makeup water control valve closes, the boric acid transfer pump returns to low-speed operation, the concentrated boric acid control valve opens, and the makeup stop valve to the charging pump suction closes.

If the automatic makeup fails or is not aligned for operation and the tank level continues to decrease, a low-level alarm is actuated. Manual action may correct the situation or, if the level continues to decrease, an emergency low-level signal from both channels opens the stop valves in the refueling-water supply line to the charging pumps and closes the stop valves in the volume control tank outlet line.

2. Dilution The dilute mode of operation permits the addition of a preselected quantity of primary makeup water at a preselected flow rate to the reactor coolant system. The operator sets the mode selector switch to dilute, the primary makeup water flow controller setpoint to the desired flow rate, the primary makeup water batch integrator to the desired quantity, and initiates system start. This opens the primary-makeup-water control valve and closes the boric acid valve so that the normally operating primary water pump will deliver water to the

Revision 5209/29/2016 NAPS UFSAR 9.3-31 volume control tank. From here the water goes to the charging pump suction header. An excessive rise of the volume control tank water level is prevented by automatic actuation (by the tank level controller) of a three-way diversion valve, which routes the reactor coolant letdown flow to the boron recovery system. When the preset quantity of water has been added, the batch integrator causes the primary-makeup-water control valve to close and the boric acid valve to open.

The deborating demineralizers are located downstream from the mixed-bed and cation-bed demineralizers and can be used intermittently to remove boron from the reactor coolant near the end of core life when boron concentration is low. When the deborating demineralizers are in operation, the letdown stream can pass through the mixed-bed demineralizers and then through the deborating demineralizers and into the volume control tank after passing through the reactor coolant filter.

3. Alternate Dilution The alternate dilute mode of operation is similar to the dilute mode except that a portion of the dilution water flows directly to the charging pump suction and a portion flows into the volume control tank via the spray nozzle and then flows to the charging pump suction.

4. Boration The borate mode of operation permits the addition of a preselected quantity of concentrated boric acid solution at a preselected flow rate to the reactor coolant system. The operator sets the mode selection switch to borate, the concentrated boric acid flow controller set point to the desired flow rate, the concentrated boric acid batch integrator to the desired quantity, and initiates system start. This opens the makeup stop valve that delivers boric acid solution to the charging pump suction header. The total quantity added in most cases is so small that it has only a minor effect on the volume control tank level. When the preset quantity of concentrated boric acid solution is added, the batch integrator returns the boric acid transfer pump to low-speed operation and closes the makeup stop valve to the suction of the charging pumps.

5. Manual The manual mode of operation permits the addition of a preselected quantity and blend of boric acid solution to locations other than the reactor coolant system (e.g., refueling-water storage tank or spent-fuel pit) and serves as a backup for the automatic mode. While in the manual mode of operation, automatic makeup to the reactor coolant system is precluded. The discharge flow path must be prepared by opening manual valves in the desired path. The operator then sets the mode selector switch to manual, the boric acid and primary makeup water flow controllers to the desired flow rates, the boric acid and primary makeup water batch integrators to the desired quantities, and actuates the makeup start switch. The start

Revision 5209/29/2016 NAPS UFSAR 9.3-32 switch actuates the boric acid flow control valve and the primary makeup water flow control valve to the boric acid blender and switches the boric acid transfer pump to high-speed operation.

When the preset quantities of boric acid and primary water have been added, the boric acid and primary makeup water flow control valves close and the boric acid transfer pump returns to low-speed operation. This operation may be stopped manually by actuating the makeup stop switch.

If either batch integrator is satisfied before the other has recorded its required total, the pump and valve associated with the integrator that has been satisfied will terminate flow. The flow, controlled by the other integrator will continue until that integrator is satisfied.

6. Alarm Functions The reactor makeup control is provided with alarm functions to call the operators attention to the following conditions:

a. A deviation in the primary-makeup-water flow rate from the control set point.

b. A deviation in the concentrated boric acid flow rate from the control set point.

c. A high level in the volume control tank. This alarm indicates that the level in the tank is approaching a high level and that there is a resulting 100% diversion of the letdown stream to the boron recovery system.

d. A low level in the volume control tank. This alarm indicates that the level in the tank is approaching emergency low-low level and that a resulting realignment of charging pump suction to the refueling-water storage tank will occur.

9.3.4.2.3 Layout The volume control tank is located above the charging pumps to provide sufficient net positive suction head (NPSH). All parts of the charging and letdown system are shielded as necessary to limit dose rates during operation with an assumed 1% fuel defects. The regenerative heat exchanger, excess letdown heat exchanger, letdown orifices, and seal bypass orifices are located within the reactor containment. All other system equipment is located inside the auxiliary building.

9.3.4.2.4 Component Description A summary of the principal component design parameters is given in Table 9.3-5, and the safety classifications and design codes are given in Table 9.3-6.

9.3.4.2.4.1 Charging Pumps. Three charging pumps are supplied to inject coolant into the reactor coolant system. The charging pumps for Units 1 and 2 are provided with a cross-connect to ensure availability of high-pressure borated makeup water to the reactor coolant system of either unit. The charging pumps are all of the single-speed, centrifugal type. All parts in contact

Revision 5209/29/2016 NAPS UFSAR 9.3-33 with the reactor coolant are fabricated of austenitic stainless steel or other material of adequate corrosion resistance. The charging pumps and support systems in the pump cubicle meet the requirements of NUREG-0578 for operation in the post-accident radiation environment.

There is a minimum-flow recirculation line on each centrifugal charging pump discharge header to protect it against a closed discharge valve condition.

The charging flow rate is determined from a pressurizer level signal. Charging flow control is accomplished by a modulating valve on the discharge side of the centrifugal pumps. The centrifugal charging pumps also serve as high head safety injection pumps in the emergency core cooling system. (Section 6.3.2.1).

9.3.4.2.4.2 Boric Acid Transfer Pumps. Two centrifugal, two-speed pumps per unit are used to circulate or transfer the boric acid solution. The pumps circulate boric acid solution through the boric acid storage tanks and the boron injection tank in the safety injection system, and inject boric acid into the charging pump suction header or furnish boric acid to the boric acid blender.

Although one pump normally is used for boric acid batching and transfer for each unit and one for boric acid injection for each unit, either pump may function as standby for the other. The design head of one pump at high speed is sufficient, considering line and valve losses, to deliver rated flow to the charging pump suction header when the volume control tank pressure is at the maximum operating value. All parts in contact with the solutions are made of austenitic stainless steel or of other suitable corrosion-resistant material.

The boric acid transfer pumps are operated either automatically or manually from the main control room. The reactor makeup control operates one of the pumps automatically when boric acid solution is required for makeup or boration.

9.3.4.2.4.3 Regenerative Heat Exchanger. The regenerative heat exchanger is designed to recover heat from the letdown flow by reheating the charging flow, which reduces thermal shock on the charging penetrations into the reactor coolant loop piping.

The letdown stream flows through the shell of the regenerative heat exchanger and the charging stream flows through the tubes. The unit is made of austenitic stainless steel and is of all-welded construction.

The temperatures of both outlet streams from the heat exchanger are monitored, with the indication given in the main control room. A high-temperature alarm is given on the main control board if the temperature of the letdown stream exceeds desired limits.

9.3.4.2.4.4 Nonregenerative Heat Exchanger. The nonregenerative heat exchanger cools the letdown stream to the operating temperature of the mixed-bed demineralizers. Reactor coolant flows through the tube side of the exchanger while component cooling water flows through the shell. All surfaces in contact with the reactor coolant are made of austenitic stainless steel, and the shell is of carbon steel.

Revision 5209/29/2016 NAPS UFSAR 9.3-34 The letdown temperature control indicates and controls the temperature of the letdown flow exiting from the nonregenerative heat exchanger. The temperature sensor, which is part of the Chemical and Volume Control System, provides input to the controller in the component cooling system. The exit temperature is controlled by regulating the component cooling water flow through the nonregenerative heat exchanger by using the control valve located in the component cooling water discharge line. Temperature indication is provided on the main control board.

9.3.4.2.4.5 Excess-Letdown Heat Exchanger. The excess-letdown heat exchanger cools reactor coolant letdown flow at a rate that is equivalent to the nominal seal injection flow that flows downward through the reactor coolant pump labyrinth seals.

The excess-letdown heat exchanger can be employed when normal letdown is not available to maintain pressurizer level within limits. The letdown flows through the tube side of the unit and component cooling water is circulated through the shell. All surfaces in contact with reactor coolant are made of austenitic stainless steel, and the shell is of carbon steel. All tube joints are welded. A temperature detector measures the temperature of excess letdown downstream from the excess-letdown heat exchanger. Temperature indication is provided on the main control board.

A pressure sensor indicates the pressure of the excess letdown flow downstream from the excess-letdown heat exchanger and the excess-letdown control valve. Pressure indication is provided on the main control board.

9.3.4.2.4.6 Seal-Water Heat Exchanger. The seal-water heat exchanger is designed to cool fluid from three sources: reactor coolant pump seal water returning to the Chemical and Volume Control System, reactor coolant discharged from the excess-letdown heat exchanger, and centrifugal charging pump recirculation flow. Reactor coolant flows through the tube side of the heat exchanger and component cooling water is circulated through the shell. The design flow rate is equal to the sum of the excess letdown flow, the maximum design reactor coolant pump seal leakage, and the recirculation flow from one centrifugal charging pump. The unit is designed to cool the above flow to the temperature normally maintained in the volume control tank. All surfaces in contact with reactor coolant are made of austenitic stainless steel, and the shell is of carbon steel.

9.3.4.2.4.7 Volume Control Tank. The volume control tank provides the surge capacity for that part of the reactor coolant expansion volume not accommodated by the pressurizer. When the level in the tank reaches the high-level setpoint, the remainder of the expansion volume is accommodated by diversion of the letdown stream to the boron recovery system. The volume control tank also provides a means for introducing hydrogen into the coolant to maintain the required equilibrium concentration, it is used for degassing the reactor coolant, and it serves as a head tank for the charging pumps.

A spray nozzle located inside the tank on the letdown line nozzle provides liquid-to-gas contact between the incoming fluid and the hydrogen atmosphere in the tank.

Revision 5209/29/2016 NAPS UFSAR 9.3-35 For degassing, the tank is provided with a remotely operated solenoid valve backed up by a pressure control valve that ensures that the tank pressure does not fall below minimum operating pressure during degassing to the waste disposal system. During outage periods the volume control tank may be purged directly to the primary sample sink or to the process vents via a jumper from the sample sink. This is done to minimize the amount of oxygen that is sent to the waste gas decay tanks. Manual actions will ensure that the volume control tank pressure does not fall below minimum operating pressure. Relief protection, gas space sampling, and nitrogen purge connections are also provided. Relief discharges from the letdown line and the seal-water return line go to this tank.

Volume control tank pressure and temperature are monitored, with indication given in the main control room. Alarms are given in the main control room for high- and low-pressure conditions and for high temperature.

Two level channels govern the water inventory in the volume control tank. These channels provide local and remote level indication, level alarms, level control makeup control, and emergency makeup control.

If the volume control tank level rises above the normal operating range, one channel provides an analog signal to a proportional controller that modulates the three-way valve downstream from the reactor coolant filter to maintain the volume control tank level within the normal operating band. The three-way valve can split letdown flow so that a portion goes to the boron recovery system and a portion to the volume control tank. The controller would operate in this fashion during a dilution operation when primary water is being fed to the volume control tank from the reactor makeup control system.

If the modulating function of the channel fails and the volume control tank level continues to rise, then the high-level alarm will alert the operator to the malfunction and the letdown flow can be manually diverted to the boron recovery system. If no action is taken by the operator and the tank level continues to rise, the full-letdown flow will be automatically diverted.

During normal power operation, a low level in the volume control tank initiates automatic makeup, which injects a preselected blend of boron and water into the charging pump suction header. When the volume control tank is restored to normal, automatic makeup stops.

If the automatic makeup fails or is not aligned for operation and the tank level continues to decrease, a low-level alarm is actuated. Manual action may correct the situation or, if the level continues to decrease, a low-level signal from both channels opens the stop valves in the refueling-water supply and closes the stop valves in the volume control tank outlet line.

9.3.4.2.4.8 Boric Acid Storage Tanks. Three boric acid storage tanks are shared by the two units.

The combined capacity of the tanks is sufficient to provide cold shutdown of each unit (assuming the most reactive RCC assembly is not inserted) following a refueling shutdown of both units simultaneously. One tank, if the level is maintained above the low-low level alarm point, contains

Revision 5209/29/2016 NAPS UFSAR 9.3-36 sufficient boric acid solution for a cold shutdown of one unit even if the most reactive RCC assembly is not inserted.

The boric acid storage tanks are both seismic and tornado protected. The backup source for borated makeup is the refueling water storage tank, which is seismic but not tornado protected.

In Modes 1-4, the boric acid storage tank(s) is required to have at least 6000 gallons of water with a boron concentration between 12,950 ppm (7.4 weight percent) and 15,750 ppm (9.0 weight percent). The refueling water storage tank is required to have a minimum volume of water, see Figure 6.3-6, with a boron concentration between 2600 and 2800 ppm. Either source is more than sufficient to provide a shutdown margin from all operating conditions, or 1.77% delta k/k after xenon decay and cooldown to 200°F. The maximum boration capability requirement occurs at end of life from full power equilibrium xenon conditions and requires 6000 gallons of 12,950 ppm borated water from the boric acid storage tank(s) or 54,200 gallons of 2600 ppm borated water from the refueling water storage tank.

The concentration of boric acid solution in storage is maintained between 7.4 and 9.0 weight percent. Periodic manual sampling and corrective action, if necessary, ensure that these limits are maintained. As a consequence, measured amounts of boric acid solution can be delivered to the reactor coolant to control the concentration.

Two 100%-capacity electric strip heater banks on each boric acid storage tank are designed to maintain the temperature of the boric acid solution at >115°F with an ambient air temperature of 40°F, thus ensuring a temperature in excess of the solubility limit (for 9.0 weight percent boric acid the limit is approximately 111°F).

Two temperature monitors provide temperature measurement of each tanks contents. Local temperature indication is provided, and high- and low-temperature alarms are provided on the main control board.

Two level detectors indicate the level in each boric acid storage tank. Level indication with high-, low-, and low-low-level alarms is provided on the main control board. The low-low alarm is set to indicate the minimum level of boric acid in the tank to ensure sufficient boric acid to provide for a cold shutdown with one stuck rod.

9.3.4.2.4.9 Batching Tank. The batching tank is used for mixing a makeup supply of boric acid solution for transfer to the boric acid storage tanks. The tank may also be used for solution storage.

A local sampling point is provided for verifying the solution concentration before transferring it out of the tank. The tank is provided with an agitator to improve mixing during batching operations and a steam jacket and an immersion steam coil for heating the boric acid solution.

Revision 5209/29/2016 NAPS UFSAR 9.3-37 9.3.4.2.4.10 Chemical Mixing Tank. The primary use of the chemical mixing tank is in the preparation of caustic solutions for pH control, hydrazine solutions for oxygen scavenging, and the addition of hydrogen peroxide for chemical shock during shutdown for refueling and maintenance.

9.3.4.2.4.11 Mixed-Bed Demineralizers. Two flushable mixed-bed demineralizers assist in maintaining reactor coolant purity. A lithium-form cation resin and a hydroxyl-form anion resin typically are charged into the demineralizers; however, hydrogen-form cation resin can also be used during shutdown conditions and/or to supplement the cation bed during power operation.

Both forms of resin remove fission and corrosion products. The resin bed is designed to reduce the concentration of ionic isotopes in the purification stream, except for cesium, yttrium, and molybdenum, by a minimum factor of 10.

Each demineralizer has sufficient capacity for approximately one core cycle with 1% failed fuel. One demineralizer serves as a standby unit for use if the operating demineralizer becomes exhausted during operation.

A temperature sensor measures temperature of the letdown flow downstream of the letdown heat exchanger and controls the letdown flow to the mixed-bed demineralizers by means of a three-way valve. If the letdown temperature exceeds the allowable resin operating temperature, the flow is automatically bypassed around the demineralizers. Temperature indication and high alarm are provided on the main control board. The failure mode of the air-operated, three-way valve directs flow to the volume control tank.

9.3.4.2.4.12 Cation-Bed Demineralizer. A flushable cation resin bed in the hydrogen form is located downstream from the mixed-bed demineralizers and is used intermittently to control the concentration of lithium-7, which builds up in the coolant from the B10 (n, ) lithium-7 reaction.

The demineralizer also has sufficient capacity to maintain the cesium-137 concentration in the coolant below 1.0 Ci/cm 3 with 1% failed fuel. The resin bed is designed to reduce the concentration of ionic isotopes, particularly cesium, yttrium, and molybdenum, by a minimum factor of 10.

The cation-bed demineralizer has sufficient capacity for approximately one core cycle with 1% failed fuel.

9.3.4.2.4.13 Deborating Demineralizers. When required, two anion demineralizers remove boric acid from the reactor coolant system fluid. The demineralizers are provided for use near the end of a core cycle, but they can be used at any time. A hydroxyl-based ion-exchange resin is used to reduce the reactor coolant system boron concentration by releasing a hydroxyl ion when a borate ion is absorbed. Connections are provided for regeneration.

Each demineralizer is sized to remove the quantity of boric acid that must be removed from the reactor coolant system to compensate for core burn-up and maintain full-power operation near the end of core life without the use of the boron recovery system.

Revision 5209/29/2016 NAPS UFSAR 9.3-38 9.3.4.2.4.14 Letdown Filter. The letdown filter is located on the letdown line upstream from the mixed-bed demineralizers. The filter removes particulates from the letdown stream to reduce the amount of undissolved solids entering the demineralizers.

The letdown filter is normally bypassed during operation. Flow may be directed through the letdown filter if filtration prior to the demineralizers is desired A pressure indicator is provided on each side of the filter to provide local indication of the pressure drop across the filter.

9.3.4.2.4.15 Reactor Coolant Filter. The reactor coolant filter is located on the letdown line upstream from the volume control tank. The filter collects resin fines and particulates from the letdown stream. The nominal flow capacity of the filter is equal to the maximum purification flow rate.

Two local pressure indicators are provided to show the pressures upstream and downstream from the reactor coolant filter and thus provide filter differential pressure.

9.3.4.2.4.16 Seal-Water Injection Filters. Two seal-water injection filters are located in parallel in a common line to the reactor coolant pump seals; they collect particulate matter that could be harmful to the seal faces. Each filter is sized to accept flow in excess of the normal seal-water requirements.

A differential pressure indicator monitors the pressure drop across the seal-water injection filters and gives local indication with a high differential pressure alarm on the main control board.

9.3.4.2.4.17 Seal-Water Return Filter. The filter collects particulate from the reactor coolant pump seal-water return and from the excess-letdown flow. The filter is designed to pass flow in excess of the sum of the excess-letdown flow and the maximum design leakage from the reactor coolant pump seals.

Two local pressure indicators are provided to show the pressures upstream and downstream from the filter and thus provide the differential pressure across the filter.

9.3.4.2.4.18 Boric Acid Filter. The boric acid filter collects particulates from the boric acid solution being pumped to the charging pump suction line, the boron injection tank, or the boric acid blender. The filter is designed to pass the design flow of two boric acid transfer pumps operating simultaneously.

Local pressure indicators indicate the pressure upstream and downstream from the boric acid filter and thus provide filter differential pressure.

9.3.4.2.4.19 Boric Acid Blender. The boric acid blender promotes the thorough mixing of boric acid solution and primary-grade water for the reactor coolant makeup circuit. The blender consists of a conventional pipe tee fitted with a perforated tube insert. The blender decreases the pipe

Revision 5209/29/2016 NAPS UFSAR 9.3-39 length required to homogenize the mixture for taking a representative local sample. A sample point is provided in the piping just downstream from the blender.

9.3.4.2.4.20 Letdown Orifices. The three letdown orifices are arranged in parallel and serve to reduce the pressure of the letdown stream to a value compatible with the nonregenerative heat exchanger design. Two of the three are sized such that either can pass normal letdown flow; the third can pass less than the normal letdown flow. One or both of the standby orifices may be used in parallel with the normally operating orifice for flow control when the Reactor Coolant System pressure is less than normal or greater letdown is desired such as maximum purification or heatup (120 gpm maximum). This arrangement also provides a full standby capacity for the control of letdown flow. Orifices are placed in and taken out of service by the remote manual operation of their respective isolation valves.

A flow monitor provides indication in the control room of the letdown flow rate and a high alarm to indicate unusually high flow.

A low-pressure letdown controller controls the pressure downstream from the nonregenerative heat exchanger to prevent flashing of the letdown liquid. Pressure indication and a high-pressure alarm are provided on the main control board.

9.3.4.2.4.21 Valves. Valves, other than diaphragm valves, that perform a modulating function are equipped with two sets of packing and an intermediate leakoff connection or have no leakoff line with an improved packing configuration consisting of a bushing and single packing set in the stuffing box. Valves are normally installed such that, when closed, the high pressure is not on the packing. Stainless steel is the basic material of construction for all valves that handle radioactive liquid or boric acid solutions. Isolation valves are provided for all lines entering the reactor containment. These valves are discussed in detail in Section 6.2.4.

Relief valves are provided for lines and components that might be pressurized above design pressure by improper operation or component malfunction.

1. Charging Line Downstream of Regenerative Heat Exchanger If the charging side of the regenerative heat exchanger is isolated while the hot letdown flow continues at its maximum rate, the volumetric expansion of coolant on the charging side of the heat exchanger is relieved to the reactor coolant system through a spring-loaded check valve. The spring in the valve is designed to permit the check valve to open in the event that the differential pressure exceeds the design pressure differential of 75 psi.

2. Letdown Line Downstream from Letdown Orifices

Revision 5209/29/2016 NAPS UFSAR 9.3-40 The pressure relief valve downstream from the letdown orifices protects the low-pressure piping and the nonregenerative heat exchanger from overpressure when the low-pressure piping is isolated. The capacity of the relief valve exceeds the maximum flow rate through all letdown orifices. The valve set pressure is equal to the design pressure of the nonregenerative heat exchanger tube side.

3. Letdown Line Downstream from Low-Pressure Letdown Valve The pressure relief valve downstream from the low-pressure letdown valve protects the low-pressure piping, demineralizers, and filter from overpressure when this section of the system is isolated. The overpressure may result from leakage through the low-pressure letdown valve. The capacity of the relief valve exceeds the maximum flow rate through all letdown orifices. The valve set pressure is equal to the design pressure of the demineralizers.

4. Volume Control Tank The relief valve on the volume control tank permits the tank to be designed for a lower pressure than the upstream equipment. This valve has a capacity greater than the combined flow from all the letdown orifices. The valve set pressure equals the design pressure of the volume control tank.

5. Seal-Water Return Line (Inside Containment)

This relief valve is designed to relieve overpressurization in the seal-water return piping inside the containment if the motor-operated isolation valve is closed. The valve is designed to relieve the total leakoff flow from the No. 1 seals of the reactor coolant pumps plus the design excess-letdown flow. The valve is set to relieve at the design pressure of the piping.

6. Seal-Water Return Line (Charging Pump Recirculation Flow)

This relief valve protects the seal-water heat exchanger and its associated piping from overpressurization. If either of the isolation valves for the heat exchanger are closed and the bypass line is closed, the piping could be overpressurized by the recirculation flow from the centrifugal charging pumps. The valve is sized to handle the full recirculation flow with two centrifugal pumps running. The valve is set to relieve at the design pressure of the heat exchanger.

7. Steam Line to Batching Tank The relief valve on the steam line to the batching tank protects the low-pressure piping and batching tank heating jacket and coil from overpressure when the condensate return line is isolated. The capacity of the relief valve equals the maximum expected steam inlet flow. The set pressure equals the design pressure of the heating jacket.

9.3.4.2.4.22 Piping. All Chemical and Volume Control System piping handling radioactive liquid is made of austenitic stainless steel, except for flow transmitters 1-CH-FT-1113 and 2-CH-FT-2113, which have carbon steel flanged connections. This is not a corrosion problem,

Revision 5209/29/2016 NAPS UFSAR 9.3-41 because the boric acid to blender flow transmitters are lined with Teflon. All piping joints and connections are welded, except where flanged connections are required to facilitate equipment removal for maintenance and hydrostatic testing.

9.3.4.2.4.23 Electrical Heat Tracing. Electrical heat tracing is installed on all pumps, piping, valves, line-mounted instrumentation, and components normally containing concentrated boric acid solution. The heat tracing is designed to prevent boric acid precipitation due to cooling.

Exceptions are:

1. Lines that may transport concentrated boric acid but are subsequently flushed with reactor coolant or some other liquid of low boric acid concentration during normal operation.

2. The boric acid storage tanks, which are provided with clamp-on heaters.

3. The batching tank, which is provided with a steam jacket.

Duplicate heat tracing on sections of the Chemical and Volume Control System, normally containing boric acid solution, provides a backup if the operating heat tracing malfunctions. The power supply for each section of the heat tracing is connected to different emergency powered buses to ensure continuous operation during a condition of prolonged outage of normal power supplies.

9.3.4.2.4.24 Zinc Injection System. Zinc is injected into the RCS for dose reduction, reduction of the corrosion rate of primary system surfaces, and/or mitigation of the initiation of primary water stress corrosion cracking. The zinc injection system includes an injection skid which provides a small flow into the Chemical and Volume Control System (CVCS). There is one zinc injection skid for each unit. The skid is comprised of two zinc solution tanks and two separate pumping trains to ensure uninterrupted flow to the CVCS. Each train consists of a positive displacement pump, pressure gauge and appropriate valves. The zinc injection skid injects zinc into the CVCS upstream of the volume control tank with a dedicated pipeline. Primary Grade water is piped to the skid to provide for flushing zinc acetate solution.

9.3.4.2.5 System Operation 9.3.4.2.5.1 Reactor Start-Up. Reactor start-up is defined as the operations which bring the reactor from cold shutdown to normal operating temperature and pressure.

It is assumed that:

1. Normal residual heat removal is in progress.

2. The reactor coolant system boron concentration is at the cold-shutdown concentration.

3. The reactor makeup control system is set to provide makeup at the cold-shutdown concentration.

Revision 5209/29/2016 NAPS UFSAR 9.3-42

4. The reactor coolant system is either water-solid or drained to the minimum level for the purpose of refueling or maintenance. If the reactor coolant system is water-solid, system pressure is controlled by letdown through the residual heat removal system and through the low-pressure letdown valve in the letdown line.

5. The charging and letdown lines of the Chemical and Volume Control System are filled with coolant at the cold-shutdown boron concentration. The letdown orifice isolation valves are closed.

If the reactor coolant system requires filling and venting, the procedure is as follows:

1. One charging pump is started, providing blended flow from the reactor makeup control system at the cold-shutdown boron concentration.

2. The vents on the head of the reactor vessel and pressurizer are opened.

3. The reactor coolant system is filled and the vents closed.

The system pressure is raised using the charging pump and is controlled by the low-pressure letdown valve. When the system pressure is adequate for the operation of the reactor coolant pumps, seal-water flow to the pumps is established and the pumps are operated and vented sequentially until all gases are cleared from the system. The final venting takes place at the pressurizer.

Before and during the heating process, the Chemical and Volume Control System is employed to obtain the correct chemical properties in the reactor coolant system. Chemicals are added through the chemical mixing tank as required to control reactor coolant chemistry such as pH and dissolved oxygen content. Hydrogen overpressure is established in the volume control tank to ensure the appropriate hydrogen concentration in the reactor coolant.

After the filling and venting operations are completed, charging and letdown flows are established. During heatup, a combination of letdown orifices is used to provide the necessary letdown flow. Pressurizer heaters are energized and the reactor coolant pumps are employed to heat up the system. At this point, steam formation in the pressurizer is accomplished by manual control of the charging flow and the letdown flow. When the pressurizer water level reaches the no-load programmed setpoint, the pressurizer level control can be shifted to automatic level control. After a reactor coolant pump is running and the steam generators are providing a heat sink, the residual heat removal pump is stopped and the residual heat removal system is isolated from the reactor coolant system.

The reactor coolant boron concentration is then reduced by operating the reactor makeup control system in the dilute mode. The reactor coolant boron concentration is corrected to the point where the control rods may be withdrawn and criticality achieved. The reactor makeup control is operated on a continuing basis to ensure correct control rod position. Power increase may then proceed with corresponding manual adjustment of the reactor coolant boron

Revision 5209/29/2016 NAPS UFSAR 9.3-43 concentration to balance the temperature coefficient effects and maintain the control rods within their operating range.

9.3.4.2.5.2 Power Generation and Hot Standby Operation: Baseload. A t a c o n s t a n t p o w e r level, the rates of charging and letdown are dictated by the requirements of seal water for the reactor coolant pumps and the normal purification of the reactor coolant system. One charging pump is employed and charging flow is controlled automatically by the pressurizer level. The only adjustments in boron concentration are those necessary to compensate for core burn-up.

These adjustments are made at infrequent intervals to maintain the control groups within their allowable limits. Rapid variations in power demand are accommodated automatically by control rod movement. If variations in power level occur, and the new power level is sustained for long periods, some adjustment in boron concentration may be necessary to maintain the control groups within their maneuvering band.

During normal operation, normal letdown flow is maintained and one mixed-bed demineralizer is in service. Reactor coolant samples are taken periodically to check boron concentration, water quality, and pH and activity levels. The charging pump flow to the reactor coolant system is controlled automatically by the pressurizer level control signal through the discharge header flow control valve.

Load Follow A power reduction will initially cause a xenon buildup followed by xenon decay to a new, lower equilibrium value. The reverse occurs if the power level increases; initially, the xenon level decreases, and then it increases to a new and higher equilibrium value associated with the amount of the power level change.

The reactor makeup control system is used to vary the reactor coolant boron concentration to compensate for xenon transients occurring when the reactor power level is changed.

The Tavg/Tref difference is the best indication available to the plant operator for determining whether to dilute or borate the reactor coolant. If Tavg is greater than Tref, boron must be added or the control rods inserted to return Tavg to the programmed temperature. If Tavg is less than Tref then dilution (addition of primary grade water) is required or the control rods are withdrawn to return Tavg to the programmed temperature. If the temperature difference exceeds the automatic rod control setpoint, the rods will adjust position to correct Tavg. If the control rods are moving into the core, and approaching the rod insertion limit, the operator must borate the reactor coolant to allow the rods to withdraw. If the operator does not borate, the control rods may move into the core beyond the rod insertion limit specified in the Core Operating Limits Report. If, on the other hand, the rods are moving out of the core, the operator may dilute the reactor coolant to maintain desired rod height.

During periods of plant loading, the reactor coolant expands as its temperature rises. The pressurizer absorbs most of this expansion as the level controller raises the level setpoint to the

Revision 5209/29/2016 NAPS UFSAR 9.3-44 increased level associated with the new power level. The remainder of the excess coolant is let down and stored in the volume control tank. During this period, the flow through the letdown orifice remains constant and the charging flow is reduced by the pressurizer level control signal, resulting in an increased temperature at the regenerative heat exchanger outlet. The temperature controller downstream from the nonregenerative heat exchanger increases the component cooling water flow to maintain the desired letdown temperature.

During periods of plant unloading, the charging flow is increased to make up for the coolant contraction that is not accommodated by the programmed reduction in the pressurizer level.

Shutdown Operations If required, for periods of maintenance, or following spurious reactor trips, the reactor can be held subcritical, but with the capability to return to full power within the period of time it takes to withdraw the control rods. During this period, temperature is maintained at no-load Tavg by initially dumping steam to remove core residual heat, or, at later stages, by running reactor coolant pumps to maintain system temperature.

Following shutdown, xenon buildup occurs and increases the degree of shutdown; that is, initially, with initial xenon concentration and all control rods inserted, the core is maintained at a minimum of 1% delta k/k subcritical. The effect of xenon buildup is to increase this value to a maximum of about 4% delta k/k at about 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months following shutdown. After about 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , xenon decay results in a decrease in the degree of subcriticality. Since the value of the initial xenon concentration is about 3% delta k/k (assuming that an equilibrium concentration had been reached during operation), boration of the reactor coolant is necessary to counteract the xenon decay and maintain shutdown.

If rapid recovery is required, dilution of the system may be performed to counteract this xenon buildup.

Before initiating a cold shutdown, the reactor coolant system hydrogen concentration is reduced by replacing the volume control tank hydrogen atmosphere with nitrogen and periodically burping the gas space to the waste gas vent header.

Before the cooldown and depressurization of the reactor plant is initiated, the reactor coolant boron concentration is increased to the cold-shutdown value. The operator borates to cold shutdown boron concentration by using the Blender operation or Emergency boration method as described in plant operating procedures. Cold shutdown boron concentration is verified by taking reactor coolant system samples.

Contraction of the coolant during the cooldown of the reactor coolant system results in the actuation of the pressurizer level control to maintain the normal pressurizer water level. The charging flow is increased, relative to letdown flow, and results in a decreasing volume control tank level. The volume control tank level controller automatically initiates makeup to maintain the inventory.

Revision 5209/29/2016 NAPS UFSAR 9.3-45 After the residual heat removal system is placed in service and the reactor coolant pumps are shut down, further cooling of the pressurizer liquid is accomplished by charging through the auxiliary spray line. Coincidental with plant cooldown, a portion of the reactor coolant flow may be diverted from the residual heat removal system to the Chemical and Volume Control System for cleanup. The demineralization of ionic radioactive impurities and stripping of fission gases reduce the reactor coolant activity level sufficiently to permit personnel access for refueling or maintenance operations.

9.3.4.3 Safety Evaluation 9.3.4.3.1 Reactivity Control Any time that the plant is at power, the quantity of boric acid retained and ready for injection always exceeds the quantity required for the normal cold shutdown, assuming that the control assembly of greatest worth is in its fully withdrawn position. This quantity always exceeds the quantity of boric acid required to bring the reactor to hot shutdown and to compensate for the subsequent xenon decay. An adequate quantity of boric acid is also available in the refueling-water storage tank to achieve cold shutdown.

When the reactor is subcritical, that is, during cold or hot shutdown, refueling, or an approach to criticality, the neutron source multiplication is continuously monitored and indicated.

The increase in the neutron source multiplication resulting from boron dilution events that may occur when the reactor is subcritical provides positive indication of a dilution in progress, and gives operators sufficient time to start a corrective action (boron dilution termination and boration) to prevent the core from becoming critical. The rate of boration, with a single boric acid transfer pump operating, is sufficient to take the reactor from full power operation to 1%

shutdown in the hot condition, with no rods inserted, in less than 100 minutes, assuming the boric acid storage tank is at its minimum boric acid concentration of 7.4 weight percent. The boration achieved over this time interval is also sufficient to compensate for the effect of xenon decay below the equilibrium operating level, which will occur approximately 22 to 26 hours3.009259e-4 days 0.00722 hours 4.298942e-5 weeks 9.893e-6 months after shutdown.

Two separate and independent flow paths are available for reactor coolant boration: the charging line and the reactor coolant pump seal injection. A single failure does not result in the inability to borate the reactor coolant system. An alternative flow path is always available for the emergency boration of the reactor coolant.

As backup to the normal boric acid supply, the operator can align the refueling-water storage tank outlet to the suction of the charging pumps.

The Technical Requirements Manual ensures that at least one flow path is available for boron injection whenever fuel is in the reactor and that the capability of such injection is adequate to ensure that cold shutdown can be maintained. An additional requirement ensures that the

Revision 5209/29/2016 NAPS UFSAR 9.3-46 reactor will not be made critical unless redundant boration capability is available in quantity sufficient to ensure a shutdown to cold conditions.

An upper limit to the boric acid storage tank boron concentration, and a lower limit to the temperature for the tank and for flow paths from the tank are specified in order to ensure that solution solubility is maintained.

Since the nonfunctionality of a single component does not impair the ability to meet boron injection requirements, plant operating procedures allow components to be temporarily out of service for repairs. However, with a nonfunctional component, the ability to tolerate additional component failure is limited. Therefore, operating procedures require immediate action to effect repairs of a nonfunctional component, restrict permissible repair time, and require a demonstration of the functionality of the redundant component.

9.3.4.3.2 Reactor Coolant Purification The Chemical and Volume Control System is capable of reducing the concentration of ionic isotopes in the purification stream as required in the design basis. This is accomplished by passing the letdown flow through the mixed-bed demineralizers, which remove ionic isotopes except those of cesium, molybdenum, and yttrium, with a minimum decontamination factor of 10.

Through the occasional use of the cation-bed demineralizer, the concentration of cesium can be maintained below 1.0 c/cm3, assuming that 1% of the maximum calculated power is being produced by defective fuel. The cation-bed demineralizer is capable of passing the normal letdown flow, although only a portion of this capacity is normally used. Each mixed-bed demineralizer is capable of processing the maximum letdown flow rate. If the normally operating mixed-bed demineralizers resin has become exhausted, the second demineralizer can be placed in service. Each demineralizer is designed, however, to operate for one core cycle with 1%

defective fuel.

The maximum temperature that will be allowed for the mixed-bed, cation-bed, and deborating demineralizers is 140°F. If the temperature of the letdown stream approaches this level, the flow will be automatically diverted so as to bypass the demineralizers. If the letdown is not diverted, the only consequence would be a decrease in ion removal capability. Ion removal capability starts to decrease when the temperature of the resin goes above approximately 160°F for anion resin or above approximately 250°F for cation resin. The resins do not lose their exchange capability immediately. Ion exchange still takes place when the temperature is increased. However, with increasing temperature, the resin loses some of its ion exchange sites along with the ions that are held at the lost sites. The ions lost from the sites may be re-exchanged farther down the bed. The number of sites lost is a function of the temperature reached in the bed and of the time the bed remains at the high temperature. The capability for ion exchange will not be lost until a significant portion of the exchange sites are lost from the resin.

There would be no safety problem associated with the overheating of the demineralizer resins. One effect on reactor operating conditions would be the possibility of an increase in the

Revision 5209/29/2016 NAPS UFSAR 9.3-47 reactor coolant activity level, and the other would be a slight boration of the reactor coolant system.

9.3.4.3.3 Seal-Water Injection Flow to the reactor coolant pumps seals is ensured by the fact that there are three charging pumps, any one of which is capable of supplying the normal charging line flow plus the nominal seal-water flow.

9.3.4.3.4 Leakage Provisions The CVCS components, valves, and piping that see radioactive service are designed to limit leakage to the atmosphere. The components are provided with welded connections except where flanged connections are provided to permit removal for maintenance.

The volume control tank in the Chemical and Volume Control System provides an inferential measurement of leakage from the Chemical and Volume Control System as well as the reactor coolant system. A low level in the volume control tank actuates makeup at the prevailing reactor coolant boron concentration. The amount of leakage can be inferred from the amount of makeup added by the reactor makeup control system.

9.3.4.3.5 Safeguards Function A failure analysis of the portion of the Chemical and Volume Control System that is safety related (used as part of the emergency core cooling system) is included as part of the emergency core cooling system failure analysis presented in Appendix 6A.

9.3.4.4 Tests and Inspections As part of plant operation, periodic tests, surveillance inspections, and instrument calibrations are made to monitor equipment condition and performance. Most components are in use regularly; therefore, assurance of the availability and performance of the systems and equipment is provided by control room and/or local indication.

9.3.4.5 Instrumentation Application Process control instrumentation is provided to acquire data concerning key parameters of the Chemical and Volume Control System. The location of the instrumentation is shown on Reference Drawings 34 through 36.

The instrumentation furnishes input signals for monitoring and/or alarming purposes.

Indications and/or alarms are provided for the following parameters:

1. Temperature.

2. Pressure.

3. Flow.

Revision 5209/29/2016 NAPS UFSAR 9.3-48

4. Water level.

5. Differential Pressure.

The instrumentation also supplies input signals for control purposes. Some specific control functions are:

1. Letdown flow is diverted to the volume control tank upon high temperature indication upstream from the mixed-bed demineralizers.

2. Pressure downstream from the letdown heat exchanger is controlled to prevent the flashing of the letdown liquid.

3. The charging flow rate is controlled during charging pump operation.

4. The water level is controlled in the volume control tank.

5. The temperature of the boric acid solution in the batching tank is maintained.

6. Reactor makeup is controlled.

9.3.5 Boron Recovery System The boron recovery system shown in Figure 9.3-6 and Reference Drawings 37 through 40 is a common system serving both units. The system degasses and stores borated radioactive water letdown from the Chemical and Volume Control System (Section 9.3.4) and reactor coolant drains from the vent and drain system (Section 9.3.3). Further processing by evaporators, filters, and demineralizers in this system produces primary-grade water and concentrated boric acid solution for station reuse or disposal. The system is either designed to allow liquid samples to be taken before the distillate is reused or to be sent to the liquid waste disposal systems (Section 11.2).

9.3.5.1 Design Basis The original boron recovery system capacity was sized to accommodate the coolant letdown flow produced by two cold start-ups in the lead reactor plus one cold start-up in the following reactor in a 7-day period, with the lead reactor baseloaded following the second start-up. These start-ups are assumed to occur at that point in core life when the operating boron concentration in the lead reactor is 150 ppm and the boron concentration in the following reactor is 1 month out of phase. The system influent results from shutdown borating bleed, the draining of one reactor coolant loop for maintenance work, system expansion during heatup, and dilution bleed to the operating boron concentration on start-up. The boron recovery tanks are assumed to be 10% full at the time of the first cold shutdown and the boron evaporators 90% available at rated capacity during the period. Eighty percent of the boron recovery tank capacity is adequate to allow a single cold shutdown under the above conditions without the use of the boron evaporators.

The original boron recovery system was sized to accommodate letdown flow due to daily load following and weekend load reductions on both units and the normally expected range of load transients to nearly the end of the core life with 90% evaporator availability and minimum

Revision 5209/29/2016 NAPS UFSAR 9.3-49 use of boron recovery tank capacity. The daily load follow cycle consists of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months at full power, a uniform 3-hour ramp reduction to 50% power, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months at 50% power, and a uniform 3-hour ramp increase to full power.

The system is capable of removing gases from both units simultaneously at the maximum letdown flow rate.

The boron evaporators are capable of processing the average letdown rate of both units producing a distillate with a boron content not exceeding 10 ppm boron and concentrated bottoms at 7.4 weight percent to 9.0 weight percent boric acid. The waste disposal evaporator distillate demineralizer, 1-LW-I-1, a part of the liquid waste system, is used upstream from the boron evaporators to provide chloride control.

The boron recovery system is designed to provide maximum corrosion resistance and minimum leakage appropriate for recycling reactor coolant letdown and containing radioactive materials.

The design data for the boron recovery system components are given in Table 9.3-7.

9.3.5.2 System Description Reactor coolant letdown and reactor coolant drains, with entrained hydrogen and fission gases, enter the boron recovery system via the Chemical and Volume Control System and the vent and drain system. This liquid enters the gas stripper, is stripped of the majority of the dissolved gases, and, if necessary, passed through an ion exchanger for the removal of soluble fission and corrosion products. After subsequent filtration to remove additional particulate materials, the liquid is held up in the three boron recovery tanks for processing in the boron recovery evaporators or disposal via the LW system. Noncondensable gases removed from the letdown in the gas stripper are separated from the steam in the gas stripper vent condenser and chiller and discharged into the gas stripper surge tank by the gas stripper diaphragm compressors. The surge tank discharges either to the volume control tank to return the hydrogen and radioactive gases to the reactor coolant system (Chapter 5), or to the gaseous waste disposal system (Section 11.3).

The surge tank contains sufficient gas to fill the gas stripper, preventing the inleakage of air during standby or draining operations. If the stripper is to be opened to the atmosphere, the unit will be purged with nitrogen.

When degassing the RCS (gas strippers in DEGAS mode) steam heating is used to raise the temperature of the liquid such that a fraction of it flashes to steam in the gas stripper vessel.

During normal power operation, when processing diverted letdown from the volume Control Tank and drains from the Primary Drains Transfer Tank, and with the gas stripper liquid effluent directed to the Boron Recovery Tanks, steam heating is not needed. The efficiency of gas removal is not as high when steam is not used, however, operating experience shows that maintenance requirements are greater when steam is used. The radiation dose to personnel is significantly reduced when the strippers are operated without steam.

Revision 5209/29/2016 NAPS UFSAR 9.3-50 The boron evaporators are fed from the boron recovery tanks by the boron evaporator feed pumps.

The evaporators are of the external-reboiler, forced-recirculation type, and have a separation factor of about 104 to 105. Steam from the evaporators flows to the boron evaporator overhead condensers. After being condensed, the condensate is collected in the distillate accumulator and subsequently pumped through the distillate coolers to the tanks for sampling.

The distillate accumulator vents discharge to the gaseous waste disposal system (Section 11.3) only when noncondensable gases build up in the distillate accumulator.

Liquid from the test tanks can be pumped to the primary-grade water tanks, passing through a filter and an ion exchanger for further boron removal, if required. If unacceptable or not required for reuse, the test tank liquid is pumped to the liquid waste disposal system (Section 11.2). The primary-grade water requirements of both units are supplied from two primary-grade water tanks using associated pumps.

When the boric acid in the boron evaporator is at the desired concentration, the liquid is pumped through a controlled temperature bottoms cooler and a filter to the boron evaporator bottoms tank. The concentrate in the tank is sampled; if disposal of bottoms is desired, the liquid is transferred to the waste disposal system (Section 11.2). If the recycling of bottoms is desired, the liquid is transferred to the boric acid storage tanks in the Chemical and Volume Control System (Section 9.3.4).

The boron recovery system is designed so that the operation of the gas stripper is automatic when all system control setpoints are established. The operation of the evaporators is automatic upon cycle initiation from the main control room.

The majority of the boron recovery system piping is Type 304 stainless steel. All piping joints and connections are welded except where flanged connections are required to facilitate equipment removal for maintenance.

The majority of valves handling radioactive gas are packless, diaphragm valves. Valves that are not are typically designed with double packing to minimize leakage. All valves handling primary-grade water or radioactive fluid are stainless steel.

All liquid lines, equipment, and accessories containing concentrated boric acid (4% by weight boric acid or greater) are electrically heat traced with dual circuits to prevent the crystallization of boric acid. The primary-grade water tanks are heated by steam. The evaporator bottoms tank is maintained at a minimum of 141°F by dual electric heaters. The boron recovery tanks are located inside the boron recovery tank building, which is heated with auxiliary steam.

Revision 5209/29/2016 NAPS UFSAR 9.3-51 9.3.5.3 Design Evaluation 9.3.5.3.1 System Reliability Duplicate, full-capacity pumps and compressors are provided for all equipment except the bottoms tank recirculation pump. The primary water service pumps are provided with automatic controls to start the standby pump if the supply header pressure is low (e.g., demands exceed the capacity of one pump or the normally running pump fails). The controls of all duplicate equipment are designed to permit alternate duty to equalize operating hours.

9.3.5.3.2 Malfunction Analysis A malfunction analysis of boron recovery system components is presented in Table 9.3-8.

9.3.5.4 Tests and Inspections Periodic tests, calibrations, and checks are conducted on the various instrument channels to ensure the proper instrument response and the proper operation of alarm functions.

Standby pumps are switched on a periodic basis, and continuously running equipment is visually examined periodically to ensure availability. Routine preventive maintenance checks are performed on this system, as are periodic tests to ensure that a standby equipment will perform in alternative failure conditions.

9.3.5.5 Instrumentation Application The instrumentation provided gives local indication and remote indication and alarms at the boron recovery control board in the main control room.

Boron recovery control board indication and alarms include:

1. Gas stripper level alarms and indication.

2. Primary-coolant letdown flow to the gas stripper/indication and alarm.

3. System pump pressure and operating status indication.

4. Process temperature alarm and indication.

5. Stripper gas compressor pressure alarm and indication.

6. Oxygen in the stripper gas compressor discharge alarm.

7. System filter and ion exchange high differential pressure alarms.

8. Boron evaporator pressure and level alarm and indication.

9. Boron evaporator feed flow indication.

10. System tank level indication and alarms.

11. System cooler temperature indications and recorders.

Revision 5209/29/2016 NAPS UFSAR 9.3-52 Local indications include various flows, temperatures, pressures, differential pressures, and levels.

The system instrumentation is calibrated on a periodic basis.

9.3 REFERENCES

1. Letter from Stephen R. Monarque (USNRC) to D. A. Christian (Dominion), North Anna Units 1 and 2Issuance of Amendments Re: Elimination of Post-Accident Sampling System Requirements (TAC Nos. MB2948 and MB2949), December 19, 2001 (Virginia Power Serial No.01-760).

9.3 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FM-082A Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1 12050-FM-082A Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 2

2. 11715-FM-082B Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

3. 11715-FM-082D Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

4. 11715-FM-082C Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

5. 11715-FM-082E Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

6. 11715-FM-082F Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

7. 11715-FM-082G Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

8. 11715-FM-082H Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

9. 11715-FM-082J Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

Revision 5209/29/2016 NAPS UFSAR 9.3-53

10. 11715-FM-082K Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

11. 11715-FM-082L Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

12. 11715-FM-082M Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

13. 11715-FM-082N Flow/Valve Operating Numbers Diagram: Compressed Air System, Unit 1

14. 11715-FM-089A Flow/Valve Operating Numbers Diagram: Sampling System, Unit 1 12050-FM-089A Flow/Valve Operating Numbers Diagram: Sampling System, Unit 2

15. 11715-FM-089B Flow/Valve Operating Numbers Diagram: Sampling System, Unit 1 12050-FM-089B Flow/Valve Operating Numbers Diagram: Sampling System, Unit 2

16. 11715-FM-089C Flow/Valve Operating Numbers Diagram: Sampling System, Unit 1

17. 11715-FM-089D Flow/Valve Operating Numbers Diagram: Sampling System, Unit 1

18. 11715-FM-090A Flow/Valve Operating Numbers Diagram: Vent and Drain System, Unit 1 12050-FM-090A Flow/Valve Operating Numbers Diagram: Vent and Drain System, Unit 2

19. 11715-FM-090B Flow/Valve Operating Numbers Diagram: Vent and Drain System, Unit 1 12050-FM-090B Flow/Valve Operating Numbers Diagram: Vent and Drain System, Unit 2

20. 11715-FM-090C Flow/Valve Operating Numbers Diagram: Vent and Drain System, Unit 1

21. 11715-FB-9A Arrangement: Auxiliary Building, Floor Drainage, Sheet 1

22. 11715-FB-9B Arrangement: Auxiliary Building, Floor Drainage, Sheet 2

23. 11715-FB-9C Arrangement: Auxiliary Building, Floor Drainage, Sheet 3

24. 11715-FB-13A Arrangement: Fuel Building, Plumbing and Fire Protection, Sheet 1

25. 11715-FB-13B Arrangement: Fuel Building, Plumbing and Fire Protection, Sheet 2

26. 11715-FB-14A Arrangement: Turbine Area, Floor and Equipment Drains, Sheet 1

27. 11715-FB-14B Arrangement: Turbine Area, Floor and Equipment Drains, Sheet 2

28. 11715-FB-26A Arrangement: Service Building, Plumbing, Sheet 1

29. 11715-FB-26B Arrangement: Service Building, Plumbing, Sheet 2

30. 11715-FB-37A Arrangement: Reactor Containment, Floor Drainage, Sheet 1

Revision 5209/29/2016 NAPS UFSAR 9.3-54

31. 11715-FB-37B Arrangement: Reactor Containment, Floor Drainage, Sheet 2

32. 11715-FB-39C Arrangement: Decontamination Building; Plumbing, Roof and Floor Drainage

33. 11715-FB-51B Arrangement: Spillway Control House, Heating/Ventilation and Misc. Piping

34. 11715-FM-095A Flow/Valve Operating Numbers Diagram: Chemical and Volume Control System, Unit 1 12050-FM-095A Flow/Valve Operating Numbers Diagram: Chemical and Volume Control System, Unit 2

35. 11715-FM-095B Flow/Valve Operating Numbers Diagram: Chemical and Volume Control System, Unit 1 12050-FM-095B Flow/Valve Operating Numbers Diagram: Chemical and Volume Control System, Unit 2

36. 11715-FM-095C Flow/Valve Operating Numbers Diagram: Chemical and Volume Control System, Unit 1 12050-FM-095C Flow/Valve Operating Numbers Diagram: Chemical and Volume Control System, Unit 2

37. 11715-FM-086A Flow/Valve Operating Numbers Diagram: Boron Recovery System, Unit 1

38. 11715-FM-086B Flow/Valve Operating Numbers Diagram: Boron Recovery System, Unit 1

39. 11715-FM-086C Flow/Valve Operating Numbers Diagram: Boron Recovery System, Unit 1

40. 11715-FM-086D Flow/Valve Operating Numbers Diagram: Boron Recovery System, Unit 1

41. 11715-FY-4A Finished Grading, Roads and Walkways, Sheet 1

42. 11715-FY-4B Finished Grading, Roads and Walkways, Sheet 2

43. 11715-FM-1B Machine Location: Reactor Containment, Plan, Elevation 262'- 10",

Unit 1

44. 11715-FM-1C Machine Location: Reactor Containment, Plan, Elevation 241'- 0",

Unit 1

45. 11715-FM-1D Machine Location: Reactor Containment, Plan, Elevation 216'- 11",

Unit 1

46. 11715-FB-1A Arrangement: Yard, Storm and Sanitary Sewer, Sheet 1

47. 11715-FB-1B Arrangement: Yard, Storm and Sanitary Sewer, Sheet 2

Revision 5209/29/2016 NAPS UFSAR 9.3-55 Table 9.3-1 COMPRESSED AIR SYSTEM DESIGN DATA Service Air Subsystem Service Air Compressor Number 2 (one for each unit)

Discharge pressure 125 psig Discharge temperature 30°F above ambient Capacity 660 scfm Service Air Receivers Number 2 (one for each unit) 1 (one for both units)

Volume 96 ft3 1005 ft3 Design pressure 125 psig 125 psig Design temperature 400°F 400°F Operating pressure 110 psig 110 psig Operating temperature 110°F 110°F Material Carbon steel Carbon steel Design code ASME VIII, 1968 ASME VIII, Div. 1, 1977 Service Air Aftercooler Number 1 Type Plate Minimum Rated Flow Required:

@ 5°F Approach Temperature 660 scfm

@ 10°F Approach Temperature 1320 scfm Design Pressure/Design Temperature 250 psig/350°F Heat Exchanger Material Aluminum Instrument Air Subsystem Instrument Air Compressor Number 2 (one for each unit)

Discharge pressure 118 psig Discharge temperature 110°F Capacity 440 scfm Instrument Air Receivers Number 2 (one for each unit)

Volume 96 ft3 Design pressure 125 psig Design temperature 40°F Operating pressure 110 psig Operating temperature 110°F

Revision 5209/29/2016 NAPS UFSAR 9.3-56 Table 9.3-1 (continued)

COMPRESSED AIR SYSTEM DESIGN DATA Instrument Air Subsystem (continued)

Instrument Air Receivers (continued)

Material Carbon steel Design code ASME VIII, 1968 Seismic Instrument Air Receivers (Required for Safe Shutdown)

Number 8 per unit Volume 16.7 ft3 Design pressure 200 psig Design temperature 400°F Operating pressure 110 psig Operating temperature 110°F Material Carbon steel Design code ASME VIII, 1968 Instrument Air Driers Number 2 (one for each unit) 1 (Shared)

Capacity 720 scfm 900 scfm Dewpoint at 110 psig -40°F -40°F Type Desiccant Desiccant Filter retention size 3 m 3 m Instrument Air Compressor Closed Loop Cooling Heat Exchanger Number 6 (three per compressor)

Type Shell and tube Tube side flow rate (water) 42 gpm Shell side flow rate (20% glycol) 25.2 gpm Design pressure (tube side) 150 psig Design pressure (shell side) 225 psig Design code ASME VIII Tube material Stainless steel Shell material Stainless steel Tubesheet material Stainless steel Instrument Air Compressor Closed Loop Cooling Circulating Pump Number 2 (one per compressor)

Type Centrifugal Motor horsepower 5 Capacity 30 gpm Head at rated capacity 150 ft

Revision 5209/29/2016 NAPS UFSAR 9.3-57 Table 9.3-1 (continued)

COMPRESSED AIR SYSTEM DESIGN DATA Instrument Air Subsystem (continued)

Instrument Air Compressor Closed Loop Cooling Circulating Pump (continued)

Design pressure 225 psig Design temperature 130°F Material:

Pump 316 SS Shaft 316 SS Impeller 316 SS Containment Instrument Air Subsystem Containment Instrument Air Compressors Number 4 (two for each unit)

Discharge pressure 95 psig Discharge temperature 125°F Capacity 24 scfm @ 9.5 psia suction Containment Instrument Air Receivers Number 4 (two for each unit)

Volume 41.4 ft3 Design pressure 125 psig Design temperature 280°F Operating pressure 105 psig Operating temperature 105°F Material Carbon steel Design code ASME VIII, Division I, 1989, 1990 Addendum Containment Instrument Air Prefilter Number 2 (one for each dryer skid within each containment)

Capacity 24 scfm Retention size 10 m Containment Instrument Air Afterfilter Number 2 (one for each dryer skid within each containment)

Capacity 24 scfm Retention size 10m Containment Instrument Air Drier Number 4 (two for each unit)

Capacity 24 scfm Dewpoint at 90 psia -40°F Type Desiccant

Revision 5209/29/2016 NAPS UFSAR 9.3-58 Table 9.3-2 SAMPLING SYSTEM SAMPLE POINTS High Temperature Samples from Each Unit Pressurizer vapor (radioactive)

Pressurizer liquid (radioactive)

Residual heat removal liquid, upstream of the residual heat removal pumps (radioactive)

Residual heat removal liquid, downstream of the residual heat exchangers (radioactive)

Hot-leg primary coolant, each reactor coolant loop (radioactive)

Cold-leg primary coolant, each reactor coolant loop (radioactive)

Steam generator blowdown liquid, each of the blowdown lines Flash evaporator recycle pump discharge (Unit 1 pumps abandoned in place)

Flash evaporator distillate Main steam, each of the main steam lines Steam generator feedwater Steam generator surface sample, each steam generator Moisture separator reheater/heater drains High-Temperature Samples Common to Both Units Gas stripper liquid effluent (radioactive)

Auxiliary heating de-aerator Auxiliary heating boiler steam drum, each steam drum Low-Temperature Samples from Each Unit Influent header to Chemical and Volume Control System demineralizers (radioactive)

Chemical and volume control system cation demineralizer effluent (radioactive)

Condensate from condensate pump discharge Chemical and volume control system deborating demineralizer effluent (radioactive)

Chemical and volume control system mixed-bed demineralizer effluent (radioactive)

Volume control tank, liquid (radioactive)

Volume control tank, gas space (radioactive)

Pressurizer relief tank, gas space (radioactive)

Flash evaporator demineralizer effluent Charging pump discharge (radioactive)

Condensate downstream of chemical addition taps Condensate polisher effluent Condensate make-up effluent

Revision 5209/29/2016 NAPS UFSAR 9.3-59 Table 9.3-2 (continued)

SAMPLING SYSTEM SAMPLE POINTS Low-Temperature Samples Common to Both Units Low-level-waste drain tanks, liquid from two tanks (radioactive)

Boron recovery system test tank, liquid (radioactive)

High-level-waste drain tank, liquid from two tanks (radioactive)

Boron recovery tanks, liquid (radioactive)

Component cooling system, liquid Gas stripper, liquid effluent (radioactive)

Primary water tanks Contaminated drain tank, liquid from two tanks (radioactive)

Waste disposal test tank, liquid from two tanks (radioactive)

Gas stripper surge tank effluent (radioactive)

Revision 5209/29/2016 NAPS UFSAR 9.3-60 Table 9.3-3 VENT AND DRAIN SYSTEM COMPONENT DESIGN DATA Primary Drain Transfer Tanks Number 2 (one for each unit)

Capacity per tank 745 gal Design pressure 195 psig and full vacuum Design temperature 400°F Operating pressure 1 psig Operating temperature 150°F Base metal material SS 304L Design code ASME III, Class C, 1968 Primary Vent Pots Number 2 (one for each unit)

Capacity per pot 20 gal Design pressure 25 psig Design temperature 200°F Operating pressure Atmospheric Operating temperature 150°F Base metal material SS 304L Safeguards Area Sump Pumps Number 4 (two for each unit)

Type Vertical centrifugal - single stage Motor horsepower 1 Seal Packing Capacity per pump 25 gpm Head at rated capacity 36 ft Design pressure 150 psig Design temperature 180°F Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Fuel Building Sump Pump Number 2 Type Vertical centrifugal - single stage Motor horsepower 1.5 Seal Packing Capacity 25 gpm Head at rated capacity 46 ft Design pressure 150 psig

Revision 5209/29/2016 NAPS UFSAR 9.3-61 Table 9.3-3 (continued)

VENT AND DRAIN SYSTEM COMPONENT DESIGN DATA Fuel Building Sump Pump (continued)

Design temperature 180°F Materials Pump casing SS 316 Shaft SS 316 Auxiliary Building Sump Pump Number 2 Type Vertical centrifugal - single stage Motor horsepower 2 Seal Packing Capacity 50 gpm Head at rated capacity 48 ft Design pressure 150 psig Design temperature 180°F Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Reactor Containment Sump Pumps Number 4 (two for each unit)

Type Submersible - single stage Seal Mechanical Capacity 25 gpm Head at rated capacity 95 ft (min)

Design pressure 145 psig Design temperature 125°F (min)

Material Pump casing Aluminum/SS Shaft SS Impeller Chromium alloyed cast iron Incore Instrumentation Room Sump Pump Number 2 (one for each unit)

Type Vertical centrifugal - single stage Motor horsepower 0.75 Seal Packing Capacity 10 gpm Head at rated capacity 15 ft Incore Instrumentation Room Sump Pump (continued)

Revision 5209/29/2016 NAPS UFSAR 9.3-62 Table 9.3-3 (continued)

VENT AND DRAIN SYSTEM COMPONENT DESIGN DATA Design pressure 150 psig Design temperature 180°F Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Valve Pit Sump Pumps Number 4 (two for each unit)

Type Self-priming, positive displacement Motive force Air-operated Seal Diaphragm Capacity Approximately 65 gpm Head at rated capacity Approximately 80 ft Design pressure 100 psig Design temperature 150°F Materials Pump casing Cast iron Non-wetted internals Aluminum, steel Wetted internals Neoprene Decontamination Building Sump Pumps Number 2 Type Vertical centrifugal - single stage Motor horsepower 2 Seal Packing Capacity 10 gpm Head at rated capacity 20 ft Design pressure 100 psig Design temperature 150°F Materials Pump casing SS 304 Shaft SS 304 Impeller SS 304 Primary Drain Transfer Pumps Number 4 (two for each unit)

Type Canned horizontal centrifugal Motor horsepower 5 Seal Canned pump Primary Drain Transfer Pumps (continued)

Revision 5209/29/2016 NAPS UFSAR 9.3-63 Table 9.3-3 (continued)

VENT AND DRAIN SYSTEM COMPONENT DESIGN DATA Capacity 60 gpm Head at rated capacity 120 ft Design pressure 150 psig Design temperature 400°F Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316

Revision 5209/29/2016 NAPS UFSAR 9.3-64 Table 9.3-4 CHEMICAL AND VOLUME CONTROL SYSTEM DESIGN PARAMETERS Parameter Value Seal-water supply flow rate for three reactor coolant pumps, nominal 24 gpm Seal-water return flow rate for three reactor coolant pumps 7.5 gpm

[w/ Flowserve seals], nominal Seal-water return flow rate for three reactor coolant pumps 9 gpm

[w/ Westinghouse seals], nominal Letdown flow Normal 60 gpm Minimum 45 gpm Maximum 120 gpm Charging flow (excludes seal water)

Normal 45 gpm Maximum 105 gpm Temperature of letdown reactor coolant entering system 552.3°F Temperature of charging flow directed to reactor coolant system 505°F Centrifugal charging pump recirculation flow, per pump 60 gpm Normal temperature of reactor coolant directed to boron recovery system 115°F Amount of 7.4% boric acid solution required to meet cold-shutdown 6000 gal requirements for one unit shortly after full-power operation

Revision 5209/29/2016 NAPS UFSAR 9.3-65 Table 9.3-5 PRINCIPAL COMPONENT DATA

SUMMARY

Centrifugal Charging Pumps Number 3 Design pressure 2800 psig Design temperature 300°F Design flow 150 gpm Design head 5800 ft Material Austenitic stainless steel or equivalent corrosion-resistant material Boric Acid Transfer Pumps (2-speed)

Number 2 Design pressure 150 psig Design temperature 250°F Design flow 75/37.5 gpm Design head 235/60 ft Material Austenitic stainless steel Regenerative Heat Exchanger Number 1 Heat transfer rate at design conditions 8.85 x 106 Btu/hr Shell side Design pressure 2485 psig Design temperature 650°F Fluid Borated reactor coolant Material Austenitic stainless steel Tube side Design pressure 2735 psig Design temperature 650°F Fluid Borated reactor coolant Material Austenitic stainless steel Shell side (letdown)

Flow 29,820 lb/hr Inlet temperature 555.5°F Outlet temperature 291°F Tube side (charging)

Flow 22,370 lb/hr Inlet temperature 130°F Outlet temperature 505°F

Revision 5209/29/2016 NAPS UFSAR 9.3-66 Table 9.3-5 (continued)

PRINCIPAL COMPONENT DATA

SUMMARY

Nonregenerative Heat Exchanger Number 1 Heat transfer rate at design conditions 16.08 x 106 Btu/hr Shell side Design pressure 150 psig Design temperature 250°F Fluid Component cooling water Material Carbon steel Tube side Design pressure 600 psig Design temperature 400°F Fluid Borated reactor coolant Material Austenitic stainless steel Shell side (component cooling water)

Design Flow 537,100 lb/hr Inlet temperature 105°F Outlet temperature 135°F Normal Flow 81,250 lb/hr Inlet temperature 105°F Outlet temperature 170°F Tube side (letdown)

Design Flow 59,700 lb/hr Inlet temperature 380°F Outlet temperature 115°F Normal Flow 29,820 lb/hr Inlet temperature 291°F Outlet temperature 115°F Excess-Letdown Heat Exchanger Number 1 Heat transfer rate at design conditions 3.27 x 106 Btu/hr Shell side Design pressure 150 psig Design temperature 250°F Design flow 83,500 lb/hr

Revision 5209/29/2016 NAPS UFSAR 9.3-67 Table 9.3-5 (continued)

PRINCIPAL COMPONENT DATA

SUMMARY

Excess-Letdown Heat Exchanger (continued)

Shell side (continued)

Inlet temperature 105°F Outlet temperature 144°F Fluid Component cooling water Material Carbon steel Tube side Design pressure 2485 psig Design temperature 650°F Design flow 7500 lb/hr Inlet temperature 555.5°F Outlet temperature 153°F Fluid Borated reactor coolant Material Austenitic stainless steel Seal-Water Heat Exchanger Number 1 Heat transfer rate at design conditions 1.37 x 106 Btu/hr Shell side Design pressure 150 psig Design temperature 250°F Design flow 108,000 lb/hr Inlet temperature 105°F Outlet temperature 118°F Fluid Component cooling water Material Carbon steel Tube side Design pressure 150 psig Design temperature 250°F Design flow 111,600 lb/hr Inlet temperature 133°F Outlet temperature 121°F Fluid Borated reactor coolant Material Austenitic stainless steel Volume Control Tank Number 1 Volume 300 ft3 Design pressure, psig 75 psig Design temperature 250°F

Revision 5209/29/2016 NAPS UFSAR 9.3-68 Table 9.3-5 (continued)

PRINCIPAL COMPONENT DATA

SUMMARY

Volume Control Tank (continued)

Spray nozzle flow (maximum) 120 gpm Material Austenitic stainless steel Boric Acid Storage Tank Number 3 (shared)

Capacity 8000 gal Design pressure Atmospheric Design temperature 250°F Material Austenitic stainless steel Batching Tank Number 1 (shared)

Capacity 800 gal Design pressure Atmospheric Design temperature 250°F Material Austenitic stainless steel Mixed-Bed Demineralizers Number 2 Design pressure 200 psig Design temperature 250°F Design flow 120 gpm Resin volume per unit 39 ft3 Material Austenitic stainless steel Cation-Bed Demineralizer Number 1 Design pressure 200 psig Design temperature 250°F Design flow 60 gpm Resin volume per unit 27 ft3 Material Austenitic stainless steel De-borating Demineralizer Number 2 Design pressure 200 psig Design temperature 200°F Design flow 120 gpm Resin volume per unit 56 ft3 Material Austenitic stainless steel

Revision 5209/29/2016 NAPS UFSAR 9.3-69 Table 9.3-5 (continued)

PRINCIPAL COMPONENT DATA

SUMMARY

Letdown Filter Number 1 Design pressure 200 psig Design temperature 250°F Design flow 150 gpm Material (vessel) Austenitic stainless steel Reactor Coolant Filter Number 1 Design pressure 200 psig Design temperature 250°F Design flow 150 gpm Material (vessel) Austenitic stainless steel Seal-Water Injection Filters Number 2 Design pressure 2735 psig Design temperature 200°F Design flow 80 gpm Material (vessel) Austenitic stainless steel Seal-Water Return Filter Number 1 Design pressure 200 psig Design temperature 250°F Design flow 320 gpm Material (vessel) Austenitic stainless steel Boric Acid Filter Number 1 Design pressure 200 psig Design temperature 250°F Design flow 120 gpm Material (vessel) Austenitic stainless steel

Revision 5209/29/2016 NAPS UFSAR 9.3-70 Table 9.3-5 (continued)

PRINCIPAL COMPONENT DATA

SUMMARY

Boric Acid Blender Number 1 Design pressure 150 psig Design temperature 250°F Material Austenitic stainless steel Letdown Orifice 45 gpm Number 1 Design flow 22,366 lb/hr Differential pressure at design flow 1900 psia Design pressure 2485 psig Design temperature 650°F Material Austenitic stainless steel 60 gpm Number 2 Design flow 29,820 lb/hr Differential pressure at design flow 1900 psia Design pressure 2485 psig Design temperature 650°F Material Austenitic stainless steel Zinc Injection Skid Number 1 Design pressure 75 psig Design temperature 250°F Material of construction Austenitic Stainless Steel Tank volume (2 Tanks) 5 gallons (each)

Operating flow rate (per pump) 2 ml/min Maximum flow rate (per pump) 3 ml/min

Revision 5209/29/2016 NAPS UFSAR 9.3-71 Table 9.3-6 CHEMICAL AND VOLUME CONTROL SYSTEM CODE REQUIREMENTS Component Code Centrifugal charging pumps ASME P&V,a Class II Boric acid transfer pumps ASME P&V, Class III Regenerative heat exchanger ASME III,bClass C Nonregenerative heat exchanger Tube side ASME III, Class C Shell side ASME VIIIc Excess-letdown heat exchanger Tube side ASME III, Class C Shell side ASME VIII Seal-water heat exchanger Tube side ASME III, Class C Shell side ASME VIII Volume control tank ASME III, Class C Boric acid storage tanks ASME VIII (not stamped)

Boric acid batching tank ASME VIII (not stamped)

Chemical-mixing tank ASME VIII (not stamped)

Mixed-bed demineralizers ASME III, Class C Cation-bed demineralizer ASME III, Class C Deborating demineralizers ASME III, Class C Letdown filter ASME III, Class C Reactor coolant filter ASME III, Class C Seal-water injection filters ASME III, Class C Seal-water return filter ASME III, Class C Boric acid filter ASME III, Class C Boric acid blender No code Letdown orifices No code Zinc Injection Skid ANSI B31.1d

a. American Society of Mechanical Engineers, Draft ASME code for Pumps and Valves for Nuclear Power, November 1968 Edition.

b. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code: Section III, Nuclear Vessels, 1968 Edition.

c. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code: Section VIII, Nuclear Ves-sels, 1968 Edition.

d. American National Standards Institute, Power Piping, 1967 Edition.

Revision 5209/29/2016 NAPS UFSAR 9.3-72 Table 9.3-7 BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Gas Stripper Number 2 Capacity per unit 135 gpm Design pressure 100 psig Design temperature, 338°F Operating pressure 2 psig Operating temperature 219°F Material SS 304L Design code ASME III Class C, 1968 Boron Recovery Tanks Number 3 Capacity per tank 120,000 gal Design pressure 0.5 psig and full of water Design temperature 180°F Operating pressure Atmospheric Operating temperature 130°F Material SS 304L Design code API STD-650, 1970 Boron Evaporators Number 2 Capacity per unit 20 gpm Design pressure 100 psig Design temperature 338°F Operating pressure 15 psig Operating temperature 260°F Material SS 304L Design code ASME VIII, Division I, 1968 Primary-Grade Water Number 2 Capacity per tank 180,000 gal Design pressure 0.5 psig and full of water Design temperature 150°F Operating pressure Atmospheric Operating temperature 125°F Material SS 304L Design code API STD-650, 1970

Revision 5209/29/2016 NAPS UFSAR 9.3-73 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Evaporator Bottoms Tank Number 1 Capacity 4000 gal Design pressure 25 psig Design temperature 200°F Operating pressure 10 psig Operating temperature 141°F Material SS 316L Design code ASME VIII, Division I, 1968 Distillate Accumulators Number 2 Capacity per unit 350 gal Design pressure 100 psig Design temperature 338°F Operating pressure 15 psig Operating temperature 250°F Material SS 304 Design code ASME VIII, Division I, 1968 Gas Stripper Surge Tank Number 1 Capacity 80 ft3 Design pressure 200 psig and full vacuum Design temperature 300°F Operating pressure 125 psig Operating temperature 150°F Material SS 304 Design code ASME III, Class C, 1968 Test Tanks Number 2 Capacity per unit 20,000 gal Design pressure Atmospheric and full of water Design temperature 150°F Operating pressure Atmospheric Operating temperature 125°F Material SS 304 Design code API STD-650, 1970

Revision 5209/29/2016 NAPS UFSAR 9.3-74 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Stripper Feed Heat Exchangers Number 4 Total duty 5,400,000 Btu/hr Shell Design pressure 150 psig Design temperature 350°F Operating pressure 50 psig Operating temperature, in/out 100/180°F Material SS 304 Fluid Letdown Design code ASME VIII, Division I, 1968 Tube Design pressure 200 psig Design temperature 350°F Operating pressure 130 psig Operating temperature, in/out 219/139°F Material SS 304 Fluid Letdown, degassed Stripper Feed Steam Heaters Number 2 Total duty 8,700,000 Btu/hr Shell Design pressure 200 psig Design temperature 382°F Operating pressure 100 psig Operating temperature, in/out 338/338°F Material Carbon steel Fluid Steam Design code ASME VIII, Division I, 1968 Tube Design pressure 150 psig Design temperature 350°F Operating pressure 30 psig Operating temperature, in/out 120/240°F Material SS 304 Fluid Letdown Design code ASME VIII, Division I, 1968

Revision 5209/29/2016 NAPS UFSAR 9.3-75 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Stripper Trim Cooler Number 2 Total duty 1,280,000 Btu/hr Shell Design pressure 150 psig and full vacuum Design temperature 350°F Operating pressure 60 psig Operating temperature, in 105°F Material Carbon steel Fluid Component cooling water Design code ASME VIII, Division I, 1968 Tube Design pressure 250 psig and full vacuum Design temperature 350°F Operating pressure 85 psig Operating temperature, in/out 139/120°F Material SS 304 Fluid Letdown Design code ASME, VIII Division I, 1968 Stripper Vent Condenser Number 2 Total duty 1,540,000 Btu/hr Shell Design pressure 150 psig Design temperature 350°F Operating pressure 120 psig Operating temperature, in/out 105/136°F Material Carbon steel Fluid Component cooling water Design code ASME VIII, Division I, 1968 Tube Design pressure 150 psig Design temperature 350°F Operating pressure 2 psig Operating temperature, in/out 219/211.5°F Material SS 304 Fluid Steam/condensate Design code ASME, III Class 3, 1971

Revision 5209/29/2016 NAPS UFSAR 9.3-76 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Stripper Vent Chiller Number 2 Total duty 13,200 Btu/hr Shell Design Pressure 150 psig Design temperature 350°F Operating pressure 1 psig Operating temperature, in/out 215/75°F Material SS304 Fluid Steam/noncondensibles Design code ASME III, Class 3, 1971 Tube Design pressure 150 psig Design temperature 350°F Operating pressure 60 psig Operating temperature, in 70°F Material SS 304 Fluid Chilled component cooling water Design code ASME III, Class 3, 1971 Boron Evaporator Reboilers Number 2 Duty per unit 12,202,000 Btu/hr Shell Design pressure 200 psig Design temperature 382°F Operating pressure 100 psig Operating temperature, in/out 338/338°F Material Carbon steel Fluid Steam Design code ASME VIII, Division I, 1968 Tube Design pressure 150 psig Design temperature 350°F Operating pressure 35 psig Operating temperature, in/out 253/265°F Material SS 304 Fluid 1 - 12.0% boric acid Design code ASME VIII, Division I, 1968

Revision 5209/29/2016 NAPS UFSAR 9.3-77 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Boron Evaporator Overhead Condenser Number 2 Duty per unit 10,400,000 Btu/hr Shell Design pressure 150 psig Design temperature 350°F Operating pressure 15 psig Operating temperature, in/out 250/250°F Material SS 304 Fluid Steam Design code ASME VIII, Division I, 1968 Tube Design pressure 150 psig Design temperature 350°F Operating pressure 70 psig Operating temperature, in/out 105/125°F Material SS 304 Fluid Component cooling water Design code ASME VIII, Division I, 1968 Boron Evaporator Distillate Coolers Number 2 Total duty 1,200,000 Btu/hr Shell Design pressure 150 psig Design temperature 350°F Operating pressure 70 psig Operating temperature, in/out 105/120°F Material Carbon steel Fluid Component cooling water Design code ASME VIII, Division I, 1968 Tube Design pressure 150 psig Design temperature 350°F Operating pressure 50 psig Operating temperature, in/out 250/130°F Material SS 304 Fluid Distillate Design code ASME VIII Division I, 1968

Revision 5209/29/2016 NAPS UFSAR 9.3-78 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Boron Evaporator Bottoms Cooler Number 1 Total duty 950,000 Btu/hr Shell Design pressure 150 psig and full vacuum Design temperature 350°F Operating pressure 60 psig Operating temperature, in/out 120/150°F Material Carbon steel Fluid Component cooling water Design code ASME VIII, Division I, 1968 Tube Design pressure 150 psig and full vacuum Design temperature 350°F Operating pressure 45 psig Operating temperature, in/out 255/160°F Material SS 304 Fluid Up to 9.0 wt.% boric acid Design code ASME VIII Division I, 1968 Primary-Grade Water Tank Thermosiphon Heaters Number 2 Total duty 668,00 Btu/hr Shell Design pressure 200 psig Design temperature 388°F Operating pressure 100 psig Operating temperature, in/out 338/338°F Material Carbon steel Fluid Steam Design code ASME VIII, Division I, 1968 Tube Design pressure 200 psig Design temperature 388°F Operating pressure 30 psig Operating temperature, in/out 40/250°F Material SS 304 Fluid Water/steam Design code ASME VIII Division I, 1968

Revision 5209/29/2016 NAPS UFSAR 9.3-79 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Primary-Water Service Pumps Number 2 Type Vertical in-line centrifugal Motor horsepower 25 Seal type Single mechanical Capacity per pump 120 gpm Head at rated capacity 270 ft Design pressure 270 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Primary-Water Standby Pumps Number 2 Type Horizontal centrifugal Motor horsepower 40 Seal type Single mechanical Capacity per pump 200 gpm Head at rated capacity 285 ft Design pressure 275 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Boron Evaporator Bottoms Pumps Number 2 Type Horizontal centrifugal Motor horsepower 3 Seal type Mechanical seal Capacity per pump 20 gpm Head at rated capacity 74 ft Design pressure 125 psig (working pressure)

Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316

Revision 5209/29/2016 NAPS UFSAR 9.3-80 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Boron Evaporator Feed Pumps Number 2 Type Horizontal centrifugal Motor horsepower 10 Seal type Single mechanical Capacity per pump 150 gpm Head at rated capacity 115.7 ft Design pressure 200 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Boron Evaporator Distillate Pumps Number 2 Type Horizontal centrifugal Motor horsepower 3 Seal type Single mechanical Capacity per pump 22 gpm Head at rated capacity 75 ft Design pressure 220 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Boron Evaporator Test Tank Pumps Number 2 Type Vertical in-line centrifugal Motor horsepower 3 Seal type Single mechanical Capacity per pump 62 gpm Head at rated capacity 79 ft Design pressure 150 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316

Revision 5209/29/2016 NAPS UFSAR 9.3-81 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Boron Evaporator Circulating Pumps Number 2 Type Horizontal centrifugal Motor horsepower 25 Seal type Double mechanical Capacity per pump 2200 gpm Head at rated capacity 29 ft Design pressure 200 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Gas Stripper Circulating Pumps Number 2 Type Vertical in-line centrifugal Motor horsepower 15 Seal type Single mechanical Capacity per pump 145 gpm Head at rated capacity 114 ft Design pressure 200 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Evaporator Bottoms Cooler Circulating Pump Number 1 Type Horizontal centrifugal Motor horsepower 1 Seal type Single mechanical Capacity per pump 75 gpm Head at rated capacity 21.7 ft Design pressure 220 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316

Revision 5209/29/2016 NAPS UFSAR 9.3-82 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Evaporator Bottoms Tank Circulating Pump Number 1 Type Vertical in-line centrifugal Motor horsepower 3 Seal type Double mechanical Capacity per pump 50 gpm Head at rated capacity 78 ft Design pressure 150 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Gas Stripper Discharge Pumps Number 2 Type Vertical in-line centrifugal Motor horsepower 20 Seal type Single mechanical Capacity per pump 145 gpm Head at rated capacity 241 ft Design pressure 200 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Gas Stripper Diaphragm Compressors Number 2 Type Diaphragm Motor horsepower 3 Capacity per unit 2.5 scfm Discharge pressure at capacity 135 psig Design pressure 220 psig Materials Cylinder Carbon steel Piston rod Forged steel Piston Nodular iron Diaphragm and parts contacting gas SS 304

Revision 5209/29/2016 NAPS UFSAR 9.3-83 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Boron Recovery Filters Number 2 Retention size 1-3 m Filter element material Cotton or synthetic Normal capacity 270 gpm Maximum capacity 300 gpm Housing material SS 304 Design pressure 150 psig Design temperature 250°F Design code ASME VIII, Division I, 1968 Boron Cleanup Filter Number 1 Retention size 3 m Filter element material Cotton or synthetic Normal capacity 60 gpm Maximum capacity 200 gpm Housing material SS 304 Design pressure 150 psig Design temperature 250°F Design code ASME VIII, Division I, 1968 Boron Evaporator Bottoms Filters Number 2 Retention size, m 25 Filter element material Cotton or synthetic Normal capacity 20 gpm Maximum capacity 50 gpm Housing material SS 304 Design pressure 150 psig Design temperature 250°F Design code ASME VIII, Division I, 1968 Cesium Removal Ion Exchangers Number 2 Design flow 270 gpm Resin type Mixed-bed or cation type Resin active volume 45 ft3 Design pressure 200 psig Design temperature 250°F

Revision 5209/29/2016 NAPS UFSAR 9.3-84 Table 9.3-7 (continued)

BORON RECOVERY SYSTEM COMPONENT DESIGN DATA Cesium Removal Ion Exchangers (continued)

Material SS 316 Design code ASME VIII, Division I, 1968 Boron Cleanup Ion Exchangers Number 2 Design flow 200 gpm Resin type Mixed-bed Resin active volume 45 ft3 Design pressure 200 psig Design temperature 250°F Material SS 316 Design code ASME VIII, Division I, 1968

Revision 5209/29/2016 NAPS UFSAR 9.3-85 Table 9.3-8 BORON RECOVERY SYSTEM MALFUNCTION ANALYSIS Component Malfunction Comments and Consequences Tanks and other Leak Tanks and other components are protected from components overpressure by automatic controls and relief containing letdown valves; therefore, only minor leaks are liquids with dissolved considered possible. The total gas content of the gases gas stripper and associate gasholding tanks is less than that of the holdup tanks in the gaseous waste disposal system; hence, even a total release could be accommodated (Section 15.3.5).

Boron recovery tanks Leak Only degasseda liquids are normally stored in these tanks, which are protected by dikes capable of retaining the entire contents of the tank, as described in Section 3.8.1.1.8. The dikes are Seismic Class I structures. Any gaseous radiological release from a tank leak is bounded by the evaluation of the waste gas decay tank rupture described in Section 15.3.5.

Gas stripper and Failure to Two strippers and associated equipment are associated equipment function provided; hence, 50% of the maximum letdown capacity can be processed while repairs are made.

One boron recovery Failure to Degasseda letdown is directed to the boron evaporator or function recovery tanks. Two evaporators are provided; auxiliaries hence, 50% of the evaporator capacity will still be available while repairs are made. Sufficient capability to make boric acid solution for station requirements exists in the boric acid batch tank, and the primary-grade water tanks can supply adequate quantities of water. Makeup water to the primary water tanks is available.

Primary-water service Failure to During normal operation a primary-grade or standby pump function service pump handles 100% of flow requirements so that full backup is always available. During start-up or pressurizer relief tank spray, the primary-water standby pumps each handle 100% of flow requirements.

a. Processed through the gas strippers (with or without steam) to remove the majority of dissolved gases and hydrogen.

Revision 5209/29/2016 NAPS UFSAR 9.3-86 Table 9.3-8 (continued)

BORON RECOVERY SYSTEM MALFUNCTION ANALYSIS Component Malfunction Comments and Consequences Primary-grade water Leak These tanks hold a maximum of 180,000 gallons tank each and are located in the south yard. The failure of these tanks would result in water spreading out and being accommodated by the ditch configuration to the south of the tanks, as shown on Reference Drawing 42.These tanks are located at the 271-foot level, and water released will be deflected in a generally southward direction by the fuel building, the decontamination building, and the new-fuel-unloading area. A cumulative 1-foot still exists from the 271-foot level to the fuel building. The new-fuel enclosure and its foundation also act to deflect any water away from the fuel building. Based on the size and capacity of the ditches, no flooding of safety-related equipment will take place.

Boron recovery test Leak These tanks are located next to the auxiliary tank building at the 274-foot level. Each contains less than the 20,000 gallons when full. They are empty a large percent of the time. The building doors adjacent to these tanks are normally locked closed as part of the station security system. As shown on Reference Drawing 42, the building access road area adjacent to these test tanks has a pronounced grade that will cause water to run off in an easterly direction. This runoff will be accommodated by ditches and yard storm drains, as shown on Reference Drawings 42, 46 and 47. Even if the full contents of these tanks were to come into the auxiliary building, the total contents of 30,000 gallons would not result in a sufficient water level on the lowest floor of the auxiliary building to flood any safety-related equipment.

Revision 5209/29/2016 NAPS UFSAR 9.3-87 Table 9.3-9 HIGH RADIATION SAMPLING SYSTEM SAMPLE POINTS Sample Source Number of Sample Points for Each Reactor Reactor Coolant Hot leg 4 locations a Cold leg 3 locations a RHR loop 2 locations a CVCS mixed-bed demineralizer outlet 1 location Containment sump 1 location Containment atmosphere 1 location

a. One common header from outside the containment is routed to the high radiation sampling system.

Table 9.3-10 CHEMICAL ANALYSIS PANEL INSTRUMENTATION Parameter Instrument or Method Range of Measurement I. Reactor Coolant

1. Boron a Auto-Titrator 200 - 6000 ppm

2. pH Probe 1 - 13

3. Dissolved oxygen a Probe, Yellow Springs Instrument 1 - 20 ppm

4. Dissolved hydrogen a Gas chromatograph, Baseline 10 - 2000 cc/kg

5. Chloride Ion chromatograph, Dionex, portable 0 - 20 ppm II. Containment Atmosphere

1. Hydrogen Gas chromatograph, Baseline 0 - 10%

a. Reactor coolant only

Revision 5209/29/2016 NAPS UFSAR 9.3-88 Table 9.3-11 HIGH RADIATION SAMPLING SYSTEM WASTE TANK Quantity per station 1 Capacity 17 gal Material of construction Stainless steel Code ASME VIII Design pressure 150 psig Design temperature 150°F Table 9.3-12 HIGH RADIATION SAMPLING SYSTEM WASTE TANK PUMPS Quantity per station 2 Capacity 5 gpm Material of construction Stainless steel Shaft seal Double, mechanical Table 9.3-13 HIGH RADIATION SAMPLING SYSTEM EVACUATING BELLOWS COMPRESSOR Quantity per station 1 Capacity 2 scfm Discharge pressure (max) 40 psig Material of construction Stainless steel Motive device Reciprocating bellows

Revision 5209/29/2016 NAPS UFSAR 9.3-89 Table 9.3-14 HIGH RADIATION SAMPLING SYSTEM SAMPLING PANEL DESIGN CONDITIONS I. Process

1. Pressure (max) Reactor coolant sampling 2485 psig Sump sampling 75 psig Containment atmosphere 45 psig

2. Temperature (max) Reactor coolant sampling 700°F Sump sampling 220°F Containment atmosphere 310°F II. In-containment ambient

1. Pressure 9 - 60 psia

2. Temperature 310°F

3. Relative humidity 0 - 100%

III. Outside containment ambient

1. Pressure Atmospheric

2. Temperature 40 - 120°F

3. Relative humidity 0 - 100%

4. Radiation 1 x 107 rads

Revision 5209/29/2016 NAPS UFSAR 9.3-90 Figure 9.3-1 COMPRESSED AIR SYSTEM

Figure 9.3-2 (SHEET 1 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-91

Figure 9.3-2 (SHEET 2 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-92

Figure 9.3-2 (SHEET 3 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-93

Figure 9.3-2 (SHEET 4 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-94

Figure 9.3-2 (SHEET 5 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-95

Figure 9.3-2 (SHEET 6 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-96

Figure 9.3-2 (SHEET 7 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-97

Figure 9.3-2 (SHEET 8 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-98

Figure 9.3-2 (SHEET 9 OF 12)

SAMPLING SYSTEM

Revision 5209/29/2016 NAPS UFSAR 1RWH8QLWDQG8QLW'$µ06VRGLXPDQDO\]HUVZHUHUHPRYHG

9.3-99

Figure 9.3-2 (SHEET 10 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-100

Figure 9.3-2 (SHEET 11 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-101

Figure 9.3-2 (SHEET 12 OF 12)

SAMPLING SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-102

Figure 9.3-3 (SHEET 1 OF 5)

VENT AND DRAIN SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-103

Figure 9.3-3 (SHEET 2 OF 5)

VENT AND DRAIN SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-104

Figure 9.3-3 (SHEET 3 OF 5)

VENT AND DRAIN SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-105

Figure 9.3-3 (SHEET 4 OF 5)

VENT AND DRAIN SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-106

Figure 9.3-3 (SHEET 5 OF 5)

VENT AND DRAIN SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-107

Figure 9.3-4 DIESEL GENERATOR FLOOR DRAINAGE Revision 5209/29/2016 NAPS UFSAR 9.3-108

Figure 9.3-5 (SHEET 1 OF 2)

CHEMICAL AND VOLUME CONTROL SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-109

Figure 9.3-5 (SHEET 2 OF 2)

CHEMICAL AND VOLUME CONTROL SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-110

Figure 9.3-6 (SHEET 1 OF 6)

BORON RECOVERY SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-111

Figure 9.3-6 (SHEET 2 OF 6)

BORON RECOVERY SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-112

Figure 9.3-6 (SHEET 3 OF 6)

BORON RECOVERY SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-113

Figure 9.3-6 (SHEET 4 OF 6)

BORON RECOVERY SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-114

Figure 9.3-6 (SHEET 5 OF 6)

BORON RECOVERY SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-115

Figure 9.3-6 (SHEET 6 OF 6)

BORON RECOVERY SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.3-116

Revision 5209/29/2016 NAPS UFSAR 9.4-1 9.4 AIR-CONDITIONING, HEATING, COOLING, AND VENTILATION SYSTEMS 9.4.1 Main Control Room and Relay Rooms 9.4.1.1 Design Basis The main control and computer room air conditioning is designed to maintain 75°F and approximately 50% relative humidity during normal conditions. The relay rooms are designed for 75°F dry bulb at approximately 50% relative humidity during normal operation. For emergency conditions, there is sufficient cooling capacity to maintain the control room, computer room, and relay room space temperatures well below the design maximum of 120°F.

One 100% capacity cooling system which supplies the relay rooms and common control room in order to meet the single failure criterion is installed for each reactor unit. The cooling systems cannot be cross connected between the two reactor units. Each cooling system consists of two independent 100% redundant air conditioning trains, one powered from the H train and the other powered from the J train. An air conditioning train consists of a control room air handling unit (AHU), a relay room AHU, chilled-water piping and a water chiller. An additional water chiller (HV-E-4C) for each reactor unit is provided to prevent compressor failure from shutting down the H train air conditioning system for any appreciable time. This chiller has the capability of being mechanically aligned to provide chilled water to either air conditioning train of its respective reactor unit. Because the HV-E-4C chiller cannot be powered from two emergency power sources (H & J), it is not truly a swing unit.

Each reactor unit has two (HV-E-4A & HV-E-4C) chillers which receive power from the H train and an HV-E-4B chiller which receives power from the J train. The air conditioning arrangement is such that no action, either automatic or manual, is required during an emergency, as the normal mode will continue with the possible exception of chiller operation. When power to the chillers is interrupted and exceeds the protective circuit time setting, the chiller must be manually restarted with the reset button. However manual action is always required during normal and emergency plant conditions for the respective reactor unit whenever any operating air conditioning train fails. Components of two different air conditioning trains can be aligned together to provide 100% equivalent cooling capacity (e.g., chiller of one train with AHUs of the opposite train).

Normal replenishment and exhaust ventilation air is provided from external systems.

During an emergency, the main control and relay room areas are sealed with weather-stripped doors and duct closures, and the normal outside air supply and exhaust are automatically shut down.

Dual duct closures are provided in series to satisfy the single-failure criterion. Although not credited in the accident analysis, bottled, compressed dry air of breathing quality is provided to limit in-leakage when the outside air is contaminated. Emergency supply ventilation systems, taking suction from the turbine building through high-efficiency particulate air (HEPA) and

Revision 5209/29/2016 NAPS UFSAR 9.4-2 charcoal filters, are provided to supply breathing air indefinitely after being manually aligned following an accident. Intake dampers and motor operators for the emergency ventilation supply air units have been seismically tested and analyzed in accordance with plant seismic design criteria. Heaters and water-separating equipment are used to control moisture accumulation in the emergency ventilation systems.

Main control room and relay room equipment internal power losses are more than adequate for the heating of the control and relay rooms. Accordingly, no space heating is provided, although the replenishment air is tempered in cool weather.

All air-conditioning, breathing-air, and associated equipment is Seismic Class I, is located within the missile-protected boundary, and is powered from emergency buses to ensure operation during both normal and emergency conditions. All active components of the main control and relay room air-conditioning systems and supply air systems are redundant.

Table 9.4-1 lists outside design temperatures for the main control room and relay room system and for other systems described in Section 9.4. Table 9.4-2 lists the design data, Figure 9.4-1 and Reference Drawings 1 through 3 show the arrangement for the main control and relay room ventilation and air-conditioning systems.

9.4.1.2 System Description The air-conditioning equipment for the main control and relay room area is located within a missile-protected area with the refrigeration equipment for Units 1 and 2 installed at opposite ends of the emergency switchgear and relay room complex.

An air-conditioning system with two independent trains is installed for each unit. Each train has enough capacity for the total cooling load and is fitted with independent chillers, chilled-water piping, and air-conditioning units. Only one train for each unit is used at a time. A third chiller is provided for each reactor unit as an alternative for either train. Chiller HV-E-4A is remotely controlled from the main control room ventilation panel. Chillers HV-E-4B and C are locally controlled from control panels in the Air Conditioner and Chiller Rooms. Condensing water for the chillers is provided for each unit by two service-water lines - Train A and Train B. The service-water system is described in Section 9.2.1. Bearing cooling water may be supplied to the Unit 1 control room chillers in case of the unlikely event of a loss of both service water headers.

A pressure switch contact is installed in the control circuit of each chiller, so that for an elevated Service Water Reservoir temperature associated with a loss-of-coolant accident (LOCA),

the control room air-conditioning chillers remain operational. The final compressor stage is unloaded via the pressure switch prior to the elevated service-water temperature; this action prevents the compressor discharge pressure from reaching the high-pressure trip point.

Makeup and exhaust ventilation air of approximately 2200 cfm and 1900 cfm, respectively, is provided by external systems. Duct penetrations are fitted with redundant (two in series) dampers that are normally remote manually operated. In the event of an emergency (resulting in a

Revision 5209/29/2016 NAPS UFSAR 9.4-3 safety injection signal, Hi-Hi rad signal from the fuel building or manual actuation of the bottled air system), the normal outside air supply and exhaust fans are automatically shut down and the dampers closed. Doors are weather stripped and sliding missile shields are provided. Dampers are within the missile-protected areas. The compressed dry-air bottles are arranged in four trains (two per unit) to discharge breathable air for approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Emergency power ventilators, drawing turbine room air through HEPA/charcoal filters, are provided. All filter assemblies consist of a HEPA filter, a carbon adsorber, a demister, an electric coil, and a fan. Filter capabilities are discussed in Section 6.4. Breathing-air packs are also available for control room personnel. Fire barriers separate the control room and relay rooms. Fire protection is discussed in Section 9.5.1.

9.4.1.3 Design Evaluation Design requirements for the control equipment specify no loss of protective functions over a temperature range from 40°F to 120°F and 100% relative humidity. There is enough cooling capacity available for the control room, computer room, and relay room to provide adequate margin between equipment design temperature limits and either the normal or emergency environment.

The two separate 100% redundant cooling systems, one for each reactor unit, seismically designed and installed within the missile-protected and radiation-protected areas, satisfy the single-failure condition. Should a failure occur in an air-handling cooling unit or chilled-water circuit of either system, repair and return to service within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is probable. The third alternative 100% chiller unit permits the continued operation of either system on failure of a refrigeration compressor. Configuration is maintained so that two redundant systems with redundant power supplies are in service or the applicable Technical Specification Condition is entered. Each chiller is provided with an independent set of condenser and chiller circulating pumps for redundancy. Condenser cooling-water redundancy is ensured by the availability of service water under all conditions (see Section 9.2.1).

Although not required, compressed dry air provides an emergency source of breathing-quality air for operators for approximately one hour. This air will also minimize in-leakage into the MCR/ESGR envelope. The EVS fans taking air from the turbine room through HEPA/charcoal filters back up and extend the breathing air indefinitely. Breathing-air packs are an additional backup.

Two carbon dioxide (CO2) monitors have been installed in the main control rooms, one in Unit 1 and one in Unit 2. Carbon dioxide levels are measured in the air handling room for each respective main control room. Each monitor is designed to provide both audible and visual alarms when carbon dioxide levels are equal to or above accepted habitability limits.

The Main Control Room and Emergency Switchgear Room Emergency Ventilation System (MCR/ESGR EVS) was designed as four 100% capacity redundant trains that can filter and

Revision 5209/29/2016 NAPS UFSAR 9.4-4 recirculate air inside the MCR/ESGR envelope, or supply filtered air to the MCR/ESGR envelope. The two MCR/ESGR EVS trains on the accident unit actuate automatically in recirculation based on a safety injection signal. Either of these trains can also be aligned to provide filtered outside air of breathing quality approximately one hour after the event. If necessary, one train from the other unit can be manually actuated to provide filtered outside air to meet the supply air requirement.

In case of a design basis accident (DBA) during movement of recently irradiated fuel assemblies, an automatic isolation signal from the fuel building radiation monitors, or manual actuation of MCR/ESGR isolation is required. This actuation isolates the MCR/ESGR envelope, initiates bottled air and starts all available EVS trains in recirculation mode. Three of these trains can be manually aligned to provide filtered outside air within one hour after the event.

One EVS train is capable of performing the safety function of supplying outside filtered air.

Due to the location of the air intake for 1-HV-F-41, it can not be used to satisfy this requirement.

Two of the three remaining trains (1-HV-F-42, 2-HV-F-41, and 2-HV-F-42) are required for independence and redundancy.

The seismic design of all essential environmental equipment, the location of such equipment within missile-protected boundaries, and the redundancy provided satisfy the single-failure criterion for reliable operation under both normal and emergency conditions.

The fire barriers separating the main control room and relay rooms permit isolation in the very unlikely event of fire or smoke hazards during normal or emergency operations.

9.4.1.4 Tests and Inspections The environmental systems were inspected, tested, and balanced upon installation.

Individual HEPA filter and charcoal adsorber cells were individually shop-tested, and the assembled filter banks were retested after installation. Replacement HEPA and charcoal filters will be similarly tested. The bottled-air supply and HEPA/charcoal filters are arranged for periodic retesting. Leakage tests (dioctylphthalate smoke test for HEPA filters and Freon vapor tests for charcoal filters) can be made in place, and defective cells identified for removal and replacement. Emergency powered equipment is rotated periodically to ensure proper functioning and operating hours are equalized on redundant components (HV-E-4A & HV-E-4C). The B train is powered only from the J bus and does not have redundant components (HV-E-4B) therefore it does not necessitate equalized operating hours. Equal hours of operation of HV-E-4A & HV-E-4C allow higher reliability of the H train air conditioning system with the J train air conditioning system used as a back-up. Ultimately, this configuration allows higher reliability of the cooling systems. Periodic testing and inspection of filters and adsorbers will be performed in accordance with the Ventilation Filter Testing Program.

Revision 5209/29/2016 NAPS UFSAR 9.4-5 9.4.1.5 Instrumentation Application Instrumentation is provided to automatically control space temperatures. Chiller system HV-E-4A is remotely controlled from the main control room ventilation panel. Chiller systems HV-E-4B & HV-E-4C are locally controlled from control panels in the Air Conditioner and Chiller Rooms. The emergency ventilation is manually controlled from the space served. The operation of the bottled air banks is controlled from the main control room. Gauges are provided in the main control room to monitor the pressure differential of the control room envelope relative to adjoining areas. These gauges are used as an indicator of MCR/ESGR envelope integrity.

Control equipment is designated to Seismic Class I criteria.

9.4.1.6 Materials No special materials are required for these systems. All supply and exhaust ductwork for the system is galvanized steel. The fan casings and housings are steel, and the fan wheels are steel and/or aluminum. The casings for the HEPA/charcoal filter assemblies are galvanized steel. The charcoal adsorber cells are type 304 stainless steel.

9.4.2 Auxiliary Building 9.4.2.1 Design Basis The auxiliary building ventilation arrangement is shown on Figures 9.4-2 and 9.4-3, and Reference Drawings 4 and 5. The auxiliary building is a four-level compartmented structure containing the auxiliary nuclear equipment for Units 1 and 2. Equipment for handling radioactive fluids is located on the lower levels and is isolated and shielded as required. The upper lever is predominantly a ventilation equipment room.

The ventilation design is based on limiting the temperature in occupied spaces to 105°F, limiting the temperature in normally unoccupied machinery spaces to 120°F, and providing a minimum of 10 air changes per hour. The winter design is for a minimum of 50°F interior temperature. Provisions are made by multiple (three) exhaust fans installed in parallel and two separate supply air systems to permit reducing air quantities in case of airborne radioactivity and during mild to cold weather. Ventilation is designed on a once-through basis with supply to areas least likely to be contaminated and exhaust from those with the greatest contamination potential.

HEPA/charcoal filters are provided for the treatment of ventilation exhaust, as required (see Section 9.4.8). Outside design temperatures are given in Table 9.4-1. Filter specifications are shown in Table 9.4-3.

Potentially radioactive waste gases from auxiliary building equipment vents are processed through filters in the gaseous waste disposal system (Section 11.3) before discharge through the process vent. Since auxiliary building ventilation exhaust could contain comparatively slight

Revision 5209/29/2016 NAPS UFSAR 9.4-6 radioactive contamination from sources such as pump, gland, or valve leakage, the following features are incorporated in the design.

1. There are dual exhaust systems each containing three exhaust fans in parallel with a discharge damper on each fan. Both exhaust systems are designed for the capability of simultaneous operation of all three fans. This provides partial redundancy, as two fans will deliver about 75% of the total exhaust in the event that the other fan fails. This also provides a capacity reduction capability for purging in the event of airborne radioactive contamination.

2. Sampling lines from the individual exhaust systems for selective contamination monitoring, with recording and display in the main control room.

3. The common HEPA/charcoal filter bank as described in Section 9.4.8.

4. An exhaust alignment for the selective filtration of any exhaust system. Exhaust dampers are remote manually operated from the main control room.

5. Exhaust to the atmosphere through the continuously monitored vent stack A, discharged upward at Elevation 387 ft.

The radiation monitoring equipment is described in Section 11.4.

The HEPA/charcoal filters and the exhaust system from the charging pump cubicles meet Seismic Class I design criteria.

The auxiliary building central area exhaust system fan discharge ducts are seismically supported from the three area fans to preclude crimping of the exhaust system within the auxiliary building, and allow air flow through the duct system to a point exterior to the building. At a point in the central area exhaust exterior to the auxiliary building envelope, an automatic pressure relief opening provides an exit point for the central area exhaust air. In addition, a manually actuated relief opening can be actuated by the operator. These relief openings provide a means of restoring ventilation to the charging pumps/high head safety injection pumps after a seismic event.

9.4.2.2 System Description The auxiliary building is supplied by two systems with filters for continuous cleaning and steam coils for winter heating. Two major exhaust systems are used, each fitted with three fans in parallel that discharge through the auxiliary building vent stack A. This discharge can be diverted remotely from the main control room through the common HEPA/charcoal filter bank if required.

HEPA filters are installed in the exhaust branch from the auxiliary building sample cooler spaces for continuous filtration. A separate exhaust is provided for the elevator machinery room that discharges directly to the atmosphere.

Revision 5209/29/2016 NAPS UFSAR 9.4-7 Exhausts are located as far removed from space ventilation supplies as feasible. The resulting negative pressure draws the makeup air through the access to sweep the space so that possible airborne contamination from equipment leakage is drawn inward to the exhaust.

In accordance with Appendix R to 10 CFR 50, two supply fans are located on the roof of the auxiliary building. One of these two fans (capacity 28,500 cfm each) will be used if the central and/or general exhaust systems are rendered inoperable due to a fire. The supply system will serve the following areas:

two charging pump cubicles

component cooling water pump area

penetration areas These areas are designated for equipment operation and/or personnel access during plant shutdown. Sheet metal duct is routed from the fans down into the auxiliary building. When necessary, flexible duct will be routed from the permanently installed hard duct to the areas noted above.

9.4.2.3 Design Evaluation The ventilation arrangement provides the control of possible radioactive contamination by ensuring that air is not recirculated, that 10 or more changes per hour are supplied, and that the air flows from areas least likely to be contaminated to locations subject to contamination for exhaust.

After being monitored for gaseous and particulate activity, primary plant systems are exhausted through two stacks 116 feet above grade, discharging upward at high velocity. Effluent air can be selectively monitored for radioactivity and diverted through HEPA/charcoal filters before discharge if required.

The ventilation system limits summer space temperatures to 105°F in occupied spaces and 120°F in normally unoccupied machinery spaces, which is satisfactory for continuous operation.

Air rates are based on the maximum outside design temperatures and the operation of the heat-producing equipment. Summer space temperatures will be lower whenever outside conditions are below the design condition of 93°F dry bulb, and whenever the equipment is down for maintenance.

The dual three-fan exhaust systems and the two supply air systems provide step-capacity control and protection from a fan related single failure. The redundant central exhaust fans and filter isolation dampers have safety related power supplies and seismic ducts. In the case of airborne radioactive contamination, one supply system can be shut down to create a lower space pressure to increase inward air flow, or in the case of significant radioactivity, the supply and one exhaust can be shut down to reduce the flow of contaminated air through the HEPA/charcoal

Revision 5209/29/2016 NAPS UFSAR 9.4-8 filters. In case of an exhaust fan failure, the companion fan will provide about 75% of the exhaust rate while operating one supply air system.

In case of supply or exhaust fan shutdown or failure, the exhaust flow would be reduced.

Such reductions would increase space temperatures and, although long and continuous operation under these conditions would reduce the life of the equipment, the plant could continue operation pending repair.

The two standby supply fans located on the roof of the auxiliary building provide sufficient ventilation to limit space temperature to 120°F in those areas designated for plant shutdown in the event of a fire which disables normal ventilation.

9.4.2.4 Tests and Inspections The systems were inspected, tested, and balanced upon installation. Filter tests are covered in Section 9.4.8.

9.4.2.5 Instrumentation Application The ventilation system operates continuously and is manually controlled. Heating is thermostatically controlled.

9.4.3 Decontamination and Waste Solidification Building 9.4.3.1 Design Basis The decontamination building ventilation arrangement is shown in Figure 9.4-4 and Reference Drawings 6 and 7. The decontamination building abuts the fuel building. The decontamination building has a large decontamination area, waste solidification area, and a below-grade equipment level where the spent-resin processing and storage facilities are located.

The ventilation is designed to provide a minimum of 10 air changes per hour, drawing the exhaust from areas of maximum probable contamination and maintaining a slightly negative pressure in the building. The resulting air quantity limits the temperature to approximately 100°F under design conditions. The exhaust flow is significantly in excess of the supply flow to ensure inward leakage. The supply unit provides heating of the incoming air, if required. (Outside design temperatures are given in Table 9.4-1). Exhaust hoods are located in the decontamination bay area. The exhaust from these hoods is continuously discharged to the main exhaust through a demister and HEPA filter bank. Ventilation is designed on a once-through basis. Dual exhaust fans installed in parallel and two, two-speed supply fans are used to reduce air quantities in the case of airborne radioactivity, or during cool weather. The exhaust is continuously discharged to the vent stack B and can be diverted through the auxiliary building HEPA/charcoal filters if required. The same general features are incorporated as those provided for the auxiliary building and as listed in Section 9.4.2.1.

Revision 5209/29/2016 NAPS UFSAR 9.4-9 9.4.3.2 System Description Ventilation is by a 9000-cfm supply system for the decontamination area and a 8500-cfm supply system for the waste solidification area and an exhaust including both areas totaling 26,300 cfm. This excess exhaust maintains a slight internal negative pressure to prevent an outward leakage of potentially contaminated air. Each supply system incorporates a filter and a steam coil for space heating. Two-speed supply fan control is provided for capacity reduction. The two exhaust fans are located in the auxiliary building and discharge through the vent stack B, with the capability of diverting the effluent through the common auxiliary building HEPA/charcoal filter bank. Exhaust hoods are located in the decontamination bay area. The exhaust from these hoods is continuously discharged to the main exhaust through a demister and HEPA filter bank. A booster fan is installed to compensate for this filter bank loss.

9.4.3.3 Design Evaluation The ventilation system ensures continuous inward leakage, that 10 or more air changes per hour are supplied, and that no air is recirculated. Air is supplied to areas least likely to be contaminated for circulation and exhaust from locations subject to contamination. The system limits temperature to approximately 100°F in the summer and provides heating to 50°F minimum in the winter. The ventilation and heating capacities are sufficient to inhibit condensation in below-grade areas.

The hood exhaust is passed through demisters and HEPA filters to reduce the contamination hazard. Also, this effluent can be diverted through the common HEPA/charcoal filters in the auxiliary building, should this be required for gaseous iodine removal.

9.4.3.4 Tests and Inspections The systems were inspected, tested, and balanced upon installation. The HEPA filter cells are individually tested for efficiency and leakage by the manufacturer upon fabrication.

Replacement filters will be tested in the same manner.

9.4.3.5 Instrumentation Application The system is manually controlled except that winter heating is controlled thermostatically.

9.4.4 Turbine Building 9.4.4.1 Design Basis Two turbine buildings are provided, one for each unit, and are connected for crane access.

Each is approximately 272 feet long by 135 feet wide, with reinforced-concrete floors and turbine supports. These buildings house the turbine generators, condensers, feedwater heaters, pumps, oil-conditioning equipment, and associated components. The operating floor has grating and open areas for ventilation and access. The mezzanine level has partial platforms of both grating and solid construction. The lower level is at Elevation 254 ft. Walls are structural steel with metal

Revision 5209/29/2016 NAPS UFSAR 9.4-10 siding. The roof is metal decking with insulation and asphalt/felt plies topped by a single-ply unballasted membrane.

Ventilation is designed to limit the summer temperature to 104°F when operating. Heating is provided to 65°F in the case of winter shutdown. Outside design temperatures are given in Table 9.4-1.

9.4.4.2 System Description A combination of natural and forced ventilation is used. Each turbine building is exhausted by 10 power roof ventilators with a total capacity of 700,000 cfm. Supply air is introduced at lower levels to maximize heat absorption while rising alongside the hot equipment surfaces. The gratings and openings in the mezzanine and operating floor permit the ventilation air to freely circulate from the lower level upward, where it is exhausted by the power roof ventilators.

Blocking of the grating is allowed with compensatory actions to monitor temperature.

Supply is by three fan systems, totaling 240,000 cfm, with the remainder of the supply air (460,000 cfm) entering through louvered openings at the ground level. A separate 8400-cfm exhaust system is provided for the lubricating oil storage room in turbine building 1, and a 2800-cfm exhaust system is installed in the elevator machine room.

Unit heaters are installed throughout the turbine buildings for winter heating.

The ventilation arrangement is shown in Reference Drawing 8.

9.4.4.3 Design Evaluation The air quantities and arrangement will limit the temperature at the operating level to approximately 104°F during summer operation. The introduction of supply air at the lower levels, with the free passage of this air upward to the roof where it is exhausted, will provide satisfactory ventilation in compliance with normal power plant practice. Blocking of the grating is allowed with compensatory actions to monitor temperature.

9.4.4.4 Tests and Inspections The equipment was balanced, adjusted, and tested when it was installed.

9.4.4.5 Instrumentation Application The air supply systems are manually controlled by the operators to recirculate the turbine building air in cool weather or to introduce outside air in warm weather. Exhaust fans are manually controlled by the operators. All exhaust fans will normally be operated in warm weather with the natural supply louvers full open. In cooler weather, exhaust fans will be shut down and supply louvers closed as required.

Revision 5209/29/2016 NAPS UFSAR 9.4-11 9.4.5 Fuel Building 9.4.5.1 Design Basis The maintenance of a clear spent-fuel pit surface for visual fuel handling is a major design consideration. The design also provides the protective features covered under the auxiliary building requirements in Section 9.4.2.1, including dual exhaust fans and two-speed supply fans, once-through ventilation, excess exhaust, discharge through the vent stack B, and the capability of diverting the effluent through the auxiliary building HEPA/charcoal filter bank. The fuel-handling ventilation system includes design provisions to:

1. Inhibit roof condensation to prevent drippage into the spent-fuel pit.

2. Maintain a negative pressure in the building to ensure definite slight year-round infiltration into the building under neutral wind conditions. Fuel Building ventilation can be secured for short-term maintenance evolutions, testing, or other specific tasks that do not involve moving irradiated fuel assemblies nor loads over irradiated fuel assemblies. When ventilation is secured, negative pressure will not be maintained in the Fuel Building. During these time periods, the Fuel Buildings airborne activity and concentration will be periodically sampled to determine dose to workers inside the Fuel Building and to determine potential release of airborne radioactive material to the environment.

All ductwork and accessories from the fuel building wall penetration up to the exhaust fans are designed to Seismic Class I requirements. Outside design temperatures are listed in Table 9.4-1.

9.4.5.2 System Description The fuel building ventilation system is shown in Figure 9.4-2 and Reference Drawing 4.

Two supply fans are provided, one to serve the spent-fuel pit area and one for the remote equipment space at Elevation 249 ft. 4 in. Both take suction from a common plenum fitted with a combination box and high-efficiency filter (95% atmospheric dust spot efficiency) and steam coils for air tempering and space heating. The exhaust fans discharge through vent stack B and are arranged for selective alignment through the auxiliary building HEPA/charcoal filter bank. The area of the remote equipment room subject to radioactive contamination is exhausted by a branch from the decontamination building exhaust system.

9.4.5.3 Design Evaluation The design provides (1) sufficient air at a temperature that will inhibit condensation on the overhead structure to avoid drippage into the pool, (2) high-efficiency supply air filtration to minimize dust clouding of the surface, and (3) supply air distribution to avoid ruffling the surface.

A two-speed supply fan arrangement provides step-capacity control. The exhaust is continuously vented through vent stack B with the capability to divert through the auxiliary building HEPA/charcoal filter bank. The exhaust may be filtered continuously during movement of

Revision 5209/29/2016 NAPS UFSAR 9.4-12 irradiated fuel in the pool to prevent the spread of any possible airborne contamination through the exhaust air system.

The fuel building exhaust also discharges air entering the fuel building from the tunnel between the fuel building and the waste-disposal building.

The only portion of the fuel building ventilation system of Seismic Class I design is that portion connected to the common HEPA/charcoal filter bank header system, as shown in Figure 9.4-5.

The ductwork and accessories from the fuel building wall penetration up to and including the isolation dampers are Seismic Class I. The ductwork in the fuel building is used to evenly balance air flow and, even if lost, will not affect calculated off-site or control room doses since this condition is bounded by the fuel handling accident dose analysis.

A radiation detector is provided, and located to monitor the total exhaust air quantity. The fuel building exhaust does not need to be automatically diverted on a high-radiation level to the main HEPA/charcoal filter bank for the following reasons.

1. A seismic event and a fuel-handling accident are not considered to occur simultaneously during the 2-hour accident described in Regulatory Guide 1.183. Therefore, the ventilation system excluding the common HEPA/charcoal filter is not based on Regulatory Guide 1.13.

The postulated fuel-handling accident is covered in Section 15.4.5. In the analysis, offsite and onsite radiation doses are calculated assuming no charcoal absorbers. The resultant calculated site boundary integrated doses are below Regulatory Guide 1.183 and the resultant calculated control room doses remain less than the limits specified in 10 CFR 50.67.

2. A high-radiation level actuates a control room annunciator that allows a control operator to manually divert the fuel building exhaust.

3. Any release of radioactivity in the fuel building would most likely occur as a result of a fuel-handling accident with irradiated fuel present. The fuel building exhaust may be diverted through the HEPA/charcoal filters in the auxiliary building during irradiated fuel movement in the spent-fuel pit or during crane operation with loads over irradiated fuel in the spent fuel pit.

9.4.5.4 Tests and Inspections The equipment was balanced, adjusted, and tested upon installation. Ventilation filters are inspected and tested as required in the Ventilation Filter Testing Program.

9.4.5.5 Instrumentation Application The ventilation system operates continually and is manually controlled. Automatic heating controls are provided to (1) maintain a 75°F minimum temperature, (2) vary the temperature

Revision 5209/29/2016 NAPS UFSAR 9.4-13 difference between inside and outside from 30°F difference at 45°F outside temperature to 15°F difference at 75°F outside temperature, and (3) terminate heating at 90°F inside temperature.

The ventilation system can be secured for short-term maintenance evolutions, testing, or other specific tasks that do not involve moving irradiated fuel assemblies nor loads over irradiated fuel assemblies. When ventilation is secured, a negative pressure will not be maintained in the Fuel Building. During these time periods, the Fuel Buildings airborne activity and concentration will be periodically sampled to determine dose to workers inside the Fuel Building and to determine potential release of airborne radioactive material to the environment.

9.4.5.6 Materials No special materials are required for this system. All supply and exhaust ductwork for this system is galvanized steel. The fan casing and housings are steel and the fan wheels are steel and/or aluminum. The casings for the HEPA/charcoal filter assemblies are welded steel and painted. The charcoal adsorber cells are all type 304 stainless steel.

9.4.5.7 Auxiliary Monitoring Panel In addition to the fuel building ventilation previously described, additional ventilation exists for the auxiliary monitoring panel as described below:

If a fire occurs in certain areas of either Units 1 or 2, such as the control room or emergency switchgear room, an operator is dispatched to and must continuously monitor the auxiliary monitoring panels (2-EI-CB-97A and 1-EI-CB-203) in the fuel building. This fire could cause the fuel building ventilation to be inoperable, and in order to assure cooling of the operators work space, a source of outside air is required.

A single centrifugal fan located on the fuel building roof (Elevation 320 ft.) will supply outside air at approximately 2000 cfm to the panel. To prevent material from blowing into the fuel building, a filter is installed at the fan inlet. To prevent personnel injury, a protective screen is also installed at the fan inlet. Galvanized steel ducting runs from the fan discharge through a penetration in the fuel building roof down towards the auxiliary monitoring panel.

To maintain a negative pressure in the fuel building and prevent the release to atmosphere of radioactive gases when the fan is not in use, a manual operated damper is installed in the duct. This damper can also be used to throttle the amount of air flow to the panel which may be necessary during time periods when the outside air is cold.

Because the normal fuel building ventilation system will not be in use when the Auxiliary Monitoring Panel fan is operating, a slight positive pressure will result. However, analysis shows that effects of an unfiltered release are insignificant since no fuel handling accidents are postulated.

Revision 5209/29/2016 NAPS UFSAR 9.4-14 The ventilation fan and ductwork in the fuel building for the Auxiliary Monitoring Panel are seismically supported and restrained to preclude damage to adjacent equipment and structures during a seismic event.

A local starter for the fan and a transfer panel is located near the auxiliary monitoring panel.

The transfer panel has two receptacles, one connected to Unit 1 emergency power feed MCC lHl-2S and the other connected to Unit 2 emergency power feed MCC 2Hl-2S. To operate the fan, the starter is plugged into one of the two receptacles in the transfer panel and then the breaker at the appropriate MCC is energized. The fan can then be started at the starter next to the transfer panel. The operator will then open the manual damper located at the duct outlet.

9.4.6 Engineered Safety Features Areas 9.4.6.1 Design Basis These areas are contiguous to each reactor containment structure. They contain the outside recirculation spray pumps and low-head safety injection pumps, with their valve rooms, refueling water recirculating pumps, quench spray pumps, service water valves and radiation monitors, and main steam trip and nonreturn valves, and the Rod Drive Room (motor control center) that connects to the cable vault.

Spaces containing the recirculating spray and safety injection pumps and their valve rooms are subject to potential radioactive contamination from gland leakage, and consequently their exhaust system is designed as Seismic Class I; their fans are located in the auxiliary building and provided with features similar to those for the auxiliary building listed in Section 9.4.2.1.

These features include the provision of dual exhaust fans, once-through ventilation discharge through vent stack B, and the capability of diverting the effluent through the common HEPA/charcoal filter bank. In the unlikely event of a failure of the exhaust system duct, an emergency supply system designed as Seismic Class I is provided for the recirculation spray and safety injection pumps area (refer to Figure 9.4-6 and Reference Drawing 9). Ventilation is designed to limit the temperature during warm weather to a maximum of 120°F and, during cool weather, to a minimum of 75°F. The system is designed to inhibit condensation on below-grade walls. Outside design temperatures are listed in Table 9.4-1. The supply air heating and ventilating unit and associated ductwork are not seismically designed.

The exhaust from the area containing the refueling water recirculation pumps and quench spray pumps may become slightly radioactive after refueling, when the contents of the reactor fueling cavity are pumped back into the tank. The design of the refueling water tank and its recirculation loop limits the quantity of water that could be leaked into the engineered safety feature area. Furthermore, refueling cavity water which is contaminated will be treated prior to transfer to the refueling water storage tank. Assuming all of this possible leakage were to spray into the area the radioiodine activity in the air would be negligible. The radioiodine inventory of

Revision 5209/29/2016 NAPS UFSAR 9.4-15 the refueling water storage tank during this spray has the same basis as in Section 11.3.5. Because of this negligible radioiodine activity, no routing of the exhaust from these areas under normal operation to the HEPA/charcoal filter banks is necessary.

The remaining engineered safety features areas that cannot have radioactive fluid leaks are exhausted directly into the atmosphere. The supply air heating and ventilating unit and associated ductwork supplies tempered air for all spaces.

The entire engineered safety feature area exhaust system (the exhaust fans and the ductwork up to the fans as defined in Table 3.2-1) is therefore designed to Seismic Class I requirements.

The safeguards area exhaust system is seismically supported from the system fans to a point in the exhaust duct above the roof of the auxiliary building. The exhaust duct satisfies seismic and wind-loading criteria. A pressure relief damper is provided in the exhaust duct. If a seismic event causes the non-seismically qualified portion of the exhaust duct to crimp, the pressure relief damper will automatically open. Manual initiation is also possible.

9.4.6.2 System Description The ventilation arrangement is shown in Figure 9.4-6 and Reference Drawing 9. Exhaust from the spray and low-head safety injection pump and valve spaces is drawn through a Seismic Class I duct system by dual exhaust fans in the auxiliary building, discharging either directly or through HEPA/charcoal filters to vent stack B. Exhaust from the quench spray pump and refueling water recirculating pump room is vented directly to the atmosphere through a roof fan exhaust. The Rod Drive Room (motor control center) and cable vault are exhausted by fans installed in the service building at the top of the cable vault. Supply is through air-handling units fitted with two-speed fans and heating coils. An upgrade to this ventilation system has retrofitted an air conditioning system, able to provide conditioned air when required. A separate emergency supply air system designed as Seismic Class I is provided for the Rod Drive Room (motor control center). These fans are located in the Rod Drive Room (motor control center).

The main steam valve house is ventilated by a supply air fan and exhausted through the cantilever opening at the roof. Unit heaters are provided for heating during shutdown.

9.4.6.3 Design Evaluation The ventilation design provides temperatures suitable for equipment operation. The safeguards exhaust system is generally single active failure proof, with the exception of the filter isolation dampers and actuators. The system is not designed against a single passive failure of the ductwork. However, there is no requirement for consideration of a missile in conjunction with a design basis LOCA. Exhaust from the potentially contaminated spaces does provide for a fan related single failure by the use of dual exhaust fans and two-speed supply fans (high speed disabled). The safeguards exhaust system is designed to Seismic Class I requirements. The emergency recirculation system and temporary ventilation can be utilized in the event of a loss of safeguards exhaust ventilation. Normal exhaust of the potentially contaminated spaces through

Revision 5209/29/2016 NAPS UFSAR 9.4-16 vent stack B and automatic re-alignment through the HEPA/charcoal filter on a high-high containment pressure alarm protect the environment.

9.4.6.4 Tests and Inspections The system was balanced, adjusted, and tested upon installation. The emergency core cooling system pump room exhaust air cleanup system is tested in accordance with Technical Specifications.

9.4.6.5 Instrumentation Application The ventilation operates continuously and is manually controlled. Heating is automatically controlled except for the main steam valve house unit heat valve, which is manually opened during plant shutdown. On a high-high containment pressure signal, the potentially contaminated safeguards area exhaust is automatically diverted through the HEPA/charcoal filter bank.

9.4.7 Service Building 9.4.7.1 Design Basis A minimal potential for radioactive contamination exists in the hot laboratory, the personnel change area (PCA) laundry area. Ventilation is designed on a once-through basis to maintain inward leakage, to filter airborne particulate matter, to exhaust through the monitored vent stack A, and to maintain designed space temperatures. Outside design temperatures are listed in Table 9.4-1.

9.4.7.2 System Description The hot laboratory is air conditioned by the unit that services the laboratory area.

Contamination protection is provided by two hood exhaust fans installed in parallel for redundancy and exhausting continually through roughing and HEPA filters for discharge through the monitored vent stack A. The exhaust is in excess of the supply to ensure inward leakage to the room and prevent recirculation of any ventilation air.

The PCA laundry area is subject to possible contamination from soiled clothing. It is exhausted by a fan discharging continuously through a four-cell HEPA filter bank before exhaust through vent stack A.

Ventilation for the remainder of the service building is discharged directly to the atmosphere.

9.4.7.3 Design Evaluation Ventilation for these spaces that have a potential for radioactive contamination ensures that there is inward leakage and continuous discharge through HEPA filters to vent stack A where radioactivity could exist.

Revision 5209/29/2016 NAPS UFSAR 9.4-17 9.4.7.4 Tests and Inspections The systems were inspected, tested, and balanced upon installation. The HEPA filters were shop tested before delivery and retested after installation. HEPA filters are periodically inspected and replaced, as needed.

9.4.7.5 Instrumentation Application Vent stack A, through which the systems are discharged, is continually monitored for airborne radioactivity. The radioactive particulates and gases are monitored as described in Section 11.4.2.4.

9.4.8 Auxiliary Building HEPA/Charcoal Filter Loops 9.4.8.1 Design Basis A common HEPA/charcoal filter bank is located in the auxiliary building to clear any potentially contaminated primary plant exhaust system of airborne radioactivity before exhaust to the atmosphere. Two filter assemblies are installed in parallel to provide redundancy in case one assembly becomes contaminated, so that a filtration capability is maintained during a decay period for the radioactive assembly before filter replacement.

Each assembly is capable of decontaminating the largest exhaust system (auxiliary building general exhaust) with the supply fans off and one exhaust fan off. This system lineup results in (1) an increase of negative pressure in the contaminated space to inhibit outward leakage and (2) sufficient ventilation to permit continued operation of the heat-producing equipment.

Each assembly consists of HEPA filters with inlet prefiltering pads installed upstream of activated charcoal filters. Individual HEPA filters are designed to remove greater than 99.5% of airborne particulate matter down to 0.3 µm size. The charcoal filters are designed to remove airborne methyl iodide and elemental iodine from exhaust streams to reduce the overall release from a Chapter 15 accident. The charcoal iodine removal efficiency assumed for the specific accident dose analysis can be found in Chapter 15. The charcoal is periodically tested to ensure that the efficiency is still above the accident dose analysis assumptions. During normal conditions, heaters are used to prevent moisture accumulation. During accident conditions, heat from the engineered safeguards pumps will decrease the relative humidity to less than 70%.

Following a LOCA, the ventilation from rooms containing emergency core cooling system (ECCS) pumps is aligned to the filter bank. ECCS pumps are located in the Safeguards Area Building and in the Auxiliary Building (charging pump cubicles). The ECCS Pump Room Exhaust Air Cleanup System (PREACS), which includes both the safeguards area exhaust system and the auxiliary building central exhaust system, provides ventilation for these two areas. The safeguards area exhaust system is automatically aligned to the auxiliary building filter banks upon a CDA signal, and the auxiliary building central exhaust system is manually aligned to the filter

Revision 5209/29/2016 NAPS UFSAR 9.4-18 banks by post-LOCA emergency procedures. Each ECCS PREACS Subsystem is designed to align exhaust to the charcoal filters on a loss of air supply or electrical power.

The HEPA/charcoal filter loops and duct headers, including closure dampers and operators, to and from each filter assembly are designed to Seismic Class I requirements. Each filter assembly is rated at 39,200 cfm and is Seismic Class I.

9.4.8.2 System Description The common HEPA/charcoal filter assemblies are located in the auxiliary building fan room to filter any of the auxiliary exhaust systems subject to radioactive contamination. These exhausts are connected to a common manifold as shown in Figure 9.4-2 and Reference Drawing 4, to selectively serve (1) auxiliary building potentially contaminated exhaust, (2) fuel building exhaust, (3) decontamination building exhaust, (4) safeguards area exhaust, and (5) the containment purge exhaust. Any of the connected exhausts can be selectively monitored from the main control room and remote manually diverted through a HEPA/charcoal filter.

The system is generally single active failure proof with the exception of filter inlet and outlet header isolation dampers and actuators. Two pressure-tight dampers are installed in series to satisfy the single-failure criterion at locations that would permit contaminated exhaust to leak around the filter bank. Redundant inlet/outlet isolation dampers are provided in series for each HEPA/charcoal filter assembly.

The system is not missile protected and is not designed against a single passive failure of the ductwork. However, there is no requirement that a missile be considered in conjunction with a design basis LOCA.

Total carbon dioxide flooding for fire protection is provided for each filter assembly.

9.4.8.3 Design Evaluation All of these exhausts are continuously discharged through two ventilation vent stacks that are continuously monitored for radioactivity with a main control room readout and alarm. In case of alarm, the exhausts can be selectively monitored from the main control room and remote manually passed through the HEPA/charcoal filters before discharge to the atmosphere.

This filter and discharge arrangement provides environmental protection against airborne radioactivity from primary plant systems.

Demisters are not needed in the HEPA/charcoal filter assemblies, because any radioactive contamination from the connected exhausts results from small gland or pipe leakage, and the resultant air (even if contaminated) to the filter assemblies will be below saturation. Heaters are used to control relative humidity. The fuel building ventilation inhibits condensation from spent-fuel pit evaporation by the high ventilation capacity and heating to prevent saturation of the exhaust. The decontamination bay area hood exhausts continuously whether or not any contamination exists and is fitted with separate demisters and HEPA filters.

Revision 5209/29/2016 NAPS UFSAR 9.4-19 9.4.8.4 Tests and Inspections Each HEPA and charcoal filter was shop tested before shipment, and the installed filter bank was retested for efficiency and leakage. Provision is made for periodic retesting and location of defective cells for removal and replacement. The ECCS PREACS is tested in accordance with Technical Specifications.

9.4.8.5 Instrumentation Application The HEPA/charcoal filter loop is remote manually operated from the main control room, except (1) automatic re-alignment of the safeguards area exhaust through the HEPA/charcoal filter on a high-high containment pressure signal and (2) presetting of the fuel building exhaust to continually filter the exhaust air during irradiated fuel-handling operations or crane operation with irradiated fuel in the pool, when required.

The carbon dioxide fire protection system is initiated remote manually.

Filter bank pressure gauges are installed across the HEPA filter banks and charcoal adsorber banks to indicate pressure drop across the filters. When this pressure becomes excessive, the filters will be replaced.

9.4.9 Containment Structure 9.4.9.1 Design Basis Containment ventilation consists of a recirculation cooling system, a control rod drive mechanism (CRDM) cooling system, a filter system, a purge system, and a dome air recirculation system. Reference Drawing 10 shows the containment and containment auxiliary structures in cross-section, while Reference Drawing 11 show the containment ventilation system from above.

Reference Drawings 12 through 16 show the containment air recirculation system, including exhaust and ducts. Reactor coolant pump motor exhaust air (Section 5.5.1) is cooled by an integral heat exchanger supplied by the component cooling water system. The recirculation and CRDM cooling systems provide the air cooling that, in combination with the reactor coolant pump motor cooling, maintains the containment bulk air temperature within the Technical Specification limits. The relative humidity, during both summer and winter operations, is about 40%. Outside design temperatures are listed in Table 9.4-1.

The ventilation systems are designed to maintain the containment bulk air temperature within the Technical Specification limits when two of the three recirculation system fans and three dome recirculation fans are running, the CRDM cooling systems are operating, and the cooling system for the reactor coolant pump motors is functioning. Normally, all three main recirculation fans will be operating during summer periods.

There is a cooling coil assembly in each of the three recirculation system fan trains, and each fan train is designed to remove one-half of the heat load under subatmospheric operating conditions.

Revision 5209/29/2016 NAPS UFSAR 9.4-20 The CRDM cooling system is designed to meet the required heat removal load when one of the two fans provided for each of the three ventilation exhaust ducts systems is operating.

Duplicate fans are installed for 100% redundancy.

The filter system consists of two 2000-cfm filter assemblies that are provided to recirculate air within each containment. Each filter assembly consists of roughing, HEPA, and charcoal filters in series for selective use in the removal of small amounts of airborne radioactivity during subatmospheric operations.

The purge system is designed to purge the containment after the pressure has been raised to within 1-inch W.G. of atmospheric. At maximum exhaust flow, the purging rate is approximately three-fourths of an air change per hour, and the exhaust can be passed through the common 39,200-cfm HEPA/charcoal filter banks in the auxiliary building for radioactivity removal, if required. The purging rate can be reduced by various ventilation system alignments. The purge system design also provides ventilation and space heating for cold weather refueling and maintenance.

Three dome recirculation fans are provided to prevent air stratification in the dome. Each of three fans discharges air vertically upward from the operating floor, creating turbulence and inducing air movement toward the annulus and then downward to the main recirculation fans.

The containment air recirculation system, which is used to cool the containment atmosphere during normal plant operation, has no engineered safety features (ESF) functions. However, the system is equal to safety grade systems with respect to power supplies and cooling water (capable of being aligned to service water). The containment air recirculation fans and associated motors are non-safety-related with special regulatory significance (NSQ).

Each air cooler has its own seismic category I cooling water supply and return lines penetrating the containment boundary. The containment isolation valves in the individual cooling water supply and return lines are safety grade and the cooling (service water) system piping is seismic category I design. Only two of the three containment air coolers and associated fans are required to maintain containment air temperatures with the plant operating at 100% power so that loss of one air cooler and its fan would present no containment air temperature problems.

9.4.9.2 System Description The recirculation system discharges 260,000 cfm minimum with two main recirculating fans operating into a common ring duct from which cool supply air is ducted to the various compartments. This air is circulated upward through the operating floor and into the dome by the dome recirculating fans and downward along the containment walls, outside of the crane wall, and back to the cooling coils on the lower level. The coils are supplied with chilled water (Section 9.2.2.1.2) or service water (Section 9.2.1). All three main recirculation and all three dome recirculation fans normally run continuously during summer periods. The service water provides an alternative capability for heat removal on loss or interruption of the chilled water

Revision 5209/29/2016 NAPS UFSAR 9.4-21 system. The main recirculation fans will operate in containment pressures up to about 10 psig, where the motor overload protection will cut out the fan motors. This is approximately the pressure at which the containment depressurization system is actuated (Section 6.2.2).

The control rod drive mechanisms are cooled by three 24,000-cfm fans and coil banks.

Duplicate 24,000-cfm fans, installed in parallel, are provided for redundancy in each duct. Fan selection is remote manual from the control room.

Air is drawn through the top of the reactor shroud and discharges back to the containment through the cooling coils. Indicator lights on the ventilation panel in the main control room show which units are operating.

One fan of each exhaust train operates at all times, and the fans will be alternated to balance operating hours.

The filter system consists of two filter assemblies that are self-contained packages installed on the lower level of each containment within a concrete shield. Each assembly consists of a 2000-cfm fan with roughing, HEPA, and charcoal filter cells. Remote manual operation is exercised from the main control room.

The purge system consists of supply and exhaust fans arranged to ventilate either containment when the pressure has been raised to within 1-inch W.G. of atmospheric. Dual fans are installed in parallel for both supply and exhaust to facilitate step control of purging up to the maximum exhaust flow of approximately 22,000 cfm. The supply air is introduced through roughing filters and steam coils for space heating during winter shutdown. The exhaust purge air is drawn through ducts at the containment mat elevation and discharged through vent stack B that can be directed through the common HEPA/charcoal filter banks if necessary. The supply and exhaust ducts are fitted with butterfly valves on both sides of the containment penetrations for pressure integrity. The outer exhaust valve is fitted with an 8-inch bypass to permit reduced purge flow if required. An 18-inch pressure-equalizing valve is installed between the supply steam penetration valves to bring the containment up to atmospheric pressure on shutdown. The purge system fans, filter loop dampers, isolation valves, and bypass and pressure equalizing valves are remote manually operated from the main control room. During refueling, a containment high-high radiation signal will automatically stop the purge fans and close the butterfly isolation valves.

Principal component data for the containment ventilation system are given in Table 9.4-4.

9.4.9.3 Design Evaluation Whenever the chilled water system is operational and two of the three main recirculation fan and coil trains, the three CRDM fan and coil trains, the three dome recirculation fans, and the reactor coolant pump motor cooling systems are operating, the containment bulk air temperature will be maintained within the Technical Specification limits. The recirculation system will continue to operate under reactor coolant leakage conditions until either the recirculation fans trip on motor overload or the containment pressure exceeds 27.75 psia. The cooling water supply can

Revision 5209/29/2016 NAPS UFSAR 9.4-22 be switched manually from chilled water to service water system. The ancillary use of service water will not compromise the Seismic Class I design of the service water system since double valve isolation on the supply and return line is provided for accident conditions. Should containment pressure exceed 27.75 psia, the containment depressurization actuation signal will automatically secure all main recirculation and CRDM fans.

In the highly unlikely event of total loss of the air recirculation system, the containment atmosphere temperature would rise at approximately 15°F/hour. In accordance with Technical Specification requirements, the plant would have to be shut down (when the specified temperature limit was exceeded for the specified length of time) thereby reducing the heat load input to the containment atmosphere. A unit cooldown could be initiated at a maximum rate of 100°F per hour so that within approximately 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months the unit would be in a mode of operation that would allow the containment to be brought to atmospheric pressure. Containment temperatures could then be maintained by the containment purge and exhaust ventilation system.

The containment filter assemblies, which recirculate containment air, remove airborne radioactivity resulting from nominal operational leakage during subatmospheric operations.

During refueling, a high-high radiation signal from the manipulator crane, containment gas or particulate monitors will automatically trip the containment purge supply and exhaust fans and close the containment ventilation butterfly valves, thus isolating the containment.

9.4.9.4 Tests and Inspections The systems were inspected, tested, and pneumatically balanced upon installation. The common HEPA/charcoal filter banks in the auxiliary ventilation system can be used to filter purge exhaust. These filters are individually tested before shipment and each assembly is tested after installation as discussed in Section 9.4.8.4. They may be periodically tested thereafter for leakage and efficiency. The containment purge and exhaust system is tested in accordance with Technical Specifications.

9.4.9.5 Instrumentation Application An isokinetic nozzle is furnished in one recirculating duct in each containment to obtain a uniform sample of the containment air for the measurement of radioactive gases and particulates.

Temperature elements are furnished to measure the air discharge temperature from the control rod drive mechanisms. These values are indicated in the control room.

Additional containment air bulk temperatures are read on instrumentation described in Section 6.2.7 (Leakage Monitoring System).

Revision 5209/29/2016 NAPS UFSAR 9.4-23 9.4.10 Service Water, Auxiliary Service Water, and Auxiliary Feedwater Ventilating System 9.4.10.1 Design Basis This ventilation system provides room cooling for service water, auxiliary service water, and Auxiliary Feedwater Systems. The auxiliary service water ventilation system has a seismically qualified fan supplied by emergency power. Both the service water and auxiliary feedwater ventilation systems have redundant exhaust fans that are seismically qualified and provided with emergency power.

9.4.10.2 System Description and Evaluation A system drawing of the auxiliary feedwater pump house building services is shown in Reference Drawing 17. All fans shown can be manually or automatically controlled. Individual on-off auto-control switches select the mode of control. The fans have associated supply and/or exhaust dampers interlocked to open when the fan starts.

With the control switch in the auto position, each fan is controlled by individual room thermostats. On a rise in space temperature above the setpoint of the space thermostat, the fan will start and its motorized supply and/or exhaust air dampers will open. On a fall in space temperature below the off-point of the space thermostat, the fan will shut down and its dampers will return to the closed position.

The service water ventilation system consists of two redundant exhaust fans with associated dampers connected to separate emergency power sources. All fans, dampers, and damper operators are seismically qualified. Each fan is interlocked with two supply air dampers and has the capacity to maintain the design space temperature. Therefore, a single failure of a fan damper, or damper operator, does not adversely affect the equipment in the space.

The auxiliary service water ventilation system consists of one seismic exhaust fan connected to emergency power. If an auxiliary service water pump is not in operation when the failure of the fan or power source occurs, there is enough natural circulation to maintain the design space temperature with the pumps that supply service water makeup running.

If an auxiliary service water pump is running when fan or power failure occurs, the source of service water can be shifted to the Service Water Reservoir. Therefore, no ventilation system redundancy is required.

The auxiliary feedwater pump house consists of two independent and redundant pump rooms separated by a 2-foot-thick concrete wall. A redundant ventilation system is provided in the motor pump room. Each system is connected to a separate emergency power source. The turbine pump room has a seismically qualified exhaust fan and intake damper. The exhaust fan is provided with an emergency power source.

Revision 5209/29/2016 NAPS UFSAR 9.4-24 The heating and ventilation system for the service water valve house is comprised of two 100% redundant systems. Two ceiling mounted electric heaters in each bay provide heat for the valve house. Redundant ceiling mounted ventilation fans in each bay of the valve house provide ventilation air through wall-mounted louvers in each bay of the valve house. No heating or ventilation is provided below the main operating floor except for a ventilation fan provided for the South-East basement room (location of the bypass line MOVs and check valves).

The ventilation fans and louvers for above the main operating floor are designed to be seismically qualified and mounted and supplied with safety related power. This insures that the valve house inside temperature will be kept below 120°F prior to accident scenarios in order to protect the safety-related MOVs and MCCs located in the valve house. The service water valve house heaters and ventilation fans will be electrically load shed during loss of offsite power, regardless of unit status. Station procedures regarding loss of offsite power events require operator actions necessary to manually reset the 480V emergency bus load shed scheme.

Shedding of these loads is designed to remove these large non-essential heating and ventilation loads from the emergency diesel generators loading during the first hour of an accident with a loss of offsite power event.

9.4 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FB-23A Arrangement: Service Building, Ventilation, Sheet 1

2. 11715-FB-40A Flow Diagram: Air Conditioning, Chilled Water Systems

3. 11715-FB-040D Flow/Valve Operating Numbers Diagram: Air Conditioning Condenser Water Systems, Unit 1

4. 11715-FB-5B Arrangement: Primary Plant Systems, Ventilation, Sheet 2

5. 11715-FB-5C Arrangement: Primary Plant Systems, Ventilation, Sheet 3

6. 11715-FB-39A Arrangement: Decontamination Building, Ventilation

7. 11715-FB-39D Arrangement: Decontamination Building, Ultra-Sonic Hood Exhaust

8. 11715-FB-17A Arrangement: Turbine Building, Ventilation

9. 11715-FB-5A Arrangement: Primary Plant Systems, Ventilation, Sheet 1

10. 11715-FM-1E Machine Location: Reactor Containment, Sections 1-1 & 5-5, Unit 1

Revision 5209/29/2016 NAPS UFSAR 9.4-25

11. 11715-FB-006A Flow/Valve Operating Numbers Diagram: Air Cooling and Purging System, Unit 1

12. 11715-FB-7E Arrangement: Reactor Containment, Air Cooling and Purging System, Sheet 5

13. 11715-FB-7A Arrangement: Reactor Containment, Air Cooling and Purging System, Sheet 1

14. 11715-FB-7B Arrangement: Reactor Containment, Air Cooling and Purging System, Sheet 2

15. 11715-FB-7C Arrangement: Reactor Containment, Air Cooling and Purging System, Sheet 3

16. 11715-FB-7D Arrangement: Reactor Containment, Air Cooling and Purging System, Sheet 4

17. 11715-FB-72B Arrangement: Auxiliary Feedwater Pump House, Building Services

Revision 5209/29/2016 NAPS UFSAR 9.4-26 Table 9.4-1 OUTSIDE DESIGN TEMPERATURES FOR HEATING, VENTILATION, AND AIR-CONDITIONING SYSTEMS Parameter Value Summer, dry bulb, °F 93 Summer, wet bulb, °F 78 Summer, dewpoint, °F 73 Summer, ground temperature, °F 58 Winter, dry bulb, °F + 15 Winter, wind velocity, mph 15

Table 9.4-2 MAIN CONTROL AND RELAY ROOM AREA AIR-CONDITIONING AND VENTILATION SYSTEMS - DESIGN DATA Refrigeration Number Capacity, Service of Units Unit Capacity MBh per Unit Filter Type Unit 1 main control room air conditioning 2 12,500 cfm 273 Rough Unit 2 main control room air conditioning 2 12,500 cfm 273 Rough Revision 5209/29/2016 Unit 1 relay room air conditioning 2 19,000 cfm 401 Rough Unit 2 relay room air conditioning 2 19,000 cfm 401 Rough Control and relay room air supply -- 2200 cfm a -- Roll Control and relay room area exhaust 1 1900 cfm a -- --

Unit 1 main control room emergency ventilation 1 1000 cfm -- HEPA/charcoal Unit 2 main control room emergency ventilation 1 1000 cfm -- HEPA/charcoal Unit 1 relay room emergency ventilation 1 1000 cfm -- HEPA/charcoal Unit 2 relay room emergency ventilation 1 1000 cfm -- HEPA/charcoal Unit 1 compressed dry air system 2 20,700 ft3 free air -- --

Unit 2 compressed dry air system 2 20,700 ft3 free air -- --

a. Approximate values.

NAPS UFSAR 9.4-27

Revision 5209/29/2016 NAPS UFSAR 9.4-28 Table 9.4-3 AUXILIARY BUILDING VENTILATION FILTER SPECIFICATIONS Unit Number Type Plan Elevation 291 ft. 10 in.

HEPA filter with prefilter pad Main charcoal filters HV-FL-3A,B mounted in a single frame Charcoal adsorbers Purge supply HV-FL-1 Rough filters (2-inch thick)

Auxiliary building supply HV-FL-13A,B Box filter Fuel building supply HV-FL-2 Box filter Plan Elevation 274 ft. 0 in.

Ultrasonic hoods HV-FL-16 HEPA filters and demister filters Equipment room HV-FL-14A Prefilters

Revision 5209/29/2016 NAPS UFSAR 9.4-29 Table 9.4-4 CONTAINMENT VENTILATION SYSTEM PRINCIPAL COMPONENT DATA Items Items for Installed per Normal System Containment Item Capacity Operation Containment recirculating Cooling coil banks, each at 47°F EWT a 3 4.86 x 106 Btuh b 1 Cooling coil banks, each at 63.5°F EWT 3 3.56 x 106 Btuh c 3 Fans (per fan) 3 130,000 cfm 3 Dome recirculating fans (per fan) 3 50,000 cfm 3 Control rod drive cooling Cooling coil banks (per bank) 3 885,000 Btuh 3 Fans (per fan) 6 24,000 cfm 3 Filter assemblies Number 2 None Fans (per fan) 1 2000 cfm HEPA cells (per cell) 2 1000 cfm Charcoal cells (per cell) 6 333 cfm Purge supply d Fans (per fan) 2 11,000 cfm None Heating coil assembly 1 1.8 x 106 Btuh None Roughing filter bank 1 22,000 cfm None Purge exhaust d Fans (per fan) 2 11,000 cfm None Common auxiliary building HEPA/charcoal filter banksd Number 2 39,200 cfm None Charcoal cells (per cell) 98 400 cfm HEPA cells (per cell) 33 1200 cfm

a. EWT = entering water temperature.

b. Capacity with one mechanical and two steam-jet chillers operating

c. Capacity with two steam-jet coolers operating.

d. These components are common to Units 1 and 2 as shown in Reference Drawing 11.

Revision 5209/29/2016 NAPS UFSAR 9.4-30 Withheld under 10 CFR 2.390 (d) (1)

Revision 5209/29/2016 NAPS UFSAR 9.4-31 Withheld under 10 CFR 2.390 (d) (1)

Revision 5209/29/2016 NAPS UFSAR 9.4-32 Withheld under 10 CFR 2.390 (d) (1)

Revision 5209/29/2016 NAPS UFSAR 9.4-33 Withheld under 10 CFR 2.390 (d) (1)

Revision 5209/29/2016 NAPS UFSAR 9.4-34 Withheld under 10 CFR 2.390 (d) (1)

Revision 5209/29/2016 NAPS UFSAR 9.4-35 Withheld under 10 CFR 2.390 (d) (1)

Figure 9.4-5 POTENTIALLY CONTAMINATED EXHAUST SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.4-36

Figure 9.4-6 VENTILATION ARRANGEMENT: PRIMARY PLANT Revision 5209/29/2016 NAPS UFSAR 9.4-37

Revision 5209/29/2016 NAPS UFSAR 9.4-38 Intentionally Blank

Revision 5209/29/2016 NAPS UFSAR 9.5-1 9.5 OTHER AUXILIARY SYSTEMS 9.5.1 Fire Protection System The fire protection system is designed to furnish water and other extinguishing agents with the capability of extinguishing any single or probable combination of simultaneous fires that might occur at the station. The fire protection arrangement is shown on Figure 9.5-1 and Reference Drawing 1, the low-pressure carbon dioxide (CO2) system on Reference Drawing 2, the high-pressure carbon dioxide systems on Figure 9.5-2, the control room Halon 1301 system on Figure 9.5-3, and the sprinkler and water spray systems on Reference Drawing 3.

9.5.1.1 Design Basis The basic regulatory criterion for fire protection is set forth in General Design Criterion 3 (see Section 3.1.3). The stations fire protection program satisfies the regulatory criteria set forth in:

a. General Design Criterion 3,

b. 10 CFR 50 Appendix R (Sections III.G, III.J, and III.O),

c. Regulatory Guide 1.189 (applies only to Unit 2 program changes implemented after March 2011),

d. Appendix A to Branch Technical Position APCSB 9.5-1, The way the stations program for fire protection complies with these criteria is contained in the following documents:

a. Stations 10 CFR 50 Appendix R Report. This report includes the description of systems, equipment, and manpower required for safe shutdown; a listing of safe-shutdown related engineering evaluations and exemption requests from Appendix R; and an overview of the safe shutdown circuit analysis.

b. Stations Fire Protection Program document. This document describes the administrative and technical controls, the organization, and other plant features associated with fire protection.

c. Stations Technical Requirements Manual TRM. This document provides the general requirements, the technical and surveillance requirements, and the required action statements for plant operation and conditions of the fire protection systems.

d. NRCs Safety Evaluation Report by the Office of Nuclear Reactor Regulation, Fire Protection Program for North Anna Power Station, Units 1 and 2, dated February 1979.

e. NRCs Safety Evaluation by the Office of Nuclear Reactor Regulation, Appendix R to 10 CFR Part 50, Items III.G.3 and III.L, North Anna Power Station, Units 1 and 2, transmitted by letter dated 11/18/82.

Revision 5209/29/2016 NAPS UFSAR 9.5-2

f. NRCs Safety Evaluation by the Office of Nuclear Reactor Regulation Relative to Appendix R Exemptions Requested, North Anna Power Station, Units 1 and 2, transmitted by letter dated 11/6/86.

The 10 CFR 50 Appendix R Report and the Fire Protection Program are maintained up-to-date through periodic revisions. An evaluation in accordance with 10 CFR 50.48 is performed and kept on file for each revision. This evaluation includes an assessment of the revisions impact on the stations program for fire protection (i.e., a review of the effect on conformance with Appendix R; of the effect on combustible loading and distribution; and of the effect on safe shutdown circuits and associated circuits). The acceptance criteria for this assessment is that a) the level of fire protection is not being diminished, and b) the change will not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. If this acceptance criteria is met, then the revision is made.

Table 9.5-7 lists items in the referenced Safety Evaluation Reports which have been subsequently modified from the description given in the Safety Evaluation Reports. Each item has been evaluated, and it has been determined that the ability to safely shutdown in the event of a fire and fire protection capabilities have not diminished from that described in the Safety Evaluation Report.

The station is designed to minimize the use of combustible materials and to make the greatest possible use of fire-resistant materials. The fire protection systems are designed in accordance with the standards of the National Fire Protection Association (NFPA) and are based on the recommendations of the Nuclear Energy Liability Property Insurance Association (NELPIA) to provide the following:

1. A supply of water for fire fighting.

2. A system for the delivery of water to potential fire locations.

3. Automatic fire or smoke detection in critical areas.

4. Fire extinguishment by fixed equipment actuated automatically or manually.

5. Manually operated portable fire-extinguishing equipment at strategic locations.

6. Fire barriers.

The following elements are designed to Seismic Category I criteria (see Section 3.2.1):

1. The engine-driven fire pump and associated fuel-oil tank.

2. The yard hydrant piping system.

Fire protection system design data are given in Table 9.5-1.

The fire protection systems were designed in accordance with NFPA Standards 11, 12, 12A, 13, 15, 20, and 24 except where evaluations have been developed and approved for departures from those standards in accordance with our program. The NELPIA recommendations and NFPA

Revision 5209/29/2016 NAPS UFSAR 9.5-3 Standards addressing (1) approved 3-hour fire-barrier walls, (2) Class A automatic fire doors, and (3) fire barriers for transformer area have been complied with, except where evaluations have been developed and approved for departures from those standards and recommendations. Criteria for fire stops and seals are addressed in Section 8.3.1.1.2.6.

All of the fire protection water systems piping and valves, including the supply lines from the fire pumps to the yard loop and the branch piping from the yard loop to the building walls, are designed to Seismic Category I requirements.

All fire protection water lines in the auxiliary and fuel buildings are designed to Seismic Category I requirements.

Carbon dioxide and Halon 1301 fire protection systems are not designed to Seismic Category I requirements.

Carbon dioxide and Halon piping supports in safety-related areas are located to ensure that piping will not damage safety-related equipment.

As previously stated, part of the regulatory criterion is compliance with Appendix A to Branch Technical Position (BTP) APCSB 9.5-1. Section F to Appendix A, Guidelines for Specific Plant Areas identifies the specific areas of the plant that require fire suppression systems.

Section F.17, Cooling Towers, states Cooling Towers should be of non-combustible construction or so located that a fire will not adversely affect any safety related systems or equipment.

Section F.18, Miscellaneous Areas, states Miscellaneous areas such as records storage areas, shops, warehouses, and auxiliary boiler rooms should be so located that a fire or effects of a fire, including smoke will not adversely affect any safety related systems or equipment. These sections do not require a fire suppression system but rely on building location to protect safety-related systems and equipment. The following fire suppression systems are not required for compliance to regulatory criterion since the areas they protect meet Section F.17 or F.18 and do not adversely affect safety-related structures, systems and components or affect safe shutdown equipment in the event of a fire.

Fuel Oil Storage Tank Foam System Local Emergency Operating Facility (LEOF) Sprinkler System North Anna Nuclear Information Center (NANIC) Sprinkler System Records Storage Building Sprinkler System Security Building Sprinkler System Service Water Chemical Addition System Sprinkler System Training Center Building Sprinkler System Warehouses, including Warehouse #2 (Admin. Annex), Sprinkler Systems Control Room Simulator Room (Training Center Bldg.) Halon System Monitor Control Room underfloor area (Security Bldg.) Halon System Security Control Center underfloor area Halon System

Revision 5209/29/2016 NAPS UFSAR 9.5-4 Security Control Center North and South Cable Vaults Halon System LEOF Computer Room (Training Center Bldg.) Halon System Beyond Design Basis (BDB) Storage Building Clean Agent System 9.5.1.2 System Description 9.5.1.2.1 Fire Protection Water Systems The portion of the fire protection system that uses water consists of pumps, piping, hydrants, hose stations, water spray, and sprinkler systems.

The motor-driven fire pump takes suction from the North Anna Reservoir and the engine-driven fire pump takes suction from the Service Water Reservoir. Each pump is designed to maintain 100 psig at its rated flow in the yard hydrant piping loop.

The motor-driven, vertical-turbine fire pump is located in a fire-pump house over the screenwall. The diesel-engine-driven fire pump is located in the missile-protected service water pump house. The motor-driven fire pump is equipped with automatic control starting at 90 psi on decreasing line pressure. The diesel-engine-driven fire pump is equipped with automatic control starting at 52 psi on decreasing line pressure at the elevation of the service water pump house, which is equivalent to a loop pressure of 80 psig. Each pump delivers 2500 gpm at its designed discharge pressure, which varies as shown in Table 9.5-1 because of the 66-foot elevation difference between the Service Water and North Anna Reservoirs.

System pressure is normally maintained continuously between 105 and 115 psig by a pressure maintenance system consisting of a jockey pump, a hydropneumatic tank with an air compressor, and related controls and accessories.

The diesel-engine-driven fire pump is started by a 24V cranking motor. Power for this motor is obtained from either of two 24V storage batteries.

The engine is started automatically upon receipt of the necessary run signal from a run initiation device such as a pressure switch, a timer, or from the tripping of a deluge valve, or a manual switch, or from the loss of ac power to the storage battery charger.

One diesel-engine controller is furnished for the operation and control of the diesel-engine-driven fire pump and, to the extent that redundancy is required for engine starting, it is provided within the controller. This redundancy is in the form of a timer and dual batteries. The timer is started when a run signal of any kind is received, and it allows the engine to be cranked on one battery for a fixed period of time. If engine starting has not occurred within this period of time, cranking power is switched automatically to the other battery. Also, a separate manual operator, which is approved by Underwriters Laboratories, Inc., is furnished to start the engine in the event the controller malfunctions.

The diesel engine, controller, and manual operator are located within a Seismic Class I building. The diesel engine and manual operator are of Seismic Class I design.

Revision 5209/29/2016 NAPS UFSAR 9.5-5 Each fire pump is located in a separate structure and is equipped with a header containing eight 2-1/2-inch hose valves that are used for periodic capacity tests of the fire pump. These valves are required by NFPA Standard 20 and are located on the exterior wall of the pump house.

A fire occurring in the fire-pump house will be fought with the standard yard hose attached to one of these valves and directing the stream into a fire inside the pump house. Portable carbon dioxide (CO2) or dry-chemical extinguishers are also available for fire protection in the pump house.

In addition to its primary function, the fire protection system also provides alternate sources of makeup water for the spent-fuel pool and for the Unit 1 and Unit 2 auxiliary feedwater systems.

The fire protection system, shown in Figure 9.5-1 and Reference Drawing 1, is Seismic Class I from the Service Water Reservoir but not from Lake Anna. The yard connections from the loop to the fuel building and from the loop to the auxiliary feedwater pumphouses are indicated in Reference Drawing 1. The line for the spent-fuel pool extends above the spent-fuel pool and is open-ended so that, when required, water may be discharged into the pool. Teeing into this FP makeup line inside the Fuel Building is a line that is accessible external to the Fuel Building which can be used for an external source of makeup. The lines for the auxiliary feedwater systems connect with the fire protection system to provide fire protection water to the suction of all the auxiliary feedwater pumps. According to design specifications, these secondary functions of the fire protection system do not prohibit the system from performing its primary function. In accordance with BTP-APCSB 9.5-1, Appendix A, Paragraph A.4, postulated fires need not be considered concurrently with other plant accidents. (Also see Sections 9.1.3.2 and 10.4.3.3.)

The station fire-fighting equipment is as follows:

1. A 12-inch yard loop is provided, and yard hydrants are strategically placed around this loop.

Branch lines from this loop serve the interior fire protection systems. The loop has a minimum cover of 5 feet for missile protection. All piping subject to freezing at the pumps is heat-traced.

Each hydrant has a hose house furnished with hose and related firefighting equipment.

The common yard fire main system for Units 1 and 2 is shown on Figure 9.5-1 and Reference Drawing 1. Units 1 and 2 are furnishing one motor-driven fire pump and one diesel-driven fire pump.

2. An automatic water spray deluge system, which can also be manually operated (Reference Drawing 3), is provided for the following:

a. Hydrogen seal-oil unit.

b. Oil purifier unit.

c. Turbine-oil reservoir.

d. Main power transformers.

Revision 5209/29/2016 NAPS UFSAR 9.5-6

e. Station service transformers.

The sprinkler and water spray deluge systems are not interlocked with the building ventilation and exhaust systems. Any products of combustion will be removed by the normal exhaust systems.

3. Automatic wet-type water sprinkler systems (Reference Drawing 3) are provided for the following locations:

a. Turbine building floor areas below the operating floor, including turbine-oil storage room.

b. Warehouse area of service building.

c. Auxiliary boiler room.

d. Security building.

e. Records storage building.

f. Machine shop building.

g. Training center building.

h. Service water chemical addition system building.

i. Turbine deck security enclosure

4. A manually-actuated, normally dry, open-head type sprinkler system is provided for the 40-foot ceiling area of the cable vault in the service building.

5. A manually-actuated, normally dry, closed-head type sprinkler system is provided for the remainder of the cable vault and the cable tunnel in the service building, and the N-16 instrumentation enclosures.

6. An automatic wet-type sprinkler system is provided for the component cooling pumps areas in the auxiliary building, Elevations 244'-6" and 259'-6".

7. An automatic dry-type water sprinkler system is provided for Warehouse No. 2.

8. An automatic (smoke detector activated), normally dry, closed head sprinkler system is provided for the on-line chemistry monitoring system computer room (near the Technical Support Center).

9. A manual, normally dry, closed head sprinkler system is provided for the N-16 enclosure on the turbine operating floor.

10. A manual air-foam system is provided for the fuel oil storage tank, consisting of fixed piping terminating at a discharge outlet in the tank. Backup manual fire suppression is provided by foam hose stream equipment.

Revision 5209/29/2016 NAPS UFSAR 9.5-7

11. Fire hose standpipe systems for Elevations 291' and 262' of the Unit 1 and Unit 2 reactor containments with manual, locked-closed isolation valves on Elevation 244' of the auxiliary building, that will provide water for the Station Fire Brigade for manually extinguishing fires.

12. Fire hose standpipes providing water for the Station Fire Brigade in the following areas:

Turbine Building, Service Building, Auxiliary Building, Fuel Building, and Office Building.

13. A fire hose cabinet is provided on the exterior north wall of the service water pumphouse adjacent to the test hose connection.

14. An automatic (smoke detector and heat detector actuated), normally dry, closed head sprinkler system is provided for the alternate ac (AAC) Building.

15. An automatic (smoke detector actuated), normally dry, closed head sprinkler system is provided within the records room in the Records Building.

9.5.1.2.2 Fire Protection Chemical Systems 9.5.1.2.2.1 Carbon Dioxide System. Total flooding, low-pressure carbon dioxide systems (Reference Drawing 2) are provided for the following areas:

1. Automatic and manual control

a. Primary cable vault and tunnel.

b. Service building cable vault and tunnel.

c. Normal switchgear rooms (Elevation 307 ft., service building).

d. Cable-tray-spreading rooms (Elevation 294 ft., service building).

e. Turbine-generator bearing enclosures.

f. Generator excitor enclosures.

g. Emergency diesel generator rooms (interlocked to prevent automatic actuation when diesel generators are running).

The turbine-generator bearing enclosures and the generator excitor enclosure systems are modified to include additional local-application-type nozzles.

2. Manual control only

a. Auxiliary building HEPA/charcoal ventilation assembly system.

In areas requiring manual initiation, release devices for fire control are not located in the enclosure to be protected. They are located locally outside and adjacent to the enclosure.

In addition, portable backup equipment will be available for the control of fires in these protected spaces.

Revision 5209/29/2016 NAPS UFSAR 9.5-8 If radiation exposure is possible, such as at the main HEPA/charcoal filter assemblies, shielding is provided and all release devices are located outside the shielding. Any products of combustion will be removed by the normal ventilation and exhaust systems before personnel reentry into the space involved.

The above CO2 systems consist of two refrigerated low-pressure storage tanks, distribution piping, and controls for the automatic or manual discharge of carbon dioxide. One tank is installed within a missile-protected area and serves the cable vault and tunnel areas of both units, the emergency generator rooms, and the HEPA/charcoal ventilation filter assemblies. A second tank is installed outdoors and serves the remaining systems.

Automatic actuation is by means of thermostat detectors and is simultaneously indicated on the main control room fire protection panel. Independent smoke detectors for early warning also indicate on the fire protection panel when a fire situation exists. A manual release is similarly indicated on the main control room fire protection panel.

A total-flooding, high-pressure CO2 system is provided for the following areas:

a. The missile-protected fuel-oil pump rooms. They are located in the yard as free-standing buildings more than 45 feet from safety-related buildings (Figure 9.5-2).

b. The charcoal filter in the Technical Support Center area, which is not required for safe shutdown (Figure 9.5-1).

Release is automatic or manual (local), with early warning and release indication on the main control room fire protection panel.

An enclosed, ventilated area (zone), which is fire-protected by total flooding with carbon dioxide, is isolated in the event of a fire. The area isolation is not automatic for the manually actuated systems protecting the Auxiliary Building HEPA/charcoal ventilation filter assemblies.

The filter assemblies are isolated or verified isolated prior to manual initiation of the CO2 system for this zone. For other zones, automatic area isolation occurs when a fire detector has actuated the system or when the manual actuation button has been pushed. An interlocking circuit will cause the associated supply and exhaust fans to stop. The pressure of the carbon dioxide in the piping will trigger pressure releases. These pressure releases will cause wall-opening dampers and normally open doors to close automatically. This provides an enclosure that will retain carbon dioxide for specific soaking periods. The fans are turned on manually after extinguishment is certain, and, after complete flushing, the doors are returned to their normal position.

Carbon dioxide will only be released to an area 30 seconds after an activation signal from either the detection devices or the push-button manual release stations. At the start of this time delay, visual and audible predischarge alarms are activated in the affected area. Thirty seconds is considered a more than adequate time for evacuation.

The System 1 storage tank has a 17-ton capacity. The storage tank has sufficient capacity to provide one-shot, total-flooding extinguishment for the largest hazard protected, plus the capacity

Revision 5209/29/2016 NAPS UFSAR 9.5-9 for the four-shot, double-volume purging of hydrogen in either the Unit 1 or Unit 2 main generator stator enclosure. The System 2 storage tank has a 6-ton capacity to provide one-shot total-flooding extinguishment for the largest hazard protected.

Lockout devices are provided outside the following areas, which are protected by total flooding CO2 systems:

1. Upper switchgear rooms1 - Units 1 and 2.

2. Cable tray rooms - Units 1 and 2.

3. Service building - cable vault and tunnel.

4. Primary plant - electric vault and tunnel.

5. Emergency generator rooms.

6. Fuel-oil pump rooms.

The lockout device allows alarm activation, but it prevents the discharge of carbon dioxide until it is reset.

The CO2 system for the HEPA/charcoal ventilation filter assemblies can only be activated manually by a push button located outside the filter room and needs no lockout device.

The CO2 system for the turbine-generators serves the bearing areas and small enclosures and does not require a lockout.

Hose rack stations and portable fire-fighting equipment are provided at strategic locations throughout the facility.

The carbon dioxide (CO 2 ) fire system is designed as a total flood system, and the concentrations of carbon dioxide are in accordance with NFPA Standard 12.

Carbon dioxide is an electrically nonconductive inert gas that has been widely accepted and used for extinguishing fires in hazards containing flammable gaseous and liquid materials, transformers, oil switches, circuit breakers, and rotating equipment, as recommended by NFPA Standard 12. Research of the literature does not indicate incidents of temporary or permanent malfunction of electrical equipment where CO2 systems have been used. VEPCOs experience verifies the satisfactory use of carbon dioxide as an extinguishing agent in electrical areas. The discharge nozzles used prevent stream-type spray and are directed away from critical or safety-related equipment.

The chilling effect of carbon dioxide on the ambient air is a function of the amount of carbon dioxide discharged relative to room air volume, the rate of the discharge, density, and the quantity of building construction materials and equipment and their specific heat values. A

1. The lower switchgear rooms, referred to as the emergency switchgear rooms, are not protected by a CO2 system because of their high occupancy rates.

Revision 5209/29/2016 NAPS UFSAR 9.5-10 momentary air temperature drop can be expected in the space shortly after discharge. The space temperature will return quickly to normal. The air temperature transient will not affect electrical equipment. A more detailed discussion is provided in Section 9.5.1.3.7.

All critical areas are heated to maintain the minimum of 70°F. The emergency diesel-generator water jacket and lube-oil temperatures are maintained between 130 and 135°F when the engine is not running. Therefore, the ambient air will not get cold enough to affect electrical equipment, and the temperature drop will not persist long enough to chill mechanical or fluid systems. See Section 9.5.8.3 for discussion of the effect of a carbon dioxide system discharge on the operation of the emergency diesel generator.

The high-pressure carbon dioxide system in the fuel oil pump rooms consist of an electronic automatic actuation system. Each room is monitored by combination smoke/heat detectors. An incipient fire would first trigger the smoke detection system, which would alert control room personnel to a problem in the area. If a fire developed, the fixed temperature heat detectors would initiate the release of carbon dioxide. Because of the possibility of a detector failure, three combination smoke/heat detectors are provided in each room. Two heat detectors in alarm are required to initiate carbon dioxide release. If more than one fixed temperature heat detector should fail to operate, the carbon dioxide can be released manually by personnel sent to investigate the alarm. Further reliability is provided by the supervisory circuitry. The circuitry continuously monitors trouble in the system, which is annunciated in the main control room via an alarm on the main fire protection panel.

The low-pressure carbon dioxide system electric actuation devices are monitored continuously, and the following occurrences are reported on the main fire protection panel in the control room for each low-pressure carbon dioxide system:

1. Low carbon dioxide level in the storage tank.

2. High or low pressure in the carbon dioxide storage tank.

3. Loss of electrical integrity in any detection circuit.

4. Loss of electrical integrity in any actuation circuit.

5. Actuation of a zone lockout device.

9.5.1.2.2.2 Halon 1301 System. Total flooding, Halon 1301 (bromotrifluoromethane) Systems are provided for the following areas:

1. Emergency Switchgear and Relay Rooms, Unit 1 (Manual Control Only)

2. Emergency Switchgear and Relay Rooms, Unit 2 (Manual Control Only)

3. Underfloor area of the Units 1 and 2 Main Control Room (see Figure 9.5-3)

4. Control Room Simulator Room (Training Center Building)

Revision 5209/29/2016 NAPS UFSAR 9.5-11

5. Underfloor area of the Monitor Control Room in the Security Building

6. Underfloor area of the Security Control Center

7. North and South Cable Vaults of the Security Control Center

8. Computer Room of the Local Emergency Operations Facility (Training Center Building)

All of the above systems are total flooding systems having both automatic and manual control, unless noted otherwise.

The Halon 1301 System provided for the Emergency Switchgear and Relay Rooms may be actuated by control switches (local or in the Control Room). Actuation of the Halon System is annunciated in the Main Control Room. Local audible and visual alarms are provided, along with a timed delay before the Halon 1301 gas is discharged, to allow personnel to evacuate the rooms.

Smoke detectors are provided in the Emergency Switchgear and Relay Rooms for early warning of a fire condition (alarms locally and on the station fire alarm panel), but the detectors are not connected to the Halon System.

The Emergency Switchgear Rooms (ESRs) are required to meet the requirements of Section III.G.3 of Appendix R.Section III.G.3 requires fire detection and a fixed fire suppression system be installed in the area under consideration. Manually actuated Halon fire suppression systems were installed in the ESRs as part of the modification made to comply with Appendix R.

The system design was based on NFPA 12A (Reference 8), and in accordance with paragraph 1-8.1.1, the system can be manually actuated if acceptable to the authority having jurisdiction.

Based on discussion in Generic Letter (GL) 83-33 (Reference 9), the Halon system installed in the ESRs meets the requirements of a fixed fire protection system as required by III.G.3, in contrast to Section III.G.2 which requires an automatic fire suppression system. The installation of a manual Halon system is in accordance with NFPA 12A, 1980 edition. The Halon system meets the definition of a fixed fire suppression system as described by GL 83-33 and the Halon system is expected to extinguish a fire in the ESRs as concluded in NUREG/CR-3656 (Reference 10). In addition, the NRCs Inspection Report (IR) (Reference 11) addressed implementation of 10 CFR 50 Appendix R Sections III.G, III.J, III.L, and III.O at North Anna. The IR acknowledged the fixed manual Halon system in the ESRs and concluded the fire area barriers and the fixed detection and suppression systems provided for these areas appear adequate. The ESRs are located beneath the control room thereby providing for prompt response from operations in the event of an alarm allowing the Halon system to be activated with minimal delay.

The Individual Plant Examination for External Events (IPEEE) submittal addressing fire (Reference 12) established an acceptable CDF without taking any credit for detection and suppression of fires in the ESRs. Since the ESRs comply with Section III.G.3, the units can be safely shutdown even in the event of a complete loss of the area. From an IPEEE perspective, the

Revision 5209/29/2016 NAPS UFSAR 9.5-12 existence of detection and a fixed suppression system in the ESRs provides additional protection, which if modeled in the IPEEE, would result in an even more acceptable CDF.

The Emergency Switchgear Room Halon System has a 100% reserve capacity. The system is designed and was tested to maintain the minimum Halon concentration for 10 minutes. When the Halon System activates, all ventilation dampers to the protected area automatically close. The normal supply and exhaust air dampers to the Emergency Switchgear and Relay Rooms automatically close to prevent the escape of Halon gas from the rooms, but the recirculation air handlers remain on to keep the Halon gas well distributed within the rooms.

The ESR Halon 1301 Fire Suppression System is not required to operate during or after a seismic event but portions of the system are seismically supported to prevent possible damage to surrounding safety-related equipment.

The next several paragraphs discuss the Halon 1301 System for the underfloor area of the Main Control Room. The control room subflooring is relatively isolated from the control room air space. Cable penetrations through the subfloor boundaries are sealed with an RTV silicone foam material to maintain fire barrier integrity. The raised floor has removable panels that are firmly set on a grid support system. The grid support system is adjustable, which facilitates the leveling and proper seating of floor panels. The clearances between the edges of the panels are minimal and the panels require suction-cup grip handles for removal.

The cable seals and panels are utilized to ensure a high degree of confinement of Halon. The removal of floor panels to verify that the fire is extinguished is easily accomplished with grip handles, several of which are available in the control room. Two cross-connected systems of temperature detectors are provided. Signals from one system alarm only. Signals from two temperature detectors, one from each system, are required for automatic actuation. The system may be manually initiated. Manual or automatic actuation is indicated on the fire protection panel.

A smoke detection system of the photoelectric-type is provided for alarm only. It also indicates on the fire protection panel.

Two types of detection devices are used: rate-compensation-type thermostats and photoelectric-type smoke detectors. The only material in the underfloor area is control cables, which have flame-resistant insulation and jackets. The thermostat setpoint of 190°F is well below the ignition temperature of the cable insulation. The smoke detectors will annunciate an alarm in the main control room as soon as smoke is sensed in the photo chamber in the detector.

Stratification does not occur, since the Halon is released only to the underfloor area, which is approximately 18-inch deep.

The Halon system is a total-flooding system with a 100% reserve capability. The Halon concentration in the underfloor area will remain high for a long period, as no air is circulated to this area. Therefore, the cooling time will be long enough to prevent rekindling.

Each system has six 50-lb Halon cylinders: two cylinders for the main bank initial discharge, plus one cylinder for supplementary discharging; and the same number for the reserve

Revision 5209/29/2016 NAPS UFSAR 9.5-13 bank. Each bank of two cylinders is sized for sufficient capacity to provide two-shot total flooding at a 6% concentration for the underfloor volume. Each supplemental discharge cylinder is sized to maintain at least a 5% concentration for 10 minutes.

The Halon 1301 fire protection systems for the isolated underfloor area of the main control room are interlocked with the control room ventilation system. When the Unit 1 or Unit 2 system is actuated, the normal control room supply and exhaust and the corresponding units recirculation fans are shut down. The fans are turned on manually after extinguishment is certain.

A Halon 1301 system is provided for the control room simulator located in the training center building. Automatic actuation is initiated by area smoke detection. Automatic or manual actuation of the system is indicated on the local fire protection panel and remotely.

The Halon 1301 fire protection systems for the isolated underfloor areas of the security building monitor control room and the security control center, as well as the security control center cable vaults, are not interlocked with any ventilation and exhaust systems, since these areas are not connected to the supply or exhaust systems.

Automatic actuation is initiated by photoelectric-type smoke detectors. Manual actuation is also provided. The actuation of any system is indicated on the main control room fire protection panel.

Halon fire suppression is used at Units 1 and 2 for control room subfloor fire suppression.

The Halon fire protection system is composed of a double-shot, two-zone system. Each zone (one for Unit 1 and one for Unit 2) is capable of automatically delivering 150 lb of Halon. The concentration is determined by assuming that a single shot of Halon (100 lb plus a 50-lb supplemental discharge) is released from each zone while the second shot and its supplemental discharge are held in reserve. Assuming that all of the automatically discharged Halon from two zones enters the control room, the resulting concentration will be 0.75%.

Underwriters Laboratories, Inc., classifies Halon as one of the least toxic chemicals, based on the exposure of test animals (Reference 1). As postulated below, if all stored Halon is released into the control room, a concentration of 1.5% would result (Section 9.5.1.3.8). Therefore, no effect on personnel will be seen. In addition, since there is an exfiltration of control room air under all operating conditions, any uncontrolled release of Halon will be continuously diluted.

Halon detectors are not needed and thus are not provided in the control room. If stored Halon is released into the control room atmosphere, the actuation will be annunciated on the fire protection panel.

The Halon 1301 system area is monitored with smoke detectors, as those described above for the high-pressure carbon dioxide system. Reliability is achieved by circuit monitoring, as described for the water spray systems and the smoke detection section of the high-pressure carbon dioxide system. In addition, a loss of pilot pressure in the Halon system will be annunciated in the control room on the main fire protection panel.

Revision 5209/29/2016 NAPS UFSAR 9.5-14 The decomposition (Reference 4) of Halon is dependent on the size of the fire, the concentration of Halon vapor, and the length of time the agent is in contact with flames on surfaces heated above 900°F. With early detection and manual release capabilities, the confined subfloor space, and the resultant soaking time, any fire will be short-lived and surface temperatures of 900°F or greater should not occur.

9.5.1.2.3 Smoke- and Temperature-Detecting Systems Ionization combustion type or photoelectric type smoke detectors are provided for alarm purposes for the following areas:

1. Normal switchgear rooms (Elevation 307 ft. in the service building).

2. Cable-tray-spreading rooms.

3. Service building - cable vault and tunnel.

4. Primary plant - cable vault and tunnel.

5. Main control room underfloor area.

6. Battery rooms.

7. Motor control center rooms.

8. Yard diesel-fuel-oil pump rooms.

9. Spillway gate control house.

10. New records room (Records Building).

11. Training center control room simulator.

12. Motor-generator set houses.

13. Each air inlet path to the control room.

14. Reactor containment (Unit 1 and 2)

recirculation air system

cable penetration area

15. Control room (Units 1 and 2)

general area above floor

return air duct

16. Emergency switchgear and instrument rooms (Units 1 and 2) - general area.

17. Auxiliary building

charging pump cubicles general area

Revision 5209/29/2016 NAPS UFSAR 9.5-15

charging pump cubicles exhaust duct

component cooling pump area

resin and filter storage area exhaust duct

exhaust duct of small cubicles

general area of each level

18. Fuel-oil pumphouse - general area (motor control center room).

19. Service water pumphouse - general area.

20. Auxiliary service water pumphouse - general area.

21. Auxiliary feedwater pumphouse (Units 1 and 2) - general area (motor and turbine pump rooms).

22. Quench spray pumphouse (Units 1 and 2)

general area of both elevations

23. Safeguards areas (Units 1 and 2) - ventilation system exhaust duct.

24. Main steam valve house (Units 1 and 2) - general area.

25. Fuel Building - general area.

ventilation system exhaust duct

26. Waste disposal building - general area.

27. Boron recovery building - ventilation system exhaust duct.

28. Decontamination building - ventilation system exhaust duct.

29. Fire pump room - general area.

30. Intake structure control house - general area.

31. Post-accident recombiner vault - general area.

32. Auxiliary power supply building - general area.

33. Casing cooling pumphouse (Units 1 and 2) - general area.

34. Chiller room (Service Building, Elevation 254'-0"; Units 1 and 2) - general area.

35. New fuel area enclosure - general area.

36. Technical Support Center

general area

Revision 5209/29/2016 NAPS UFSAR 9.5-16

HVAC room

electrical room

battery room

37. Post-accident sampling system enclosure (Service Building, Elev. 294'-0")

38. On-line chemistry monitoring computer room.

39. N-16 enclosure (Turbine Building, Operating Floor)

40. AAC Building - battery room.

These systems are connected to an annunciator on the main control panel to alert the operator to the indicator on the fire protection panel in the main control room.

Smoke detectors generally are not furnished for areas where they are unsuitable, since (1) significant air movement (e.g., outdoors) might dilute combustion products, (2) the space is manned continuously, (3) the construction material is essentially noncombustible, (4) protection is provided by other types of sensing devices, and (5) fixed and/or portable fire-extinguishing equipment is furnished.

The hydrogen seal-oil unit, oil purifier unit, turbine-oil reservoir, transformers, auxiliary boilers, shops, and laboratories fall into one or more of the above categories and therefore are not provided with smoke detectors.

Temperature-detecting sensors are used at or in the following locations of both Units 1 and 2 with setpoints shown in parenthesis:

1. Rate - compensated types, including

a. Turbine-oil reservoir and cooler. (190°F)

b. EHC reservoir. (190°F)

c. Hydrogen seal-oil unit. (190°F)

d. Oil purifier unit. (190°F)

e. Normal switchgear room. (190°F)

f. Cable-tray-spreading room. (190°F)

g. Service building cable vault and tunnels. (190°F)

h. Primary cable vault and tunnels. (190°F)

i. Emergency diesel generator room. (190°F)

j. Control room underfloor area. (190°F)

k. Records Building. (190°F)

Revision 5209/29/2016 NAPS UFSAR 9.5-17

l. Main/HEPA charcoal filter assemblies. (225°F)

m. High-pressure turbine bearing areas. (225°F and 325°F)

n. Low-pressure turbine bearing areas. (225°F)

o. Generator bearing areas. (225°F)

p. Main excitor enclosure. (190°F)

q. Containment electrical penetration area. (155°F)

r. Reactor Containment residual heat removal pump area. (155°F)

s. Service water valve house. (155°F)

t. Technical Support Center charcoal filter assembly. (200°F and 300°F)

u. AAC Building - general area. (140°F - with one detector at 190°F)

2. Reactor coolant pumps (inside pump body insulation enclosure) (continuous-strip type).

(575°F)

3. Fuel-oil pump house (fixed temperature heat detectors). (135°F)

4. Main transformers (linear heat detectors). (280°F)

5. Training Records Vault (fixed temperature heat detectors). (135°F)

6. Station Service Transformers (linear heat detectors). (220°F)

Temperature detection sensors of the continuous-strip type operate on the principle that an increasing temperature of the strip causes the resistance of the element to decrease, allowing a greater than normal current to flow through the control circuit, which then triggers the alarm device. Incremental temperatures are integrated also throughout the length of the sensing element, which allows for the possibility of local hot spots in the equipment without triggering a false alarm. The nominal setpoint is 575°F. This temperature is a factory-set calibration with the capability of being field-adjusted within limits.

Temperature detectors of the rate-compensated, electric-contact type are sensitive to both a fast rate of rise in temperature and a maximum temperature limit. The shell of this type of sensor is made of a rapidly expanding alloy, and the inner struts, which hold the alarm contact points, are made of a more slowly expanding alloy. On a slow temperature rise, both the shell and the struts will expand together until the setpoint is reached, which will then trigger the alarm circuit or activate the fire protection system. A fast rate of rise, caused by a fire, will expand the outer shell faster than the inner struts, thereby closing the contacts and causing an alarm to sound and the fire protection system to be activated.

Revision 5209/29/2016 NAPS UFSAR 9.5-18 The linear heat detector is a fixed digital sensor and is therefore capable of initiating an alarm once its rated activation temperature is reached. At the rated temperature, the heat sensitive polymer insulation yields to the pressure upon it permitting the inner conductors to move into contact with each other thereby initiating an alarm signal. It does not require that a specific length be heated in order to initiate an alarm, nor is system calibration necessary to compensate for changes in the installed ambient temperature.

Electronic programmable heat detectors combine the features of rate compensated/fixed temperature sensing and rate-of-rise temperature sensing. The rate-of-rise and rate compensated/fixed temperature features are independently configurable. Additionally, the fixed temperature setpoint is configurable. Configurable features are individually set for each detector through programming of the fire alarm control panel which monitors the detector.

Smoke detectors of the photoelectric type use a pulsed infrared LED light source and a silicon photodiode receiver for smoke sensing. The sensitivity of the detector is user-selectable.

The ability of this detector to sense smoke particles in the smoke chamber is not adversely affected by air flow. These detectors are also capable of detecting and compensating for environmental factors, such as dust and dirt.

Smoke detectors of the air-ionization type have adjustable-sensitivity, which is preset at the factory. A minute quantity of radioactive material makes the air electrically conductive inside an ionization chamber, which is in communication with the air in the room. The normal air of the environment within the detector allows sufficient current to flow to maintain the detector in a normal operating condition. When a sufficient quantity of products of combustion interrupt the ionization process, the current flow will decrease or cease entirely, causing the detector to function.

The maximum spacing, the location, and the area covered by each of the detectors is dependent on the requirements of Underwriters Laboratories, Inc., the NFPA 72 standard, or the type of hazard being served. The floor area that an area detector can serve is also dependent on the height of the enclosure in which it is located and the type of ceiling construction. Except for the strip detectors within the insulation jackets of the main coolant pumps, the smoke and heat detectors on indoor applications are located on the ceilings, or as close as possible over the hazard that is being protected or that is likely to cause the fire. The spacing is conservative, with never less than two smoke detectors per protected space, except in small areas such as the N-16 instrumentation enclosures, Fuel Oil Pump House MCC Room, TSC Battery Room, and Auxiliary Service Water Pump House.

In the case of transformers that are protected by water sprays and are located out-of-doors, the heat-detecting devices used to actuate the water spray system in case of fire are supported from the spray rack piping located above the transformers.

The fire detection and alarm systems are installed on a multiplexed system, in accordance with the guidelines of National Fire Protection Association (NFPA) Standard 72D-1975. An

Revision 5209/29/2016 NAPS UFSAR 9.5-19 operator interface panel, installed in the Control Room, provides plant operators with the status of the system and its detectors. This operator panel employs color graphic displays to indicate the current status of the system. Addressable smoke and heat detectors are utilized which allow the status of individual detectors to be available to plant operators and technicians. The detectors for each zone are connected to local multiplex panels; these multiplex panels are located throughout the plant and are connected via a computer network back to the operator interface panel. The multiplex network is a combination of Class A and B circuits as defined in NFPA 72D-1975. All detector zones on this system are supervised circuits.

The water spray systems have a trouble horn that will sound and a lamp that lights at the local panel, which cause annunciation on the main fire protection panel in the control room when any of the following events occur within a system:

1. Loss of electrical integrity in any detection circuit.

2. Power failure of deluge valve operating circuit.

In addition, any monitored manual water valve that is moved from the full open position will also cause local and remote annunciation of the condition.

The heat detection systems located within the insulation jackets of the main coolant pumps have a control panel that will check the electrical continuity of the heat detection strip. The activation of the trouble circuit will notify the control room via the main fire protection panel that the strip is nonfunctional.

9.5.1.2.4 Additional Fire Protection Measures 9.5.1.2.4.1 10 CFR 50 Appendix R and Regulatory Guide 1.189 Compliance for Safe Shutdown.

There are several combinations of safe shutdown systems available in either unit that are capable of shutting down the reactor and cooling the core of either unit during and subsequent to a fire, concurrent with a loss of offsite power, as required by 10 CFR 50 Appendix R and Regulatory Guide 1.189. The combinations available in a fire situation will depend upon the location of the fire and the effects of the fire on such systems. Using Appendix R guidelines and Regulatory Guide 1.189, a safe shutdown analysis has been performed for each area which identifies those safe shutdown systems which would be unaffected by a worst-case fire in that fire area. The analysis has determined that either:

1. The North Anna Power Station, Units 1 and 2, design complies with the specific requirements of Appendix R Sections III.G, III.J, III.L, and III.O and Regulatory Guide 1.189, or

2. Exemptions have been requested from specific requirements of Appendix R where areas were not in strict compliance but where existing systems or configurations already provided equivalent protection to Appendix R requirements.

Revision 5209/29/2016 NAPS UFSAR 9.5-20 The specific components required, the exemptions requested, and the detailed analyses which were developed are contained in the North Anna Power Station Units 1 and 2 10 CFR 50 Appendix R Report.

9.5.1.2.4.2 Fire Barriers. The structures throughout the plant are segmented into fire areas with walls, fire doors, fire dampers, and electrical penetration seals rated to survive a fire of three hours duration.

Conduits passing through rated fire barriers are provided with internal conduit seals as follows: a) if the conduit terminates at a distance of up to 5 feet from the fire barrier, or b) if the conduit is penetrating the Control Room pressure envelope. (See Section 8.3.1.1.2.6.)

Other types of passive fire protection are provided in the station in order to comply with the requirements of 10 CFR 50 Appendix R for physical separation between safe shutdown components. These include fire retardant coatings on conduit, radiant energy shields within the Containment Building, and intermediate cable tray firestops within the Containment Building and Auxiliary Building, as described in 10 CFR 50 Appendix R Report, Chapter 2.

9.5.1.2.4.3 Portable Fire Extinguishers. Manually operated, portable fire extinguishing equipment is provided throughout the station.

9.5.1.2.4.4 Air-Breathing Equipment. There are at least 12 self-contained air-breathing apparatuses (SCBAs) dedicated at all times to fire brigade use. There are at least 24 spare air cylinders, each rated at a 30-minute capacity, available for fire brigade use. Self-contained units are distributed at various locations throughout the plant, with several sets located in the Control Room for possible use during a Halon system discharge. A description of SCBAs used for fire fighting is provided in Section 12.2.5.

Air recharging for the fire brigade cylinders is from a cascade system that is located near Warehouse 2.

9.5.1.3 Design Evaluation 9.5.1.3.1 Evaluation of Specific Plant Areas 9.5.1.3.1.1 Reactor Containment Structures. The reactor containment equipment is designed to minimize the use of combustible materials. Cable is jacketed with a fire-resistant, fire-retardant thermosetting material. Cable trays have metal covers to resist external fires or isolate any possible internal ones. Lighting and communication cables that are not jacketed with fire-retardant material are installed in conduit. Firestops have been installed in all vertical cable tray risers in the containment.

Firestops have also been installed in horizontal cable trays between primary and alternate safe shutdown components as described in 10 CFR 50 Appendix R Report, Chapter 7.

Revision 5209/29/2016 NAPS UFSAR 9.5-21 In accordance with 10 CFR 50 Appendix R, a radiant energy shield has been installed and/or fire rated conduit coating has been installed where there is less than 20 feet of horizontal separation between primary and alternate safe shutdown instrumentation.

A dry-type fire hose standpipe has been installed in the Containments for manual fire suppression capability. Fire hose is provided at the Containment entrance in the Auxiliary Building. Heat and smoke detectors have been installed in the annulus cable penetration area for detection of a fire within the penetration area.

Portable extinguishers are provided throughout the containment during shutdown. These are intended primarily for fire control during maintenance periods; however, personnel may enter the containment during subatmospheric operation for fire control purposes. The extinguishers are normally kept outside the personnel hatch for these purposes.

Personnel entering the containment during subatmospheric operation are required to use self-contained breathing apparatus. Portable extinguishers, as well as wheel-type dry-chemical extinguishers, can be passed through the personnel access hatch for use during the unlikely event of a fire in the containment.

The volute of each reactor coolant pump within the containment is monitored for possible fires from leaking bearing oil. Temperature monitors are located in the space between the insulation and pump volute to detect heat from the possible accumulation and flashing of lube oil from the pump motor. A main control room readout is provided on the fire protection panel.

In order to reduce the potential for fires in the containment, a collection system has been installed on the reactor coolant pump motors to contain leakage from the reactor coolant pump motor lube oil system. Leakproof cans with covers are placed under oil-bearing components that may leak in order to contain oil from leaks in pressurized lines and keep foreign matter out of the drain. Leakage from oil-bearing components will be collected by five enclosures on each reactor coolant pump motor. Each of the oil collection enclosures is connected to a header with a flexible hose and the header pipe drains the oil to a tank below the enclosures. This drain tank is sized to contain the total inventory of the motor. The tank is equipped with a drain and a vent with a flame arrestor. In this way, oil in contact with hot equipment is reduced, and therefore the possibility of fire is reduced. Small amounts of oil bypass the collection trays and remain uncollected. For the uncollected oil, the NRC approved an exemption from 10 CFR 50 Appendix R for Unit 1 and an evaluation has been performed for Unit 2 in accordance with Regulatory Guide 1.189. The small amount of uncollected oil has been determined not to adversely affect the ability to achieve and maintain safe shutdown.

In addition, in accordance with 10 CFR 50 Appendix R, a radiant energy shield is installed in both units between the residual heat removal pump motors. This radiant energy shield is installed to protect one of the two residual heat removal pump motors in the event of a motor fire.

This shield ensures that at least one residual heat removal pump is available for safe shutdown of the unit following a postulated fire.

Revision 5209/29/2016 NAPS UFSAR 9.5-22 9.5.1.3.1.2 Fuel Oil Storage Tank and Pumphouse. Non-safety-related, 5000-barrel fuel-oil storage tank is provided with (1) a manual air-foam fire protection system consisting of fixed piping terminating at a discharge outlet in the tank, and (2) necessary components located in the nearby hose house. This provides foam discharge into the tank and a foam hose stream for other possible fires around the tank. The tank is diked and is located approximately 20 feet from the safety-related oil storage tanks, which are buried.

The Fuel Oil Pumphouse consists of two identical pump rooms and a motor control center room. The three rooms are separated from each other by concrete walls which provide a 3-hour fire barrier.

Each pump room contains four safety-related fuel oil transfer pumps; one for each diesel generator. An unmitigated fire in one of the pump rooms could damage all of the equipment within the room; however, the pumps in the redundant room would be unaffected and would supply fuel oil to the diesel generators.

The fuel oil pump rooms are each protected by an automatic (heat detector actuated) high pressure carbon dioxide system. Backup manual fire suppression is provided by foam hose stream equipment.

9.5.1.3.1.3 Auxiliary Feedwater Pumphouses. Fire protection for the auxiliary feedwater pump house is provided by the following:

a. Concrete monolithic construction.

b. Spatial separation - two pump rooms.

c. A fire barrier - a 2-foot-thick concrete wall between rooms.

d. The use of noncombustible materials exclusively in construction.

e. The redundancy of the pump rooms themselves.

The Motor Driven Auxiliary Feedwater Pump Rooms are 10 CFR 50 Appendix R, III.G.3 areas, and therefore require fixed suppression systems. An exemption was requested and approved by the NRC (SER dated 11/6/1986), exempting the Motor Driven Auxiliary Feedwater Pump Rooms from having fixed suppression systems. The Turbine Driven Auxiliary Feedwater Pump Rooms are 10 CFR 50 Appendix R, III.G.1 areas, and therefore do not require fixed fire suppression systems. Portable equipment and a yard hydrant with a hose are available for fire fighting. A smoke detection system is provided in each pump room.

A fire in the motor-driven auxiliary feedwater pump room could disable both motor-driven pumps as well as level indication for the emergency condensate storage tank. Safe shutdown can be achieved using the turbine-driven auxiliary feedwater pump along with the local indicator for pump suction pressure. Procedures address the use of pump suction pressure as a means to determine adequate level in the emergency condensate storage tank level. This alternative safe

Revision 5209/29/2016 NAPS UFSAR 9.5-23 shutdown capability is provided in accordance with 10 CFR 50 Appendix R. (Also see 10 CFR 50 Appendix R Report, Chapter 7.)

9.5.1.3.1.4 Battery Rooms. Each of the four station battery rooms in each unit has a ventilation system consisting of a fan, intake and exhaust ducts, and associated fire dampers. This system mixes and exchanges air in the battery rooms to maintain room temperature, and to limit hydrogen concentration that may be released from the batteries to less than 2% by volume. As part of the fire protection system, flow switches have been installed in the ventilation duct of each battery room, which will alarm in the control room upon loss of air flow.

9.5.1.3.1.5 Control Room Complex. Protection for the main control room against fires that originate outside the main control room is provided by boundaries with a 3-hour fire rating and by fire doors that are tight against the entrance of smoke. The cable-tray-spreading rooms located above the main control room are protected by the CO2 system previously described. The possibility of internal fires is reduced by the use of flame-retardant materials and the segregation of possible sources of control board wiring fires, as noted in Section 9.4.1. Portable equipment is provided for extinguishing smoldering fires in the main control room, and, since the required concentration does not adversely affect personnel, Halon 1301 is used to flood the underfloor area. Scott Air Pack units are also provided for the additional protection of operating personnel.

The breathing apparatus has a built-in supply of pure air and cannot be contaminated by fumes or particulates. No adverse effect on the operators vision is expected from the minimal release of products of combustion contained within the subfloor space. The breathing apparatus is of the type regularly used by fire departments in toxic and corrosive atmospheres. The facepiece is manufactured of materials that will not decompose or be damaged to hinder the operators vision.

Alternative safe shutdown capability for a fire in this area is provided in accordance with 10 CFR 50 Appendix R.

An auxiliary shutdown panel located in each Emergency Switchgear Room contains controls necessary for safe shutdown in the event of damage of Control Room equipment or a forced evacuation of the Control Room. An auxiliary monitoring panel located in the Fuel Building contains the process instrumentation necessary for safe shutdown. Emergency Diesel Generators 1H and 2H are provided with local control panels which are electrically isolated from the Control Room. This ensures that the diesel generators can be locally started and controlled.

The service water pumps, residual heat removal pumps, and the component cooling water pumps are normally controlled from the Control Room. In the event of a Control Room evacuation, the pumps for these systems can be operated at the switchgear in the Emergency Switchgear Room. Other modifications made as a result of 10 CFR 50 Appendix R requirements provide the operator with the capability of manually closing the main steam line isolation valves and/or the steam generator power-operated relief valves from outside the Control Room in the event the Control Room has sustained damage due to a fire or is evacuated.

Revision 5209/29/2016 NAPS UFSAR 9.5-24 The Control Room Complex is protected by a smoke detection system throughout the area, and by an automatic Halon 1301 fire suppression system in the underfloor area.

9.5.1.3.1.6 Emergency Switchgear Rooms. Separate fire areas are provided for each units Emergency Switchgear and Relay Room area. Each fire area is composed of two emergency switchgear rooms and a single relay room. The rooms within each fire area adjoin each other with open passageways between them. The auxiliary shutdown panel for each unit is located in this area. Station 125V dc batteries are also located in the area in separate rooms within their associated switchgear rooms.

Alternative safe shutdown capability for a fire in this area is provided in accordance with 10 CFR 50 Appendix R.

The Emergency Switchgear and Relay Room area for each unit is protected by a smoke detection system and by a manual Halon 1301 fire suppression system. Dikes have been provided to prevent equipment damage due to flooding from a pipe rupture or fire suppression system actuation in adjacent areas. Dikes have been installed at the doorway from the Turbine Building into the Emergency Switchgear Room, at each doorway from the Emergency Switchgear Rooms into the Cable Vaults, and at each doorway from the Turbine Building into the Chiller Rooms.

9.5.1.3.1.7 Cable Vaults and Tunnels. Separate fire areas are provided for each units Cable Vault and Cable Tunnel fire area. Each fire area is composed of the Service Building Cable Vault, Cable Tunnel, Outside Containment Cable Penetration Vault, Motor Control Center Room, and the Motor-Generator Set House (located above the Motor Control Center Room).

Alternative safe shutdown capability for a fire in this area is provided in accordance with 10 CFR 50 Appendix R.

The Cable Vault and Tunnel area for each unit is provided with smoke detection systems.

The Cable Vault and Tunnels and Motor Control Center Rooms for each unit are provided with automatic (heat detector actuated) carbon dioxide fire suppression systems. This system is backed up by manually actuated water sprinkler systems in the Service Building Cable Vault.

9.5.1.3.1.8 Auxiliary Building. The Auxiliary Building contains equipment which serves both units. The Auxiliary Building, Fuel Building, and Decontamination Building are all located in a common fire area.

The Auxiliary Building fire area is separated from adjoining fire areas by 3-hour fire barriers, and all openings in the fire barriers are provided with fire rated doors and penetration seals, except for a pipe tunnel which is open to the Turbine Building (see 10 CFR 50 Appendix R Report, Chapter 7).

The Auxiliary Building has two important safe shutdown systems: the charging system and the component cooling water system. These systems have both Unit 1 equipment and Unit 2 equipment located in the Auxiliary Building. Manual cross-connections are provided between units to allow the components from one unit to perform safe shutdown functions for the other unit.

Revision 5209/29/2016 NAPS UFSAR 9.5-25 This alternative safe shutdown capability is provided in accordance with 10 CFR 50 Appendix R.

The components of one unit are in a separate zone from the components of the other unit, except for portions of the cables for the charging pumps and component cooling water pumps. These sections of cable have been wrapped with a 1-hour fire rated wrap. Firestops have been provided in those cable trays which constitute a potential intervening combustible.

The Auxiliary Building is provided with smoke detectors on each elevation of the building although the spacing does not provide full area coverage. Detectors are located in areas with large amounts of cable, in the area of the component cooling water pumps and cables, and in the area of the charging pumps and cables and associated valves. Automatic sprinkler systems are provided on Elevations 244'-6" and 259'-6" for protection of the component cooling water pumps and cables and for protection of the charging pump cables. (See 10 CFR 50 Appendix R Report, Chapter 7).

New, redundant auxiliary building ventilation fans have been installed on a concrete slab on the building roof. The fans ensure that ventilation for the charging pumps and for the component cooling pumps will be available following a fire in any area. The redundant fans and associated cabling are separated by approximately 40 feet. (See 10 CFR 50 Appendix R Report, Chapter 7.)

Ducts are routed from the fans down to an enclosure on Elevation 259'-6" of the building. Flexible duct is contained in the Auxiliary Building, Elevation 244' stairwell and would be routed to the pump areas, as needed.

An oil or grease fire could be postulated on Elevation 259'-6" of the Auxiliary Building, which could result in oil flow through the floor level openings into the charging pump cubicles below. To preclude this possibility, a 4-inch high dike or toeplate has been installed around each of the floor openings into the six charging pump cubicles. This dike/toeplate minimizes the possibility of fire propagation to the charging pumps and also prevents significant quantities of water from entering the cubicles.

9.5.1.3.1.9 Diesel Generator Rooms. There are four identical Diesel Generator Rooms located adjacent to each other in the west end of the Service Building. Each room contains an emergency diesel generator, fuel oil day tank, and auxiliary equipment. Each unit has two diesel generators, one for each safety-related division. Each Diesel Generator Room is a separate fire area.

Diesel Generators 1H (Unit 1) and 2H (Unit 2) are provided with local isolation and control capability. In the event of a fire outside of the Diesel Generator Rooms, either of these diesels could be started locally in order to provide power to the equipment needed for safe shutdown.

An automatic (heat detector actuated) carbon dioxide fire suppression system is provided in each Diesel Generator Room. A dike has been provided around the fuel oil day tank in each Emergency Diesel Generator Room that can retain 110% of the capacity of the day tank.

9.5.1.3.1.10 Main Steam Valve Houses. The Main Steam Valve House for each unit is a multi-level structure located adjacent to its units Reactor Containment Building.

Revision 5209/29/2016 NAPS UFSAR 9.5-26 The Main Steam Valve Houses contain the main steam code safety relief valves, the steam generator power-operated relief valves (PORVs), and the steam supply valves to the turbine-driven auxiliary feedwater pump. A fire in this area could disable the cables for the PORVs. This will result in the code safety relief valves opening in order to relieve steam pressure.

After the fire is extinguished, the PORVs can be manually opened by the handwheels. This alternative safe shutdown capability is provided in accordance with 10 CFR 50 Appendix R.

Smoke detectors are provided in the Main Steam Valve House at the upper elevation. Fixed fire suppression systems are not necessary in the Valve House. (See 10 CFR 50 Appendix R Report, Chapter 7.)

9.5.1.3.1.11 Quench Spray Pump Houses. The Quench Spray Pump House for each unit is a two-story structure located adjacent to its units Reactor Containment Building, and in between the Main Steam Valve House and Safeguards Area. The Quench Spray Pump House is located in a common fire area with the Safeguards Area, but is separated from the Main Steam Valve House by 3-hour fire barriers.

A fire in the Quench Spray Pump House could disable the steam generator pressure transmitters. Safe shutdown can be achieved using the local pressure indicators on the main steam system located in the Main Steam Valve House. This alternative safe shutdown capability is provided in accordance with 10 CFR 50 Appendix R.

Smoke detectors providing full area coverage of both elevations are provided in the Quench Spray Pump Houses. Fixed fire suppression systems are not necessary in the Valve House. (See 10 CFR 50 Appendix R Report, Chapter 7.)

9.5.1.3.2 Evaluation of Fire Protection Water Supply The capacity of each fire pump was established to provide for the simultaneous flow of 2000 gpm for the sprinklers and 1000 gpm for hose streams, with the other pump serving as a 100%-capacity backup. Each pump is UL-rated at 2500 gpm, per Table 9.5-1, but will deliver 3000 gpm at reduced heads of 305 feet for the motor-driven pump and 250 feet for the diesel-driven pump.

The selection of the number of fire pumps for adequate coverage is based on the requirement of the Nuclear Energy Liability Property Insurance Association.

Reliable water sources are available from both the North Anna and Service Water Reservoirs. An electric-motor-driven fire pump takes suction from the North Anna Reservoir and a diesel-engine-driven fire pump of Seismic Class I design, installed in a tornado-missile-protected structure, takes suction from the Service Water Reservoir. Separate pumps and drivers ensure the delivery of adequate water for fire protection purposes. The diesel-driven fire pump has fuel storage for a minimum operation of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

The pressure in the yard fire-protection water distribution system is automatically controlled to maintain a 105-115 psig pressure. When any water fire protection system operates,

Revision 5209/29/2016 NAPS UFSAR 9.5-27 the pressure drop in the fire main initiates a signal to start the motor-driven fire pump, and in the event of a further drop in pressure, the diesel-driven fire pump starts. Both pumps can also be started manually. The operation of either fire pump is annunciated in the control room.

Fire pump readiness is also indicated in the control room as follows:

1. Motor-driven fire pump.

a. Trouble.

b. Running

c. Breaker automatic trip.

2. Diesel-driven fire pump.

a. Trouble.

b. Automatic start.

c. Nonautomatic control.

d. Fuel-oil tank low level.

9.5.1.3.3 Evaluation of Fire Detection Systems The smoke detection alarm systems are designed to give an alarm in the earliest stages of combustion to permit safe evacuation of personnel as required, and to allow for the use of portable extinguishers or the manual release of carbon dioxide or water spray systems before the sensing of heat by the temperature detectors. The local wiring of the smoke and temperature detection system is supervised for continuity. Any trouble is annunciated in the main control room and alarmed locally. A minimum of two detectors are located in safety-related areas.

9.5.1.3.4 Evaluation of Fire Suppression Systems The automatic wet pipe sprinkler system in the turbine building provides 0.20 gpm/ft2 coverage for any 10,000 ft2 of the area under the turbine room floors and inside the oil storage room, except in areas where electrical equipment is located. This system is also capable of providing coverage at a rate of not less than 0.30 gpm/ft2 for the most remote 3000 ft2 area.

The Halon 1301 concentration provided for extinguishment does not present any danger to personnel in the affected areas.

The carbon dioxide systems provide total flooding. This discharge from the nozzles is directed away from critical or safety-related items. Approved UL nozzles with shells or baffles were installed in these areas to diffuse the discharge and prevent a stream-type flow from impinging on any given surface or piece of equipment. Some shells have been removed to aid in CO2 dispersion.

Revision 5209/29/2016 NAPS UFSAR 9.5-28 The operation of the foam fire protection system requires the manual operation of a valve to deliver foam solution to the tank foam-maker.

The water spray systems serving the hydrogen seal-oil unit, the turbine-oil cooler reservoir, the oil purifier, the main transformers, and the station service transformers are operated manually from a remote station or locally from the deluge valve station. Automatic actuation is initiated by temperature detectors that operate when a fixed temperature or a rate of rise in temperature is exceeded (except main transformer and station service transformer detectors do not have rate of rise capability). Fire in these areas is automatically indicated on the main control room fire protection panel.

Each wet pipe sprinkler system in the turbine building, boiler room, and records room is equipped with automatic sprinkler heads that open and discharge water when the thermal ratings are exceeded. The flow of water through the sprinkler system piping automatically indicates on the main control room fire protection panel.

The dry pipe sprinkler system in Warehouse No. 2 building is equipped with automatic sprinkler heads that open, bleed air, and then discharge water when the thermal ratings are exceeded.

All CO2 fire protection systems may be manually operated from local stations. A fire in any of the areas to be flooded by carbon dioxide automatically indicates on the main control room fire protection panel.

The cable vaults, the normal switchgear rooms, and the cable-tray-spreading rooms above the main control room are provided with separate smoke detection systems for alarm and thermostatic detection systems that alarm and initiate the procedure for releasing total-flooding carbon dioxide. All CO2 protected spaces are equipped with local warning alarms and a time delay for personnel protection. System lockouts are also provided for personnel protection.

9.5.1.3.5 Inadvertent Operation of Fire Protection Systems An evaluation has been performed concerning the discharge of fire protection features as a result of accidental operation or a line break. The accidental operation of the fire protection systems is minimized by relying on manual operation wherever possible. This method requires a deliberate action to initiate flow. This design, having the least possible reliance on automatic operation and the most on manual operation, prevents to a high degree the possible accidental operation of a fire protection system, causing an unsafe condition in the plant.

The design and application of the extinguishing agents used throughout the plant are based on NELPIA recommendations. Although the use of these agents may cause unsafe conditions, the designs of the suppression systems, by being in accordance with current industry and insurance practices, minimize the hazards.

The release of Halon to the underfloor area of the control room will not damage cables and will not create a hazard to personnel, as discussed in Section 6.4, Habitability Systems.

Revision 5209/29/2016 NAPS UFSAR 9.5-29 Any CO2 release is directed away from safety-related equipment. Diffusion-type nozzles are used to prevent direct impingement of a stream-type flow on any surface, as described in Section 9.5.1.3.4.

The operators are protected from the leakage of carbon dioxide or Halon from tanks or pipes by the following:

1. The 17-ton CO2 tank is located outdoors.

2. The 6-ton CO2 tank is located in the auxiliary building, which has Seismic Class I exhaust systems.

3. Carbon dioxide is used in noncontrol areas (i.e., areas in which no control functions are required during the safe-shutdown earthquake).

4. No carbon dioxide is discharged into the control room, and Halon has a negligible effect on the operators.

Leaking carbon dioxide or Halon will not have an adverse effect on the safe shutdown of the plant.

If during a seismic event a pipe were to break in the hazard space, only a single-shot release of carbon dioxide could occur if both the master valve at the tank and the hazard discharge valve remain intact. If either valve, both of which are outside the hazard space, or the distribution piping between the two valves, should fail no carbon dioxide can enter the hazard space.

Therefore, a release of carbon dioxide in a hazard space from a pipe break resulting from a seismic event is not a credible accident.

9.5.1.3.6 Inadvertent Operation of Water Systems The manual application of water by hose stream is available in areas housing safety-related equipment. Manual application of water by hose streams can be controlled by fire brigade members to reduce impact on available safety-related equipment. Sprinklers are also available in some safety-related areas. This type of suppression system is not expected to adversely affect the operation of safety-related equipment since only the sprinkler head or heads in the area of the fire will activate since they are individually heat activated, and the flow from a sprinkler head is far less than the expected flow from a fire brigade hose stream. In addition, the NRC recommends the use of automatic sprinkler systems in safety-related pump rooms and cable spreading areas in Appendix A to BTP APCSB 9.5-1. The fire protection system is designed so that interior portions of the system can be isolated in the case of failure. This will prevent the flooding of safety-related equipment and will maintain adequate protection to the structures, systems, and components.

Portable fire extinguishers will be available to provide backup fire protection.

The operator will become aware of a fire protection system pipe break or leak in various ways, any of which would be a reason for the operator to initiate action for a visual inspection to establish the location of the break/leak, thus enabling further action to isolate faulty sections.

Revision 5209/29/2016 NAPS UFSAR 9.5-30 All branch pipes serving areas and equipment have alarm check valves, deluge valves, or flow indicators, and each also has annunciation in the control room to indicate any flow in the branch. Any continuous flow in excess of the 30 gpm provided by the jockey pump will start a fire pump, which is annunciated in the control room. This occurrence, without branch line flow annunciation, would show the fault to be upstream of any annunciation indication device in the branch.

9.5.1.3.7 Inadvertent Operation of Carbon Dioxide Systems Hazards protected by carbon dioxide have individual fire detection and initiation systems. A single failure in a fire detection system would result in the inadvertent release of carbon dioxide to that detection systems hazard only. The fuel oil pump house high-pressure carbon dioxide system has detection and releasing systems for each room. Both rooms share a common fire protection panel, a single failure could result in an inadvertent discharge of a single shot of CO2 in either room or simultaneously in both rooms. The analysis consisted of determining the effects of an inadvertent release of carbon dioxide, due to a false signal, to any hazard containing electrical equipment essential to a safe shutdown. A simultaneous discharge into both rooms of the fuel oil pump house does not impact the overall conclusion of the analysis.

It is calculated that the hazard air temperature will reach a low of 0°F for areas with a 3-minute discharge time and -30°F for areas with a 92-second discharge time. These values are conservative, since only the air contained in the hazard and the hazard walls was considered to give up heat to vaporize the carbon dioxide. Because of the complexity of determining the masses involved, the equipment within the space was assumed to give up no heat. Further, by neglecting the equipment as a heat source, the calculated values are conservative and will still be shown to create no problems.

The temperature of -30°F occurs in the emergency diesel generator rooms. If the diesel is considered to give up heat, the air temperature should be about 0°F, considering the large mass of the diesel. In addition, since the single failure only opens one selector valve, the redundant diesel is available.

The 0°F air temperature that is reached at the end of the CO2 discharge is in agreement with results of tests conducted by two manufacturers of CO2 fire protection systems (References 2

& 3). These tests also show that the air temperature immediately begins to rise at the end of the CO2 discharge. The room temperature will return to 35°F within 2 minutes, and it will reach 50°F within 6 minutes. This is based on data from tests in which the heat was transferred through the walls only, since there was no equipment within the space (References 2 & 3). Therefore, the times can be regarded as conservative, since the equipment acts as another source of heat.

The 0°F temperature is the air temperature only; it cannot be applied to any equipment within the hazard. Heat transfer between the 70°F surface of the equipment and the 0°F air will elevate the air temperature and decrease the equipment surface temperature until a state of equilibrium is reached. At this point both air and surface temperatures will rise as heat is

Revision 5209/29/2016 NAPS UFSAR 9.5-31 transferred into the hazard through the walls. Because of this condition, in conjunction with the rapid return of air temperature to near normal, surface temperatures should not go below 30-35°F.

This also agrees with test results (Reference 2 & 3).

The minimum air temperature for the essential electrical equipment rooms was calculated using the following equation (Reference 2):

2 h fg - u /2gJ t = ------------------------------------------------------------------------------------

C pv + ( M a /M v )C pa + 0.5h ( A/M v )

where:

t = calculated temperature drop hfg = latent heat of vaporization, Btu/lb u = velocity of sound of vapor at nozzle, ft/sec u= k Rv Tn k = specific heat ratio of vapor g = acceleration of gravity ft/lb Rv = gas constant of vapor, -------------

lb/°R Tn = vapor temperature at nozzle, °R J = 778 ft-lb/Btu Cpv, Cpa = specific heat at constant pressure, vapor and air, Btu/lb-°F Ma = initial weight of air in chamber, lb Mv = weight of vapor in chamber after discharge, lb Btu h = coefficient of heat transfer - convection, ------------------------------- 2 hour/ft - °F A = inside surface area of chamber, ft2

= period of injection, hr This equation can safely be used, since Walter Kidde and Company has found that calculated temperature drops agreed quite closely with test results.

A direct comparison of such items as volume, area, concentration, and discharge duration between North Anna areas and the test areas is meaningless. Each item appears in the above equation, and the total combination is what determines the final temperature drop. The important item is that the referenced test results are predictable using the above equation.

North Anna estimates were arrived at by the use of this equation, and not by a comparison with actual tests. The referenced test results were used for comparison with North Anna results to show that the answers were credible.

Revision 5209/29/2016 NAPS UFSAR 9.5-32 Internal temperatures of equipment will therefore vary from 70°F to 30°F depending on the mass and shape of a particular piece of equipment. Temperatures of 30°F for 2 minutes will have no effect on the electrical equipment.

All hazards protected by carbon dioxide with automatic actuation have a 30-second time delay between system actuation due to a fire signal and the release of carbon dioxide into the hazard to allow the evacuation of personnel. The duration of a seismic event will be less than 30 seconds (Reference 4). Since no carbon dioxide can be present in the hazard during a seismic event, combined low temperature and seismic effects are nonexistent. An inadvertent release of carbon dioxide will therefore have no adverse effect on safe shutdown.

9.5.1.3.8 Inadvertent Operation of the Control Room Halon System If all stored Halon is postulated to enter and become evenly dispersed throughout the control room as the result of a seismic event and mixing by the ventilation system, the maximum possible concentration will be only 1.5%. At the time of the Halon system installation, the National Fire Protection Association recognized Halon 1301 as the only gaseous agent acceptable for use in occupied areas. Also, Underwriters Laboratories, Inc., classifies Halon in the least toxic group, as listed in NFPA Standard 12A-1973.

On an uncontrolled release of Halon above the control room floor, such as from a Halon storage tank rupture, the Seismic Class I control room ventilation systems would effect a complete air recirculation of the control room approximately every 4 minutes. This rate would be sufficient to prevent stratification. On an actual fire-induced controlled release of Halon below the control room floor, the ventilation system would be secured. Initial concentration tests have indicated that without ventilation, the Halon remains in the under-floor area and migration of Halon to the control room is minimized.

The density of Halon is five times that of air. Therefore, even if local stratification is postulated, it would be in the form of Halon settling to the control room floor, leading to a decreasing concentration at the operator inhalation level.

In NFPA Volume 7, Section 12A, Halon 1301 is listed in the group of gases that do not appear to produce injury in concentrations up to at least 20% by volume for durations of exposure on the order of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The North Anna control room concentrations are well below this.1 From the above facts the following is concluded:

1. Stratification will not occur.

2. The postulated occurrence of stratification does not increase the concentration at the operator inhalation level.

3. The concentration of Halon will be well below the limits of that expected to cause injury.

1. Human studies (References 5, 6 & 7) showed that exposures of 7% by volume for 4-minutes to 5-minutes periods result in no adverse effects.

Revision 5209/29/2016 NAPS UFSAR 9.5-33 Therefore, with the low Halon concentration in the control room, any spurious or accidental release of Halon will not impair control room habitability.

9.5.1.4 Evaluation of Postulated Fires An evaluation has been made concerning the causes and consequences of various postulated fires. This evaluation is presented below.

9.5.1.4.1 Identification of Causes 9.5.1.4.1.1 Starting Conditions and Assumptions. T h e f o l l o w i n g a r e c o m b i n a t i o n s o f combustible material and ignition sources most likely to start a fire:

1. Spilled oil on hot pipes.

2. Electrical insulation and malfunctioning overload protective devices.

3. Packing materials of wood and paper and carelessly discarded smoking materials.

4. Any combustible materials and unidentified sources of ignition.

9.5.1.4.1.2 Protective Systems. Oil fires have the greatest potential where quantities of oil are used for cooling or combustion purposes, as in the turbine room, turbine oil reservoir, main and station service transformers, oil pump rooms, and emergency diesel generator rooms. Protective systems such as sprinklers, spray, foam, and carbon dioxide are provided with various detection and actuation devices for these areas.

For sprinkler systems, the initiation of protection is automatic. Rising temperatures will melt fusible links in sprinkler heads, releasing water to douse the fire and cool down heated surfaces. Oil storage equipment, such as the turbine-oil storage room, is diked to prevent the spread of burning oil. The release of water is immediately annunciated in the main control room and is identified specifically on the fire protection panel, also located in the main control room.

Areas such as the lower levels of the turbine building and the boiler room are also sprinkled and are protected to prevent spreading of a fire. For these sprinkler systems, no operator action is required to initiate the system. A local application CO2 system is installed on the turbine operating level to extinguish turbine bearing oil fires. This system is automatically actuated, and no operator action is required to initiate the system. Hose stations are also provided throughout the plant for use if required.

Deluge water spray systems are provided for major oil systems such as the turbine-oil reservoir and the main and station service transformers. These areas are also diked to prevent the spreading of a fire. All systems are automatic and require no operator action to initiate the flow of water.

The potential for electrical insulation fires is considered greater when there are concentrations of cables and cable trays, as in the cable tray rooms, cable vault areas, and the

Revision 5209/29/2016 NAPS UFSAR 9.5-34 control room underfloor cable system. These areas are provided with CO2 or Halon systems and early-warning detection systems. Release is automatic and no operator action is required.

Wood or paper fires are considered as probable fires in the storage areas. Sprinklers and hose stations are provided in the warehouse. An automatic (smoke detector actuated), normally dry, closed head sprinkler system is provided within the records room in the Records Building.

Where few combustibles are present, as in battery rooms, the potential for fires is considered low. Detection systems are provided to alert the operator. Other minimally combustible areas, such as the auxiliary building and the fuel building, are provided with hose stations and portable extinguishers.

9.5.1.4.1.3 Control Room Operator Actions. Automatic systems such as sprinkler and deluge systems require no operator action to initiate the system. Visual inspection of the fire protection panel will inform the operator of the specific area or areas involved.

Detection systems will annunciate an alarm in the main control room and alert the operator to locate the specific area on the fire protection panel, also located in the main control room.

In addition to automatic releases, local manual release stations are provided for all systems.

Specific action may be taken by a local observer to release the system.

Remote manual push-button stations on the fire protection panel in the control room are provided for such areas as the turbine-oil facilities and transformers. If the operator receives a fire signal and no flow signal, he will have the option of using the push-button station on the fire protection panel or inspecting the area and locally releasing the system, if required.

9.5.1.4.2 Analysis of Effects and Consequences: Methods, Assumptions, and Consequences Fire prevention methods that have been developed include the segregation of spaces by the use of fire-barrier walls and fire doors, and the use of fire dampers to inhibit the spread of fire from one space to another. Combustibles have been reduced to a minimum wherever possible.

Extinguishing systems have been provided, as described in Section 9.5.1.

Engineered safeguards features are redundant and separate to ensure their effectiveness.

Fires will be contained or extinguished without affecting the capability of the engineered safeguards system to function. Undetected and uncontrolled fires in the continuously manned main control room are improbable because of early detection and automatic extinguishing systems, portable extinguishers, and the extensive use of noncombustible material.

The consequences of fires are generally dependent on their size, which, in turn, usually is dependent on the length of time they go undetected. Hence, emphasis is given to a detection system which gives early warning.

External fires such as grass and brush fires are easily contained by hydrant hose systems.

Detection is visual because of the usually large release of smoke clouds. Since the main plant area

Revision 5209/29/2016 NAPS UFSAR 9.5-35 consists largely of paved roads and graveled areas, the consequences of external fires are negligible.

In the event that the CO 2 and Halon systems become nonfunctional during the safe-shutdown earthquake (SSE), the cable vault rooms and tunnels, switchgear rooms, cable tray areas, diesel generator rooms, and other safety-related areas are protected from fires by two means:

1. The plant itself is designed to exclude or prevent, as effectively as possible, the cause or spread of fire. Listed below are some of the items incorporated in the design.

a. Noncombustible building construction.

b. Fire barriers.

c. Spatial separation.

d. Noncombustible materials wherever possible.

e. Fire stops in cable trays at penetrations through fire-rated walls and floors.

f. Flame-retardant cable insulation.

g. Cable enclosures.

h. Isolated redundant diesels.

2. Manually operated, portable fire-fighting equipment is located throughout the plant and can be used in this situation. The yard firewater system can be utilized, as it is designed to Seismic Class I requirements.

9.5.1.5 Tests and Inspections The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

9.5.1.5.1 Construction checkout and testing, and pre-operational testing were as follows:

1. Construction checkout and testing.

a. The fire pumps and controllers were tested before station operation.

b. The low-pressure storage tanks and lines to the discharge valves were pressure-tested at 300 psig. High-pressure lines were proven to be bubble-tight.

c. Carbon dioxide and Halon 1301 equipment was tested for proper performance.

Included were full-concentration tests of all systems to prove that design concentrations would be achieved and proper concentrations maintained for the required time periods.

d. The low-pressure storage units were tested for refrigerant leaks and proper operation.

Revision 5209/29/2016 NAPS UFSAR 9.5-36 The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

e. The yard hydrant piping loop, the sprinkler, and the deluge lines were flushed clean before connecting any of the system. All new systems were hydrostatically tested at 200 psig.

f. Final insurance acceptance tests for each system were performed in accordance with applicable NFPA pamphlets in the presence of an NELPIA representative.

2. Pre-operational tests

a. Functional tests were performed on all CO2 and Halon 1301 systems in safety-related areas. Included were (1) a dry-trip test and (2) a puff test of various CO2 systems to ensure flow from each nozzle.

b. The fire pumps and controllers were tested to ensure proper operation. Included were a flow test and an automatic start test of each fire pump.

c. Each hose station in safety-related areas was checked to ensure that all equipment was present, and each valve was partially opened to verify valve operability and freedom from blockage.

d. Smoke detectors in all safety-related areas were functionally tested.

3. Inservice tests are covered in the discussion of surveillance requirements in the Technical Requirements Manual.

9.5.1.6 Technical Requirements, Required Actions, and Surveillance Requirements The technical requirements for the fire protection system, the required actions to be taken when equipment is nonfunctional, and surveillance requirements are given in Technical Requirements Manual. These requirements were previously included in each units Technical Specifications but were removed in accordance with Generic Letter 86-10, Implementation of Fire Protection Requirements. The bases for these requirements are described below.

9.5.1.6.1 Fire Detection Instrumentation Functionality of the fire detection instrumentation ensures that adequate warning capability is available for the prompt detection of fires. This capability is required in order to detect and locate fires in their early stages. Prompt detection of fires will reduce the potential for damage to safety-related equipment and is an integral element in the overall facility fire protection program.

In the event that a portion of the fire detection instrumentation is nonfunctional, the establishment of frequent fire patrols in the affected areas is required to provide detection capability until the nonfunctional instrumentation is restored to functional status.

Revision 5209/29/2016 NAPS UFSAR 9.5-37 9.5.1.6.2 Fire Suppression Systems The functionality of the fire suppression systems ensures that adequate fire suppression capability is available to confine and extinguish fires occurring in any portion of the facility where safety-related equipment is located. The fire suppression system consists of the water system, CO2, Halon and fire hose stations. The collective capability of the fire suppression systems is adequate to minimize potential damage to safety-related equipment and is a major element in the facility fire protection program.

In the event that portions of the fire suppression systems are nonfunctional, alternate backup fire fighting equipment is required to be made available in the affected areas until the nonfunctional equipment is restored to service.

When the nonfunctional fire fighting equipment is intended for use as a backup means of fire suppression, a longer period of time is allowed to provide an alternate means of fire fighting than if the nonfunctional equipment is the primary means of fire suppression.

In the event the fire suppression water system becomes nonfunctional, a backup fire suppression water system must be established immediately in accordance with Section 7.1.1 of the Technical Requirements Manual.

9.5.1.6.3 Penetration Fire Barriers The functional integrity of the penetration fire barriers ensures that fires will be confined or adequately retarded from spreading to adjacent portions of the facility. This design feature minimizes the possibility of a single fire rapidly involving several areas of the facility prior to detection and extinguishment. The penetration fire barriers are a passive element in the facility fire protection program and are subject to periodic inspections.

Fire barrier penetrations, including cable penetration barriers, fire doors and dampers, are considered functional when the visually observed condition is the same as the as-designed condition. For those fire barrier penetrations that are not in the as-designed condition, an evaluation shall be performed to show that the modification has not degraded the fire rating of the fire barrier penetration.

During periods of time when a barrier is not functional, Section 7.2 of the Technical Requirements Manual provides the required actions.

9.5.2 Communication Systems The communication systems are designed to provide communications to all essential areas of the station associated with Units 1 and 2 and to essential locations remote from the station during normal operation and under accident conditions.

Communication systems vital to the operation and safety of Units 1 and 2 are designed and provided as necessary so that the failure of one component will not impair the reliability of the total system. This is accomplished within the station by four overlapping systems. For

Revision 5209/29/2016 NAPS UFSAR 9.5-38 communication from within to outside the station, four additional overlapping systems are provided.

9.5.2.1 Communication Systems Within the Station Those systems provided for communication within the station are discussed below.

9.5.2.1.1 Public Address System The public address system is designed for communication throughout the station; coverage extends to key operating areas and/or areas that are frequently occupied.

High-noise areas are given special consideration by installing a speaker system with conservative power requirements to ensure proper audibility. The handset stations are enclosed in sound-proof booths, where required, to provide a suppressed-noise-level environment and ensure good communication.

The areas that need to be accessible for safe shutdown are defined in Section 7.4. The plant shutdown can be controlled from the main control room or the auxiliary shutdown panel, the reactor trip switchgear, and a motor control center in the cable tunnel, as shown on Figure 1.2-3 and Reference Drawings 17, 18, 19 and 20. The noise levels in these areas are low and no significant increase should occur during or following an accident. These areas and the walkways between them are considered key operating areas and are designed to ensure audibility. It may be necessary during shutdown for high-noise areas to be entered for the operation or surveillance of equipment. Communication can be maintained by the sound-powered phones, with the public address as the backup system.

The system line balance is adjusted to minimize sidetone and hum and to properly terminate the signal lines. Speaker volumes are adjusted individually to provide adequate system sound levels during page in the areas of coverage. Any reverberation problems that may arise are corrected by the refacing of speakers, by adjustments in muting, and, if problems still remain, by the addition or relocation of page stations.

The public address system has an emergency power supply that will maintain the system in an operational condition in the event of a station power failure. If the system should become nonfunctional due to equipment failure, the failed equipment can be manually isolated from the system until repairs are completed. The system will be in use continuously; this continuous usage will verify the systems functionality.

The public address system within the protected area and key operating areas is powered from vital bus 1-II or vital bus 2-II. Power may be transferred via manual connection to either vital bus 1-II or vital bus 2-II, increasing system reliability in the event of the loss of either vital bus. The public address system has extended coverage in less frequently occupied areas outside the Unit 1 and Unit 2 protected area where there is no plant operating equipment. These portions of the system are powered from local, normal power sources. Loss of coverage to these areas will not have impact on plant operations or safe shut down.

Revision 5209/29/2016 NAPS UFSAR 9.5-39 9.5.2.1.2 Sound-Powered Telephone System A sound-powered telephone communications system is installed in the station and serves Units 1 and 2. This system is a multiple-channel system connecting all operating areas of Units 1 and 2.

Headsets consisting of earphones and a microphone are connected to a two-wire channel for direct communication between persons in different areas. The operation of this system is not dependent on the availability of the electric power system. This system is normally used for the maintenance and/or calibration of equipment. During an emergency, the system will be relied upon as an alternative means of relaying messages between different operating areas.

The areas for safe shutdown have jacks available for communication between the areas.

Maintenance on the interconnecting channels is minimal. Maintenance on the headsets is performed as needed.

9.5.2.1.3 Radio Communication Hand-held portable radios are available in the station for use during normal and emergency conditions. These radios are designed for direct communication between each portable radio set and the main control room through a 850-MHz trunking radio system. The portable radios are powered by rechargeable batteries and are not dependent on any station electrical system.

During an emergency situation, the radios will be available as an alternative means of relaying messages between different areas of the plant. During an emergency, the radios will be used to maintain contact with radiation monitoring teams that are sent out. The radios will also provide communication in high-noise areas.

Personnel in safe-shutdown areas will be able to maintain radio communication between areas.

To meet the requirements of 10 CFR 50 Appendix R, a 850-MHz emergency radio communication system is installed. The system provides total plant coverage as well as coverage of the 10-mile radius of the Emergency Planning Zone.

The Central Site equipment is considered the primary system and utilizes trunking technology. The Central Site includes normal and backup central controllers, repeaters and antennas all located at the Communications Tower across from the North Anna Nuclear Information Center. Conventional backup repeaters are located in the Unit 1 Cable Spreading Room to provide communications in the event of a total Central Site equipment failure. When the backup repeaters are activated from a central control point, all designated emergency radios will automatically select their proper channel without user intervention.

Redundant antenna trains with amplifiers are installed throughout the Auxiliary building and inside both containment structures to improve radio coverage.

Revision 5209/29/2016 NAPS UFSAR 9.5-40 The location of system equipment is such that a postulated fire in any one area would only destroy one system.

The communication system also consists of fixed handsets, mobile and portable handheld units.

9.5.2.1.4 Private Branch Telephone Exchange A company owned private branch telephone exchange (PBX) is installed inside the protected area. The 48V dc powered equipment is battery backed up and provides for telephone communications within the site as well as with the public switched telephone network and tie line communications with other company offices via company owned facilities. A failure of one telephone handset or cable connecting it to the PBX will not affect the operation of the other handsets.

9.5.2.2 Offsite Communication Systems Those systems provided for communication between the station and offsite areas are described below.

9.5.2.2.1 Commercial Telephone Access to the public switched telephone network (PSTN) is provided for via the station PBX described in Section 9.5.2.1.4. Local or long distance calls can be made via company owned fiber or microwave facilities.

9.5.2.2.2 Microwave System Company owned fiber optic and microwave transmission facilities provide for data and voice communications with company owned offices. These facilities also provide access to the public switched telephone network and various data services. These company owned facilities are battery backed for operation during power outages.

9.5.2.2.3 Radio Communication System Section 9.5.2.1.3 describes the Radio Communication System in use at the station.

9.5.2.2.4 Emergency Notification System The Emergency Notification System (ENS) provides communications between North Anna Power Station and the Nuclear Regulatory Commission (NRC) Operations Center. The ENS is the system on which initial notifications, as well as ongoing information about plant systems, status and parameters are provided to the NRC.

9.5.2.3 Communication System Reliability A failure of one communication system will not affect the operation of other communication systems at the station. Two of the four systems provided for communication

Revision 5209/29/2016 NAPS UFSAR 9.5-41 within the station rely on station power. The public address system has a backup emergency power supply. The sound-powered phone system does not rely on any station power system.

Since the onsite communication system normally will be in use, equipment failure will not go unnoticed. Connecting wiring for individual components in each system are routed along separate paths in the station. The multiplicity of the onsite communication network ensures the availability of adequate communication.

Systems provided for communication between the station and offsite locations are separated so as to ensure that one accident will not affect all systems. Equipment for these systems is located in different areas of the station, thus ensuring that an accident in one area of the station would not incapacitate all four communication systems. Failure of normal power supplies would not deprive the station of offsite communication capability. The usage of the offsite communication ensures that failure will not go undetected.

9.5.3 Lighting Systems Normal lighting for the turbine building, reactor containments, auxiliary building, fuel building, service building, decontamination building, and office building is supplied from local lighting cabinets located in the area of service and fed from the 480-V station service system through local 480-120/240-V, single-phase, dry-type transformers. Normal lighting for remote areas is supplied through local 480-120/240-V, single phase, dry-type transformers.

The type of normal lighting is incandescent, high pressure sodium (HPS), and/or fluorescent, except for the hi-bay mercury in the turbine room on the operating floor, intake structure, and service water pump house, as well as the lighting around the station. Incandescent lighting is provided for the reactor containments, fuel building, and hydrogen and nitrogen storage tank areas, as well as all emergency lighting. Incandescent lighting is also provided for the auxiliary building and decontamination building, but compact fluorescent lights may be installed in incandescent fixtures where allowed by technical analysis. Fluorescent lighting is provided for the remaining areas.

All emergency lighting, including that in the main control room, is provided by incandescent units or light-emitting diode (LED) units that are normally de-energized. These lights are automatically energized by the 125-V dc system upon the sensing of a loss of voltage on the local lighting panels. Emergency lighting for the main control room and all other emergency lighting have independent battery feeders. Emergency lighting for the reactor containment is controlled by a contactor in the auxiliary building near the personnel hatch, and it is energized by personnel before entering the containment. The turbine room operating floor emergency lighting is automatically energized by a loss of voltage and will stay energized until the lighting intensity is above predetermined levels. Emergency lighting for remote areas is provided by local, self-contained, battery-powered, emergency lighting units.

The emergency lighting for the Technical Support Center (TSC) will automatically transfer to the TSC uninterruptible power supply (UPS) upon detection of loss of the normal source. The

Revision 5209/29/2016 NAPS UFSAR 9.5-42 emergency lighting will provide 3 to 5 foot-candles of light for at least 15 minutes upon transfer to the TSCs UPS.

A post-fire emergency lighting system has been provided in accordance with the requirements of 10 CFR 50 Appendix R, Section III.J. Emergency lighting consists of local units with 8-hour rated battery power supplies, except for the Control Room. Control Room lighting is provided by diesel-backed lighting panels. (See 10 CFR 50 Appendix R Report, Chapter 7, Exemption Requests.) Emergency lighting is provided for illumination of all areas needed or operation or monitoring of post-fire safe shutdown equipment, and in all access/egress routes thereto.

The equipment which may require manual operation or repairs to achieve cold shutdown does not require 8-hour battery-backed emergency lighting, because sufficient time is available to provide temporary lighting in these areas should it be required.

9.5.4 Emergency Diesel Generator Fuel-Oil Storage and Transfer System 9.5.4.1 Design Basis The emergency diesel generator fuel-oil storage and transfer system has the following design bases:

1. Provide sufficient storage of fuel oil in missile-protected, Seismic Category I tanks to supply the requirements for full-load operation of two diesel generators for 7 days.

2. Deliver this fuel oil to the diesel generators by redundant, missile-protected, Seismic Category I systems.

9.5.4.2 System Description The emergency diesel-generator fuel-oil storage and transfer system is shown on Reference Drawing 4. Each engine has an independent 1000-gallon storage day tank with a capacity for at least one hour of full-load operation when filled to the minimum allowed capacity. These storage tanks are located inside Seismic Category I, missile-protected cubicles and are filled by pumping through two buried fuel-oil lines, one of which is a standby, from two underground fuel-oil storage tanks of 50,000-gallon capacity each. No special provision is made in the design of the fuel-oil storage fill system to minimize the creation of turbulence of the sediment in the bottom of the storage tank. However, the fuel-oil suction line from the underground storage tanks is 6 inches above the bottom of the tank, and a strainer and foot valve are provided in each emergency generator day tank. The fuel lines and the underground fuel-oil storage tanks are of Seismic Category I design and are missile protected. The two underground tanks contain sufficient oil for 7 days continuous operation at full load for two diesel generators. They are fed by gravity from an aboveground main fuel-oil storage tank of 5000-bbl (210,000-gallon) capacity. They could also be fed by emergency, Seismic Category I, tornado, missile, and flood-protected truck fill line connections, in the event that the non-seismic above ground tank is not available.

Revision 5209/29/2016 NAPS UFSAR 9.5-43 Fuel oil passes through a strainer before entering the 5000-bbl fuel-oil storage tank to remove any suspended solids.

Four sets of fuel-oil pumps are provided, with each set consisting of two redundant pumps, one called the ready pump and the other the standby pump. As shown on Reference Drawing 4, each pump in a set takes suction from a different underground storage tank and has separate suction and discharge lines from the underground tank to the appropriate diesel-generator day tank. Each set of pumps is powered from the emergency bus associated with the diesel to which the pumps supply fuel oil. The pumps are of Seismic Category I design. The two fuel-oil pumps feeding the diesel engine from the day tank are mounted on the engine skid; one is shaft-driven and the other dc-powered from the associated diesel battery. Table 9.5-2 presents the design data for the equipment in the emergency diesel generator fuel-oil storage and transfer system. The emergency-generator day tanks are described in Section 8.3.1.1.

The ready and standby fuel-oil pumps are installed in an aboveground Seismic Category I structure designed to protect the pumping facilities from tornado missiles. Separate spaces, divided by a 3-hour fire wall, are provided for the ready fuel-oil pumps and the standby fuel-oil pumps. The piping associated with one pump is in one space and does not enter any other space.

This physical separation satisfies the single-failure criterion.

Each space is provided with an automatic, carbon dioxide total-flooding system as well as an photoelectric-type smoke detection system.

The fuel oil pump room is unheated; because of the type of fuel oil used, heating is not required to ensure that the fuel oil can be pumped in case of safe shutdown.

Should additional fuel oil be required over the amount stored in the tanks, sufficient quantities are available from an offsite supplier.

Each underground fuel-oil tank is equipped with an oil/water interface detector, which alarms in the main control room if a significant amount of water should be in the tank. In addition, moisture sensors, which alarm in the main control room, are provided in the discharge line from each underground fuel-oil storage tank to detect the presence of water in the fuel oil and enable the operator to take the appropriate action to ensure a supply of fuel to the diesel generators.

Underground fuel oil lines are coated and wrapped to protect against corrosion. In addition, the ten 1-1/2-inch fuel oil lines that run from the Fuel Oil Pump House to the Auxiliary Boiler and diesel generators are bonded into the buried service water piping impressed current cathodic protection system. See Section UFSAR Section 3.11.3 for more information.

All diesel fuel oil is delivered through a permanently installed duplex strainer with 1/16-inch-diameter perforated baskets. Each basket is fitted with permanent magnets to ensure the removal of minute ferrous particles. The fuel oil is tested in accordance with the Diesel Fuel Oil Testing Program.

Revision 5209/29/2016 NAPS UFSAR 9.5-44 The emergency diesel generator fuel-oil storage and transfer system does not specifically reference ANSI Standard N195, Fuel Oil Systems for Standby Diesel Generators. The construction permit for North Anna Unit 2 was granted in February 1971; therefore, compliance with an ANSI standard issued in April 1976 is not considered appropriate. However, Unit 2 emergency diesel generators do comply with ANSI N195-1976, with the following exceptions:

1. Paragraph 6.1: Tanks The overflow line from the day tank is to the ground and not to the supply tank. Redundant level switches are provided to preclude day tank overflow. Refer to Reference Drawing 4.

The switches stop the transfer pumps upon a high level and prevent tank overflow.

2. Paragraph 6.3: Strainer In place of a strainer and engine fuel filter, a duplex fuel-oil filter is provided for each engine.

3. Paragraph 7.5: Other Requirements A fill line duplex strainer is provided for the Units 1 and 2 aboveground fuel-oil tank (5000-barrel capacity). This tank then supplies the emergency diesel-generator underground fuel-oil storage tanks. No strainer is provided between these fuel-oil tanks.

4. Paragraph 7.1: Safety Class; 7.2: Materials; and 7.4: Applicable Codes, Standards and Regulations The Fuel Oil Systems and components are constructed in accordance with ANSI B31.1-1967 with seismic analysis instead of ASME Section III Subsection ND.

9.5.4.3 Design Evaluation The fuel-oil pumps are powered from the emergency generator buses to ensure that an operating diesel generator has a continuous supply of fuel oil.

In the event that the 5000-barrel aboveground fuel-oil tank and one underground fuel-oil tank are not available, the remaining underground tank can keep two diesels running for approximately 4.5 days. During this period, fuel-oil delivery trucks will be scheduled to provide fuel as required.

Trucks will be able to supply oil as follows:

1. The underground tanks can be filled from a truck through the Seismic Class I fill line connections.

2. In addition, each 1000-gallon day tank can be filled through existing connections.

An evaluation has been made to determine the buoyancy effects of high water table on the underground fuel-oil tanks.

The underground tanks provide fuel oil to run the emergency diesel generators, which are required for the safe shutdown of the plant if offsite power is lost. Design data for the two fuel-oil

Revision 5209/29/2016 NAPS UFSAR 9.5-45 tanks are given in Table 9.5-2. Because of the vital importance of a dependable supply of fuel oil, assurance is needed that during the period of a high water table, the tanks will remain in place, thus leaving intact the emergency diesel generator fuel-oil storage and transfer systems.

Figure 9.5-4 shows the placement of the underground fuel-oil tanks for the emergency diesel generators. The tanks are approximately 60 feet long and 12 feet in diameter. They are buried in compacted select granular fill, with axes at an elevation of 261 feet. Two feet of the compacted select granular fill are above the tanks and a 2-foot-thick slab of reinforced concrete lies above the fill. The slab provides tornado missile protection, as well as a downward force that effectively prevents the buoyancy effect of a high water table from floating the tanks.

Geotechnical engineers have considered the possibility of ground-water levels and saturated soil at a much higher elevation than normal during periods of heavy rainfall.

The crosshatched area in Figure 9.5-4 denotes the volume of compacted fill that must be displaced before the tanks can float. The most conservative case of an empty fuel-oil tank during a period when the water table is at Elevation 270 ft. 6 in. has been consideredthat is, when a water table is essentially at the ground surface. Surface drainage prevents the site from being flooded above this elevation.

Table 9.5-3 summarizes data needed for the buoyancy calculation. Table 9.5-4 outlines the buoyancy calculation and summarizes the results. The downward force of the concrete and the compacted fill is calculated with an allowance for the buoyant effect of the water table on the fill and on that part of the concrete that is below grade (1.5 feet). The calculations outlined in Table 9.5-4 are based on the dimensions of Figure 9.5-4. The calculated safety factor of 1.31 indicates a favorable margin of safety under the most adverse conditions.

9.5.4.4 Tests and Inspections The fuel-oil pumps are checked for proper operation during the operational test of the emergency generators.

Testing of fuel oil is performed in accordance with the Diesel Fuel Oil Testing Program.

Periodic sampling of the aboveground tank, each underground tank, and each day tank is accomplished in accordance with the Diesel Fuel Oil Testing Program.

The underground tanks and the day tanks are generally maintained full at all times. This limits the formation of condensate from any air vapor in the tank.

9.5.5 Diesel-Generator Cooling Water System 9.5.5.1 Design Basis The emergency diesel-generator cooling water system:

1. Provides cooling water to the emergency diesel generator from a Seismic Class I, missile-protected system.

Revision 5209/29/2016 NAPS UFSAR 9.5-46

2. Provides emergency diesel-generator lubricating oil cooling from a Seismic Class I, missile-protected system.

9.5.5.2 System Description The diesel-generator jacket coolant water system is provided to dissipate the heat rejected by the engine water jackets and lube oil at rated load and at maximum outside ambient temperatures of 104°F when using treated water as the cooling medium. Coolant is circulated through the engine at approximately 800 gpm by an engine-driven centrifugal pump. It then passes through a temperature control valve, which directs it through or around the radiator as necessary to maintain required temperature. The emergency diesel-generator engine cooling system employs an AMOT three-way bypass-type, thermostatically controlled valve on all emergency diesel generators, thereby complying with NUREG/CR-0660. The coolant then passes through the lube-oil heat exchanger where it picks up the heat rejected from the lube oil, after which it enters the pump suction and repeats the cycle. Other components of the system include an expansion tank, check valves, alarm switches, and pressure and temperature gauges. Refer to Figures 9.5-5 and 9.5-6 for system drawings.

Figures 9.5-5 and 9.5-6 show two different cooling systems for each engine, namely, the diesel jacket water cooling system and the aftercooler for cooling combustion air after its passage through the turbocharger. Each engine has its own main and standby systems for each of the air cooler and jacket cooling systems, with no sharing between engines.

The rated duty for the diesel jacket water cooling system radiators is 6,627,000 Btu/hr and for the aftercooler radiators is 2,881,000 Btu/hr.

The coolant expansion tank, provides makeup coolant and takes care of the expansion of the coolant in the jacket and oil cooler coolant circuits. The tank is filled only to within approximately 2 inches of the top to allow for the expansion of the coolant without overflow.

The expansion tank is equipped with a low-level alarm that alarms if the level of water in the expansion tank falls to approximately 3 inches.

A three-way thermostatic control valve is provided to divert flow around the radiators when the water temperature is below 155°F to permit fast warmup and to control the flow of water through the radiators so as to maintain the temperature of the coolant out of the engine in the range of 165-185°F.

The jacket coolant radiators are located nearest the inside of the units (aftercooler radiators are the outermost).

The standby heater system provides heat from a 24-kW, 480V, 3-phase, 60-Hz electric heater mounted in the radiator compartment. This is fed through a contactor that is controlled by a temperature switch and heats the jacket water and air cooler water circuits (with the exception of the water in the radiator). The jacket water and air cooler water circuits are maintained above the

Revision 5209/29/2016 NAPS UFSAR 9.5-47 alarm setpoint. This system will be in operation whenever the engine is not running or is below 250 rpm.

Three check valves are provided to confine the flow during standby heating to the desired sections of the coolant system.

A low-pressure switch connected to the engine discharge pipe in the jacket water system activates the alarm upon low pressure of the jacket water after starting. The switch opens at 9 psi and recloses at 12 psi.

A temperature converter is set to actuate on increasing temperature at 195°F and trigger an alarm. A second high-temperature converter provides a shutdown function.

9.5.5.3 Design Evaluation An evaluation has been completed regarding the adequacy of makeup sources for the cooling system. The diesel generator cooling water makeup is supplied through the expansion tank fill cap from a primary grade water source. The Diesel Jacket Coolant Schematic is shown on Figure 9.5-6. This is sufficient for operating the diesel for the following reasons:

1. The total cooling system, including the expansion tank, is Seismic Category I.

2. The cooling system is a closed loop system and the pumps have mechanical seals, thus keeping the loss of water at a minimum.

3. The expansion tank is vented through the external level gauge to reduce the evaporation of water.

4. The cooling system is alarmed for a coolant level low, a coolant pressure low, and a coolant temperature high, which will alert the personnel to a problem and allow time to add water if conditions warrant it.

5. The loss of jacket-coolant water due to a pipe break is considered a single failure, and the other diesel generator set shall be available for a safe shutdown of the plant.

Therefore, there is no need to have a Seismic Category I makeup source for the diesel-generator cooling water system.

The emergency diesel-generator radiator cooling system is a closed loop system which is self-contained to reduce the loss and evaporation of fluid from the system. The unit is also supplied with an expansion tank that would automatically add makeup water should it become necessary.

Revision 5209/29/2016 NAPS UFSAR 9.5-48 The following information is HISTORICAL and is not intended or expected to be updated for the life of the plant.

The manufacturer, the Fairbanks Morse Engine Division of Colt Industries, has installed similar units, experiencing no loss of cooling water from these systems, and states that the diesels can operate for 7 days without the addition of makeup water.

Supporting information has been obtained through correspondence with two users of Fairbanks-Morse units having radiator cooling systems identical to those installed at North Anna. A 2880-hp Model 38TD 8-1/8 unit, operated by Nebraska City Utilities, has been run under normal loading conditions for a period exceeding 1 month without the addition of any makeup water. In addition, VEPCO has been advised by the Chief Engineer of the Town of Hudson, Massachusetts, Light and Power Department that they routinely operate their 2880-hp engines for periods of 2 weeks or more without adding water.

These examples of actual operating experience with diesel generators having identical cooling systems to those at North Anna serve to demonstrate the capability of the diesels to operate for periods in excess of 7 days without the necessity of providing a makeup water source.

9.5.6 Diesel-Generator Starting System 9.5.6.1 Design Basis The diesel-generator starting system is a Seismic Category I system designed to start the emergency diesel generator in an average time of 2 seconds. Starting system equipment located prior to the valves upstream of the air receivers such as compressor, electric motor, diesel engine, aftercoolers, air dryer, and associated piping and instrumentation, may be considered non-safety-related.

9.5.6.2 System Description Each emergency diesel generator is supplied with a complete starting air system with compressor, air receivers, air dryers, relief valves, dual air-start solenoid valves, pressure switches and gauges, etc. The individual systems are interconnected to provide an overlap of air pressure in case any piece of equipment becomes nonfunctional. The air compressors are Quincy two-stage units, each having the loadless start features, and are driven by electric motors. The air receivers are connected through valves to a common manifold that allows either or both receivers to supply the air-start solenoid valves for starting the engine. To remove moisture accumulation, a water separator is installed, along with refrigerant air dryers, downstream from the compressor aftercooler. Additionally, a prefilter is installed to remove particulate and oil mist carried in the compressed air stream. Engine starting is accomplished by the action of compressed air on the diesel-generator pistons in their proper firing order. The system also provides air pressure to the

Revision 5209/29/2016 NAPS UFSAR 9.5-49 booster/accumulator piston of the diesel-generator lubrication system to initiate the operating lubrication mode.

The system is shown in Figure 9.5-7 and the major components are described below:

1. General Each unit is supplied with two complete and independent starting air systems with compressors, aftercoolers, air-drying equipment, air receivers, relief valves, dual air-start solenoid valves, pressure switches and gauges, etc.

2. Air Compressors The two-stage air compressors, normally driven by an electric motor, can in an emergency be driven by a diesel engine by shifting belts from the motor to the engine.

3. Aftercooler and Air-Drying Equipment The compressed air is cooled and dried before entering the air receivers. An aftercooler is installed downstream from each air compressor, and the air-drying equipment is installed between the aftercooler and the air receivers. The air-drying equipment consists of a water separator, prefilter, and air dryer.

4. Air Receivers The air receivers are connected through valves to a common manifold that allows either or both receivers to supply the air-start solenoid valves for starting the engine.

5. Relief Valves Relief valves are provided at the compressor and on each receiver. The compressor valves are set to open at 275 psi. The valves on the receivers are set at 250 psi.

6. Solenoid Valves Each unit is equipped with two 2-way, solenoid-operated valves to admit starting air to the engine. Each solenoid valve is connected to a separate air receiver, with a check valve between the valve and the receiver to ensure functioning in cases of damage such as hose failure, etc.

7. Low Starting Air Pressure Switches Two low-pressure alarm switches are provided. One is connected to each of the lines from the two receivers. This gives an indication of low pressure in either receiver.

8. Vent Valve This valve, which is arranged to open when the solenoid start valves are closed and vice versa, is provided to vent the air from the engine air distributor when the air-start solenoid valves are closed. This prevents wear on the air-start distributor cam.

Revision 5209/29/2016 NAPS UFSAR 9.5-50 Air for the starting system is required at between 150 and 250 psi at the engine and is stored in air storage tanks.

The diesel is started by direct air admission to the cylinders. The average time for a successful start is 2 seconds. If unsuccessful, the start failure circuit, after 7 seconds, will close the air-start solenoids. This is not considered a diesel-generator trip. A restart may be initiated by operator action at the control panel by depressing the reset button. The quantity of air used for a successful start is 50 scf. Moisture accumulation in the air receivers is prevented by means of an air dryer between the compressors and air receiver tanks, as recommended by NUREG/CR-0660.

9.5.6.3 System Evaluation The diesel engine is provided with two independent air-starting systems, either of which is capable of starting the engine without outside power. Each engine-starting system includes an electric-motor- or diesel-engine-driven air compressor, an aftercooler, air-drying equipment, and an air storage tank.

Each air compressor has sufficient capacity to recharge its air receiver within 0.5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months from minimum to maximum starting air pressure.

The starting air system is setup such that the air compressors maintain air pressure in the air receivers between 200-240 psig. This nominal operating range ensures sufficient air pressure for two engine starts per receiver when air pressure is at the lower end of the operating range, 200 psig. For a manual engine start, the air receivers will supply starting air until the engine starts (2-3 seconds) or for 7 seconds if the engine fails to start. When an emergency start is initiated, starting air is supplied to the engine until the engine starts (2-3 seconds) or until the air receivers are completely discharged.

Pressure gauges, pressure and safety valves, tank bottom drains, and other necessary fittings for connecting the air-start systems to the diesel engine are also included.

9.5.7 Diesel-Generator Lubrication System 9.5.7.1 Design Basis

a. The emergency diesel-generator lubrication system provides adequate lubrication from a Seismic Category I system during operation and

b. it provides continuous lubrication when the diesel generator is idle, preventing the possibility of dry starts.

9.5.7.2 System Description The engine lubrication system consists of engine-driven lube-oil pumps, lube-oil filters, oil cooler, motor-driven lube-oil circulating pumps, electric heater, and booster/accumulator. The system is shown schematically in Figure 9.5-8.

Revision 5209/29/2016 NAPS UFSAR 9.5-51 The lube-oil pump is engine-driven and has sufficient capacity to ensure adequate lubrication of main bearings, crank pins, camshaft bearings, valve gear, rocker arms, and other wearing parts. The oil is also used for piston cooling. Lube-oil circulating pumps are also provided to supply warmed lube oil to the engine sump and other necessary components when the engine is not running. A lube-oil electric heater maintains lube-oil viscosity by keeping the oil warm, to meet the quick start requirement when the diesel generator is idle. The lube-oil electric heater is designed with a thermostatic switch that maintains the lube oil in the sump above the alarm setpoint of 90°F. In the standby mode, the lube-oil circulating pump provides heated lube-oil flow to a point downstream of the engine-driven lube-oil pump continuously, lubricating all of the bearings on the engine lower crankshaft line. A 2-gallon capacity booster/accumulator ties into the normal engine operation. During the next start the lube-oil accumulated in the booster cylinder assembly is forced by starting air pressure acting on the opposite side of the piston, to be fed into the bearings along the upper crankline.

A check valve is located in the keep-warm line near the point where the line enters the main lube-oil piping. A time-delay relay prevents overfilling of the upper crank by delaying the keep-warm pump start for 10 minutes after the engine is stopped. The time delay allows some drainback from the upper crankline when the engine comes to rest.

The lube-oil filter is of the full-flow type and uses a cellulose filtering medium.

The lube-oil cooler consists of a heat exchanger capable of controlling the oil temperature at the required levels by the use of engine-cooling water. The cooler conforms to the ASME Boiler and Pressure Vessel Code,Section VIII, and is suitable for the pressures and temperatures encountered in this service.

1. General The lube-oil system consists of an engine-driven lube-oil pump, a full-flow lube-oil filter with internal bypass valves, a lube-oil cooler, a full-flow strainer, three lube-oil pressure switches, two high lube-oil temperature converters and one low lube-oil temperature alarm converter, a low lube-oil level alarm, a crankcase pressure alarm and shutdown switch, and other equipment as shown in Figure 9.5-8.

2. Lube-Oil Filter The lube-oil filter uses nine stacked, throwaway, cellulose paper disk elements in parallel.

Access to the filter assembly for element changeout is through the radiator compartment end door.

The full-flow lube-oil filter is equipped with internal bypass valves that open at a pressure drop of approximately 20 psi across the cartridge. Whenever the pressure drop across the filter becomes excessive, the cartridges should be changed.

3. Lube-Oil Strainer

Revision 5209/29/2016 NAPS UFSAR 9.5-52 A full-flow lube-oil strainer with three basket-style elements is provided to trap any foreign particles that may have bypassed the filter, before they reach the engine. A gauge with a three-way cock is provided on the strainer. Whenever the pressure drop across the strainer becomes excessive, the strainer elements are cleaned. This condition is monitored manually.

4. Lube-Oil Pressure Switches The low lube-oil prior alarm switch will give an alarm when the lube-oil pressure falls to 20 psig. Any further loss of lube-oil pressure will activate a second switch, the low lube-oil pressure shutdown switch. This switch will shut down the engine if the lube-oil pressure drops to a dangerously low level (17 psi at rated speed). As a result of an emergency start the switch is bypassed.

5. Lube-Oil High-Temperature Converters Two temperature converters are installed in the lube-oil discharge line from the engine. The first temperature converter sounds an alarm if temperature of the lube oil should rise to 225°F. A continued increase in temperature will result in the second temperature converter shutting down the engine at 230°F. As a result of an emergency start the switch is bypassed.

6. Lube-Oil Low-Temperature Converter This converter sounds an alarm if the temperature of the lube oil in the sump falls below 90°F.

7. Oil-Pressure-Operated Engine Run Switch This switch is a backup device that will energize the protective system in case of a malfunction of the engine-driven speed switch.

8. Low Lube-Oil Level Alarm Switch The low lube-oil level alarm switch sounds an alarm if the oil level drops to the add oil point.

9. Crankcase Pressure Switch A crankcase pressure switch is provided to detect positive crankcase pressure and trigger alarms and engine shutdown. As a result of an emergency start the switch is bypassed.

10. High Filter Differential-Pressure Alarm Switch The lube-oil filter is fitted with a differential pressure switch, which is adjusted to close on increasing differential at a differential pressure of 13 psi. The actuation of this switch gives an alarm and actuates the appropriate annunciator.

Revision 5209/29/2016 NAPS UFSAR 9.5-53 9.5.7.3 System Evaluation The diesel-generator lubrication system has sufficient capacity to ensure adequate lubrication during operation and eliminates the probability of a dry start by continuous lube-oil circulation when the engine is idle, and reduces the chance of smoky starts or hydraulic lock by the booster/accumulator system which prevents the upper crankline from being over oiled.

9.5.8 Diesel-Generator Ventilation and Combustion Air Intake and Exhaust System 9.5.8.1 Design Basis The emergency diesel-generator ventilation and combustion air intake and exhaust system provides a Seismic Class I and missile-protected system for the following items.

1. General space cooling.

2. Diesel-engine combustion air intake and exhaust.

3. The dissipation of heat from the diesel-engine cooling system.

The design air flow rate is 154,000 cfm across the radiators. The maximum design inlet air temperature at the radiator is 110°F. The maximum air outlet temperature is 161°F when the inlet is at maximum. At the radiators maximum design inlet air temperature of 110°F, the jacket coolant will be about 195°F. Should the outside ambient air temperature increase above 102°F, the jacket coolant alarm point of 195°F may be exceeded. An emergency diesel generator room temperature rise in the range of 7-8°F is expected at full load. At the maximum design outside ambient temperature of 104°F, the radiator inlet temperature is expected to be about 112°F and the jacket coolant temperature would be about 197°F. This is above the alarm setpoint, but below the shutdown temperature of 205°F. Based on historical data, the highest recorded temperature was 100.1°F. This reading represents an integrated average over an hour. Therefore, even if the outside temperature does rise to the maximum design value of 104°F, it would be for a very short time.

With the jacket coolant temperature 197°F, there is still 8°F of margin until the shutdown temperature, which is bypassed in the emergency operating mode, is reached.

9.5.8.2 System Description The emergency diesel-generator ventilation system is shown on Reference Drawing 5. The ventilation system in each diesel generator room is designed to maintain acceptable room temperatures. The air inlet to each room consists of a 192 x 192 inches fixed-blade louver backed by a self-actuating damper. Each diesel generator room also contains a 5000-cfm exhaust fan, complete with self-actuating damper. Each exhaust fan is installed in the discharge duct connecting the penthouse on the service building roof to the main diesel-cooling fan. These exhaust fans, 1-HV-22A, B, C, and D, are not required for the operation of the diesels. However, each is powered from the emergency bus of the respective emergency diesel in the space.

Revision 5209/29/2016 NAPS UFSAR 9.5-54 The fans are operated manually or automatically by individual local on-off-auto control switches. In the auto position, the fan will operate when the space temperature rises above 75°F.

Whether in the on or auto mode of operation, the fan will be locked out to prevent operation on a release of carbon dioxide into the diesel generator.

With the diesel operating, the self-actuating damper on the exhaust fan will close as a result of the higher static pressure resulting from the main diesel-cooling fan. During diesel operation, space ventilation is provided by the main diesel-cooling fan. This fan causes over four air changes per minute in the generator room.

The main diesel-cooling fan is located on the emergency-diesel-generator skid and is powered mechanically by a power takeoff on the emergency diesel. This fan is an integral part of the emergency diesel generator package supplied by the vendor and is Seismic Class I equipment.

The ventilation air intake has three devices. One device is for inclement weather protection and consists of an array of multipaneled, fixed louvers over the total face area of the ventilation air intake opening. The open free area constitutes about 40% of the gross face area. The second device is located next in the air stream and consists of an array of individual damper blades. These blades are not interconnected but open with the air flow independently of each other, creating a multiplicity of air flow paths. The missile labyrinth is the third device in the air stream.

The intake louvers and dampers are designed to comply with Seismic Class I requirements.

The wall surrounding the louver and damper is also Seismic Class I.

If a missile penetrates the air intake, it will be contained by a 2-foot-thick reinforced-concrete wall located inside the cubicle between the air intake and the diesel generator.

This missile shield wall is designed in accordance with the design tornado missile spectrum as outlined in Section 3.3.2.

The air outlet is covered by bird screen only (no louvers or dampers) and is located on the roof of the emergency generator cubicle. Missile protection is provided by a 2-foot-thick reinforced-concrete labyrinth which will prevent missiles from entering the cubicle. The labyrinth is designed in accordance with the design tornado missile spectrum as outlined in Section 3.3.2.

Therefore, the outlet is missile protected.

The combustion air intakes for the diesel-generators are located inside the diesel-generator cubicles, as shown in Figure 9.5-9. The diesel-generator exhausts are located on the diesel-generator cubicle roofs.

The bypass portion of the diesel generator exhaust line is always open and is missile protected thereby ensuring continued emergency diesel generator operation under all postulated severe weather conditions.

The diesel-generator ventilation system is designed to minimize the quantity of dust and debris entering the diesel generator areas. In this regard, inlet louver dampers, along with an aluminum bird screen, are used at the combined ventilation and combustion air inlet wall. This

Revision 5209/29/2016 NAPS UFSAR 9.5-55 prevents the introduction of deleterious material into the emergency diesel generator space. Air filters are provided in the combustion inlet air ducting to prevent dust infiltration into the engine.

All of the diesel-generator control cubicles in the diesel generator room are equipped with fully gasketed doors. The cubicle that houses the excitation transformer has unfiltered louvers in the rear for heat removal. However, all interconnecting cables that penetrate the excitation transformer cubicle from the other control cubicles are fully gasketed. There are other controls for the diesel-generator that are located in the emergency-switchgear room, the main control room, and the normal switchgear room. Since these areas are ventilated with air-conditioned air, and there is little or no dust generated, these areas pose no dust problem.

Figure 9.5-9 depicts the path of outside air as it enters and exits the diesel generator room while the diesel is in operation.

The surface of the ground outside the air intake has been paved. This pavement has limited the generation of dust in the diesel generator room.

Logs are taken periodically by operations personnel in the diesel generator rooms. It has always been general policy for operations personnel to note any area of the plant that needs cleaning and initiate corrective action.

9.5.8.3 System Evaluation An evaluation has been undertaken to determine the effects of carbon dioxide or diesel generator exhaust entering the diesel-generator air intake.

The only gases that might be drawn into the combustion air intakes for the emergency diesel generators are the diesel exhaust gases, carbon dioxide from the fire protection systems, and carbon dioxide from a large fire at the fuel-oil storage tank.

The only fire extinguishing system that would result in carbon dioxide at the combustion air intake is the CO2 system in the generator room itself. During diesel operation, the CO2 system is locked out to prevent the automatic activation of the carbon dioxide. Although automatic activation is prevented, manual CO2 release is still available. The CO2 valve is a normally closed valve that fails closed on loss of power, thereby further preventing the accidental release of carbon dioxide into the diesel generator room during operation.

Even if an inadvertent release of the carbon dioxide occurred while the diesel was running, the concentration that would develop would be low enough to permit the maintenance of full power. Based on the discharge rate of the carbon dioxide and cooling air flow rate, the maximum concentration would be 11% carbon dioxide by volume for only the 120 seconds that the carbon dioxide is discharged. The generators are capable of developing power up to a CO2 concentration of 15% by volume.

Revision 5209/29/2016 NAPS UFSAR 9.5-56 In analyzing a large fire at the fuel-oil storage tank, located 330 feet south of the air intake, the following extremely conservative assumptions were made:

1. Ground-level release.

2. No wake effects from buildings, etc.

3. No convection turbulence due to temperature.

4. No excess air at the fire.

From published data, No. 2 fuel oil burning with zero excess air produces a CO 2 concentration of 15.5% by volume in the combustion products. The 15% concentration figure was supplied by the diesel generator manufacturer. It is based on an analysis of oxygen available during the combustion process. At full load, 5.17 lb of oxygen is present for every pound of fuel.

With a 15% concentration of carbon dioxide in the combustion air, this ratio becomes 4.39 to 1.

Since only 3.33 lb of oxygen per pound of fuel is required for stoichiometric combustion, there is still oxygen in excess of that required for combustion. Therefore, the figure of 15% is a conservative boundary limit.

As previously stated, the maximum CO2 concentration resulting from a release from the CO2 fire protection system is 11%. Therefore, the minimum power output is 100%. There is no adverse effect on safe shutdown and no corrective action is required. Concentration levels relative to the source strength 100 m away were calculated using various meteorological conditions and were, in the 5th percentile, 0.068 or 6.8% of the original concentration. All other percentiles were less concentrated. This corresponds to a CO2 concentration of 15.5% x 0.068 = 1.1% by volume at the diesel air intakes. Therefore, a fuel-oil storage tank fire would not affect the performance of the diesel generators under any meteorological condition.

Exhaust gases from the diesel discharge would have to travel approximately 40 feet horizontally and then 20 feet downward to reach the top of the outside air intake. The potential for an indraft of gases that could affect the diesel is zero due to the following facts: (1) the exhaust gases leave the exhaust pipe at a temperature of approximately 700°F; (2) the exit velocity of the exhaust gases is approximately 100 mph vertically; and (3) the air intake louver blades are fixed at a downward angle of 45 degrees.

Since the hot exhaust gas is discharged vertically at a substantial velocity and the intake is well below the exhaust and angled at 45 degrees, it is impossible for exhaust gases to be drawn into the combustion air intakes in sufficient concentrations to have any effect on the diesels ability to perform its safety functions.

9.5.9 Decontamination Facility 9.5.9.1 Design Basis The decontamination facility is designed to provide an area in which equipment can be decontaminated without releasing activity to the environment in an uncontrolled manner.

Revision 5209/29/2016 NAPS UFSAR 9.5-57 Decontamination procedures are specified to reduce surface contamination to a level at which the components can be handled safely. The facility is capable of accommodating a spent-fuel cask while the cask is being prepared for loading or for shipment.

The Helium and Vacuum Drying System and its associated work platforms and hardware are installed to prepare the spent fuel cask for storage at the Independent Spent Fuel Storage Installation (IFSFI). The vacuum system will remove the remaining water from the spent fuel cask after it is removed from the fuel pool. After the fuel cask is dry, the fuel cask will be backfilled with helium to provide an inert gas in the fuel cask to facilitate heat transfer from the cask.

9.5.9.2 Description The decontamination building (shown on Reference Drawings 6 & 7) adjoins the fuel building and incorporates the structure associated with the fuel building trolley. It is of concrete block construction; the principal personnel access from the auxiliary building is via the fuel building. Roof hatches permit the lowering of large pieces of equipment such as the spent-fuel cask into the building for decontamination. A door in the west wall is provided for smaller items, and a crane and monorail system handles these items inside the building.

The floors of the three work bays where heavy equipment is placed are covered with a stainless steel liner extending 4 feet up the walls. All other interior surfaces are covered with a protective coating.

Primary-grade water, steam, compressed air and electrical power are provided for decontamination work. Component cooling water hose connections are provided for cooling a loaded spent-fuel cask while it is in the building. A fluid-waste-treating tank is provided to receive spillage from equipment, runoff from cleaning operations, and discarded cleaning solutions. This tank has a pump for transferring liquid to the liquid waste disposal system described in Section 11.2.2. A filter is provided for cleanup of the fluid before its transfer to the waste disposal system. A ventilation supply system, heated in winter, and an exhaust system are provided. The exhaust system has fans of slightly greater capacity than the supply. This design feature prevents the leakage of airborne radioactivity from the building to the environment. The exhaust system discharges through the auxiliary building vent stack B, which has equipment for radiation monitoring and provisions for diverting the airstream through the common auxiliary building HEPA/charcoal filter bank.

Technical information on the equipment provided for the decontamination facility is given in Table 9.5-5.

The vacuum system consists of two parallel 5 HP rotary vane vacuum pumps, an inlet filter, and monitoring equipment. The helium system consists of a bottle rack, regulating equipment, and monitoring equipment to monitor the filling of the spent fuel cask after the cask has been vacuum dried.

Revision 5209/29/2016 NAPS UFSAR 9.5-58 A Vacuum Drying System (VDS) is installed in close proximity to the NUHOMS 32PTH DSC (Dry Shielded Canister) on the working level platform. The VDS is a single skid mounted computer unit with monitor and all the necessary valves, pumps, moisture separator tank, cooling and heating systems, flow meters, pressure and vacuum gauges and external boom connections to facilitate, draining, reflooding and helium back filling of the DSC.

9.5.9.3 Design Evaluation The facility provides a contained area within which all discharges are controlled to prevent the inadvertent release of activity to the environment.

In the event of leakage from piping or equipment, all areas of the building are provided with sumps to which fluids will drain. The sumps discharge to the liquid waste disposal system via the sump pumps and fluid-waste-treating tank. Airborne particulate matter and gases, prevented from leaking from the building by the slightly subatmospheric pressure, are discharged into the auxiliary building ventilation vent.

9.5.9.4 Tests and Inspections Periodic tests are conducted on the radiation detection equipment in the ventilation system.

Operating equipment and storage tanks are subjected to periodic visual inspections.

9.5.10 Primary Plant Gas Supply System 9.5.10.1 Design Basis The primary plant gas supply system is shown in Reference Drawing 8. It is designed to provide compressed nitrogen, hydrogen, and oxygen to the Emergency Core Cooling System (Section 6.3), Reactor Coolant System (Chapter 5), Gaseous Waste Disposal System (Section 11.3), Chemical and Volume Control System (Section 9.3.4), and boron recovery systems (Section 9.3.5) as needed.

9.5.10.2 System Description A high-pressure (about 700 psig) nitrogen manifold maintains the required gas overpressure in the safety injection accumulators in the safety injection system and in the pressurizer relief tank in the reactor coolant system. Lower pressure (about 100 psig) nitrogen serves the volume control tank in the Chemical and Volume Control System and waste gas decay tanks in the gaseous waste disposal system. The lower pressure nitrogen can also be used to purge the gas strippers in the boron recovery system.

The hydrogen supply system for the auxiliary building is shown on Reference Drawing 8.

As indicated on this figure, hydrogen is supplied from a manifold that is located outside the auxiliary building in an open gas storage area. The supply consists of eight cylinders with a total capacity, when fully charged, of approximately 1550 ft3. The hydrogen is reduced in pressure by a 2000-lb to 100-lb pressure-reducing system, and the flow is limited to 20 scfm through a

Revision 5209/29/2016 NAPS UFSAR 9.5-59 restriction orifice, both of which are located immediately adjacent to the hydrogen cylinders and outside the Auxiliary Building. The hydrogen is distributed in the auxiliary building to the volume control tanks located at Elevation 274 ft. and to the gas strippers at the 259-foot elevation. During normal plant operation, the supply line to the gas strippers is isolated by a normally shut valve located at the 274-foot elevation of the Auxiliary Building.

The oxygen manifold used to provide low-pressure (about 10 psig) oxygen to the gaseous waste disposal system catalytic recombiner package which was removed from the plant.

Each manifold is equipped with a pressure relief valve to release excess pressure to the atmosphere. The relief valves release above the gas storage area roof.

A 1-month supply of each gas can be connected to a manifold. Storage facilities are available for an additional 3-month supply of each gas.

The primary plant gas supply system is common to both units.

All piping and components of the primary plant gas supply system are designed to the applicable codes and standards listed in Table 9.5-6.

The transfer, handling, storage, and use of hydrogen and oxygen comply with regulations as given by the Occupational Safety and Health Act.

9.5.10.3 System Evaluation The primary gas supply system is not designed to Seismic Class I standards and does not have redundant piping. The following design factors limit the severity of the possible pipe ruptures.

1. The high-pressure nitrogen system, which maintains the pressure on the safety injection accumulators, is normally isolated from the primary gas supply system. The supply path to the accumulators, including the normally closed valve, is Seismic Class I. Therefore, a seismic event will not result in a loss of pressure to the safety injection accumulators.

2. The low-pressure nitrogen system, which supplies inerting gas to the volume control tank and waste gas decay tanks, is not required for a safe shutdown of the plant. The nitrogen line to the volume control tank is normally closed. The portion of the nitrogen supply line from the volume control tank, including the normally closed valve, is Seismic Class I. Therefore, a seismic event will not result in the loss of pressure or gases from the volume control tank.

The supply to the waste gas decay tanks is normally isolated. From the closed valve to the decay tanks, the supply lines are Seismic Class I. Therefore, a seismic event will not result in a loss of pressure. A rupture of the supply to the outer waste gas decay tank will not result in a loss of pressure from the inner waste gas decay tanks. Decay tank design is discussed in Section 11.3.

Revision 5209/29/2016 NAPS UFSAR 9.5-60

3. The hydrogen system is Seismic Class I within the auxiliary building for all lines that are normally pressurized, except for the hydrogen used for instrument calibration, and is routed through areas that offer protection from accidental impacts.

The total available supply of hydrogen in the primary plant gas system (1550 ft3 when all of the cylinders are fully charged) represents a very small percentage of the 67,000-ft3/min.

ventilation flow rate available in the auxiliary building during all conditions. Furthermore, the pressure reduction of the hydrogen supply from 2000 to 100 psig, coupled with the restriction orifice, which limits the maximum flow to 20 scfm, would prohibit the entire hydrogen supply from being discharged through a broken line instantaneously, and thus would ensure a very rapid dilution of hydrogen in any given area by the ventilation system.

The smallest cubicle, which contains safety-related equipment, through which normally pressurized hydrogen lines are run, contains the volume control tanks. This cubicle is equipped with an individual air exhaust that draws at a rate of 500 scfm. This exhaust is part of the emergency-powered, safety-grade auxiliary building ventilation system. If a rupture of the hydrogen line in the volume control tank cubicle should occur, it still would not be possible to exceed a 4% hydrogen concentration, since the maximum hydrogen flow is limited to 20 scfm with a ventilation flow rate of 500 scfm.

It should be noted that this flow is based on an open-ended pipe rupture, whereas a more credible piping failure of this low-energy line is a crack that would rather restrict the flow and further reduce the maximum hydrogen concentration.

The rest of the hydrogen piping is generally routed through open areas of large volumes where a break in the line would not permit hydrogen concentrations in excess of 3.8% even if the ventilation flow rate were restricted or reduced.

Thus, it can be concluded that, because of the very short runs of piping containing hydrogen, the low pressure of hydrogen in these lines, and the restricted capacity of the system to discharge hydrogen should a break in the lines occur, coupled with the emergency ventilation system that would function after accident conditions, it is unreasonable to postulate that a hydrogen concentration of 4% could occur in any cubicle or space containing safety-related equipment.

4. The oxygen system piping within the auxiliary building is not in service and the oxygen source is isolated from this piping outside of the auxiliary building. It was intended to supply a system that has been abandoned. Therefore, a seismic event will not result in conditions that could enhance the severity of a fire.

The primary-gas supply bottles are not Seismic Class I, although these bottles and racks are ruggedly constructed for safety reasons. These bottles are located out-of-doors and will not result in a hazard causing an explosion or fire within any buildings. The codes and standards for the primary gas supply system are listed in Table 9.5-6.

Revision 5209/29/2016 NAPS UFSAR 9.5-61 9.5.11 Alternate AC (AAC) Diesel and its Supporting Systems 9.5.11.1 Design Basis In response to Regulatory Guide (RG) 1.155, a non-safety-related with regulatory significant (NSQ) diesel generator is installed in a separate building which is located within the protected area on the west side of the Unit 2 Turbine Building and the flood dike. The AAC diesel generator is designed to support a postulated 4-hour Station Blackout (SBO) duration and will reach to the rated voltage within 2 minutes. The diesel generator has a 0.95 reliability.

9.5.11.2 System Description The AAC diesel generator is a Caterpillar Model 3612, four cycle, turbocharged diesel engine. The engine operates at 900 rpm and 4640 horsepower to produce 3300 electrical kilowatts on a continuous basis. The general equipment layout of the SBO Building is shown on Reference Drawings 9 through 11. The major diesel supporting systems are described below:

Fuel Oil System The fuel oil system is comprised of a day tank, a tank makeup pump, a engine driven pump, a hand priming pump, injectors, an air-cooled return oil cooler, and filtering equipment. The 1080-gallon storage day tank is sized to hold sufficient fuel oil to support full load operation for a postulated 4-hour SBO duration. The primary source of the fuel oil supply for the day tank is from the above ground main fuel oil tank 1-FO-TK-1. The normal fuel oil level in the day tank is maintained by the tank makeup fuel pump during a SBO event. The fuel oil system is shown on Reference Drawing 12.

Starting Air System The starting air system is comprised of an air tank, two compressors, three air powered starting air motors, and air-drying/filtering equipment. The air tank capacity is approximately 207 ft3 which is sufficient for 5 engine starts. The air dryer is a refrigerant type with a design dew point of 39°F. For added system reliability, the air tank is epoxy lined and the air piping and tubing are stainless steel. The starting air system is shown on Reference Drawing 13.

Air Intake and Exhaust Systems Intake combustion air is filtered through a Caterpillar supplied air filtering assembly and routed through piping to the turbocharger compressor inlet. The engine exhaust is discharged out of both turbocharger exhaust turbine outlets flexible connections and routed through piping to the roof-mounted exhaust silencer. The air intake and exhaust system is shown on Reference Drawing 14.

9.5.11.3 Engine Cooling and Keep Warm Systems The engine cooling system is comprised of two separate cooling circuits. One circuit is for the jacket water, cylinder heads, and turbocharger cooling. The other circuit is for the after cooler and oil coolers. Each circuit is piped independently and is equipped with its own radiator. The two

Revision 5209/29/2016 NAPS UFSAR 9.5-62 radiator and fan sets are assembled as one unit and mounted on the roof of the AAC Building. A single expansion water tank is located close to the radiator on the roof. The cooling water is approximately a 50-50 water and glycol mixture. In order to meet the quick start requirement of standby application, a keep warm system consisting of a 36-kW jacket water heater with a circulating pump and a 12-kW lube oil heater with a circulating pump is furnished. Makeup is added to the expansion tank manually. The engine cooling system is shown on Reference Drawing 15.

9.5.11.4 Lubrication and Pre-Lube Systems The lubrication system provides a constant supply of lube oil under all engine design conditions. The lube system consists of a gear driven oil pump, a priority valve, filtering equipment, and engine sump. For quick starting application, a pre-lube system consisting of an ac driven pump and an air driven pump (for black start) is provided. The lubrication and pre-lube systems are shown on Reference Drawing 16.

Revision 5209/29/2016 NAPS UFSAR 9.5-63

9.5 REFERENCES

1. National Fire Protection Association, Standard on Halogenated Fire Extinguishing Agent Systems (Halon 1301), NFPA No. 12A-1973.

2. Letter from Walter Kidde and Company, to Stone & Webster Engineering Corporation,

Subject:

Temperature Drops Resulting From the Discharge of CO2 or Halon in Total Flooding Systems, dated January 15, 1975.

3. Letter from Chemetron Gases Group Research Center, to Stone & Webster Engineering Corporation, dated February 6, 1975.

4. B. A. Bolt, Duration of Strong Motion, Fifth International Conference on Earthquake Engineering, Rome, 1974.

5. C. H. Hine, Clinical Toxicologic Studies on Freon FE 1301, Report No. 1, Hine Laboratories, Inc., January 1968.

6. C. F. Reinhardt, and G. J. Stopps, Human Exposures to Bromotrifluoromethane, Report No. 230-66, Haskell Laboratory for Toxicology and Industrial Medicine, E. I. du Pont de Nemours & Company, December 1, 1966.

7. E. I. du Pont de Nemours & Company, Toxicology of du Pont Halon 1301 Fire Extinguishment, Publication S-35A, 1971.

8. NFPA 12A, Halon 1301 Fire Extinguishing Systems, 1980 Edition.

9. Generic Letter 83-33, NRC Positions on Certain Requirements of Appendix R to 10 CFR 50.

10. NUREG/CR-3656, Evaluation of Suppression Methods for Electrical Cable Fires.

11. Inspection Report (IR) 50-338 and 50-339, dated 11/04/85.

12. Virginia Electric and Power Company, North Anna Power Station Units 1 and 2, Response to Generic Letter 88-2, Supplement 4, Individual Plant Examination of Non-Seismic External Events and Fires, Serial No.94-302, June 28, 1994.

13. North Anna Appendix R Report, Revision 30, dated March 17, 2011, Section 1.2.4, Unit 2 Licensing Basis.

14. Order EA-12-049, Order to Modify Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, dated March 12, 2012.

Revision 5209/29/2016 NAPS UFSAR 9.5-64 9.5 REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FB-2A Arrangement: Fire Protection, Sheet 1

2. 11715-FB-21B Flow Diagram: Low Pressure Carbon Dioxide System

3. 11715-FB-21A Flow Diagram: Sprinkler and Water Spray Systems

4. 11715-FB-035A Flow/Valve Operating Numbers Diagram: Yard, Fuel Oil Lines, Unit 1

5. 11715-FB-24L Arrangement: Service Building, Ventilation and Air Conditioning, Sheet 11

6. 11715-FM-9A Arrangement: Decontamination Building, Sheet 1

7. 11715-FM-9B Arrangement: Decontamination Building, Sheet 2

8. 11715-FM-105A Flow/Valve Operating Numbers Diagram: Primary Plant Gas Supply, Unit 1

9. 11715-FM-11D Arrangement: Station Black Out Building, Plan, Units 1 & 2

10. 11715-FM-11E Arrangement: Station Black Out Building, Sections, Units 1 & 2

11. 11715-FM-11F Arrangement: Station Black Out Building, Exterior Elevations, Units 1 & 2

12. 11715-FM-113D Flow/Valve Operating Numbers Diagram: Fuel Oil, Station Black Out

13. 11715-FM-113A Flow/Valve Operating Numbers Diagram: Starting Air, Station Black Out

14. 11715-FM-113E Flow/Valve Operating Numbers Diagram: Air Intake and Exhaust, Station Black Out

15. 11715-FM-113C Flow/Valve Operating Numbers Diagram: Cooling Water, Station Black Out

16. 11715-FM-113B Flow/Valve Operating Numbers Diagram: Lube Oil, Station Black Out

17. 11715-FM-2B Arrangement: Auxiliary Building, Plan, Elevation 259'- 6"

18. 11715-FM-2C Arrangement: Auxiliary Building, Plan, Elevation 274'- 0"

19. 11715-FE-27B Arrangement: Main Control Room, Elevation 276'- 9", Units 1 & 2

20. 11715-FM-5C Arrangement: Service Building, Sheet 3

Revision 5209/29/2016 NAPS UFSAR 9.5-65 Table 9.5-1 FIRE PROTECTION SYSTEM COMPONENT DESIGN DATA Fire Pumps Motor-Driven Engine-Driven Number 1 1 Type Vertical turbine Vertical turbine Horsepower 300 250 Capacity 2500 gpm 2500 gpm Head at rated capacity 330 ft 270 ft Design pressure 175 psig 175 psig Design temperature 95°F 95°F Seal Packing Packing Material Pump Casing Cast iron Cast iron Shaft Stainless steel Stainless steel Impeller Bronze Bronze Earthquake design None Class I Pressure Maintenance Pump Number 1 Type Submersible turbine Motor horsepower 5.0 Capacity 30 gpm Head at rated capacity 325 ft Design pressure 125 psig Design temperature 95°F Material Pump casing Stainless steel Shaft Stainless steel Impeller Bronze Hydropneumatic Tank Number 1 Type Cylindrical, vertical Capacity 455 gal Design pressure 200 psig Design temperature 100°F Material Carbon steel Design code ASME VIII, Division I, 1968/2001*

Reconciled per Spec. NAP-0148

Revision 5209/29/2016 NAPS UFSAR 9.5-66 Table 9.5-1 (continued)

FIRE PROTECTION SYSTEM COMPONENT DESIGN DATA Fire Pump Fuel-Oil Tank Number 1 Type Flat oval, horizontal Capacity 354 gal Design pressure 2 psig Design temperature 200°F Material Carbon steel Design code ASME VIII, Division I, 1968 Earthquake design Class I Air Compressor Number 1 Capacity 8.5 scfm DCP 05-002 Discharge pressure (Oper.) 125 psig (Max.) 145 psig Low-Pressure Carbon Dioxide Storage Tanks General Emergency Generator Rooms, Cable Vaults and Tunnels Number 1 1 Type Cylindrical, horizontal Cylindrical, horizontal Capacity 17 tons 6 tons Design pressure 357 psig 363 psig Normal operating pressure 300 psig 300 psig Normal operating temperature 0°F 0°F Material SA-516-70 Carbon steel Design code ASME VIII, Division I, 2013 ASME VIII, Division I, 1968

Revision 5209/29/2016 NAPS UFSAR 9.5-67 Table 9.5-2 EMERGENCY DIESEL-GENERATOR FUEL-OIL SYSTEM DESIGN DATA Underground Storage Tanks Number installed 2 Capacity per tank 50,000 gal Design pressure 40 psig Design temperature 100°F Operating pressure 15 psig Operating temperature 40°F Material A-285 GR C Corrosion allowance 1/16 in.

Design code ASME VIII, 1968 Fuel-Oil Storage Tank (Aboveground)

Number installed 1 Capacity per tank 210,000 gal (5000 gal barrels)

Design pressure Full of water Design temperature 150°F Operating pressure Atmospheric Operating temperature 0-115°F Material A516 GR 70 Corrosion allowance 1/16 in.

Design code API STD-650, 1970 Fuel-Oil Pumps Number installed 8 Type Positive displacement screw type Motor horsepower rating 0.5 Seal Mechanical Capacity 6 gpm Design pressure 150 psig Design temperature 180°F Material Cast iron Piping Material Fuel Oil Fill Line Polyethylene Driscopipe 1000 Entire System except Carbon Steel Fuel Oil Fill Line Design Code Fuel Oil Fill Line ASTM D3350 ASTM F714 ASTM D2774

Revision 5209/29/2016 NAPS UFSAR 9.5-68 Table 9.5-2 (continued)

EMERGENCY DIESEL-GENERATOR FUEL-OIL SYSTEM DESIGN DATA Piping (continued)

Design Code (continued)

Entire System except ASTM A106, Grade A or B Fuel Oil Fill Line ANSI B31.1-1967 with seismic analysis Quality Grouping Q1 Piping 1-1/2 inch and larger shall be stress analyzed using the B31.7 computer stress analysis program.

Q2, Q3, or S Piping larger than 6 inches shall be stress analyzed using the B31.1 computer stress analysis program Q1, Q2, Q3, or S Piping sizes smaller than above shall be stress analyzed using the chart method unless the configuration of the piping or its functional importance as a safety feature dictates the need for computer analysis.

Revision 5209/29/2016 NAPS UFSAR 9.5-69 Table 9.5-3 BUOYANCY CALCULATION DATA Fuel Tank Empty weight 79,200 lb Effective length 60 ft Diameter 12 ft Select Compact Granular Fill Saturated density 140 lb/ft3 Dry density 125 lb/ft3 Reinforced Concrete Density 150 lb/ft3 Table 9.5-4

SUMMARY

OF BUOYANCY CALCULATION Weight Category Weight (lb/ft)

Effective weight of concrete 150 lb ft-3 (16 x 0.5) ft2 1200.0

-3 (16 x 1.5) ft2 (150 - 62.4) lb ft 2102.4 Effective weight of soil (above EG-TK-2A)

(140 - 62.4) lb ft-3 (16 x 2) ft2 2483.2

-3 (12 ft x 6 ft - (6 ft)2 x /2)

(140 - 62.4) lb ft 1199.0

-3 (140 - 62.4) lb ft (2.5 ft x 6 ft/2 - 1.5 ft x 6 ft/2) 931.2 Weight of tank (in air) 79,200 lb/60 ft 1320.0 Total weight (downward) 9235.8 Weight of water displaced (buoyant force upward) 7057.3 (6 ft)2 (62.4 lb ft-3)

Safety factor = forces resisting buoyancy = 9235.8 = 1.31 buoyant force on tank 7057.3

Revision 5209/29/2016 NAPS UFSAR 9.5-70 Table 9.5-5 DECONTAMINATION FACILITY COMPONENT DATA Fluid-Waste-Treating Tank Number 1 Capacity 6000 gal Design pressure 30 psig Design temperature 250°F Operating pressure Atmospheric Operating temperature 125°F Material SS 316L Design code ASME VIII, 1968 Fluid-Waste-Treating Tank Filter Number 1 Retention size 10m Filter element material Cotton or metallic Capacity 32 gpm Pressure vessel material SS 316L Design pressure 150 psig Design temperature 170°F Design code ASME VIII, 1968 Fluid-Waste-Treating Tank Pump Number 1 Type Centrifugal Motor horsepower 2 Seal type Mechanical Capacity 32 gpm Head at rated capacity 50 ft Design pressure 220 psig Materials Pump casing SS 316 Shaft SS 316 Impeller SS 316 Design code None

Revision 5209/29/2016 NAPS UFSAR 9.5-71 Table 9.5-6 PRIMARY PLANT GAS SUPPLY SYSTEM CODE REQUIREMENTS Piping and valves (excluding manifold) ANSI B31.1-1967 or B31.7-1969 Gas cylinders Compressed Gas Association Standards Manifolds and associated valves Compressed Gas Association Standards

Table 9.5-7 CHANGES TO FIRE PROTECTION SAFETY EVALUATION REPORTS COMMITMENT SOURCE STATUS A. FIRE PROTECTION SAFETY EVALUATION REPORT, DATED 2/79 (FPSER-79)

1. Specific fire area boundaries were identified in the FPSER-79 Due to the Appendix R Reanalysis, some of the fire fire hazards analysis submittal to the NRC, which Section 1 areas discussed have been changed. Specifically, were then evaluated by the NRC. Page 1 - Battery Rooms 1-11, 2-11, 1-IV, and 2-IV have been Revision 5209/29/2016 combined with their Emergency Switchgear Room into the same fire areas.

- The Auxiliary, Decontamination, and Fuel Buildings have been combined into the same fire area.

- Safeguards and the Quench Spray Pumphouse are one fire area for each unit.

- Several non-safety-related areas have been combined into the same fire area (Turbine Building, Normal Switchgear Rooms, Cable Spreading Rooms, Office Building, Records Rooms, Auxiliary Boiler, and Service Building).

- Outdoor fuel oil tanks and equipment areas are not considered to be a fire area. NAPS UFSAR

- The Motor Control Center Rooms and Motor-Generator Set Houses have been combined with their Cable Vaults/Tunnels into one fire area for each unit.

- Non-safety-related structures located outside of the station protected area are not considered to be fire areas.

9.5-72

Table 9.5-7 (continued)

CHANGES TO FIRE PROTECTION SAFETY EVALUATION REPORTS COMMITMENT SOURCE STATUS

2. Deluge and water spray systems are in accordance FPSER-79 Transformer spray systems code deficiencies were with the guidance of NFPA 15 Section II.B evaluated to be acceptable.

Page 3

3. A Halon system is provided for the new Records FPSER-79 The Halon system was removed after the Records Revision 5209/29/2016 Room, which is not safety-related. Section II.C Room was moved to the new Records Building. The Page 4 Records Building is protected throughout by a sprinkler system. Meets intent of FPSER.

4. Smoke Detector System Additions Install detectors for Reactor Containment - Residual FPSER-79 Heat detectors are installed in lieu of smoke detectors.

heat removal pump area. Table 1 Meets intent of FPSER.

Page 15 Install detectors for Quench Spray Pump House - Smoke detectors are installed at the ceiling in lieu of Ventilation System exhaust duct. the exhaust duct. Exceeds intent of FPSER.

Install detectors for Auxiliary Building - General Detectors are installed throughout the Auxiliary area of each level. Building, above or near cable concentrations, but do not meet the criteria of NFPA 72 E for full area coverage. Meets intent of FPSER.

Install detectors for Boron Recovery Building - Duct type smoke detectors are installed in lieu of General area. ceiling mounted smoke detectors. Meets intent of NAPS UFSAR FPSER.

Install detectors for Decontamination Building - Duct type smoke detectors are installed in lieu of General area. ceiling mounted smoke detectors. Meet intent of FPSER.

9.5-73

Table 9.5-7 (continued)

CHANGES TO FIRE PROTECTION SAFETY EVALUATION REPORTS COMMITMENT SOURCE STATUS

5. Fire Hose Standpipe Connections, Racks and FPSER-79 Amended by 12/27/83 letter to NRC. Hoses are located Cabinets Table 1 Page 16 at containment entrance rather than at each station.

Reactor Containment - Add dry hose connection standpipes at Elevations 291 feet and 262 feet-Revision 5209/29/2016 Place lengths of hose at each station.

6. Fire Damper/Door Additions and Changes FPSER-79 Rescinded by Company letter 148 dated 6/11/79.

Control Room - Replace 1-1/2 -hour damper with Table 1 Existing normally closed valves are equivalent to a 3-hour damper in wall contiguous to Turbine Page 18 3-hour damper. Accepted by NRC letter dated 7/9/79.

Building.

7. Emergency Lighting FPSER-79 New emergency lighting has been added due to the Control Room - Add 8-hour battery packs. Table 1 Appendix R reanalysis. Exceeds the intent of the Page 18 FPSER. (See Appendix R Report, Chapter 6.)

Cable Vault and Tunnel and Motor Control Center Room

- Add 2-hour battery packs for egress.

Emergency Switchgear and Instrument Room - Add 8-hour battery packs for auxiliary shutdown panel and 8-hour battery packs for egress.

Emergency Diesel Generator Rooms - Add 2-hour battery packs for egress. NAPS UFSAR Auxiliary Building - Add 2-hour battery packs for egress.

Quench Spray Pump House - Add 2-hour battery packs for egress.

Safeguard Area - Add 2-hour battery packs for egress.

Main Steam Valve House - Add 2-hour battery packs for egress.

9.5-74

Table 9.5-7 (continued)

CHANGES TO FIRE PROTECTION SAFETY EVALUATION REPORTS COMMITMENT SOURCE STATUS Fuel Building - Add 8-hour battery packs for proposed auxiliary instrument panel and 8-hour battery packs for egress and access routes to the panel.

B. SAFETY EVALUATION REPORT, DATED 11/18/82 (SER-82)

Revision 5209/29/2016

1. Alternate shutdown may be required in the event of a SER-82 The current Appendix R analysis indicates that fire in the Control Room, Emergency Switchgear Item B alternate shutdown may also be required in the Rooms, Cable Vault and Tunnel areas, and the Page 4 Motor-Driven Auxiliary Feedwater Pump Rooms, Auxiliary Building. Quench Spray Pumphouse, and Main Steam Valve House. Meets intent of SER.

2. An electrically isolated remote panel will be installed SER-82 Rescinded by the current Appendix R analysis. Local in the Fuel Building and will include instrumentation Item B indication is available in the Main Steam Valve House.

for steam generator pressure Page 5 (See Appendix R Report, Chapter 6.)

3. The valves and devices which were considered for SER-82 The number of valves considered for spurious spurious operations were identified as safe shutdown Item D.2 operations has increased significantly. Procedures are circuits and were included in submittals to the NRC. Page 9 developed to ensure correct system alignment as detailed in the Appendix R Report. Meets intent of the SER.

4. Provide the capability for control of the emergency SER-82 The current Appendix R Analysis indicates that diesel generators from remote panels located in the Item E modification of diesels 1H (Unit 1) and 2H (Unit 2) is NAPS UFSAR Diesel Generator Rooms. Page 10 sufficient to meet the requirements of Appendix R.

(See Appendix R Report, Chapter 6.)

9.5-75

Table 9.5-7 (continued)

CHANGES TO FIRE PROTECTION SAFETY EVALUATION REPORTS COMMITMENT SOURCE STATUS

5. High/low pressure interfaces were identified. SER-82 The number of high/low pressure interfaces considered Procedures will be written to ensure correct alternate Item F has increased. Modifications were made to prevent shutdown system alignment, including opening the Page 11 spurious operations, and procedures are developed to power supply breakers for the pressurizer PORVs and ensure correct system alignment as detailed in the for the RHR System interlock valves. The decay heat Appendix R Report. Meets intent of the SER.

Revision 5209/29/2016 release valves and steam generator pressure control valves were also included in submittals to the NRC.

C. SAFETY EVALUATION REPORT RELATIVE TO APPENDIX R EXEMPTIONS REQUESTED, TRANSMITTED BY LETTER DATED 11/6/86 (SER-86)

1. The Decontamination Building is provided with SER-86 The Decontamination Building is provided with ceiling mounted smoke detectors. Section 2.2 Page 4 duct-mounted smoke detectors only. This section of the SER discusses the potential for damage to the charging or CCW pumps and cable. Since the Decontamination Building is separated by a large distance and by barriers from the charging and CCW equipment, the type of detection in the Decontamination Building has no bearing on the conclusion of the SER. Meets intent of the SER.

2. The power feeds for the charging pumps extend up SER-86 Sections The center Unit 1 charging pump power feed is through their respective cubicles to Elev. 259'-6". 2.2.1 and 2.3 Pages provided with a 1-hour rated fire wrap until a NAPS UFSAR The Units 1 and 2 charging pump power feeds are 5&6 horizontal separation of 20 feet is achieved from the separated by a minimum of 20 feet horizontal Unit 2 charging pump power feeds. This is similar to separation. the arrangement of the CCW pump power feeds which is accepted by the SER. Meets intent of the SER.

9.5-76

Table 9.5-7 (continued)

CHANGES TO FIRE PROTECTION SAFETY EVALUATION REPORTS COMMITMENT SOURCE STATUS

3. Safe shutdown components are located within SER-86 Several modifications have been made to the valves in several building that require exterior access. These Section 11.2 Page the Service Water System. Exterior access to the SW buildings are the main steam valve house, AFW 22 pumphouse is no longer required; however exterior pumphouse, QSPH, fuel oil pumphouse, SW access to the new SW valve house is required. All pumphouse, and auxiliary SW pumphouse and yard other factors are equal. Meets intent of SER.

Revision 5209/29/2016 vault pit.

NAPS UFSAR 9.5-77

Revision 5209/29/2016 NAPS UFSAR 9.5-78 Withheld under 10 CFR 2.390 (d) (1)

Figure 9.5-2 HIGH PRESSURE CARBON DIOXIDE SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.5-79

Revision 5209/29/2016 NAPS UFSAR 9.5-80 Figure 9.5-3 HALON 1301 SYSTEM

Revision 5209/29/2016 NAPS UFSAR 9.5-81 Figure 9.5-4 BURIED FUEL OIL TANKS

Figure 9.5-5 DIESEL AIR COOLER SCHEMATIC Revision 5209/29/2016 NAPS UFSAR 9.5-82

Figure 9.5-6 DIESEL JACKET COOLANT SCHEMATIC Revision 5209/29/2016 NAPS UFSAR 9.5-83

Figure 9.5-7 EMERGENCY DIESEL AIR START SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.5-84

Figure 9.5-8 EMERGENCY DIESEL LUBE OIL SYSTEM Revision 5209/29/2016 NAPS UFSAR 9.5-85

Revision 5209/29/2016 NAPS UFSAR 9.5-86 Figure 9.5-9 DIESEL CUBICLE VENTILATION

Revision 5209/29/2016 NAPS UFSAR 9.6-1 9.6 CONTROL OF HEAVY LOADS 9.6.1 Introduction/Background On December 22, 1980, NRC issued a generic letter (unnumbered) which was supplemented February 3, 1981 (Generic Letter 81-07) regarding NUREG-0612, Control of Heavy Loads at Nuclear Power Plants (Reference 1). NUREG-0612 presents an overall philosophy that provides a defense-in-depth approach for controlling the handling of heavy loads.

The approach is directed toward the safe handling of lifted loads.

Generic Letter 81-07 requested that North Anna implement certain interim actions and provide the NRC information related to heavy loads. Submittals were requested in two parts; a 6-month response (Phase I) and a 9-month response (Phase II). Phase I responses were to address Section 5.1.1 of NUREG-0612 which covers the following areas:

Guideline 1 - Safe Load Paths Guideline 2 - Load Handling Procedures Guideline 3 - Crane Operator Training Guideline 4 - Special Lifting Devices Guideline 5 - Lifting Devices (not specially designed)

Guideline 6 - Cranes (inspection, testing, and maintenance)

Guideline 7 - Crane Design In addition, the Phase I Report was to identify all load handling systems within the plant that are capable of carrying a heavy load. These load handling systems were divided into two groups:

Group I: Heavy load handling systems from which a load drop may result in damage to any system required for plant shutdown or decay heat removal, taking no credit for interlocks, technical specifications, operating procedures, detailed structural analysis or system redundancy.

Group II: Heavy load handling systems excluded from Group I based on determination by inspection that there is sufficient physical separation between any load impact point and any system needed for plant shutdown or decay heat removal.

Phase II responses were to address Sections 5.1.2 thru 5.1.6 of NUREG-0612 which cover the need for electrical interlocks/mechanical stops, or alternatively, single-failure-proof cranes or load drop analyses in the spent fuel pool area, containment building, and other areas of the plant and the specific guidelines for single-failure-proof handling systems.

On June 28, 1985, NRC issued Generic Letter 85-11, Completion of Phase II of Control of Heavy Loads at Nuclear Power Plants NUREG-0612 (Reference 2), which rescinded Phase II. It

Revision 5209/29/2016 NAPS UFSAR 9.6-2 concluded the Phase I implementation provided sufficient protection such that the risk associated with potential heavy load drops was acceptably small and no further action was required beyond that identified during Phase I.

The NRC Safety Evaluation and their consultants Technical Evaluation Report (TER)

(Reference 3) of the 6-month response (Phase I) along with Generic Letter 85-11 form the basis for North Annas commitments to Section 5.1.1 of NUREG-0612. Each of the seven guidelines of Section 5.1.1 of NUREG-0612 along with the definition of a heavy load subject to NUREG-0612 and the list of the Group I handling systems that are capable of moving heavy loads subject to NUREG-0612 are discussed in detail below.

Sections 9.6.2 through 9.6.4 summarize the commitments that were made by Virginia Power as part of the Phase I submittal with regard to compliance with Section 5.1.1 of NUREG-0612. Any errors made in the Phase I report are noted and corrected. In addition, additions or deletions since the Phase I report are also included.

On September 14, 2007, the nuclear industry's Nuclear Strategic Issues Advisory Committee approved an industry initiative to address NRC staff concerns regarding the interpretation and implementation of regulatory guidance associated with heavy load lifts (Reference 9). In response to the industry initiative, reliance on a reactor vessel (RV) head drop analysis was included into the safety basis for the control of heavy loads at North Anna. Further discussion on this is provided in Section 9.6.5.

9.6.2 Heavy Loads NUREG-0612 defines a heavy load as any load that weighs more than the combined weight of a single spent fuel assembly and its associated handling tool. This is taken at 2000 pounds at North Anna. (The TER defined 2500 pounds as a heavy load based on an error in the 6-month response. The 9-month response (Reference 4) corrected the weight to 2000 pounds.) A heavy load is subject to NUREG-0612 if it is carried over irradiated fuel, safe shutdown equipment or decay heat removal equipment.

9.6.3 Overhead Heavy Load Handling Systems The following load handling systems are subject to compliance with NUREG-0612:

1. Reactor containment polar cranes

2. Reactor containment annulus hoists

3. RHR pump monorails

4. Auxiliary Building monorail (Elevation 259' - Mark No. l-MH-CRN-8)

5. Auxiliary Building monorail (Elevation 274' - Mark No. 1-MH-CRN-9B)

6. Fuel Building movable platform

Revision 5209/29/2016 NAPS UFSAR 9.6-3

7. Fuel Building Trolley (SFP gates may be carried over spent fuel provided restrictions on the gate lift height, redundant rigging, and fuel inserts in the load path are controlled by the Technical Requirements Manual which prohibits other loads more than 2500 lb from being lifted over irradiated fuel in the spent fuel pool. Loads between 2000 and 2500 lb that are lifted over spent fuel are subject to NUREG-0612.)

Although, the TER included the new fuel bridge crane as subject to NUREG-0612, this handling system has been removed from Virginia Powers heavy loads program because existing physical restrictions on the crane operating area prevent loads from being lifted over targets of concern to NUREG-0612 (irradiated fuel and safe shutdown equipment). Therefore, the new fuel crane is not subject to NUREG-0612.

A listing of the NUREG-0612 heavy loads per handling system is tabulated in Table 9.6-1.

9.6.4 NUREG-0612, Section 5.1.1 Guidelines 9.6.4.1 Safe Load Paths Safe load paths for the movement of heavy loads have been developed which follow, to the extent practical, structural floor members, beams, etc., such that if the load is dropped, the structure is more likely to withstand the impact. These load paths have been incorporated into lifting procedures. With the exception of the SFP gates, safe load paths do not require specific lift height restrictions other than to keep the load as low as possible while maintaining adequate vertical clearances over obstructions in the load path. (Maximum lift height limits and load drop studies were part of the Phase II requirements that were rescinded by the NRC (Reference 2).)

Safe load paths are not marked on the floor in the area where the load is handled. In the containment structure, the majority of the operating floor consists of removable hatches and mechanical equipment and is typically covered during outages. This makes safe load path markings impractical. Supervisory personnel review the safe load path with the crane operators prior to a lift being made and a signalman then guides the operator along the safe load path during the lift operation. Also, restricted areas are used in the containment structure for several heavy loads such as concrete floor plugs that are routinely shuffled to several laydown areas during an outage. These restricted areas include: over the reactor, steam generators, and main steam/feedwater riser area. Engineering has developed drawings which indicate operating floor capacities that are used by Containment Coordinators to control laydown space in conjunction with the Heavy Loads Program. With appropriate evaluation by Engineering, these drawings can be revised to suit specific applications.

Safe load paths are not used in the Fuel Building. Instead, exclusion areas are used.

Revision 5209/29/2016 NAPS UFSAR 9.6-4 9.6.4.2 Load Handling Procedures Station maintenance procedures have been developed for performing heavy load lift operations. The procedures identify the following items:

1. Equipment identification.

2. Required equipment inspections and acceptance criteria prior to performing lift and movement operations.

3. Approved safe load paths or exclusion areas.

4. Safety precautions and limitations.

5. Special tools, rigging hardware, and equipment required for the heavy load lift.

6. Rigging arrangement for the load.

7. Adequate job steps and proper sequence for handling the load.

9.6.4.3 Crane Operators Training NUREG-0612 requires that crane operators be trained, qualified and conduct themselves in accordance with Chapter 2-3 of ANSI B30.2-1976, Overhead and Gantry Cranes (Reference 5).

At North Anna, station administrative procedures ensure that crane operators are qualified.

In order for a Station individual to be qualified as a crane operator, the following three items must be satisfied:

1. Complete knowledge testing of the crane to be operated in accordance with the applicable ANSI crane standard (Reference 5).

2. Complete practical testing for the type crane to be operated.

3. Obtain supervisor signatory authorization on the practical operating examination (Job Performance Measure [JPM]) form.

In addition, all crane operators are required to meet the applicable physical requirements for crane operators as delineated in the applicable ANSI crane standard.

Qualification of contractor crane operators to the applicable ANSI crane standards shall be documented by the contractor organization and approved by the Virginia Power Department Head or designee to whom the contractor reports to.

Virginia Power Department Heads are responsible for ensuring all crane operators are qualified and monitoring crane operations periodically to ensure that safety and good handling practices are followed.

Revision 5209/29/2016 NAPS UFSAR 9.6-5 9.6.4.4 Special Lifting Devices As indicated in the TER (Reference 3), North Anna committed to the following:

The special lifting devices used for the reactor vessel heads, reactor internals, and reactor coolant pump motors are standard lifting devices designed and supplied by Westinghouse for these specific functions.

The special lifting devices were designed such that the design stress would not exceed one-fifth of the ultimate material strength. The design, fabrication, and quality assurance requirements were defined on detailed manufacturing drawings and purchase order documents. An initial load test followed by nondestructive surface examination of critical welds was performed for the reactor vessel head and internals lift rigs. All of the tensile and shear stresses meet the ANSI design criteria.

These devices are not, however, in strict compliance with the ANSI N14.6-1978 requirements for acceptance testing, maintenance, and continuing compliance, as noted in the following exceptions:

1. All three lifting devices were initially load tested to 100%, vice 150%, followed by the appropriate nondestructive testing after site assembly and prior to initial use within the plant.

2. Annual testing per ANSI requires that either a 150% load test or dimensional, visual, and nondestructive testing be performed; it is noted that a 150% load test is impractical since these devices are located in the containment. However, plant procedures presently require that each device, its welds, and any bolted joints be visually inspected prior to use and immediately after lifting the load. In addition, a load cell is used with the reactor vessel head and internals lift rigs for continuous monitoring during all lifting and lowering.

To ensure more reliability and a higher level of confidence in the continuing compliance with ANSI N14.6-1978, North Anna has instituted a nondestructive examination (NDE) program which will provide for inspection and NDE of all critical welds and critical parts over a normal inservice inspection interval of 10 years.

Based on the above, it has been concluded that:

1. All tensile and shear stresses meet the ANSI N14.6-1978 design criteria

2. The ANSI requirements for design, fabrication, and quality assurance are generally in agreement with those used for the devices

3. Although not in strict compliance with ANSI requirements, the load tests and nondestructive tests performed following assembly demonstrates the acceptability of these devices. Present station procedures meet the intent of ANSI N14.6-1978 regarding verification of continuing compliance.

Revision 5209/29/2016 NAPS UFSAR 9.6-6 Additional special lifting devices have been identified that were not included in the TER:

a. Reactor cavity seal ring lift rig

b. Spreader beams for spent filter casks

c. Charging pump cubicle wall lifting beam

d. Cask Lift Beam

e. Long cask lid lifting tool

f. Short cask lid lifting tool These lifting devices have been included in station maintenance procedures as special lifting devices and will be visually inspected prior to use and immediately after lifting the load and will be inspected under the 10 year Inservice Inspection Program using NDE methods.

Engineering calculations have been prepared documenting the structural adequacy of these additional devices in conformance with ANSI N14.6 (Reference 5) criteria.

Two additional special lifting device types have been identified for inclusion under the guidelines of NUREG-0612 at North Anna. These special lifting devices were not previously mentioned in the TER nor were they included with the subsequent group of six, as listed above in (a) through (f):

g. Reactor vessel head stud racks

h. Reactor cavity seal ring flip rig These devices are not, however, in strict compliance with ANSI N14.6-1978 for design, fabrication, quality assurance, maintenance and continuing compliance, as noted in the following exceptions:

1. These two additional special lifting device types were fabricated without official design calculations. To reconstitute a design basis, an engineering evaluation was performed following the design criteria of ANSI N14.6-1978. The special lifting devices were conservatively assumed to be fabricated out of carbon steel materials with strength properties at least comparable to that of ASTM A36.

2. These two additional special lifting device types were fabricated without fabrication or quality assurance records. Each of these additional special lifting devices have received initial load tests to 150% of their rated load capacities. A visual inspection was performed to further assess the quality of construction. Some minor modifications were performed to ensure that all tensile and shear stresses would continue to meet the ANSI design criteria.

Following the modifications, baseline nondestructive examinations were performed on all critical welds and critical parts to provide documented evidence of quality construction.

Revision 5209/29/2016 NAPS UFSAR 9.6-7

3. Annual testing per ANSI requires that either a 150% load test or dimensional, visual and nondestructive testing be performed. However, plant procedures presently require that each device, its welds, and any bolted joints be visually inspected prior to use and immediately after lifting the load. Therefore, the ANSI annual testing requirements have been waived in lieu of the prior to use visual inspections. To ensure more reliability and a higher level of confidence in the continuing compliance with ANSI N14.6-1978, North Anna has instituted a nondestructive examination (NDE) program which will provide for inspection and NDE of all critical welds and critical parts over a normal service interval of 10 years.

Based on the above, it is concluded that:

1. All tensile and shear stresses meet ANSI N14.6-1978 design criteria.

2. The ANSI requirements for design, fabrication, and quality assurance are generally in agreement with those used for these special lifting devices.

3. Although not in strict compliance with ANSI requirements, the load tests and nondestructive testing performed following assembly demonstrate the acceptability of these special lifting devices. Present station procedures meet the intent of ANSI N14.6-1978 regarding verification of continuing compliance.

In addition to the previously stated lifting devices, an intermediate lift ring, supplied by Framatome ANP, was installed during the installation of the NAPS Unit 1 and Unit 2 replacement closure heads. Installation of the intermediate lift rings required the lift rod lower clevises, which were used to connect to the closure head lifting lugs, to be removed. Each intermediate lift ring uses upper and lower adapter blocks and lift pins to attach this lift ring to the lifting rig assembly and the replacement closure head lifting lugs. These components were tested to 150% of the design load (i.e., 480,000 lb) for a minimum of ten (10) minutes, which meets the requirements of ANSI N14.6-1978. After this load-test, non-destructive and visual examinations were performed for surface indications, evidence of permanent deformation, and other nonconformances. Surfaces of the intermediate lift ring, adapters, bolts, and lift pins were examined utilizing PT with acceptance criteria as established by NF5350 of the ASME Section III 1995 Edition with Addenda through 1996. Furthermore, post load-test visual examinations and dimensional checks for evidence of permanent deformation of intermediate lift ring, adapters, bolts, and lift pins were conducted. These examinations have demonstrated that the intermediate lift ring is acceptable for lifting operations (References 7 & 8).

9.6.4.5 Lifting Devices Not Specially Designed (Slings)

The North Anna station administrative procedures requires that slings used for heavy load lifts meet the requirement specified for slings in accordance with ANSI B30.9-1971 (Reference 5).

Revision 5209/29/2016 NAPS UFSAR 9.6-8 As stated in the TER (Reference 3), evaluation of sling capacity indicates that dynamic load constitutes a small percentage of the total load imposed on the slings; therefore, the slings ratings can be safely expressed in terms of the maximum static load only.

9.6.4.6 Cranes (Inspections Testing, and Maintenance)

Cranes subject to NUREG-0612 requirements are inspected, tested, and maintained in accordance with Chapter 2-2 of ANSI B30.2-1976, Overhead and Gantry Cranes (Reference 5),

Chapter 11.2 of ANSI B30.11-1973, Monorail Systems and Underhung Cranes (Reference 5), or Chapters 16-1.2.1 and 16-1.2.3 of ANSI B30.16-1973, Overhead Hoists (Reference 5), with the exception that tests and inspections may be performed prior to use for infrequently used cranes.

Prior to making a heavy load lift, an inspection of the crane is made in accordance with the above applicable standards.

9.6.4.7 Crane Design NUREG-0612, Section 5.1.1(7), requires the cranes be designed to meet the applicable criteria and guidelines of Chapter 2-1 of ANSI B30.2-1976, Overhead and Gantry Cranes (Reference 5) and of CMAA-70, Specifications for Electric Overhead Traveling Cranes (Reference 6). An alternate to a specification in ANSI B30.2 or CMAA-70 may be accepted in lieu of specific compliance if the intent of the specification is satisfied.

At North Anna, the containment polar cranes are designed to the Electric Overhead Crane Institute Specification 61 - Specifications for Electric Overhead Traveling Cranes (EOCI-61) that was in effect at the time of manufacture of cranes. These specifications are the predecessors of CMAA-70.

The primary difference between the EOCI-61 and CMAA-70 specifications are changes in the design of bridge girders. The changes reflected in the CMAA-70 specification allow the use of higher allowable stresses for the better grade materials available today and also provide new design formulas. These changes are a result of advancements in the state of the art of girder structural design, allowing the use of lighter, more efficient structures and do not increase the conservatism in the design from the older EOCI-61 specification.

The North Anna cranes, hoists, and trolleys are designed in accordance with the requirements of ANSI B30.2-1967, which was the applicable edition for design requirements when the cranes were manufactured. The polar cranes meet all of the 14 revised requirements of CMAA-70. This has been stated in the TER (Reference 3).

9.6.5 Reactor Vessel Head Drop Analysis and Lifting Procedures A RV head drop analysis based on the guidance and acceptance criteria in NEI 08-05, Industry Initiative on Control of Heavy Loads (Reference 10), has been performed to establish limits on load height, load weight, and medium present under the load. Procedures are used to control the lift and replacement of the RV head, which ensure the limits established in the RV head drop analysis are maintained.

Revision 5209/29/2016 NAPS UFSAR 9.6-9

9.6 REFERENCES

1. H. George, Control of Heavy Loads at Nuclear Power Plants, NUREG-0612, U.S. Nuclear Regulatory Commission, Washington, D. C., July 1980.

2. Generic Letter 85-11, Completion of Phase II of Control of Heavy Loads at Nuclear Power Plants NUREG-0612, June 28, 1985 (Serial No.85-507).

3. Letter from J. R. Miller, NRC, to W. L. Stewart, VEPCO, Control of Heavy Loads (Phase I),

dated May 25, 1984, Docket Nos. 50-338 and 50-339, with enclosed Safety Evaluation Report, and Technical Evaluation Report. TER-C5506-372/373, dated May 14, 1984.

4. Letter from R. H. Leasburg, VEPCO, to H. R. Denton, NRC, NUREG-0612, Control of Heavy Loads, dated March 22, 1982, with enclosed Nine Month Response for both North Anna and Surry Power Stations.

5. American National Standards Institute:

a. ANSI B30.2-1976, Overhead and gantry Cranes

b. ANSI B30.9-1971, Slings

c. ANSI B30.11-1973, Monorail Systems and Underhung Cranes

d. ANSI B30.16-1973, Overhead Hoists

e. ANSI N14.6-1978, Special Lifting Devices for Shipping Containers Weighing 10,000 Pounds (4500kg) or More

6. Crane Manufacturers Association of America, Inc., Specifications for Electric Overhead Traveling Cranes, CMAA-70, 1975.

7. Framatome ANP Document 23-5024301, QA Data PackageIntermediate Lift Ring for NA1 RVCH, March 2003.

8. Framatome ANP Document 23-5023813, QA Data PackageIntermediate Lift Ring for NA2 RVCH, January 2003.

9. Letter horn A. R. Pietrangelo, NEI, to J. E. Dyer, NRC, Industry Initiative on Heavy Load Lifts, September 14, 2007.

10. NEI 08-05, Industry Initiative on Control of Heavy Loads, July 2008. (Transmitted to NRC by Reference 10).

11. Letter from A. R. Pietrangelo, NEI, to E. J. Leeds, NRC, Industry Initiative on Control of Heavy Loads, July 28, 2008.

Revision 5209/29/2016 NAPS UFSAR 9.6-10 Table 9.6-1 HEAVY LOADSa Handling System Heavy Load Capacity (Tons) Weight (Tons)

Containment 140/15 b -

Polar Crane RV Head Lifting Rig - 6.0 RV Head Assembly Lift Weight - 129.9 l RV Internals - 7.2 Lifting Rig RV Upper Internals - 53.5 RV Lower Internals c - N/A CRD Missile Shield - 33.3 RV Seal Ring - 8.5 d Reactor Coolant Pump Motor - 39.0 Floor Concrete Hatches - 1 to 20 RV Inspection Tool e - N/A Reactor Containment Recirc. Fan - 3.9 f Reactor Stud Rack (Full) g - 3.3 Containment 5.0 -

Annulus Crane Various Loads up to Rated Capacity - Up to 5.0 RHR Pump 3.0 -

Monorails RHR Pump Motors - 3.0 Auxiliary Building Material Handling Monorails:

Elevation 259' (Mark # 1-MH-CRN-8) 8.0 h -

Elevation 274' (Mark # 1-MH-CRN-9B) 12.0 -

Filter Cask 1-LW-CASK-1 - 7.2 i Filter Cask 1-LW-CASK-2 - 2.4 Filter Cask 1-LW-CASK-3 - 2.4 Fuel Building 2 @ 2.0 -

Movable Platform Spent Fuel Cavity Gate - 1.8

Revision 5209/29/2016 NAPS UFSAR 9.6-11 Table 9.6-1 (continued)

HEAVY LOADSa Handling System Heavy Load Capacity (Tons) Weight (Tons)

Fuel Building 125/10 -

Trolley Spent Fuel Cask (incl. Fuel, Lift - 125 Beam, Lid)

Cask Lift Beam - 3.7 Cask Lid and Tool j - 6.9 Spent Resin Container and Cask k - N/A Irradiated Specimen Cask - 5.7 Fuel Pool Gate - 2.1 NOTES:

a. The loads in the table have been taken from the TER (Reference 3) or subsequent evaluation (which provide a listing of anticipated heavy loads) with the exception of eliminated handling systems as discussed in Section 3. Whether or not a specific lift (or a load not listed) will be subject to NUREG-0612 is determined by standards and procedures which address Virginia Powers implementation of NUREG-0612 commitments. All weights are for reference only) are not controlled and are considered approximate.

b. Polar crane auxiliary hook capacity listed as 50 tons in TER based on error given in 6-month report. Crane vendor drawing indicates 15-ton capacity based on normal 4 part reeving.

c. RV lower internals is listed in the TER; however, since the reactor vessel is completely defueled and the fuel transfer gate valve is closed before lifting the lower internals it is not subject to NUREG-0612.

d. Seal ring listed as 7.5 tons in the TER. Calculations show this to be approximately 8.5 tons.

e. RV Inspection Tool is listed in the TER; however, since the reactor vessel is completely defueled and the fuel transfer gate valve is closed before lifting the tool it is not subject to NUREG-0612.

f. Recirc. fan weight listed as 2.8 tons based on error given in 6-month report. Actual weight is 3.9 tons.

g. TER did not include the reactor stud rack which is subject to NUREG-0612.

h. A design change removed the old 12-ton tandem hoists and installed a single 8-ton hoist in its place.

i. Filter cask weight is listed as 4.0 tons in the TER based on error given in the 6-month report.

Actual weight is 7.2 tons established during filter procedure enhancements in 1989.

j. The lift of the spent fuel cask lid was not included in the TER and is subject to NUREG-0612.

k. Lifts of the spent resin container and its cask are performed in the Decontamination Building where NUREG-0612 is not applicable.

l. Intermediate lift ring was designed, fabricated, and initially load tested to meet the requirements of NUREG-0612 and ANSI N14.6-1978. Refer to Section 9.6.4.4 for compliance with the requirements.

Revision 5209/29/2016 NAPS UFSAR 9.6-12 Intentionally Blank

Revision 5209/29/2016 NAPS UFSAR 9A-i Appendix 9A Structural Analysis of the Spent-Fuel Pool

Revision 5209/29/2016 NAPS UFSAR 9A-ii Intentionally Blank

Revision 5209/29/2016 NAPS UFSAR 9A-1 APPENDIX 9A STRUCTURAL ANALYSIS OF THE SPENT-FUEL POOL1 9A.1 INTRODUCTION On July 9, 1976, VEPCO notified the Office of Inspection and Enforcement (OI&E),

Region II, U.S. Nuclear Regulatory Commission (NRC), of a deficiency that resulted from a review of design calculations for the spent-fuel pool. As required by 10 CFR 50.55(e)(3), an interim 30-day report was submitted by VEPCO in a follow-up letter to I&E Region II, dated August 10, 1976, Serial No. 170, Docket Nos. 50-338 and 50-339. This letter indicated that corrective action was being taken in the form of a detailed structural analysis and that a final report was forthcoming. The following information constitutes that final report.

9A.2 DESCRIPTION OF THE FUEL BUILDING The fuel building is a Seismic Class I structure. Reference Drawing 1 and 2 show the general arrangement of the fuel building. It is bounded by the Seismic Class I auxiliary building on the north, reactor containments on the east and west sides, and by the nonseismic waste solidification and decontamination buildings on the south. The fuel building is designed and arranged to contain new and spent fuel and related fuel handling and fuel storage systems and components to serve both Units 1 and 2 of the North Anna Power Station. The structure is approximately 136 feet long by 40 feet wide and is supported by a 6-foot-thick reinforced-concrete mat founded on bedrock at Elevation 243 ft. 4 in. (ground grade is at Elevation 271 ft. 6 in.). Walls of the spent-fuel storage pool are nominally 6 feet thick and extend up from the mat to Elevation 291 ft. 10 in. Narrow canals connect the pool to the fuel transfer tube of each containment structure. Exterior walls enclosing the balance of the structure are 2 feet thick and also extend up from the mat to Elevation 291 ft. 10 in. The fuel building superstructure is enclosed with metal siding on a structural steel frame, from Elevation 291 ft. 10 in. to the roof elevation. A metal deck roof at Elevation 320 ft. covers the eastern 110 feet of the 136-foot-long building. The remaining portion of the roof at the west end of the building is raised to Elevation 338 ft. to permit clearance for the spent-fuel cask-handling trolley.

The spent-fuel pool is comprised of a cask-loading area, storage rack area, and transfer canals, all of which are lined with stainless steel plate. The cask-loading area is separated from the storage racks by a stainless-steel-lined, 3-ft. 6-in. reinforced-concrete wall. This wall is designed to act as a barrier to prevent a cask from falling on spent fuel in the storage racks. An opening 25 feet high by 3 feet wide in this wall permits the transfer of fuel from the racks to the cask. A 32-inch high pedestal has been placed in the deep end of the cask loading area to allow the fuel

1. This appendix was originally submitted as Appendix 0 to the North Anna FSAR.

Revision 5209/29/2016 NAPS UFSAR 9A-2 assemblies in the spent fuel cask to be at approximately the same elevation as the assemblies in the spent fuel racks.

9A.3 DESCRIPTION OF THE DEFICIENCY In May 1976 the original structural design computations for the reinforced-concrete spent-fuel pool were reviewed to determine how much additional load from the new high-density fuel racks could be carried by the walls. At that time, it was proposed to support the racks seismically by bracing them to the walls of the pool. These original computations were made by hand in the period between October 1970 and April 1971, and used the analytical techniques contained in U.S. Department of the Interior, Bureau of Reclamation, publication entitled Moments and Reactions for Rectangular Plates by W. T. Moody (Reference 1). Fuel pool walls were analyzed as flat plates fully fixed against translation and rotation at the mat and at their intersection with orthogonal walls and free to translate and rotate at the top, at Elevation 291 ft.

10 in. Bending moments from this analysis were used to design flexural reinforcing. However, the May 1976 review of these computations indicated incompatible design forces and moments along common boundaries of adjacent flat plates.

In order to determine whether or not this design deficiency was significant, new computations were made for the north wall of the spent-fuel pool where it was presumed that the consequences of analytical incompatibility would have its greatest effect. Additional hand computations were made using the previously referenced Bureau of Reclamation publication (Reference 1), and then, to more closely account for local wall stiffnesses created by the tunnel structure below Elevation 264 ft. 1 in. at the west end of the Unit 1 transfer canal, and by the wall below Elevation 264 ft. 1 in. at the east end of the Unit 2 transfer canal, a two-dimensional mathematical model was developed. This model employed the finite-element capability of the ICES STRUDL II computer program and permitted a more precise determination of structural response. Boundary moments were made compatible by manual computations employing the technique of moment distribution.

Preliminary results of this analysis indicated that local stresses from hydrostatic loading, plus the operational-basis earthquake and the operating thermal loadings, exceed ACI Code (Reference 2) Working Stress Design allowables as a result of horizontal moments at Elevation 264 ft. 1 in. in the vicinity of the gate opening into the transfer canals and at Elevation 291 ft. 10 in. at the east and west ends of the wall, and as a result of vertical moments at the wall/mat boundary between 9 and 9-3/4 lines. It was concluded that a significant design deficiency could exist and that an extensive evaluation was required to fully define the state of stress in the entire spent-fuel pool under its design loadings.

Revision 5209/29/2016 NAPS UFSAR 9A-3 9A.4 ANALYSIS OF SAFETY IMPLICATIONS The spent-fuel pool must be capable of maintaining structural integrity under its design loadings to ensure that spent fuel stored in it will always be kept in a safe condition as prescribed by NRC regulations. While preliminary new computations do show local stresses exceeding allowables, these conditions do not necessarily constitute jeopardy of the structural integrity of the pool. Nonetheless, these results did not satisfy Stone & Webster structural design criteria, as contained in Section 3.8.1.4.

9A.5 CORRECTIVE ACTION TAKEN 9A.5.1 Scope The new analysis, performed up to this point, had been limited to the study of a two-dimensional mathematical model of the north wall of the spent-fuel pool.

The scope of the new analysis was then expanded to include the preparation of a three-dimensional mathematical model (see Figure 9A-1) of the entire spent-fuel pool structure.

The results of this work were used for comparison with the results of the two-dimensional analysis of the north wall and to determine if any other portions of the structure experienced stresses in excess of allowables. A study of the stresses computed from the three-dimensional model confirmed that a design deficiency did exist and that corrective action was required.

It was apparent from these results that additional stiffness was required in the north wall in order for stresses to be within allowables. Of the various alternatives considered, the best structural solution appeared to be that which involved constructing a stainless-steel-lined, reinforced-concrete counterfort inside the spent-fuel pool against the north wall. This counterfort would extend from the top of the mat at Elevation 249 ft. 4 in. up to the top of the north wall at Elevation 291 ft. 10 in. and be located between 9 and 9-3/4 lines. Figure 9A-2 shows the counterfort in detail, while Figures 9A-3 through 9A-8 show various views of the spent-fuel pool after addition of the counterfort.

The three-dimensional mathematical model of the spent-fuel pool was then appropriately revised to reflect the counterfort feature and reanalyzed to confirm that this would result in a structure that would satisfy the design criteria. The following factors were considered when assessing the suitability of the counterfort as a corrective measure.

The anchorage of the counterfort internally in the fuel pool consists of removing 6 feet of the liner for the total height of the pool and 8 feet into the pool. The face of the concrete is then chipped back to locate the outer layers of reinforcing. Holes are drilled into both the wall and mat, and the reinforcing of the counterfort is then placed and grouted.

Revision 5209/29/2016 NAPS UFSAR 9A-4 The failure mode of the counterfort has been investigated. The primary mode of concern is at the bottom of the counterfort with the connection to the mat. The tension reinforcing of the counterfort is anchored to its full development length. A failure mechanism is only possible if the group of reinforcing bars fail in a cone type pullout from the mat. The bending moments at the base of the counterfort do not produce enough stress in the reinforcing to create that pullout failure.

Calculations indicate that development of this cone type failure will require a force of 7043 kips, whereas the total tension capacity of the reinforcing in the counterfort is only 3994 kips. This illustrates that the reinforcing in the counterfort would yield before a shear failure develops in the mat. For the various design loads investigated the maximum factored stress is 24.6 ksi, far below yield.

9A.5.2 Design Loads 9A.5.2.1 Hydrostatic Hydrostatic pressure, normal to surfaces within the spent-fuel pool, are those associated with maintaining a pool water level at or below Elevation 289 ft. 10 in. The exterior walls and mat of the pool are designed to support hydrostatic pressures. Interior walls, such as the wall separating the cask-laydown area from the storage rack area and the south wall of the Unit 2 transfer canal are designed for hydrostatic pressures on one side associated with de-watering the cask-laydown area or transfer canal, respectively.

9A.5.2.2 Thermal The spent-fuel pool experiences a continuous thermal loading while maintaining the stored irradiated fuel in the fuel storage racks at the bottom of the pool. It also experiences transient rises while the fuel is being removed from the reactor.

The two controlling thermal loads are as follows:

1. Service Load Condition - One-third core removal with one fuel pit cooler and associated pump and 105°F component cooling water.

2. Abnormal/Extreme Environmental Condition - One core removal following a one-third core refueling with one fuel pit cooler and pump and 105°F component cooling water.

9A.5.2.3 Seismic The inertia forces associated with a seismic event are computed from the data generated by dynamic analysis of a spring-connected lumped-mass model. Additional information concerning the modeling technique and method of dynamic analysis is contained in Section 3.7.2. Inertia forces for horizontal and vertical motion are computed for both the operational-basis earthquake and the design-basis earthquake. One horizontal component of the inertia force is combined with the vertical component in such a manner as to result in the most severe effect on the structure.

Revision 5209/29/2016 NAPS UFSAR 9A-5 Inertia forces for the reinforced-concrete substructure and steel superstructure were computed by multiplying their masses by the appropriate acceleration value as determined from the previously discussed dynamic analysis. Inertia forces for the water within the pool were computed using the methods of Chapter 6 of Atomic Energy Commission (AEC) Division of Technical Information publication Nuclear Reactors and Earthquakes (Reference 3). Inertia forces for the high-density spent-fuel racks were computed by multiplying an appropriate mass by an acceleration value as determined by a comparison of the modal analysis of the rack structure with amplified response spectra.

9A.5.3 Design Criteria Load equations used for reanalysis of the spent-fuel pool with the counterfort added to the north wall conform to Section 3.8.4 of NRC Office of Nuclear Reactor Regulation publication Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR edition (Reference 4).

Definitions of loads are as follows:

D = dead loads or their related internal moments and forces including any permanent equipment loads and hydrostatic load L = live loads or their related internal moments and forces including any movable equipment loads and other loads that vary with intensity and occurrence To = thermal effects and loads during normal operating or shutdown conditions based on the most critical transient or steady-state condition Ta = thermal effects and loads during an abnormal operating or shutdown condition based on the most critical transient or steady-state condition E = loads generated by the operating-basis earthquake E' = loads generated by the design-basis earthquake U = section strength required to resist design loads based on the strength design methods described in ACI-318-71 (Reference 2).

There are no significant wind loads (W), pipe support reactions (Ro, Ra), fluid pressures (P0), nor pipe break effects (Yr, Yj, Ym) postulated to act concurrently with the dead, live, thermal, and seismic loads.

Load equations used are as follows:

Service Load Conditions U = 1.4D + 1.7L U = 1.4D + 1.7L + 1.9E

Revision 5209/29/2016 NAPS UFSAR 9A-6 U = (0.75) (1.4D + 1.7L + 1.7To)

U = (0.75) (1.4D + 1.7L + 1.9E + 1.7To)

Abnormal/Extreme Environmental Conditions U = D + L + E' U = D + L + Ta U = D + L + T a + E' 9A.5.4 Design Assumptions The following assumptions were used to provide bounds on the scope of structural analysis:

1. The maximum water level in any portion of the spent-fuel pool is Elevation 289 ft. 10 in.

2. The storage rack portion of the fuel pool is full of water at all times, but the cask-laydown area and transfer canals may be either full, partially full, or dry, in any combination.

3. The service load condition for thermal is a transient peak pool water temperature of 140°F with 105°F maximum component cooling water and at least one fuel pit cooler and associated pump operating at 2800 gpm.

4. The abnormal/extreme environmental condition for thermal is a transient peak pool water temperature of 170°F with 105°F maximum component cooling water and at least one fuel pit cooler and associated pump operating at 2800 gpm.

9A.5.5 Results of Analysis The primary instrument of analysis used in examining the pool was the ICES STRUDL II computer program, a well-known structural analytical tool in the public domain. The finite-element model shown in Reference Drawing 1 used rectangular and triangular isotropic plate-bending elements of 4 and 3 nodes, respectively. The elements are capable of accepting out-of-plant loadings uniformly distributed over the surface of the elements or at the joints. The variation in hydrostatic and seismic loadings is recognized in the analysis of the pool by applying the varying of the loads as equivalent step loads on the face of the wall. Within the elements, which were approximately 6 feet by 6 feet, the magnitude of the force at the centroid was used as the uniform load. This method gives exactly the same amount of applied force over the element as that obtained by the actual linear distribution of forces over the element. To account for the reduced flexural rigidity of the sections due to cracking under thermal loadings, a reduced value of the modulus of elasticity was used as suggested in the Portland Cement Association publication Circular Tanks Without Prestressing.

The seismic analysis of the pool and the subsequent loadings were obtained without a reduction in the value of the modulus of elasticity of the concrete. Neglecting the reduction in stiffness of the walls due to cracking should not create a significant increase in the seismic

Revision 5209/29/2016 NAPS UFSAR 9A-7 loadings, as noted in Section 3.7 of the FSAR. The analysis of the reactor containment with extensive cracking generates a difference of only 10% in the forces and moments. The design as it exists, can accept an increase in the seismic stresses of greater than 25%, which is greater than that which would be expected in an analysis recognizing a reduced bending stiffness in the walls.

Note also that this type of structure is low and stiff and responds primarily as a shear beam with little amplification from that of the net acceleration. The publication Circular Tanks Without Prestressing indicates that reduction in the flexural rigidity of the section due to cracking under thermal loadings can be made by reducing the value of the modulus of elasticity of the concrete.

The theory is applied without regard to shape of the structure.

Output from the finite-element analysis is given in force couples at the nodal points.

Conversion to the internal stresses of the concrete and reinforcing is performed by a Stone &

Webster code NEWSECT. The program performs a nonlinear 2 stress analysis of reinforced-concrete sections subjected to bending moments and axial forces. It assumes a linear strain distribution through the section with the concrete incapable of taking tensile loads or compressive strains above 0.003 in./in. It uses a nonlinear stress curve for the relationship between concrete stress and strain in accordance with Section 10.26 of ACI 318-71. The assumptions used are in accordance with Sections 10.2.1 and 10.2.6 of ACI-318-71 and are summarized below:

1. The distribution of strain through the section is linear and proportional to distance from the neutral axis.

2. Concrete tensile strength capacity is neglected.

3. The maximum usable concrete strain is 0.003 at the extreme compression fiber.

4. Stress in the reinforcing steel is considered equal to Es (modulus of elasticity of reinforcing steel) times strain in the reinforcing steel up to yield strain. Above yield strain stress in the reinforcing steel is independent of strain and is equal to the yield stress of the steel.

5. The stress-strain curve of the concrete is given by Equation for the Stress-Strain Curve of Concrete, in the Journal of the American Concrete Institute, September 1964, Equation (14)

(Reference 5).

2. The use of the nonlinear terminology within the context of the report refers only to the stress distribu-tion within the concrete sections and not to the method of analysis. The analysis performed was linear elastic.

Revision 5209/29/2016 NAPS UFSAR 9A-8 In order to verify the NEWSECT code, a comparison of the ultimate moment resisting capacity of a reinforced concrete section as calculated by hand and as calculated by NEWSECT is shown below.

Fy = 40,000 psi d = 20.5" Fc' = 3000 psi 24" b = 12" 3.5" As = 1.0 in 2 a

M u = A s F y d - ---

2 Mu = ultimate moment capacity of section As = area of reinforcing steel Fy = yield stress of reinforcing steel F c' = compressive strength of concrete d = distance from extreme compression fiber to centroid of reinforcing steel a = depth of equivalent rectangular stress block By summation of forces on the section T=C AsFy = 0.85Fcab 40(1) = 0.85(3)a(12) a = 1.307 in.

1.307 M u = 40 ( 1 ) 20.5 - -------------

2 Mu = 795.6 in-K = 66.15 ft-kips Mu from NEWSECT = 66.38 ft-kips (see Table 9A-1)

The results of the above analyses were factored into the governing load equations.

Violations of the design allowables occur in the upper northeast and northwest corners of the pool as well as the intersection with the north wall of the weir wall at the end of the Unit 2 canal and the pipe tunnel junction with the north wall. The large aspect ratio of the north wall (length to height = 3) is the primary contributor to the problems associated with the fuel pool generating large cantilever moments at the base of the wall and large horizontal moments at the upper

Revision 5209/29/2016 NAPS UFSAR 9A-9 corners. The deflections in the wall are also significant enough to induce tension in the members out of plane to the north wall, creating discontinuity stresses in the main wall.

The remaining portions of the spent-fuel pool meet the design criteria.

To relieve the load concentrations at the above points, a counterfort is required on the interior face of the north wall (Figure 9A-2).

A revised finite-element model using the same analytical techniques described above showed that the load reductions with the added counterfort are sufficient to bring the pool design stresses within the design criteria. Results of the revised analysis are shown in Table 9A-2.

As part of the spent fuel pool reracking effort, the thermal analysis for the spent fuel pool was evaluated and determined to be unaffected because the spent fuel pool temperature criteria were not changed. Likewise, full core offloads during normal refueling do not impact the thermal analysis for the spent fuel pool since the temperature criteria were not changed.

9A.6 CONCLUSION The analysis performed on the North Anna Units 1 and 2 spent-fuel pool showed that the pool design as it presently exists is marginally under-reinforced for the design operating conditions. Although the pool fails to pass the criteria for operating conditions, it does not constitute a danger to the public safety as the unfactored average stresses in the pool are low and the margin to a failure mechanism is still quite high.

The addition of the counterfort will reduce the stresses along the north wall to within the bounds of the allowable criteria and constitutes the only corrective structural action required for the spent-fuel pool.

9A REFERENCES

1. Moody, W. T., Moments and Reactions for Rectangular Plates, U.S. Department of the Interior, Bureau of Reclamation.

2. American Concrete Institute, Building Code Requirements for Reinforced Concrete, Standard 318-71, 1971.

3. U.S. Atomic Energy Commission, Nuclear Reactors and Earthquakes, TID-7024, Division of Technical Information, August 1963.

4. U.S. Nuclear Regulatory Commission, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR edition, Section 3.8.3 and Section 3.8.4, NUREG-75/087, Directorate of Licensing, September 1975.

Revision 5209/29/2016 NAPS UFSAR 9A-10

5. American Concrete Institute, Equation for the Stress-Strain Curve of Concrete, Journal of the American Concrete Institute, September 1964.

6. Stone & Webster Engineering Corporation, Spent Fuel Storage Pool North Anna Units 1 and 2 Project drawings.

7. National Lead Company, 10/24 and 1/2 spent fuel shipping cask drawings 70651F; 70510F.

8. Bechtel Power Corporation, Design of Structures for Missile Impact, BC-TOP-9-A, Revision 2, 1974.

9. Ammann and Whitney Consulting Engineers, Primary Fragment Characteristics and Impact Effects in Protective Design, New York, N.Y.

10. American Society of Civil Engineers, Structural Analysis and Design of Nuclear Plant Facilities, 1976.

11. Department of the Army, Structures to Resist the Effects of Accidental Explosions, TM 5-1300, Washington, D.C., 1965.

12. R. C. Gwaltney, Missile Generation and Protection in Light-Water-Cooled Power Reactor Plants, ORNL NSIC-22, Oak Ridge National Laboratory, Oak Ridge, Tennessee, 1968.

13. G. Winter, Design of Concrete Structures, McGraw-Hill Book Company, 1972.

14. U.S. Department of the Army, Protective Design - Fundamentals of Protective Design (Nonnuclear), TM-5-855-1, Department of the Army Technical Manual, 1965.

15. R. J. Roark, Formulae for Stress and Strain, McGraw-Hill Book Company, 1965.

16. R. H. Wood, Plastic and Elastic Design of Slabs and Plates, Ronald Press Company, 1961.

17. J. M. Biggs, Introduction to Structural Dynamics, McGraw-Hill Book Company, 1964.

18. R. A. Williamson and R. R. Alvy, Impact Effects of Fragments Striking Structural Elements, Holmes and Narver, Inc., 1973.

19. R. A. Beth, Concrete Penetration, OSRD-4856, National Defense Research Committee Report A-319, 1945.

20. S. Timoshenko and S. Wionowski-Kreiger, Theory of Plates and Shell, McGraw-Hill Book Company, 1945.

21. K. W. Johansen, Yield-Line Formulae for Slabs, Cement and Concrete, Association London (translation by Pauling M. Katborg).

22. E. Hognestad, Yield-Line Theory for the Ultimate Flexural Strength of Reinforced Concrete Slabs, ACF Journal, Vol. 24, No. 7, 1953.

Revision 5209/29/2016 NAPS UFSAR 9A-11 9A REFERENCE DRAWINGS The list of Station Drawings below is provided for information only. The referenced drawings are not part of the UFSAR. This is not intended to be a complete listing of all Station Drawings referenced from this section of the UFSAR. The contents of Station Drawings are controlled by station procedure.

Drawing Number Description

1. 11715-FM-3A Arrangement: Fuel Building, Sheet 1

2. 11715-FM-3B Arrangement: Fuel Building, Sheet 2

Revision 5209/29/2016 NAPS UFSAR 9A-12 Table 9A-1 COMPARISON OF ULTIMATE FLEXURAL CAPACITY AS CALCULATED BY NEWSECT VS. HAND COMPUTATION Comp strength of concrete = 0.3000D+04 (psi)

Steel yield strength = 0.4000D+05 (psi)

Section depth = 24.000 (in)

Section width = 12.000 (in)

Maximum strain in concrete = 0.237D-02 Maximum stress in concrete = 0.3000D+04 (psi)

Concrete uncracked length = 0.1464D+01 (in)

Steel Area Distance Strain Stress (ksi) Force (kips)

No. (sq. in) (in) 1 1.000 3.500 0.3095D-01 40.000 40.000 Force in concrete = 0.4000D+02 (kips)

Calculated force = 0.000 (kips) Applied force = 0.0 (kips)

Calculated moment = 66.377 (kip-ft) Applied moment = 66.377 (kip-ft)

Mu = 66.38 ft-kips (from NEWSECT)

Mu = 66.15 ft-kips (from hand solution according to ACI 318-71)

Revision 5209/29/2016 NAPS UFSAR 9A-13 Table 9A-2 REVISED ANALYSIS RESULTS Load Combination Reinforced Stresses Location U1 (ksi) U2 (ksi) U3 (ksi)

North wall A 15.96 17.77 18.70 B 24.20 17.97 17.56 C 23.70 Small Small D 29.50 9.50 7.79 E 17.65 12.47 12.31 Short east wall A 31.63 23.72 23.21 A1 27.57 27.23 10.03 West wall B 25.50 19.12 21.33 B1 22.89 8.47 6.36 South wall A 4.58 3.13 2.76 C 5.39 22.38 23.68 C1 16.98 28.36 29.73 D 6.91 4.13 4.86 East wall B 31.65 29.36 30.67 B1 36.55 8.07 Small Mat at face of counterfort 25.66 24.55 27.54 Note 1: Load combinations U1 = 1.4D + 1.7L + 1.9E U2 = 0.75 (1.4D + 1.7L + 1.9E + 1.7To)

U3 = D + L + Ta + E' For definition of symbols see Section 9A.5.3.

Note 2: Allowable stress = 39.6 ksi.

Note 3: Concrete compressive stresses are not shown since the sections are under-reinforced and cannot develop high compressive loads.

Figure 9A-1 THREE-DIMENSIONAL MATHEMATICAL MODEL OF THE SPENT-FUEL PIT STRUCTURE Revision 5209/29/2016 NAPS UFSAR 9A-14

Revision 5209/29/2016 NAPS UFSAR 9A-15 Figure 9A-2 COUNTERFORT DETAIL

Revision 5209/29/2016 NAPS UFSAR 9A-16 Figure 9A-3 FUEL POOL - MAT SLAB

Revision 5209/29/2016 NAPS UFSAR 9A-17 Figure 9A-4 FUEL POOL - NORTH WALL

Revision 5209/29/2016 NAPS UFSAR 9A-18 Figure 9A-5 FUEL POOL - SOUTH WALL

Revision 5209/29/2016 NAPS UFSAR 9A-19 Figure 9A-6 FUEL POOL - SHORT EAST WALL

Revision 5209/29/2016 NAPS UFSAR 9A-20 Figure 9A-7 FUEL POOL - WEST WALL

Revision 5209/29/2016 NAPS UFSAR 9A-21 Figure 9A-8 FUEL POOL - EAST WALL

Revision 5209/29/2016 NAPS UFSAR 9A-22 Intentionally Blank

Revision 5209/29/2016 NAPS UFSAR 9B-i Appendix 9B Fuel Pool Separating Wall Design

Revision 5209/29/2016 NAPS UFSAR 9B-ii Intentionally Blank

Revision 5209/29/2016 NAPS UFSAR 9B-1 APPENDIX 9B FUEL POOL SEPARATING WALL DESIGN 1 9B.1 INTRODUCTION The purpose of this design is to provide a separating wall between the loading area for the spent-fuel cask and the spent-fuel storage area of the fuel pool. The wall is to act as a barrier to prevent a cask from falling on spent fuel in the fuel storage area of the spent-fuel pool.

9B.2 CASKS EVALUATED The National Lead Company NLI (10/24) multi-element rail cask and the NLI (1/2) single-element truck cask were used in this analysis. See Figures 9B-1 and 9B-2 for the dimensions and weights of these fuel casks. When a cask is selected for use at some time in the future, this analysis will be reevaluated to ensure that the cask used would not cause an accident more severe than that described in this report.

A subsequent safety evaluation concluded that the consequences from the drop of either an NLI 1/2 or an NLI 10/24 cask are bounding for a TN-32 storage cask and are bounding for a NUHOMS OS-187H transfer cask. The TN-32 cask is described in the North Anna ISFSI Safety Analysis Report and the TN-32 Topical Safety Analysis Report. The NUHOMS OS-187H transfer cask is described in the NUHOMS-HD Final Safety Analysis Report. 32-inch high pedestal has been placed in the deep end of the cask loading area to allow the fuel assemblies in the spent fuel cask to be at approximately the same elevation as the assemblies in the spent fuel racks. As evaluation of this pedestal shows that the original TN-32 drop and tip analyses remain bounding.

9B.3 ACCIDENTS CONSIDERED Since the spent-fuel cask is suspended from a crane that can move only in a north-south direction, the only way a horizontal velocity could occur that would cause the cask to move in the direction of the fuel storage area would be from either a failure in a cask trunnion, lifting yoke, or crane cable, or east-west earthquake excitation while the cask is sitting on the floor, pedestal, or ledge. In evaluating the adequacy of the wall, each of these occurrences is assumed to be possible any time during the casks vertical or horizontal travel. Based on the arrangement of the fuel-cask-loading area and the path of the cask, no other events that would cause cask movement toward the fuel storage area have been postulated. The above-stated events were considered in the following manner.

1. This appendix was originally submitted as Appendix N to the North Anna FSAR.

Revision 5209/29/2016 NAPS UFSAR 9B-2 9B.3.1 Failure or Disengagement of One Trunnion or One-Half of the Lifting Yoke If a failure occurred while the trunnion axis was aligned in an east-west direction, in either the cask trunnion or yoke of a two-trunnion cask, the cask would free-fall vertically until the remaining half of the yoke became taut (see Figure 9B-3). At this time, the force in the intact portion of the yoke would impart both a horizontal and rotational velocity to the cask, causing it to move toward the fuel storage area.

In order to prevent this accident from causing damage to the spent fuel, cask-handling procedures will ensure that the trunnion axis is in a north-south direction. This orientation will obviate any consideration of cask movement in an east-west direction. In this procedure, the cask will be rotated before it is brought into the fuel building so that the trunnion axis will be aligned in a north-south direction and kept in that orientation during its entire time in the fuel building. If a failure occurs while the trunnions have this orientation, the resulting motion of the cask can only be in a north-south direction, which is parallel to the separating wall and not toward the fuel storage area.

9B.3.2 Failure in Crane Cable The second event that may cause the cask to move toward the fuel storage area is a failure in the crane cable between the lower block-hook assembly and either the cable drum or the upper block (equalizing drum) at the cable bridge (see Figure 9B-4). If part of this cable broke, the cask would fall straight down as the remaining cable unwound through the upper and lower blocks.

However, because of the possibility of the cable whipping after it breaks, wrapping around the remaining cable and preventing its running freely through the blocks, it will be assumed that the cask is supported by the remaining cable that is prevented from running out. In order to conservatively maximize the energy of the cask due to swinging on the remaining cable, the stabilizing effect of the cable between the lower block and the upper block was neglected. This assumes that the cask, lower block, yoke, and cable system are swinging about the point of attachment at the cable drum of the single cable running between the lower block and the cable take-up drum on the crane bridge. This point is the farthest point away from the center of gravity of the system and has the greatest arc of swing. This will cause the center of gravity of the system to have the largest change in vertical height and, therefore, the largest change in potential energy that will be transformed into kinetic energy. It is this kinetic energy that was used in determining the adequacy of the wall design. Since the point of attachment at the cable drum varies as the cask is lowered and more cable is unwound from the drum, the kinetic energy at impact was calculated for the fully raised and fully lowered cases.

When the cask is in the fully raised position, in addition to ensuring that the wall is adequately designed to absorb the cask energy, the cask motion was checked to ensure that it did not have sufficient energy to cause it to tip over the top of the wall and fall into the fuel storage area. For this purpose, the cask was assumed to have its largest kinetic energy; any energy absorbed by local crushing of the concrete in the wall or flexure of the wall was conservatively

Revision 5209/29/2016 NAPS UFSAR 9B-3 neglected. At impact, the remaining cable was conservatively assumed to go slack as the cask rotated about the point of impact. The maximum kinetic energy of the system, due to swinging, was compared to the work required to raise the center of gravity of the system to an unstable position that would cause the cask to continue to tip toward the fuel storage area (see Figure 9B-5). For the NLI (10/24) cask, the kinetic energy was 149 in.-K and the available restoring energy was 1614 in.-K; for the NLI (1/2) cask, the maximum kinetic energy was 59 in.-K and the available restoring energy was 79 in.-K. The above procedure is not required for the NLI (1/2) cask since, because of its smaller diameter and therefore greater distance from the wall, it will not swing far enough in the fully raised position to hit the wall. Due to the above conservative procedure, it is shown that there is no possibility of the cask tipping over the top of the separating wall resulting from a cable break.

9B.3.3 Cask Tip Due to Seismic Event Both casks were subjected to simultaneous horizontal and vertical accelerations that would occur under the design-basis earthquake when sitting on the ledge at Elevation 269 ft. 0 in., or on the floor at Elevation 246 ft. 10 in. (see Figure 9B-6). The NLI (10/24) cask was found to be stable under the above excitation. However, the NLI (1/2) truck cask was not found to be stable when the overturning moment, produced by the seismic accelerations, was compared to the restoring moment of the cask deadweight. This cask was then assumed to rotate about one edge due to the maximum seismic inertia loads (which were conservatively assumed to remain constant during rotation of the cask) and the resulting kinetic energy at impact was calculated as shown in Figure 9B-6. It was found to have a kinetic energy of 211 in.-K at impact, less than other governing design conditions that are summarized in Table 9B-1.

9B.4 SEPARATING WALL ANALYSIS AND DESIGN 9B.4.1 Introduction The wall separating the fuel-cask-loading area from the spent-fuel storage area is a concrete wall that is 3-ft. 6-in. thick, 21-ft. 4-in. wide by 42-ft. 6-in. high, with a slot in the top that is 3-feet wide by 25-ft. 10-in. high to allow transfer of spent fuel from the fuel storage area to the fuel-cask-loading area. It is reinforced with bundled (two bars per bundle) No. 8 reinforcing bars at 12-inch center-to-center spacing both horizontally and vertically in each face. These bars are anchored into the existing concrete fuel pool walls and mat by drilling and grouting. Embedments are designed to develop the ultimate tensile strength of the bars. The wall is lined on both sides with a 1/4-inch-thick ASTM A-240, Type 304, stainless steel liner. The presence of the liner on the spent-fuel storage side of the wall guarantees that, if there is damage to the floor or wall liners in the cask-loading area due to a cask drop accident, there will still be a continuous intact liner around the stored spent fuel to ensure adequate water over the fuel. However, the structural benefits of the liner were conservatively neglected.

Revision 5209/29/2016 NAPS UFSAR 9B-4 9B.4.2 Analysis Methods The wall was analyzed according to the methods outlined in a Bechtel Corporation report, reviewed by the AEC Structural Engineering Branch staff in November 1974.

For all cases of cask impact, the cask itself was assumed to be rigid and, therefore, conservatively, requiring that all energy be absorbed by the wall without any energy being absorbed by deformation of the cask. The effects of buoyancy and drag forces on the cask have been conservatively neglected. During impact of the cask, energy will be absorbed simultaneously in the wall via two phenomena. There will be overall displacement of the wall at the point of impact that will cause strain energy to be dissipated in the wall by flexural movement. At the same time, energy will be dissipated by crushing of the concrete at the point of impact as the cask penetrates into the wall. In this analysis, it was conservatively required that the wall absorb the cask energy either entirely by flexural displacement or entirely by penetration without a punching shear failure occurring, since is extremely difficult to describe in time the distribution of force and energy between the two mechanisms. The wall was designed to absorb plastically, in flexure, the entire kinetic energy of the cask at impact in conjunction with concurrent seismic, hydrostatic, and dead load. The flexural resistance of the wall was determined using yield line analysis, and the ductility ratio () required to absorb the cask energy was limited to less than 10.

The allowable ductility limit is consistent with past positions of the NRC staff, as stated in their review of the above-mentioned Bechtel report. Figure 9B-7 illustrates the elastoplastic strain energy available in the wall to absorb the cask energy.

Rm = yield line resistance of wall (kips)

P1 = k x y1 (kips) y1 = displacement at point of impact due to concurrent loads (in.)

k = stiffness (kips/in.) of wall as determined from an elastic analysis of the wall using two-dimensional finite elements and a cracked-concrete section Rm yel = ------- (yield displacement) k y max

= -----------

y el (Rm - P1) (ymax - yel) + 1/2 (Rm - P1) (yel - y1) = kinetic energy of the cask at impact.

The separating wall was also designed to absorb the cask energy entirely via penetration of the cask into the concrete without perforation or formation of a shear plug. Small particles, if any, will be stopped by the liner on the fuel storage side of the wall.

Revision 5209/29/2016 NAPS UFSAR 9B-5 Missile impact testing of reinforced-concrete test panels has been performed by IITRI-S&W (References 2 & 3) and Calspan-Bechtel (Reference 4). From these tests, it was determined that a rigid missile (steel slug) penetrating a depth T into a concrete wall generated an equivalent contact stress during impact of approximately 55 ksi. This type of missile will generate the highest impact force. The contact stress was determined from the following equations:

(F x T) = 1/2 MV2 2 2

= d F = MV -------------

2T 4 2

2MV

= ---------------

2 d T where:

(F x T) = work done by concrete on missile F = force applied by concrete on the missile during impact (kips)

M = mass of the missile (kips-sec2/in.)

V = velocity of missile at impact (in./sec)

T = penetration of missile (in.)

d = diameter of missile (in.)

= contact stress, 55 ksi.

During impact, the cask is assumed to exert over the area of contact a stress of 55 ksi on the concrete. Since the contact area increases with penetration, the area is calculated at small increments of penetration and the concrete checked for shear failure at each increment. The work done during each increment of penetration is:

W =AT W = work done during penetration (in.-kips)

T = increment of penetration (in.)

A = contact area during increment of penetration T (in2)

The work done during each increment of penetration is added to that done during previous penetration and the process continued until the total work done is equal to the initial kinetic energy of the cask.

Revision 5209/29/2016 NAPS UFSAR 9B-6 9B.4.3 Results The wall was examined for its flexural and shear capacity at the top of the fuel transfer slot, since this is the weakest location of the wall. At the location (Point A in Figure 9B-8), the wall was analyzed for the impact energies due to a cable break when the NLI (10/24) cask is in the fully raised position and the bottom of the cask is 1 foot above the top of the spent-fuel pool walls.

Also, the energy resulting from the seismic tip of the NLI (1/2) truck cask, when it is subjected to the design-basis earthquake while seated on the ledge at Elevation 269 ft. 0 in., was investigated.

The wall was also analyzed for cask impact at the bottom of the fuel transfer slot, since this is the weakest point of the lower portion of the wall (Point B in Figure 9B-8). At this location, the wall was checked for the impact energy due to a cable break when the NLI (10/24) cask is in the fully lowered position. Also checked was the impact energy resulting from the tipping of the NLI (1/2) truck cask under the design-basis earthquake while sitting on the floor at Elevation 246 ft. 10 in.

For conservatism, the energy from tipping of the cask while sitting at Elevation 269 ft. 0 in. was used. The kinetic energies and impact points considered in the wall analysis are summarized in Table 9B-1.

9B.5 CONCLUSION In establishing the impact energies from the cable break accident, the energy was conservatively estimated by ignoring the stabilizing effect of the remaining cable between the lower block and the upper block. Also, the energy from the cask tip, due to a seismic event, was conservatively estimated by assuming the maximum seismic acceleration to remain constant during the cask rotation. The effects of buoyancy and drag forces were conservatively neglected in calculating the cask impact energies. These factors, coupled with the fact that the wall was conservatively analyzed by requiring total absorption of cask energy solely by flexure or solely by penetration of the cask without a punching shear failure occurring, and the fact that neither substantial penetration or plastic deformation resulted in the wall, demonstrate the adequacy of the separating wall in providing a conservatively designed protective barrier for the fuel storage area. In addition, the use of administrative controls to prevent cask motion toward the spent fuel from a trunnion/yoke failure, together with the physical restriction of the cask-handling crane movement in an east-west direction, demonstrates conclusively the inability of a fuel-cask-handling accident to cause damage to stored spent fuel.

Revision 5209/29/2016 NAPS UFSAR 9B-7 9B REFERENCES

1. Bechtel Power Corporation, Topical Report, Design of Structures for Missile Impact, BC-TOP-9A, Revision 2, San Francisco, California, 1974.

2. Z. D. Jankov, J. A. Shanahan, and M. P. White, Missile Tests of Quarter-Scale Reinforced Concrete Barriers, Stone & Webster Engineering Corporation, a paper presented to the Symposium on Tornadoes, Assessment of Knowledge, and Implications for Man, Texas Tech University, 1976.

3. IIT Research Institute, One Quarter Size Reinforced Concrete Missile Barrier Tests, Project J8184 for Stone & Webster Engineering Corporation, 1976.

4. Calspan Corporation, Technical Report, Missile Impact Testing of Reinforced Concrete Panels, HC-5609-D-1, Buffalo, New York, prepared for Bechtel Power Corporation, 1975.

Revision 5209/29/2016 NAPS UFSAR 9B-8 Table 9B-1 GOVERNING DESIGN CONDITIONS FOR CASKS AT IMPACT Accident Impact Point Penetration Description (Figure 9B-8) Kinetic Energy Ductility Ratio Depth Cable break - A 149 in.-kips <1.0 0.4 in.

NLI (10/24) cask in fully raised position Cable break - A 58 in.-kips <1.0 Not checked NLI (1/2) cask because the in fully raised above governs position Cask tip - NLI A 211 in.-kips =1.02 0.55 in.

(1/2) cask due to seismic tip Cask tip - NLI B 211 in.-kips <1.0 0.55 in.

(1/2) cask due to seismic tip Cable break - B 619 in.-kips =1.13 0.71 in.

NLI (10/24) cask in fully lowered position Cable break - B 336 in.-kips <1.0 0.63 in.

NLI (1/2) cask in fully lowered position

Revision 5209/29/2016 NAPS UFSAR 9B-9 Figure 9B-1 NLI - 10/24 RAIL CASK

Revision 5209/29/2016 NAPS UFSAR 9B-10 Figure 9B-2 NLI - 1/2 TRUCK CASK

Revision 5209/29/2016 NAPS UFSAR 9B-11 Figure 9B-3 FAILURE OF LIFTING YOKE OR TRUNNION

Revision 5209/29/2016 NAPS UFSAR 9B-12 Figure 9B-4 FAILURE IN CRANE CABLE

Revision 5209/29/2016 NAPS UFSAR 9B-13 Figure 9B-5 CASK TIP DUE TO CABLE BREAK

Revision 5209/29/2016 NAPS UFSAR 9B-14 Figure 9B-6 CASK TIP DUE TO SEISMIC MOTION

Revision 5209/29/2016 NAPS UFSAR 9B-15 Figure 9B-7 ELASTO-PLASTIC RESPONSE & AVAILABLE STRAIN ENERGY OF THE WALL

Revision 5209/29/2016 NAPS UFSAR 9B-16 Figure 9B-8 CASK IMPACT LOCATIONS

ML17033B540

Text

9.2 REFERENCES

9.3 REFERENCES

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

9.5 REFERENCES

Subject:

SUMMARY

9.6 REFERENCES

Navigation menu

Search