ML17258A417
| ML17258A417 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 12/30/1981 |
| From: | Maier J ROCHESTER GAS & ELECTRIC CORP. |
| To: | Crutchfield D Office of Nuclear Reactor Regulation |
| References | |
| TASK-03-04.C, TASK-3-4.C, TASK-RR NUDOCS 8201060522 | |
| Download: ML17258A417 (43) | |
Text
'I REGULATORY INFORMATION DISTRIBUTION ST TEM ('RIDS)
SUBJECT:
Forwards.safety assessment for SEP Topic III.4.Ciinternally-generated missiles,Addi evaluation will 'be performed during Spring 19S2 refueli.ng outageiallowing access to containment-
~
Missiles,do not represent safety concern.
DISTRIBUTION )CODE!
A035S
>COPIES >RECEIVED LTR ENCL TITLE:
SEP 'Topics SIZE:,
AOCE'SSION NBR:8201060522 DOC ~ DATE: 61/12/30 NOTARI'ZED:
NO DOCKET FACIL:50 '244 Rober t Emmet Ginna Nuclear 'Plant<
Unijt 1g Rochester G
05000244 AUTH ~ NAME AUTHOR AFFILIATION MAIERiJ ~ E, Rochester Gas 8 Electric Corp'EiCIP BYNAME RECIPIENT AFFILIATION GRUTCHF IELDi D ~
Operating Reactors Branch 5
NOTES: 1 copy:SEP "Sect, Ldr ~
05000244 RECIPIENT ID CODE/NAME ACTION:
=06 NRR/DE/HGEB 10 NRR/DL SEPB 12 04 COPIES LTTR ENCL 7
7 2
'2 2
"2 3
3 1
1 RECIPIENT ID CODE/NAME NRR/DF/ADYQE 13 NRR/DL/ORAB 11 NRR/DS I/CSB 07 COPIES LTTR ENCL EXTERNAL: ACRS, NRC PDR 14' 02 10 10 1
LPDR NTIS 3~
5&.
TOTAL NUMBER OF COPIES REQUIRED o L'TTR ENCL 1
C$ g~
ai
~
/
~
~
I
It I!4I////IIII / /IIIIIIII!IIII
" ZII
/I/ ~IIIIIIIII/
ROCHESTER GAS AND ELECTRIC CORPORATION
~ 89 EAST AVENUE, ROCHESTER, N.Y. 14649 JOHN E. MAIER Vice President TELERHONE AREA CODE 7le 546-2700 December 30, 1981 Director of Nuclear Reactor Regulation Attention:
Mr. Dennis M. Crutchfield, Chief Operating Reactors Branch No.
5 U.S. Nuclear Regulatory Commission Washington, D.C.
20555 pp.gg,IVY 5 882~
~
DsiruN WlASRI ClNDDDD DDt,<<gg QS4QDtt DD moc
Subject:
SEP Topic III-4.C, Internally Generated Missiles R. E. Ginna Nuclear Power Plant Docket No. 50-244
Dear Mr. Crutchfield:
Consistent with the SEP Redirection effort, attached is Rochester Gas and Electric's Safety Assessment for SEP Topic III-4.C, Internally Generated Missiles.
This assessment is based on the guidance and format provided in the NRC's "lead topic" assessment for the Palisades Nuclear Plant, sent by letter from the NRC to Consumers Power Company dated July,,20, 1981.
It. should be noted that. additional evaluation of certain potential internally-generatedmissiles must. yet be. completed.
Some of this work cannot be perfo'rmed"until access to the containment is available, during the Spring 1982 refueling outage.
Any conclusions changed as the result of the refueling outage inspections will be incorporated into the assessment, at that time.
We believe we have comprehensively defined all potential internally-generated missiles.
However, if any additional potential missile sources or damaging effects are noted in future reviews, the information will be used to revise this safety assessment.
Very truly yours, Jo n E. Maier Attachment ag()gPb052>0500P2P4I
= ------=----sai230
'OP ADDCK pDR i
P e5
h
j
~ ~
Attachment SAFETY ASSESSMENT R. E.
GINNA NUCLEAR POWER PLANT SYSTEMATIC EVALUATION PROGRAM TOPIC:
III-4.C INTERNALLY GENERATED MISSILES INTRODUCTION Missiles postulated to be generated internally to the reactor facility (inside or outside containment.)
could possibly damage structures, systems and components:
1) that are necessary for the safe shutdown of the reactor facility, or accident mitigation, and. 2) whose failure could result in a significant release of radioactivity.
The potential sources of such missiles are valve stems and
- bonnets, hardware-retaining bolts, relief valve parts, instrument wells, pressure containing eguipment such as accumulators and high pressure bottles, high speed rotating machinery, and rotating segments (e.g.,
impellers and fan blades).
Sco e of Review The scope of review is as outlined in the Standard Review Plan (SRP) Section 3.5.1.1, "Internally Generated Missiles (Outside Containment),"
and SRP Section.3.5.1.2, "Internally Generated Missiles (Inside Containment)."
The review specifically excludes SRP Section 3.6.1, "Plant Design for Protection Against Postulated Piping Failures in Fluid Systems Outs'.de Containment," 3.6.2, "Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping," as well as those SRP sections dealing with natural phenomena (including missiles generated by natural phenomena),
missiles generated outside the facility, and turbine missiles.
REVIEW CRITERIA The acceptability of the design of protection for facility structures,
- systems, and components from internally generated missiles is based on meeting the following criteria:
1.
General Design Criterion 4, with respect to protecting structures, systems and components against the effects of internally generated missiles to maintain their essential safety functions.
2.
Regulatory Guide 1.13, as related to the spent fuel pool systems and structures being capable of with-standing the effects of internally generated missiles and preventing missiles from impacting stored-fuel assemblies.
~
~
f I
P J 't f I, II f
C I'
1
Regulatory Guide 1.27, as related to the ultimate heat sink being capable of withstanding the effects of internally generated missiles.
III.
RELATED SAFETY TOPICS AND INTERFACES Review Areas Outside the Sco e of this To ic As stated previously, this review specifically excluded the following:
SRP Section 3.6.1, "Plant Design for Protection Against Postulated Piping Failure in Fluid Systems Outside Containment" This matter is covered under SEP Topic III-5.B "Piping Break Outside Containment."
2.
3.
SRP Section 3.6.2, "Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping" - This matter is'covered under SEP Topic III-S.A "Effects of Pipe Break on Structures, Systems and Components Inside Containment."
Natural Phenomena - This matter is covered under SEP Topics III-6, "Seismic Design Considerations" and III-4.A, "Tornado Missiles."
Turbine Missiles This matter is covered under SEP Topic III-4.B, "Turbine Missiles."
Interfaces with Other SEP To ics Topic II-3.C "Safety-Related Water Supply (Ultimate Heat Sink)"
2.
5.
6.
7.
8.
9.
10.
Topic III-1 "Classification" Topic III-S.A, "High Energy Line Break Inside Containment" Topic III-5.B, "Pipe Break Outside Containment" Topic V-5, "RCPB Leak Detection" Topic VII-3 "Systems Reguired for Safe Shutdown" Topic VII-4 "Effects of Failure in Non-Safety Related Systems on Selected Engineered Safety Features" Topic IX-1 "Fuel Storage" Topic IX-3 "Station Service and Cooling Water System" Topic IX-5, "Ventilation Systems"
0
~
~
I I
12.
Topic IX-6, "Fire Protection" Topix KV-16, "Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment."
REVIEW GUIDELINES Structures, systems and components which should be evaluated relative to internally generated missiles are identified below:
2.
3.
Systems needed to perform safety functions (safe plant shutdown or accident mitigations):-
a.
Emergency Core Cooling Systems c.
Containment Heat Removal and Atmosphere Cleanup Systems d.
Chemical and Volume Control System (portions of) e.
Residual Heat Removal System f.
Component Cooling Water System g.
Service Water System h.
Diesel Generator Auxiliary Systems i.
Main Steam System (portions of) j.
Feedwater and Condensate Systems (portions of) k.
Steam Generator Blowdown System l.
Auxiliary Feedwater Systems m.
Standby Auxiliary Feedwater System n.
Ventilation System for Vital Areas o.
Combustible Gas Control System p.
Refueling Water Storage Tank Systems whose failure may result in damage to safety-related equipment or in release of radioactivity:
a.
Spent Fuel Pool Cooling and Cleanup System b.
Sampling System c.
Waste Disposal System d.
Containment Purge System e.
Instrument and Service Air Systems All Class IE electrical systems, including the diesel generators and batteries, as well as the necessary
- cabling, cable trays, conduit, switchgear, instrumentation, control panels, etc.,
which are necessary for the performance of safety functions.
REVIEW AND EVALUATION General - As noted in the Ginna FSAR, Section 6.1, the ZoOO.,owz.ng design philosophy was used during the design and construction of Ginna to prevent internally generated missiles from becoming a hazard to safety-related equipment:
0
~
~
I
"AEC General Design'riterion 40 Adequate protection for those engineered safety features, the failure of which could cause an undue risk to the health and safety of the public, shall be provided against dynamic effects and missiles that might result from plant equipment failures."
RG&E Design Basis to Effect GDC 40 (from Section 6.1.3 of the, Ginna FSAR):
"Systems containing hot pressurized fluids are carefully checked for potential sources of missiles where such missiles could be directed toward safety features.
Suitable engineering and quality control are applied to'the design, manufacture, and installation of com-ponents to prevent the generation of missiles where such missiles could adversely affect the intended functioning of engineered, safety features.
- Thus, a design criterion is that components of the pressurized system defined above are not missile sources.
Prevention of missiles is accomplished by identifying all potential sources, investigating to assure design adequacy in preventing missile generation, redesigning where the investigation discloses inadequate safety margins for missile prevention, and providing a suitable quality assurance program to avoid unanti-cipated deficiencies and assure that design margins are preserved."
Also, from Section 6.1.1 of the Ginna FSAR:
. For such engineered safety features which are required to ensure safety in the event of a LOCA or equipment failure, protection is provided primarily by the provisions which are taken in the design to prevent the generation of missiles.
In addition, protection is also provided by the layout of plant equipment or by missile barriers in certain cases."
The following discussions will describe the specific plant systems and features, in order to evaluate the
.internally-generated missile protection available at, Ginna.
2.
S stems Needed to Perform Safet Functions:
a.
Reactor Coolant S stem The reactor coolant system serves as the pressure retaining boundary for the reactor coolant and is comprised of a reactor pressure vessel and two parallel heat transfer loops.
Each loop contains
'ne steam generator and one pump, connecting
e
piping and instrumentation.
A pressurizer and associated safety and relief valves are connected to one of the reactor hot legs via the surge line.
Pressurizer spray lines and associated valves are connected to the top of the pressurizer from each of the reactor coolant cold legs, at the discharge of the reactor coolant pump.
The purpose of the pressurizer is to maintain primary coolant pressure and compensate for coolant. volume changes as the heat load changes.
All components of the primary coolant system are located within the containment building.
Overpressure protection is provided to assure the coolant system pressure does not exceed design limits.
The reactor closure head and the reactor vessel
.flange are joined by 48 six-inch diameter studs.
It is unlikely that, any of the studs would become a missile since they are not subjected to direct reactor pressure and, therefore, are not exposed to sufficient pressure to create an accelerating force sufficient to cause them to become missiles.
The pressurizer safety and relief valves, which are mounted atop the pressurizer, have the potential for becoming missiles.
The position of the pressurizer, above the loops in a concrete compartment, is such that any missiles generated because of a failure of these valves would not be likely to damage other components or piping of the reactor coolant system.
Furthermore, the plant. is designed to cope with the consequences of a full diameter hot leg
- break, a break substantially larger than any piping in the pressurizer compartment.
All valves in the pressurizer spray line are located within the loop or pressurizer compartments, and would thus not be expected to damage any safety-related equipment in the event of a valve failure.
Control rod drive assemblies are mounted on the top of the reactor vessel and are considered as an extension of the reactor vessel head.
Each control rod drive assembly is designed as a hermetically sealed unit to prevent leakage of reactor coolant.
All pressure retaining components are designed to meet the requirements of the ASNE Code,Section III, Class A vessels.
Because of this design, the assemblies are not considered as likely missiles.
- Further, 1 1/4" thick steel missile shield is placed over the control rods during operation as further protection against potential missile damage to safety systems.
l kI J
kl lt H
k
Instrumentation requires some penetration into the reactor coolant system.
These penetrations are small and generally take the form of welded wells.
The RTD's are direct.-immersion types, also with very small penetrations.
Because of their size and the fact that 'any damage would be confined within a loop compartment, RG&E does not consider that this instrumentation is of concern as related to internally-generated missiles.
RGSE also evaluated the possibility that missiles may result from destructive overspeeding of one of the primary coolant pumps in the event of a pipe break in the pump suction or discharge.
Potentially damaging impeller missile ejection from the broken pipe is minimized by a massive steel pump casing.
Generation of missiles from overspeed of the motor, flywheel and the impeller is a generic problem which will be reviewed under Task Action Plan B-68, "Pump Overspeed During a LOCA."
This is discussed in SEP Topics III-10.B and V-7.
The two steam generators have manways held in position by studs on the primary and secondary sides of the shell.
These studs are not subjected to sufficient pressure to result in a significant missile source.
These manways are used during each refueling outage, at which time the studs,
- gaskets, and manway covers are thoroughly inspected.
It is expected that leak detection systems inside containment would note any leakage, in the event of loosening of manway covers, long before any failures would be anticipated.
It is, therefore, not considered that the steam generators are likely missile generating sources.
In summary, relative to the Reactor Coolant System, it is considered that, the likelihood of missile generation, and resultant,
- damage, is minimized by virtue of equipment design features, component arrangement and compartmentalization.
b.
Emer enc Core Coolin S stem The Ginna emergency core cooling system (ECCS) serves as the means of injecting water for core protection in the event of reactor coolant system water loss and consists of a high-head safety injection system, a low-head safety injection
- system, and accumulator tanks.
High head safety injection flow and accumulator flow is provided into the reactor coolant system through the two cold leg reactor inlet pipes.
The high-head system consists of three
- pumps, each rated at 300
p t t
t ht t~
h'
gpm.
Two passive accumulator tanks containing borated water, pressurized with nitrogen to 700
- psig, are provided inside the containment, building.
The low-head safety injection system injects directly into the reactor vessel upper plenum via two nozzles on opposite sides of the vessel.
The low-head system consists of two pumps, each rated at 2000 gpm.
The initial source of water for the high-head pumps are the Boric Acid Storage Tanks.
Suction is automatically transferred to the Refueling Water Storage Tank (RWST) on low level in the Boric Acid Storage Tanks.
The initial source of water for the low-head pumps is the RWST.
Both the 'Boric Acid Storage Tanks and the RWST are located in the Auxiliary Building.
The high and low head piping systems are separated
, from each.other outside containment, taking suction from opposite sides of the RWST.
Each train of these systems is routed together in the auxiliary building.
Once inside containment,
- however, separation of the individual injection lines is provided.
Each train of low head and high head safety injection piping is routed in opposite directions inside containment.
Injection headers are located outside the missile barriers.
Individual injection lines, connected to the injection headers, pass through the missile barriers and then connect to the reactor coolant system.
As noted in Section 6.1.3 of the Ginna
- FSAR, special provisions have been made to minimize the possibility of generating internal missiles.
Most valves installed in the ECCS have stems with backseats, to prevent ejection of valve stems.
If it were assumed that the stem threads fail, the backseat would prevent penetration of the bonnet, thus preventing the valve stem from becoming a
missile.
The potential for missile generation was further minimized during the, design and construction of Ginna by use of proper valve design, materi'als selection, inspections, and testing.
The following quote from Section 6.1.3 of the Ginna FSAR describes the philosophy used:
"...Valves with nominal diameter larger than two inches are designed to prevent bonnet-body connection failure and subsequent bonnet ejection.
The means of prevention includes:
a) using the design practices of ASME Section VIII which limits the allowable stress of bolting material to less than 20% of its yield strength,
h
~
I'
b) using the design practices of ASME Section VIII for flange design, and c) controlling the load during the bonnet-body connection stud-tightening process...
The complete valves are hydrotested per USAS B16.5...
The cast stainless steel bodies and bonnets are radiographed and dye-penetrant tested to verify soundness.
"Valves with nominal diameter of two inches or smaller are forged and have screwed bonnets with canopy seals.
The canopy seal is the pressure boundary while the bonnet threads are designed to withstand the hydrostatic end force.
The pressure containing parts are designed to the criteria established by USAS B16.5 specification."
A further means of minimizing damage from internally-generated missiles in the ECCS was generally to direct the valve stem away from other safety-related equipment.
Using the information and evaluation techniques provided by the NRC in the Palisades lead topic assessment and considering the Ginna design, it was considered that the most likely source of missiles in the ECCS are the low head and high head safety injection pumps.
The high head SI pumps are 350 hp horizontal multi-stage centrifugal pumps operating at, 1770 rpm, with a design shutoff head of about 3500 feet.
The low head SI pumps are 200 hp horizontal multi-stage centrifugal pumps operating at about 3600 rpm, with a design shutoff head of about 325 feet.
These pumps have a thick steel casing, making it highly improbable that a source of missiles, such as a broken impeller, would penetrate the casing to cause any damage.
The low head safety injection pumps, also used for residual, heat removal, are located in the RHR pit, which is separated from other safety-related equipment.
During normal plant. operation, the majority of this system is isolated from the high pressure reactor coolant system, and is thus not subjected to forces which might cause a missile to be generated.
All pressure boundary valves, which are subject to high pressure, have backseats, which would prevent missile generation.
If a missile were generated as a result of pump failure during normal reactor shutdown, it, would affect only the RHR system.
The RHR system could be
- isolated, and the reactor maintained in a stable shutdown condition, using the steam generators, until repairs could be effected.
The high head safety injection system is also normally not at high pressures.
Thus, it is not expected that missiles would be generated.
Pressure boundary valves, which are subject to high pressure, have backseats to prevent missile generation.
Because of the design considerations used in the fabrication and layout of these 'systems, it is not postulated that a missile would be generated following an accident which would actuate these systems (such as following a LOCA or steam line break).
The present design basis for the ECCS is that, following an accident, the mitigation systems should be capable of maintaining safe shutdown or abundant emergency core cooling, even in the event of a single active failure.
Passive failures are considered of low enough probability not to require additional consideration.
The two accumulators are located on separate sides of the containment, and are located behind the steam generator missile shielding.
Based on a review of valve stem orientation, it is not expected that any unacceptable damage would occur as the result of a missile generated from the accumulator lines.
Additional.information relative to the design and 'potential failure modes and effects of valve 832B, a two-inch manual valve in the A accumulator instrument line, which is oriented toward some cable trays, will yet be required.
In summary, in considering the
- ECCS, because of its design and layout, component design provisions, and general operational state, it is RG&E's judgment, that the systems will be capable of performing their intended functions, even considering internally-generated missiles, as discussed
- above, pending resolution of valve 832B.
c.
Containment Heat Removal and Atmos here Cleanu
~ss erne The containment heat removal and atmosphere cleanup systems consist of two independent systems the containment air recirculation system and the con-tainment spray system.
The containment air recircu-lation system consists of four fans and heat exchangers, as well as two charcoal filter units.
The containment spray system consists of two spray pumps, with associated piping, ring headers, and nozzles.
The source of water for the containment spray system is the Refueling Water Storage Tank.
The-four containment fan cooler units are positioned in pairs on opposite sides of containment.
Therefore, because of this separation, it is unlikely that a
single missile could fail more than one pair of these units.
The spray system headers and nozzles are split into redundant "trains".
The spray nozzles are located high inside containment.
Sufficient separation is available to minimize the possibility of damage to more than a single containment spray train.
The spray system pumps are. located in the auxiliary building, near the high pressure Safety Injection pumps.
There are no high energy, lines in this vicinity which could be a source of internally generated missiles.
- Further, the spray system itself is not under pressure during normal plant operation.
It is thus concluded that no failure due to internally generated missiles are expected for the containment spray system.
It should also be noted that the failure of one spray train, or one fan cooler with charcoal filter-train, can be compensated for by operation of additional sprays or fan coolers.
In summary, in considering the containment heat removal and atmosphere cleanup
- systems, with their redundant features and separation, it is considered that these systems will be capable of performing their design function, considering internally generated missiles, as discussed above.
d.
Chemical and Volume Control S stem The chemical and volume control system (CVCS) controls and maintains reactor coolant system inventory and purity through the process of makeup and letdown, and provides seal injection flow to the reactor coolant pump seals.
The letdown portion of the system consists of a regenerative heat exchanger and a non-regenerative heat exchanger to cool the reactor coolant letdown, and three parallel orifice valves to reduce the pressure.
The coolant is then passed through purification and deborating demineralizers, as necessary, where corrosion and fission products are removed.
The coolant then is routed to the volume control tank (VCT).
Seal return flow passes from the reactor coolant pump seals, through a motor operated containment isolation valve and the seal water heat exchanger, before being returned to the VCT.
10-
'l 4
4
The seal return line is at low pressure and temperature.
The charging pumps draw from the VCT and inject into the reactor coolant, system, both through the normal makeup path and via the reactor coolant pump seals.
The charging flow passes through an accumulator at the charging pump discharge, which serves to dampen pressure surges and vibration in the charging line.
Additional water and boric acid is provided as necessary from the reactor makeup water tank and the boric acid storage tanks, respectively.
Some portions of the system are not normally in use, and are separated from the rest of the CVCS and the RCS by normally closed valves.
These portions include the excess letdown path, as well as the alternate charging and alternate auxiliary spray.
It. is considered that the most likely source of missiles in the CVCS would be generated in the portions of the system which are normally at high pressure and temperature.
A low pressure or cold water system is not considered to have a major forcing mechanism to cause internally-generated missiles.
Thus, the letdown line and charging line on the RCS side of the regenerative heat exchanger, as well as portions of the CVCS connected directly to the
- RCS, were evaluated as potential sources of internally generated missiles.
All of this piping is located inside containment.
- Also, the CVCS letdown piping up to the non-regenerative heat exchanger, located outside containment, was evaluated.
The piping systems inside containment were thoroughly evaluated in RG&E's review of SEP Topic III-5.A, "High Energy Line Break Inside Containment."
The relevant information contained in RGSE's September 12, 1979 and October 1, 1981 submittals will be repeated here with some additional information relevant to this topic assessment.
(Note:
drawings provided with the 1979 submittal include equipment location and valve designation information):
Alternate Charging this portion of the system is located within the loop compartment.
No adverse effect on any safety-related equipment. is expected, since there are no sources of missiles between the check valve and the RCS.
Auxiliary Spray - a portion of this system downstream of check valve 297 is located within the pressurizer compartment.
No adverse effects on safety-related equipment is expected, since there are no sources of missiles between the check valve and the RCS.
AOV 296 is subject to high pressure during normal 11
operation, and is a potential missile source.
This valve has a backseat,
- however, and would thus not be expected to become a missile source.
Excess Letdown this small 3/4" line is not normally inservice, with AOV 310 in a closed position.
This valve, as well as manual valve 544, are'ithin the RCS loop compartment..
It is thus not expected that a missile would result in adverse effects.
Letdown Line the orifice valves
- 200A, 200B,
- 202, air operated valve HCV 133, as well as relief valve RV 203 inside containment.
are considered to be potential sources of missiles.
Valves 200A,
- 200B, and 202 have backseats, and would thus not be expected to become a source of missiles.
Therefore, valves HCV133 and RV203 need to.be evaluated for potentially damaging effects.
Some safety-related piping and electrical equipment are in the vicinity of these valves.
Since access to these valves is difficult at this time, final evaluation of the significance of these potential missiles can only be determined during reactor refueling shutdown, scheduled for Spring 1982.
This concern is similar to the concern expressed in the review of SEP Topic III-5.Arelative to jet impingement effects on cable trays in this area.
The resolution of both items will be pursued concurrently.
As noted in RGSE's October 1, 1981 submittal relative to III-S.A, no immediate safety concern relative to cable trays is apparent, since the electrical equipment.
has redundant or equivalent counterparts separate from the affected area.
The safety injection and RHR piping in the vicinity is thick-walled pipe, and is expected to be highly resistant to missile damage.
- However, a final assessment, of the effect of potential missiles from the CVCS letdown line is still pending.
Charging line flow is heated at the regenerative heat exchanger 'inside containment.
Potential sources of missiles are valve stems for AOV's 392A and 294.
Also, the charging flow maintains high pressure on auxiliary spray valve 296.
These valves all have backseats, and would not be expected to be a source of missiles.
A portion of the CVCS letdown line outside containment, up to the non-regenerative heat exchanger, was also evaluated relative to internally-generated missiles.
The valve stem of air operated valve 371 was considered a potential missile source.
However, this piping system is routed behind 12
concrete shield walls remote from other safety-related equipment in the auxiliary building, and thus a
missile would not. have any deleterious effect.
The occurrence of a CVCS line failure was already considered in SEP Topic XV-16; "Radiological Consequences of a Failure of Small Lines Carrying Radioactive Fluid Outside Containment,"
and considered acceptable.
No further assessment of the CVCS outside containment is required.
In summary, relative to the CVCS, it is concluded that additional study of the effect of internally-generated missiles which could be postulated to occur due to failures inside containment, of selected letdown line valves needs to be conducted during the Spring 1982 refueling outage.
e.
Residual Heat Removal S stem The majority of this system was discussed as part of the low head safety injection portion of the ECCS in Section 2b above.
Motor operated valves
- 700, 701,
- 720, and 721, not discussed in 2b, are not considered credible missile sources, since these valves have backseats to prevent stem ejection.
f.
Com onent Coolin Water S stem The component cooling water system is a closed system with two motor driven pumps rated at 150 HP and 2980 gpm and two shell and straight tube heat exchangers.
This equipment is grouped on the operating floor (El. 271'") of the auxiliary building and on a pedestal in the same area, at elevation 281.5'.
Heat transferred to the component cooling water system is transferred to the service water system through the two heat exchangers and is released into Lake Ontario.
(See also topic IX-3 "Station Service and Cooling Water System" ).
The component cooling water system removes heat from the residual heat removal heat exchangers;
- RHR, CS, and SI pump seals; non-regenerative heat exchanger; reactor coolant pump seals and bearings and motors; excess letdown heat exchanger; seal water heat exchanger; reactor support cooling pads; sample heat exchangers; the waste gas compressor's; as well as the items in the waste and boric acid systems.
Based on a.review of the component cooling w'ater system it was concluded that it is unlikely that this system would be a source of missiles since it is a low temperature
- system, operated at less than
- 13
lh
~
V II
100 psig, and the pump speeds are only 1750 rpm.
- Further, a complete postulated failure of the CCW system was evaluated in SEP Topics V-10.B, V-ll.B, and VII-3 (Safe Shutdown Systems) transmitted by letter dated September 29,.1981 from Dennis M.
Crutchfield to J.
E. Maier. It was concluded that a failure of the CCW system could be accomodated by removing residual heat via the auxiliary feedwater system and steam generators until repairs to the CCW system could be made.
It is thus concluded that the component cooling water system is adequately protected from internally generated missiles.
g.
Service Water S stem The service water system consists of four 300 HP 5300 gpm capacity vertical motor driven pumps located in the screenhouse.
(See also SEP Topic IX-3 "Station Service and Cooling Water System".)
The system is configured such that. there are two redundant safety-related trains, each capable of supplying one set of required safety-related equipment.
Only one pump from either train is generally required to provide the necessary safe shutdown and post-accident safety functions, although two pumps are desirable in the long-term post-LOCA sump recirculation phase.
These pumps take suction from the ultimate heat sink (Lake Ontario),
and the system piping is routed from the screenhouse underground to the auxiliary and other buildings.
The two service water headers can also be tied together via normally closed redundant.
manual valves.
Separation of safety and non-safety loads is provided via redundant motor operated isolation valves.
It is not considered that, the service water pumps would be likely missile generators, because of their enclosure (casing) and submergence in the service water pump bay, their low operating speed (1140 rpm) and low operating pressure
(-100 psig).
Also located in the screenhouse are a diesel driven and a motor driven.fire pump.
Since these pumps are not normally in operation, it is not considered that they would be a credible source of internally-generated missiles.
A review of valves in the screenhouse concluded that only the valve stem from manual valve 4666 was oriented towards safety-related equipment (a
cable tray).
- However, because of the low pressure
a I'I lk H
AI
h.
in the Service Water System, it is not expected that an internally generated missile which could cause damage would occur.
Diesel Generators Auxiliar S stems The two diesel generators are located in separate diesel generators
- rooms, located off the north side of the turbine building.
These are low speed engines with no high pressure hydraulic systems.
Separation of the redundant portions of the system is sufficient to provide assurance that internally-generated missiles are not of concern.
i.
Main Steam S stem The main steam system consists of two steam generators, with two steam lines which connect in the intermediate Building prior to entering the Turbine Building.
Each steam line has four main steam safety valves, an atmospheric dump valve, a steam admission valve to the turbine driven auxiliary feedwater
- pump, a
main steam isolation valve, and a non-return valve, all located in the Intermediate Building, upstream of the junction of the two lines.
The main steam lines are of heavy-walled
(
1" thick) construction, and it is not expected that they would be damaged by internally-generated missiles.
The main steam safety valves were modified in the early 1970s, when heavy reinforcing saddles were added on the main steam headers.
These saddles were specifically designed and analyzed to prevent the main steam safety valves from becoming missiles.
The main steam relief valves are similarly designed.
- Further, the valves are oriented away from other safety-related equipment items, and would thus not be expected to cause damage.
The main steam lines, together with the main feedwater lines, were also evaluated as a part of SEP Topic III-5.B, "Pipe Break Outside Containment", for jet impinge-ment effects.
In a letter dated August 7, 1980, RG&E committed to provide jet shielding protection for the valves in one loop from the other loop.
This shielding will enhance the protection already afforded the valves by their heavy construction,
, restraints, and orientatio'n.
It is thus considered that the main steam system is adequate with respect to internally generated missiles in the Intermediate Building, pending completion of the resolution of SEP Topic III-5.B.
In containment, the steam lines are not expected to be missile generators, since there are no valves inside containment.
- Further, the "A" and "B" steam lines are on opposite sides of containment.
15
l 1
II 4
'1 f I l(
J J
I
The balance of the main steam system is in the
'Turbine Building. 'here is no safety-related
.>.equip'ment "in'he turbine building,, it is thus not expected that a postulated'internally-generated missile would be of concern.
j.
Feedwat'er and Condensate S stem Condensate is taken from the condenser
- hotwell, located in the turbine building, through the hydrogen coolers, air ejectors, gland steam condenser, low pressure
- heaters, condensate booster
- pumps, and AVT system to the suction of the feedwater pumps.
The feedwater is then directed through the high pressure
- heaters, feedwater control valves, and finally pass into the Intermediate Building.
The feedwater then passes into the containment, and into the steam generators.
Xn the Turbine Building, there is no safety-related equipment.
The occurrence of an internally-generated missile would thus not be expected to result in any consequential damages.
There are no valves other than check valves, in the feedwater line in either the Intermediate Building or containment.
Further jet impingement separation between loops will be provided in the Intermediate Building, as discussed in the Main Steam System section above.
Xn the containment, the two feedwater loops are located on opposite sides of containment.
Xt is thus concluded that the feedwater and condensate system is adequately protected from internally-generated
- missiles, as described above.
k.
Steam Generator Blowdown This system provides a continuous flow of high pressure water across the tubesheet of the steam generators, in order to remove impurities which might collect in that region.
This system is located in containment, the Intermediate Building, and the Turbine Building.
Xn containment, the steam generator blowdown lines exit from the steam generators at elevation 255',
above the lower support structure for the steam generators.
The lines exit from the loop compartments and are routed above the intermediate floor to the containment penetration.
There are only a small number of manual valves in these lines inside containment.
The only safety-related equipment in the vicinity of the blowdown piping are the Service Water lines to cool the fan coolers, and the cabling associated with the fan coolers.
Wide 16
~
I8 ii P
t V
4 p
I l'
P
range steam generator level and some pressurizer instrumentation is also located in this vicinity.
Since an internally-generated missile would result only in a very small feedwater line break, the redundant unaffected fan coolers, as well as the containment spray system, are available to provide the necessary containment, heat removal.
Other steam generator indication is located away from the blowdown lines and would be available for operator use.
Finally, other instrumentation, including containment pressure, sump level, containment radiation, and SI and charging flow are available to provide operator indication of safety system conditions.
In the Intermediate Building, the steam generator blowdown lines are generally routed in the sub-basement, away from all safety-related piping except Service Water.
However, there are.no potential sources of missiles near the SW piping.
A small portion of blowdown piping in the Intermediate Building has valves which could be potential sources of internally-generated missiles.
The operator for valve CV5737 is restrained such that the occurrence of an internally-generated missile would not be expected.
The operator for valve CV5738 is not restrained.
Further evaluation of the potential for that valve stem to become an internally-generated missile must still be made.
In the Turbine Building, there is no required safety-related equipment in the vicinity of the SG blowdown piping, which could be damaged by internally-generated missiles.
Thus, it can be concluded that the steam generator blowdown system is not of concern with respect to internally-generated
- missiles, as discussed
- above, except possibly for valve CV5738.
l.
Auxiliar Feedwater S stem The auxiliary feedwater system consists of two subsystems:
one subsystem has two motor driven auxiliary feedwater
- pumps, one directing flow to each steam generator; the other subsystem is a
200% capacity turbine-driven auxiliary feedwater pump, which directs flow to both steam generators.
The design flow of the motor-driven pumps is 200 gpm, the turbine-driven pump is 400 gpm.
The primary suction source of these pumps is from the Condensate Storage Tanks.
If necessary, the Service Water System will provide an indefinite water supply to these pumps.
17
~
4
\\
I I
I'
'The Auxiliary Feedwater System is not normally in operation; it is used only during startup and shutdown operations, and in the event of an accident.
It is thus considered that only the normally pressurized portions of the system would be capable of being missile generators.
There are only a small number of manual valves in this normally pressurized portion of the system.
The valve stem orientation of these valves z.s directed either towards the containment wall or at the feedwater line.
Neither of these items would be expected to fail as the result of a valve stem missile.
Further, there is a Standby Auxiliary Feedwater
- System, located remote from the normal Auxiliary Feedwater
- System, which could be used to provide adequate cooling water in the event of a loss of the Auxiliary Feedwater System.
It is thus considered that the Auxiliary Feedwater System is adequately designed for internally-generated
- missiles, as discussed above.
m.
Standb Auxiliar Feedwater S stem This system consists of two 100% capacity pumps, as well as piping which directs the flow from one pump to one steam generator.
A cross-connect would allow each pump to feed any generator.
The system would be used only in the event of a failure of the Auxiliary Feedwater System.
It is thus considered that, only the normally pressurized portion of the system, which is connected to each feedwater line inside containment, would be capable of producing inteinally-generated missiles.
There is only one manual valve downstream of each check valve used to separate the Standby Auxiliary Feedwater System from each feedwater line.
The valve stems from these valves are directed either at containment or the main steam line.
Neither of these items would be expected to fail as the result of a valve stem missile.
- Further, because the Standby Auxiliary Feedwater System is located remote from the normal Auxiliary Feedwater
It is thus concluded that the Standby AFW System is adequately designed against internally generated
- missiles, as discussed above.
18
n.
Ventilation S stems for Vital Areas 1)
Safety-Related Pump Motor Coolers These-systems provided ducted air, cooled by Service Mater, to the Safety Injection and Containment Spray Pump Motors, as well as the RHR Pump and Charging Pump Rooms.
2)
Control Room The control room is air conditioned by a separate ventilation system, which includes a
charcoal filter circuit.
Fresh outside air is normally taken, and discharged to the Air Handling/Mechanical Equipment Room.
In the event of high radiation, the system dampers are adjusted to provide complete 'internal recirculation.
3)
Battery Rooms This is an independent air conditioning system, taking suction from the Air Handling Room and discharging to the Turbine Building.
The ventilation systems are low pressure
- systems, and therefore not expected to produce missiles.
No sources of missile were apparent in the vicinity of the control room and battery room ventilation systems.
Some of the Safety-Related Pump Motors cooling ductwork is in the vicinity of pump motors and valves, as discussed in paragraphs 2b, 2c, 2d above.
As discussed in those sections of this
- report, no internally-generated missiles are expected in the area.
Even if some damage to the ductwork occurred, it is expected that this would be acceptable, since total cooling capability would not be lost.
It is thus considered that the ventilation systems, as discussed above, will be capable of performing their function considering internally-generated missiles.
o.
Combustible Gas Control The Ginna design has redundant hydrogen recombiners located on opposite sides inside containment.
Since the hydrogen recombiner is not normally in operation, it is considered that the only credible source of missiles would be from the compressed
)
II II t~
s
on-site hydrogen supplies.
These supplies are located in a separate
- building, away from vital equipment, such that they would not affect other safety-related equipment, or be damaged. by other internally-generated missiles.
It is thus concluded that the combustible gas control system is capable of performing its function, considering internally-generated missiles as discussed above.
p.
Refuelin Water Stora e Tank The RWST is located in the Auxiliary Building, and could be subject to internally-generated missile damage.
However, it. is expected that the limiting missile damage would result from tornado missiles, discussed in SEP Topic III-4.A. Final resolution of the RWST will be considered in that topic.
3.
SYSTEMS WHOSE FAILURE COULD RESULT IN DAMAGE TO SAFETY-RELATED EQUIPMENT OR IN RELEASE OF RADIOACTIVITY.
a.
S ent Fuel Pool Coolin S stem This system is designed to remove heat from the spent fuel pool, which is heated by stored spent fuel elements.
The present system is a single train system, consisting of a pump, demineralizer, filter, and heat. exchanger.
Heat is removed from the system by the Service Water System.
The entire system is located in the Auxiliary Building.
Another redundant system has been proposed for inclusion in the Ginna SFP Cooling System.
The design was approved by the NRC in a letter dated November 24, 1981.
This latter system is not yet installed.
Since this is a low pressure
(( 150 psig) system, it is not expected to be a source of internally-generated missiles.
Damage to the Spent Fuel Pool Cooling System, though'not, desirable, could be tolerated.
System arrangement is such that the Spent Fuel Pool itself could not be damaged.
Even if the SFP Cooling System were damaged, the large thermal capacity of the pool would maintain temperatures below design (180'F) for many hours.
A portable skid-mounted
- system, located in the Auxiliary Building, could be put into service before any excessive heatup occurred.
This configuration was reviewed and approved by the NRC in Amendment 11 to the Ginna License, dated November 15, 1976.
20
't l
I
~"
tr
It is thus considered that the SFP Cooling System is acceptable with respect to internally-generated
- missiles, as discussed above.
b.
Sam lin S stem The sampling system provides samples for laboratory analysis to evaluate reactor coolant, feedwater, steam system, and other reactor auxiliary systems during normal operation.
Samples are routed in an area away from other required safety-related equipment and routed into a separate room.
Shielding is being provided for the sampling, as prescribed in NUREG-0737.
Because of the location of the sampling system, and the shielding to be provided in the near future, it is considered that. internally-generated missiles are not of concern.
c.
Waste Dis osal S stem The entire waste disposal system is a low pressure
- system, not expected to be a credible source of missiles.
The most likely sources, the gas decay
- tanks, are separated from other safety-related systems.
The failure of a gas decay tank is a Design Basis Event, analyzed in the FSAR.
Resultant doses are well within design limits.
It is concluded that the waste disposal system is not of concern relative to internally-generated missiles.
d.
Containment Pur e
S stem This low pressure system is used very infrequently to purge the containment.
The system consists of
- ductwork, dampers,
- fans, and filters. It is considered very unlikely that this system could produce internally-generated missiles.
The ductwork is routed high in the Intermediate Building, away from the missile sources.
It is thus considered that this system is not subject to damage from internally-generated missiles.
e.
Instrument and Service Air S stems This system consists of four air compressors (three instrument air, one service air), four aftercoolers, four air receivers as well as air dryers, pre-filters, and filters.
The three instrument air compressors and the service air
- 21
P N
~
w'I ~
compressors are of the vertical type, with the use of oil-free cylinder construction for the instrument air compressors.
The air systems are cooled by Service Water.
The air pressure systems are not safety-related.
All equipment controlled by the air systems is either not required to operate for safe shutdown or accident mitigation, or fails in the safe position upon loss of air.
Therefore, the system was evaluated only to determine if there were any potential sources of missiles.
A review of the system design and configuration determined that is is a low pressure system being operated at between 115 and 125 psig.
The only sources of missiles considered credible are the air compressors and air receivers.
These are located in the basement of the turbine building.
There is no safety-related eguipment in the vicinity of the air compressors or receivers which is expected to be damaged.
It is therefore considered that the instrument and service air system is acceptable with respect to internally-generated missiles.
4.
ELECTRICAL SYSTEMS The electrical systems were reviewed to ensure that internally-generated missiles resulting from fluid system damage could not cause damage.
The review and conclusion regarding potential damage to electrical systems is provided in the system descriptions and assessment provided in Section 2 above.
It was concluded that only a number of cable trays were subject to the effects of internally-generated missiles.
These effects will be evaluated during the subsequent resolution of this SEP topic.
CONCLUSIONS k
The review of internally-gen'crated missiles for the Ginna plant disclosed that, for the most, part, internally-generated missiles are not of safety concern.
However, additional evaluation, some of which cannot be completed until the Spring 1982 refueling outage, is still required.
These latter evaluations are relative to the CVCS letdown line, valve 832B associated with the A accumulator, valve CV5738 in the SG Blowdown System, and the Refueling Water Storage Tank.
22
(
I 11