ML18046A806
| ML18046A806 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 07/20/1981 |
| From: | Crutchfield D Office of Nuclear Reactor Regulation |
| To: | Hoffman D CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.) |
| References | |
| TASK-03-04.C, TASK-3-4.C, TASK-RR LSO5-81-06-051, LSO5-81-6-51, NUDOCS 8107240182 | |
| Download: ML18046A806 (29) | |
Text
'
9 v
I_
- ~...
,.....:,.;.;.... ~
~*
,:\\
---~---
- --.,p**..
July 20, 1981 I~
Docket No. 50-255*
LS05 06-051 Mr. David P. Hoffman Nuclear, Licensing Administrator Consumers Power Company 1945 W Parnall Road Jackso~,-M1~higan 49201
Dear Mr. Hoffman:
- -\\ \\ I
\\\\
- suBJECT:
SYSTE_MATIC EVALUATION PROG~, TOPIC III-4.C, INTERNALLY
/
GENERATED MISSILES - PALISADfS\\
- -.-' /
i\\
Enclosed is a copy of our draft ~e~aluation of Syste\\llatic Eyalu;ation Program Topic 111-4.C.
_/
r, "
./
. ~.
You are requested to examt.tie ttie facts upon which the staff has based its evaluation and respond eitfi*Eir by confirming that the,facts are correct, or by identifying errors* and supplying the corrected i nformat1on.
We encourage you to* supply any other m~terial that might.affect the staff's evaluation of these topics or be significant in the,.integrated assessment of your facility.
Your response is requested within 30 ~~-of receipt of this letter. lf lio response is received within that time, we *will assume that you have no comments or corrections..
Enclosure:
As stated cc w/enclosure:
See next.p~ge c
9107240182 810720 PDR ADOCK 05000255,*
P PDR I
~*
_J..
Sincerely, Dennis M.- Crutchfield, Chief Operating Reactors Branch No.
Division of Licensing 5
560'1 s
,~,
~~ c..stt: ( t>,.,) -
JUL 30 1981 OFFICE ** S.E:P.~.=.0.1..~..... SJP.~.~D.~~~.... S. ;.OJ......... OH.. W.!?.:.Qh;RM..
A:.Qh.........................
isuRNAME* DPersinko:d RHermann WRussell TWambach GL BATE~ '.7?~./~~................ *.*.*.'!! _?.' ?~:~.*.*.*.*~: : :
- ~! ~'. !.~:~::::::: -~'(/~.*~~~.-... *.*.*.*.*.*.*.
- ~ (!{(:~~::::::: :: : "" -.~;.~*.* i.~'.i.................................................... :
.NRCfORM318119/80l.NRCM02'4()
OFFICIAL RECORD COPY
- USGP0:1980-329*824
9*
SAFETY EVALUATION PALISADES PLANT CONSUMERS POWER COMPANY
-SYSTE~ATfC EVALUATION PROGRAM TOPIC:
III-4.C INTERNALLY GENERATED MISSILES I.
INTRODUCTION Missiles that are generated internally to the reactor facility (inside or out-side containment) may lead to damage of structures, systems and components that are necessary for the safe shutdown of the reactor facility or accident mitigation and to the structures, systems and components whose failure coul~
r~sult in a significant release of radioactivity. The sources of such missiles are valve bonnets and hardware retaining bolts, relief valve parts and instru-ment wells, pressure containing equipment such as accumulators and high pres-sure bottles, high speed rotating machinery, and rotating segments (e.g.,
impellers and fan blades).
Scope of Review The scope of the review is as outlined in the Standard Review Plan (SRP) Section 3.5.1.l, "Internally Generated Missiles (Outside *containment)," and SRP Section 3.5.l.2, "Internally Generated Missiles (Inside Containment)." The review specifically excludes SRP Section 3.6.l, "Plant Design for Protection Against Postulated Piping Failures in Fluid Systems Outside Containment, 11 3.6.2, "Determination of Break Locations and Dynamic Effects As,sociated with the Postulated Rupture of Piping, 11 as well as those SRP sections dealing with natural phenomena _(including missiles generated by natural phenomena), missiles generated outside the facility, and turbine missiles.
- II.
REVIEW CRITERIA The acceptability of the design of protection of facility structures, systems, and_components from internally generated missiles is based on meeting the following criteria:*
- 1.
General Design Criterion 4, with respect to protecting structures, systems and components against the effects of internally generated
\\
missiles to maintain their essential safety functions.
2:
Regulatory Guide 1.13, as related to the spent fuel pool systems and structures being capable of withstanding the effects of internally generated m~ssiles and preventing missiles from impacting stored fuel as.sembl i es.
3:
Regulatory Guide 1.27, as related to the ultimate heat sink and connecting conduits capable of withstanding the effects of internally generated missiles.
III.
RELATED SAFETY TOPICS AND INTERFACES Review Areas Outside the Scope of this Topic As stated previously, this review specifically excluded the fo1lowing:
- 1.
SRP Section 3.6.1, "Plant Design for Pr~tection Against Postulated Piping Failure in Fluid Sy~tems Outside Containment - This matter will be covered under safety topic III-5.B "Piping Break Outside Containment."
- 2.
SRP Section 3.6.2, "Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping" - This matter will be covered under safety topic III-5.A "Effects of Pipe Break on Structures, Sys terns and Components Inside Containment.
11
- 3.
Natural Phenomena - This matter 1*Jill be covered under safety topic III-6~
"Seismic Design Considerations and III-4.A, 11T6rnado-r*lissiles.-
11
- 4.
Turbine Missiles - This matter will be covered under safetY topic III-4.B, "Turbine Missiles."
Interfaces with Other SEP Safety Topics.
Satisfactory resolution. of the following safety topics will depend, at least in part, on satisfactory resolution of this topic:
l.* Topic VII-3 "Systems Required for Safe Shutdown"
- 2.
Topic VII-4 "Effects of Failure in Non-Safety Related Systems on Selected Engineered Safety Features"
- 3.
Topic IX-1 "Fuel Storage"
- 4.
Topic IX-3 "Station Service and Cooling Water System"
- 5.
Topic_ I!._-~:~- '_'Safety-Related Water Supply" (Ultimate Heat Sink)
IV.
REVIEW GUIDELINES
- 1.
Systems and components needed to perform safety functions were identified as those listed in SRP Section 3.2.2, "Systems Quality Group Classifica-ti on"
.~Y.5-tgfll?_ii~epep _to_pe.r:for.m safety functions (safe plant shutdown or accident
_mi ti.~tjQns : ___
- a.
Primary Cool_Q11t$s..t~- ***--**-**
- c.
- d.
Containment Emergency Co~ling Systems Chemical and Volume Control System
- e.
- f.
- g.
- h.
- i.
- j.
- k.
- 1.
- m.
- n.
Residual Heat Removal System Component Cooling Water System Service Water System Compressed Air System Diesel Generator Auxiliary Systems Diesel Fuel Oil System Main Steam System (portions of)
Feedwater and Condensate Systems (portions of)
Auxiliary Feed\\'>later System Ventilation System for Areas such as Control Room and Engineered Safety Features Equipment Rooms o.* Condensate Storage System
- p.
Combustible Gas Control System
- 2.
Systems whose failure may result in release of unacceptable amounts of radioactivity:
- a.
Spent Fuel Pool Cooling and Cleanup System b.. Sampling System
- c.
Liquid Waste Processing System
- d.
Gaseous Waste Processing System
- e.
Containment Waste Processing System
- f.
Containment Purge System
- 3.
- Add iti ona Hy-,..:.e lectri ca 1 SY.Sterns v1h i ch a re necessary to support those fluid systems needed to perform safety functions are:
aa.
Diesel Generators bb.
Station Batteries cc.
2400V and 480V Switchgear and Relay Rooms dd.
Control Room ee.
Cable Spreading Room V.
REYIEW AND EVALUATION
- 1.
Systems need to perform safety functions:
- a.
PRIMARY COOLANT SYSTEM The primary coolant system serves as the pressure retaining boundary for the primary coolant and is comprised of a reactor pressure vessel and two parallel heat transfer loops.
Each loop contains one steam generator and two pumps, connecting piping and instrumentation. A pressurizer and associated safety valves are connected to one of the reactor outlet pipes.
The purpose of the pressurizer is to maintain primary coolant pressure and compensate for coolant volume changes as the heat load changes.
All compo-nents of the primary coolant system are located within the containment building.
Overpressure protection is provided to assure the coolant system pressure does not exceed design limits.
The reactor vessel head is secured to the reactor vessel by special hydraulic stud tensioners.
It is unlikely tha.t any of the studs would become a missile since they are not subjected to reactor pressure and, therefore, are not exposed to sufficient pressure to create an accelerating force sufficient to cause them to become missiles.
The pressurizer relief.valves have the potential for becoming missiles.
Both the power operated relief valves and the primary relief valves are mounted on top of the pressurizer.
The position of the pr~~surizer above the loops and in a concrete compartment is such that any parts blown off the relief valves would strike above or to the side walls and is not likely to dama~e other ~omporients or piping of the primary coolant system.
Control rod drive modules are mounted on the top of the reactor vessel and are considered as an extension of the reactor vessel head.
Each module is bolted to a flange on-the reactor vessel head and seal welded.
The modules are all structurally tied together for seismic reasons and to provide lateral stabili~y. Because of this design, we do not consider the modules as likely missiles *for these reasons.
Further, a 24 11 thick concrete cover is placed over the control rods during operation as further protection against potential missile damage to safety systems.
Instrumentation generally requires some penetration into the reactor I
coolant system.
These penetrations are usually small and take the form of welded wells.
We considered the brientation of the wells and con-eluded that they are not likely candidates for missiles but should one fail, that it will not cause serious destructive damage to the reactor coolant system or-compromise its safety.
We also examined the possibility that missiles may also result from destructive overspeeding of one of the primary coolant pumps in the event of a pipe break in the pump discharge.
We concluded that poten-tially damaging impeller missile ejection from the broken pipe is minimized by a massive steel pump casing.
Generation of missiles from overspeed of both the motor, flywheel, and the impeller is a generic prob 1 em which is being reviewed under Task Ac ti on Pl an B-68:, "Pump Over-
- speed During a LOCA.
11 We believe that the probability of missiles from overspeed of both the motor and impeller of a primary coolant pump that could result in damage to safety-related equipment is acceptably low to allow continu~d operation of this plant.
Should the results of our generic study indicate the need for any design modifications, Palisades will be required to satisfy these requirements.
The two steam generators have manways held in position by studs on the primary and secondary sides of the shell. These studs are not subjected to sufficient pressure to result in a significant missile source.
We, there-fore, do not consider the steam generators as likely missile generating source.
In summary, in considering the primary coolant system, because of its equipment design features and component arrangement, it is our judgement that this system's function will not be detrimentally affec~ed considering internally generated missile sources from the reactor coolant system as identified above.
Further, should.a missile create a break in the pri-mary coolant system, the emergency core cooling system will keep the core cooled.
- b.
EMERGENCY CORE COOLING SYSTEM The Palisades emergency core cooling system (ECCS) serves as the means of injecting water for core protection in the event of primary coolant system water loss and consists of a high-head subsystem, a low-head subsystem, and safety injection tanks.
ECCS flow is provided from these three subsystems into the reactor coolant system through the four cold-leg reactor inlet pipes.
The high-head subsystem consists pf three pumps, each rated at 300 gpm.
The low-head system consists of two pumps, each rated at 3000 gpm.
Four passive safety injection tanks containing borated water are provided inside the containment building.
The initial source of water for the high-head and low-head pumps is the Safety Injection and Refueling \\~ater Storage Tank.
This tank is located out-of-doors on the roof of the auxiliary building above the control room.
The high and low head subsystem piping follows a common pipe chase from the pumps, passes through containment penetrations and stays below the operating floor as the piping branches out to the four cold-leg reactor inlet pipes.
The four safety injection tanks are positioned inside containment about
~ *---**** -- *-*--: *-.. *.. - ------ - _
100 feet above the containment floor in separate quadrants of containment.
These four tanks also connect to the four cold-leg reactor inlet pipes.
During our visit to the site we were not able to enter certain areas of the plant.
From our discussions with the licensee and his contractor, we determined that except for the safety injection tanks and the Safety Injection and Refueling Water Storage Tank, the main components of the ECCS redundant trains are located in two separate engineered safety feature (ESF) rooms below ground level outside containment.
The high-head and lovJ-head subsys-terris are arranged such that sufficient active components_
are located in each room to meet the design basis requirements of the system.
Each ESF room has a sump pump and a ventilation system, each of which is powered from the emergency buses (see safety topic IX-5 "Venti-lation System 11 ).
We concluded that the most likely source of missiles in the ESF rooms was from the high-head pump.
This pump is a 400 H.P. horizontal multistage centrifugal pump operating at 3600 rpm.
We believe that this pump will not become a source of missiles because the impeller, if broken; is not likely to penetrate the thick steel casing.
The other pumps (low-head) io the rooms operate at lower speeds and are thus less ~ikely to generate missiles.
Should missiles be generated in one of the two ESF rooms, those missiles.are not likely to penetrate the barrier wall between rooms and. result in the loss of the redundant ESF equipment.
The separa-tion 6f redundant pumps and other associated ECCS equipment into the
- separate ESF rooms thus reduces.the likelihood of simultaneous loss of more than one train of ECCS equipment by a postulated missile.
The positioning of the Safety Injection and Refueling Water Storage Tank on the roof of the Auxiliary Building would tend to make the tank safe from internally generated missiles other than those which might originate from the turbine generator (see safety topic III-4.B "Turbine Missiles").
The tank is not tornado missile proof (see safety topic III-4.A 11Tornado Missiles 11 )~ however, the building roof and parapet construction provide some inherent tornado missile protection.
Once the piping from the two ESF rooms enters conta.i nment it is kept below the operating floor before separating and con~ect{ng ~o the f6ur reactor inlet (cold) legs. While this piping may be subject to damage from internally generated missiles, a single missile should not damage more than a limited area of a single train of piping.
Further, depending on where the pipe damage is encountered, upstream or dm*ms tream of the valve nearest to the primary system, determines the extent of the effect on the primary system.
If the damage (break) occurs downstream of the valve, a demand would be placed on the ECCS (LOCA) and the system will perform its design function once the affected line is isolated. If the break occurs upstream of the valve,' no demand will be placed on the ECCS a~ the valves are initially closed an~ no LOCA results, however, the plant will be shutdown and the piping repaired.
The four safety injection tanks are located well away from each other.
This physical separation and the elevation of the tanks provides inherent protection against damage to more than one tank from internally generated missiles inside containment.
Further, loss of one of the four tanks (safety injection.tank spillage) was taken into consideration in the ECCS performance (LOCA) analyses.
In summary, in considering the ECCS, because of its functional design, redundant features, separation and equipment design features, it is our judgement that this system will be capable of performing its design function considering internally generated missile sources as discussed above.
- c. _CONTAINMENT EMERGENCY COOLING SYSTEMS The containment emergency cooling systems consists of two independent systems - an air recirculation and cooling system and a spray system.
The containment air recirculation and cooling system consists of four heat exchanger fan units, and the spray system consists of three half-capacity pumps, spray headers~ and nozzles.
The source of water for the spray system is the Safety Injection and Refueling Water Storage Tank (see section ~- Emergency Core Cooling System).
The four recirculation heat exchanger fan units are positioned inside con-tainment in separate quadrants. Therefore, because of this separation, it is unlikely that a single missile could fail more than one of these units.
The spray system headers and nozzles are split into redundant halves.
The spray nozzles are located high inside containment.
There-fore, it is questionable that any missiles would reach these. components.
Should one half of the nozzles be damaged, some amount of containment cooling utilizing the sprays could be provided using the redundant half of the nozzles.
The spray system pumps are located separately in the two engineered safety feature rooms (see section b. Emergency Core Cooling System).
We toncluded in sectibn b. that the most likely source of missiles in that room was from the high-head pump.
Should a missile fail one of the spray system pumps, the remaining spray system pumps would continue to function.
Further, the four recirculation heat exchanger fan units have adequate cooling capacity to perform the emergency containment cooling.
- - - ln_suml]l(lry, _ _j_n_c:_on?idering the containment emergency cooling systems, its redundant features and separation, it is our judgement that this system will be capable of performing its design function considering internally generated missile sources as discussed above.
- d.
CHEMICAL AND VOLUME CONTROL SYSTEM The chemical and volume control system (CVCS) controls and maintains.reactor coolant system inventory and purity through the process of makeup and let-down.
The system consists of a regenerative heat exchanger and letdown heat exchanger to cool the excess coolant taken from the primary system during plant heat up and plant operation. The coolant is reduced in temperature and pressure and passed to purification and deboratfng demineralizers where corrosion and fission products are removed.
The coolant is then returned to the volume control tank.
The charging pumps return the coolant to the primary system from the. volume control tank.
Additional water or boric acid is supplied. to the charging pumps as necessary.
The equipment for this system other than the regenerative and letdown heat exchangers is located in the auxiliary building in individual rooms which contains no equipment from other systems which might produce missiles.
The heat exchangers are both located inside containment at approximately El._ 907 feet.
During our walk through of the plant and discussions with the licensee and his contractors we were not able to identify any potential sources of
~issiles which could endanger the CVCS.
The system, however, is not fully
.* redundant and a missile could disable the system.
Should this happen, the plant could still be shut down safely in a normal manner usi~g the auxiliary feedv1ater system and the residual heat removal system.
\\-le, therefore, conclude that \\'Jhile the possibility of internal missile damage to the eves is very low, such an event \\*Jill not result in an unacceptable release of radioactivity or endanger the safe shutdO\\*m of the plant.
We conclude that additional protection is not required.
- e.
RESIDUAL HEAT REMOVAL SYSTEM The shutdown cooling (residual heat removal) function of the safety injection system is brought into use during plant shutdown when the pri-mary coolant temperature and pressure fall below 350°F and 270 psia.
At. that time certain valves are remote manually ali9ned to allO\\\\I primary coolant flow through the shutdown ~ooling heat exchangers.
The residual heat removal system consists of the shutdown cooling heat exchangers and*
the associated valves and piping.
The reactor coolant is circulated through the shutdown cooling heat exchangers using the LPSI pumps and is then pumped ba~k to the cold leg inlet of the reactor.
The shutdown cooling heat exchanger transfers decay heat to the component cooling water
.system which in turn transfers its heat to the service water system which discharges into Lake Michigan, the ultimate heat sink.
While the residual heat removal system is not redundant, the components of the system are located in the ESF rooms such**that tfie potential f~r missiles striking the system is low.. Should a missJle strike the system, the plant can be safely shutdO\\m using the auxiliary feed\\vater system.
In our judgement the plant can be safely shutdovm considering a missile sfrHes fhe sistem pi ping or components. -
. f.
COMPONENT COOLING WATER SYSTEM The component cooling water system is a closed system with three motor driven pumps rated at 300 HP and 6000 gpm and two horizontal counter flow heat exchangers.
This equipment is grouped below grade in a room directly outside of containment in the auxiliary* building.
Heat transferred to the component cooling water system is transferred to the service water system through the two horizontal counter flow heat exchangers and is
- released into Lake Michigan (see also topic IX-3 "Station Service and Cooling Water System).
The component cooling water system removes heat from the shutdown cooling heat exchangers, engineered safeguards pump jackets and seals, letdown heat exchanger arid reactor coolant pump seals and bearings.
Two branch loops of the component cooling water system prov~de cooling for the spent fuel'heat exchanger and for the reactor primary shield cooling systel]l which is a closed loop subsystem designed to keep the concrete in the reactor shield within design temperature.
From our review of the component cooling water System we conclude that it is unlikely that this system would be a source of missiles since it is operated at less than 100 psig and the pump speeds are only 1750 rpm.
Further, we did not identify any potential missile sources which*
might endanger the component cooling water system.
Should *a missile strike the ~O!flponent cooling.water system, it \\*JOuld be necessary to shut the reactor dovm.
The auxiliary' feedwater system \\'JOuld be used (see section c. "Resi-dual Heat Removal System").
Should a missile strike the branch loop which cools the reactor primary shield cooling system, its loss is not of imme-diate concern as the te~perature rise in the concrete is slow.
The system would be repaired at the earliest convenient time.
A missile strike into the spent fuel heat exchanger branch loop can be tolerated as the fuel pool heatup is a slow process and there is time to execute repairs or provide alternate cooling before the pool temperature becomes excessive.
We conclude that.the component cooling water system is adequately protected from internally generated missiles.
- g.
SERVICE WATER SYSTEM The service water system consists of three 350 HP 8000 gpm 50% capacity vertical motor driven pumps located. i~ the intake structure.
(See also SEP Topic IX-3 "Station Service and Cooling Water System.) These pumps are located approximately four feet apart, take their suction from the intake structure (Lake Michigan) and discharge into a corrmon header.
Isolation valves are provided at ~ach pump.
The common discharge header contains sectionalizing valves operable from the control room if isola-tion of a portion of the system is required.
Critical service water is taken from each end of the common discharge header providing two 24-inch critical service water lines. These *two critical service water lines_ are routed underground to the auxiliary building. A thi.rd 24. inch line supplies service water to non-critical systems.
The two 24 inch.critical service water lines enter ~he auxiliary building in its substructure.
The piping and valving is sectionalized such that one line provides water to the containment air coolers and one emergency diesel generator, one control room air conditioner, two air compressor after coolers, engineered safeguard room coolers, and engineered safeguard pump seals. The other critical service line supplie~ the component cooling water heat exchangers and one emergency diesel generator heat exchanger, one control room air conditioner, two air compressor after coolers, engineered safeguard roqm coolers, and engineered safeguard pump seal cooling.
We conclude that the three 350 HP 8000 gpm vertical motor driven service water pumps are ~nlikely missile generators because of their enclosure (casing) and submergence in the intake structure, their low operating speed (1140 rpm) and low operating pressure (<100 psig) and would not endanger the critical service water system piping and valves in the intake struc-ture.
At the intake structure there is one electric driven fire pump and two diesel driven fire pumps along with the controls for the traveling screens and a screen wash pump.
We do not consider this equipment as likely sources of missile generation because they are 20 to 30 feet away from the main service watet pumps and are small low capacity pumps such that.even if they failed it is unlikely they would cause destructive
- damage to the critical service water system.
The piping inside of the auxiliary b~ilding consists of relatively short pipe runs between valving to permit cross connections between headers, branch system isolation and connection to the back up fire protection system.
Our review of this area did not disclose missile sources or
.* ta~~~ts th~t wou~d contribute t~ loss of function of the system.
- Further,
\\'le could not identify any potential missi.le generators posing a threat to the tv*IO 24 inch lines between the intake structure and the auxiliary building since the piping is underground.
In the event of loss of this system, decay heat removal could be accom-
. pl ished by use of the auxiliary feedwater system.
The reactor could be placed in a natural circulation mode utilizing the steam generators for
- decay heat removal.. Fire protection water could also be used as a service water substitute depending on the location -Of.the damage to the service water system. -
W~ conclude that the service water system is not a potential source of damaging missiles nor is it susceptible to the loss of function due to missile damage and meets our requirements for design against missiles.
- h.
COMPRESSED AIR SYSTEM I
The compressed air system is designed to supply oil free air to both the inst~u-ment air and service air systems.
Three full capacity nonlubricated compressors are provided with separate after coolers and air receivers.
The air receivers are interconnected.
Two air headers leave the air receivers, one to supply instrument air after filtering and drying, the other to supply the service -
air system.
Both headers have bran~h lines routed to the various buildings associated with the reactor facility.
Two high pressure compressors with after coolers drters ~nd receivers were added to supply air* to an air header routed to the engineered 'safety feature rooms to operate the air operated valves.
A third* system is being installed to operate five valves in the condensate system as well as portable loads during plant shutdown.
The manual cross ties between these s.xs.t.e>.ms. PX~,O.QJ:JIJall>! s;.1 osed and under admi ni strati ve contro 1.
The normal air supply sys tern.functions at about 100 psi g.
The high pres-sure system is designed for 325 psig and is protected against missiles by its location beneath the main turbine at floor El. 590'-0: The air distribution headers are protected from missiles by routing the piping through protected structures unti'l they reach their terminal point.
The largest potential missile generator is the air receivers but these are ASME Code Vessels protected by relief valves set well below the air receiver rupture pressure.
Our assessment of this system is that it is unlikely to produce missiles or be impacted by missiles because of the protection provided by the surrounding structures utilized in their routing.
The equipment location and rou~ing of headers in our judgement affords adequate protection against missiles.* In our judgement this system will be capable of performing its design f~nction considering internal missiles as described above.
- i.
DIESEL GENERATORS AUXILIARY SYSTEMS T\\'>'O diesel generators are located in the NW wing of the auxiliary building.
The two units and their auxiliaries are separated by walls and the ele-vated diesel oil tanks are located in a concr~te enclosure in a corner of the room.
Due to independence and separation of the diesels and their associated auxiliary systems, it is our judgement that the diesel generator auxiliary systems will be capable of performing their function conside~ing internal missiles.
I
- k.
MAIN STEAM SYSTEM (portions of)
The main steam system consists of two steam generators, two 36-inch steam lines or headers, and main steam isolation valves.
The steam generators are.located inside containment (see section a. "Primary Coolant System").
The two main steam lines penetrate containment at El. 617.
The main steam isolation valves, safety valves, and atmospheric dump valves are located outside the containment at this point.
The steam lines are then routed into the turbine building where the two lines are split into 4 lines just prior to joining the turbine.
The point of entry into the turbine building*f()r the main steam lines is below the turbine.floor.
The main steam lines are heavy walled, well supported and protected from internally generated missiles from other sources by their physical locatio.n behind structural walls and floors.
We conclude from our review of the main steam system that this system will not produce missile$ due to its heavy walled design and construction.
Should a missile from other sources cause damage to the main steam*
system downstream of the main steam isolation valve, the valve would be closed and the plant w.ould be shutdown.
Should the missile damage occur upstream of the valve or at the valve itself, the plant can be safely*
shutdown as one of the design basis accidents for the plant is a steam generator blowdown.
In summary, in considering the main steam system, its features and pro-tection from internally generated missiles due to plant layout, it is our judgement that this system will be capable of performing its design function considering internally generated missiles as described above.
- 1.
FEEDWATER AND CONDENSATE SYSTEMS (portions of)
The main feedwater system consists of two turbine driven pumps which pump water to the two steam generators.
Condensate from the ho£ well is pumped by two 50% capacity motor driven pumps through the air ejectors and gland seal condensers and then through several stages of preheating in parallel to the turbine driven main feedwater pumps.
The only area of concern for this system is that portion of the system from the steam generator to the isolation valves.
We believe the likelihood of missile damage to this area of the system is low due to its location and protection by surrounding equipment.
- Further, if the system were damaged in this ar~a, that st~am generator would probably blowdown.
The plant could, however, be cooled down using the second steam generator and the auxiliary feedwater system.
- m.
AUXILIARY FEEDWATER SYSTEM The auxiliary feedwater system consists of two trains of equipment; one train contains an electrical-driven pump and the second train contains a turbine-driven pump.
Both pumps are rated at 450 gpm.
The auxiliary feedwater system pumps take their suction from the.condensate storage.
tank (see section w. "Condensate Storage System").
The discharge from the pumps combines beyond the pump stop and check valves and then splits again in order to feed both steam generators.
From our review of the auxiliary feedwater system we conclVde that the most likely-source of missiles would be the pump~.thcmselves~ The two p~mps are located side by side but are removed from other high energy sources.
The pump casings are steel.
We conclude from our review of the construction of the pumps that there is a low probability that missiles would get outside of the casings.
In summary, in considering the auxiliary feedwater system, its redundant features and protection to internally generated missiles due to plant layout (separation), it is our judgement that this system will be capable of performing its design function considering internally generated
- missiles.
- n.
VENTILATION SYSTEM FOR AREAS SUCH AS THE CONTROL ROOM AND ENGINEERED SAFETY FEATURE ROOMS a)
Engineered* Safeguards Room The equipment in the engineered safeguards room is designed to operate ai 135°F. _Normally fresh filtered air is brought in via a blower and a series of discharge subheaders one of which is directed to the engineered safeguards room.
Two independent water cooled fan units are also provided in these two equipment spaces for emergency operation.
The exhaust air from the engi~eered safeguards rorim is directed to filters and fans which mix the air with other air going up the vent stack.
b)
The Control Room The control room is independently air conditioned by two completely separate units. Air is recirculated and fresh air is added to create a sligh_t positive pressure in the control room.* Both fresh air and recirculated air is filtered prior to admittance to the control room.
Our review did not reveal any potential missiles being generated by the
-venti Ta ti on system for either the engineered safety feature rooms or the control room.
While duct work can be penetrated by missiles, the total cooling capability is not lost for either area, and time is available for action to restore adequate ventilation.
In summary, in considering' the ventilation systems for *the t\\oJO areas, it is our judgement that these systems will be capable of performing their design function considering internally generated missiles.
-o.
CONDENSATE STORAGE SYSTEM The condensate storage sy?tem consists of a 125,000 gallon tank for storage of makeup water for the main feedwater*system and as a source of auxiliary feedwater.
By virtue of the tank's locati-0n in the station yard (not in a building),
we conclude that the tank is not subject to internally generat~d missiles nor is it a source of mis$iles.
- p.
COMBUSTIBLE GAS CONTROL SYSTEM An electrical recombiner system has been provided as part of the engi-neered safety system consisting of two electrically heated units inside of containment.
The units are passive, redundant in ~hat only one unit is necessary for combustible gas control of the containment volume, and
-operate by natural convection-circulating-the air inside of containment.
- From our review of this system, we conclude that it:is not a missile generating system.nor is it subject to the impact of missiles.
The sy~t~m is not needed to shut the plant down.
Should a missile strike the system, its repair could be scheduled in a timely manner so as to not interfere with plant operation.
- 2. Systems whose failure may result in release of unacceptable amounts of radioactivity:
- a.
SPENT FUEL COOLING SYSTEM.
The spent fuel cooling system is a closed loop system consisting of two
- half capacity pumps,.two full capacity heat exchangers in series, a by-pass filter, a bypass demineralizer, a booster pump, piping valves and instrumentation.
Heat from the spent fuel pool is transferred by means of the above heat exchangers to the component cooling water system (see section f. "Component Cooling Water System").
The equipment is divided into three shielded cells in the spent fuel pool equipment room at El.
590'.-0 11 near the center of the auxiliary building.
The spent fuel c~oling system is a low energy system unlikely to generate missiles or be impacted by them because of the compartmentalization of system components.
Discussions with the applicant and their contractor indicated that the compartmentalization of this system make it unlikely that missile generation could damage surrounding equipment or that damage by outside missiles to the system could occur.
Should the equipment become inoperable due to that missile damage, there is sufficient time to effect repair or arrange for alternate cooling.
In our judgement, this system will be capable of performing its function considering internally g'enerated missiles as desired above.
- b.
SAMPLING SYSTEM Reactor coolant system fluid samples are passed through a delay coil and a cooler, pressure reducing coil, flow controller and finally an analyzer.
Grab samples are also taken for later analysis in the chemistry lab. All of these sampling operations are carried on behind a steel shield wall.
The likelihood of missiles causing damage to the sampling system is con-sidered highly unlikely.
Further, a mi~sile strike to this system would not result in unacceptable.consequences.
We conclude the above system meets our requirements for design against missiles.
- c.
LIQUID WASTE PROCESSING The liquid waste. system is divided into three sections:
(1)
Clean wastes (high activi.ty low solids)
(2)
Dirty wastes (3)
Lau*ndry wastes The liquid waste system is located in shie)ded vaults which provi~e pro-tection *against. internally generated missiles.
The largest pumps are in the order of 75 HP at 3500 rpm and 100 psig, and, therefore, i~ not likely to generate missiles.
Further, should a missile damage this
~ -*----..
system and if contents are drained, the resulting liquid release would be retained in the building long eno~gh to allow a clean-up.
. d.
- GASEOUS WASTE PROCESSING SYSTEM The gaseous waste system is divided into two sections:
(1)
Gas Collection Header (2)
Waste Gas Processing System
- , The waste gas system is operated at pressures less than 120 psig.
The total gas volume at pressure i.s.less than 1000 ft3. Thus, the sy~tem is not likely to be a source of internally generated missiles.
All of the compressors ~nd storage tanks are behind shield walls and include shield walls between clusters of equipment.
Our review of this system verified that this system was protected from internally generated missiles from outside sources and the potential for internally generated missiles from the system itself was small.
- Further, missile damage to the system will not affect the safe shutdown of the facility.
- e.
CONTAINMENT WASTE PROCESSING Drainage inside containment is collected in the containment sump.
From the containment sump it is pumped to the dirty waste drain tank in the auxiliary building.
From our review of this system we could not identify a method by which it could produce missiles*:. Should a missile damage the system, there is adequate time to make repairs.
- f.
CONTAINMENT PURGE SYSTEM The containment purge system is provided to periodically purge th~ contain-ment -prior to entry.
The system consists of three fan_s, filters,.duct work and isolation valves*.
All of these components except portions of the duct work and the isolation valves are located in a common room-in ------------
the auxiliary building.
- e Th~_ licensee st_ates that the system is only operated with the reactor shutdown.
It f6llows that this system could only be considered a poten-tial missile producer at that time.
From our review we co~clude that the probability of this system producing missiles or being damaged by a missile is very low.
Should a missile damage this system, there would be ample time to perform reapirs.
We, therefore, conclude that the.missile protection provided for the system is acceptable.
- 3.
Electrical Systems which are necessary to support thos~ fluid systems needed to perform safety functions:.
a)
DIESEL GENERATOR See Section V.1.i.
b)
STATION BATTERIES The two station batteries are in separate rooms both of which are located in.the cable*spreading room.
Their auxiliary systems are independent.
From our examination of the two station battery rooms we conclude that there is a very low potential for a missile being generated in these two rooms.
We were informed that the cells of the batteries have caps designed to minimize the possibility of hydrogen explosions.. Should a missile be generated in one of the two rooms and damage the battery, it is questionable that the missile would penetrate the wall between the rooms and damage the second battery.
From our review of the two station batteries we conclude that.the separate ro-oms. for.the two batteries provide protection from internally generated missiles.
).. c) 2400V and 480V SWITCHGEAR There are three 2400V lriad centers, two of which are integral parts of the plant engineered safeguards electrical system.
These two load centers are located in separate rooms, on different floors of the auxiliary building.
The fire protection system, is the only potential source of missiles in these areas, and since it is a lmv pressure system, it is not a likely missile source.
. The 480V switchgear consists of one double-ended load center and two motor control centers which are part of the plant engineered safeguards elec-trical system.
The 480V switchgear is located in the cable spreading room (see section ee. "Cable Spreading Room").
As is stated in that section, the cable spreading room does not contain any piping or other pressurized sources which might produce missiles.
We conclude that the location of 2400V and 480V switchgear provi~e ade-quate protection from internally generated missile ~our~es.
d)
CONTROL ROOM The control room is located in the north\\'1est corner of the auxiliary building.
From our walkdown of the plant we were concerned that large portions of two walls of the control room are glass.. We concentrated our efforts on looking for missile sources outside of these two glass areas.
We did not identify any potential missile *generators outside the control room.area which could result in damage to the control room:
Also our wa1k arouncf of the control room itself did not disclose any sources which might produce missiles other than possibly fire extin-guishers.
We do not consider these items as sources of potentially damaging missiles.
We concluded that there are no missile sources which could affect the proper funG-ti-oning -of the control ro-om.
- e)
CABLE SPREADING ROOM The cable spreading room is located directly below the control room.
This room contains the electrical cables, the 480V switchgear, the two battery rooms (see section bb.. "Statiori Batteries) and the control rod contactor panel.
The cables are routed through this. room on their way to the control room.
The cable spreading room does not contain any piping or other pressurized sources or rotating equipment which might produce missiles.
The fire protectfon system in this room is low pres-sure and thus is not capable of generating potentially damaging missiles.
Wi conclude that there are no potential missile sources in this area
. which could affect safety related equipment.
VI.
CONCLUSIONS From our review of the systems and components needed to perform safety functions, we conclude that the design of protection from internally generated missiles meet the intent of the ~riteria listed in Section II REVIEW CRITERIA and are, therefore, considered to be acceptable.