ML18046A933
| ML18046A933 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 09/21/1981 |
| From: | Crutchfield D Office of Nuclear Reactor Regulation |
| To: | Hoffman D CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.) |
| References | |
| TASK-03-04.C, TASK-3-4.C, TASK-RR LSO5-81-09-053, LSO5-81-9-53, NUDOCS 8109280379 | |
| Download: ML18046A933 (30) | |
Text
y I
~,t..
. September 21, 1981 Docket No. 50-255 LS05 09-053 Mr. David P. Hoffman Nuclear LiGensing Administrator Consumers Power Company 1945 W Parnal1 Road Jackson, Michigan *49201
Dear Mr. Hoffman:
SUBJECT:
SYSTEMATIC EVALUATION PROGRAM TOPIC 111-4,C. "INTERNALLY GENERATED MISSILES" - PALISADES Enclosed is our evaluation of Systematic Evaluation Program Topic 111-4.C.
Following exchanges between your staff and the NRC staff, we have revised the draft evaluation that was sent to you on July 20, 1981 to reflect the additional information you have-supplied. Therefore, our review of this topic is complete and this evaluation will be a basic input to the integrated safety assessment for your fac111ty. This topic assessment may be revised in the future if your facility design is changed or if additional information is provided to the staff.
Enclosure:
As stated cc w/enclosure:
- See next page
~: NRC._FORM 318 (10-80) NRCM 0240 Sincerely, Dennis M. Crutchfield, Chief Operating Reactors Branch No. 5 D1vis-1on of L 1censing OFFICIAL RECORD COPY USGPO: 1981-335-960
- r.. '
Mr. David P. Hoffman r
cc M. I. Miller, Esquire
-Isham, Lincoln & Beale Suite 4200 One First National Plaza Chicago, Illinois 60670 Mr. Paul A. Perry, Secretary Consumers Power Company 212 West Michigan Avenue Jack son, Mi chi gan 49201 Judd L. Bacon; Esquire Consumers Power Company 212 West Michigan Avenue Jackson, Michigan 49201 Myron M. Cherry, Esquire Suite 4501 One IBM Plaza Chicago, Illinois 60611 Ms. Mary P. Sinclair Great Lakes Energy Alliance 5711 Summerset Drive Midland, Michigan 48640 Kalamazoo Public Library 315 South Rose Street Ka 1 amazoo, Michigan 49006
- Township Supervisor Covert Township Route 1~ Box 10
- Van Buren County, Michigan Office of theGovernor (2)
Room 1 - Capitol Building Lansing, Michigan 48913.
William J. Scanlon, Esquire 2034 Pauline Boulevard Ann Arbor, Michigan 48103 Palisades Plant ATTN:
Mr. Robert Montross Pl ant Manager Covert,. Michigan 49043 49043 U. S. Environmental Protection Agency Federal Activities Branch Region V Office ATTN:
Regional ~adiation Representative 230 South Dearborn Street Chica*go, 111 i noi s 60604 Charles Bechhoefer, Esq.~ Chairman Atomic Safety and Licensing Board Panel U. s. Nuclear Regulatory Conmission Washington, D. C.
20555 Dr. George C. Anderson
- Department of Oceanography University of Washington Seattle, Washington 98195 Dr. M. Stanley Livingston 1005 Calle Largo Santa Fe, New Mexico 87S01.
Resident Inspector c/o U. S. NRC Palisades Plant Route 2, P. O~ Box 155 Covert, Michigan 49043
t..1*
j:
I.
INTRODUCTION SAFETY EVALUATION PALISADES PLANT CONSUMERS POWER COMPANY SYSTEMATIC EVALUATION PROGRAM TOPIC:
III-4.C INTERNALLY GENERATED MISSILES Missiles that are generated iriternally to the reactor facility (inside or out-*
side containment) may lead to damage of structures, systems and components that are necessary for the safe shutdown of. the reactor faci 1 i ty or accident mitigation and to the structures~ systems and components whose failure could re~sult in a significant release of radioactivity *.
The sources of such missiles are valve bonnets and hardware retaining bolts, relief valve parts and instru-ment \\-Jells, pressure containing equipment such as* accumulators and high pres.-
sure bottles, high speed rotating machinery, and. rotating segments (e.g.,
- impellers and fan blades}.
Scope* of Review.
The scope of the review is as outlined in the Standard Review Plan (SRP) Section.
3.5.1. l, "Internally Generated Missiles (Outside Containment),
11 and SRP Section -
3.5.1.2, "'Internally Generated Missiles (Inside Containment)." The review specifically excludes SRP Section 3.6.l, "Plant Design for Protection Against Postulated Piping Failures in Fluid Systems Outside Containment," 3.6.2, "Determination.of Break Locations and Dynamic Effects Associated with the
- Postulated Rupture of Piping*,i, as well as those SRP sections dealing with natural phenomena (including miss.iles generated by natural phenomena),.missiles generated outside the facility, and turbine missiles.
II.
REVIEW CRITERIA The acceptability of the design of protection. of faci 1 ity structures, systems, a~d components from internally generated missiles is based on ~eeting the following criteri~:
- 1. General Design Criterion 4, with respect to protecting structures, systems and components against the effects of internally generated miss i 1 es to maintain their essenti a 1 safety fUncti ans *
. 2: Regulatory Guide 1.13, as related to the spent fuel pool systems and structures being capable of withstanding the effects of internally generated missiles and preventing missiles from impacting stored fuel assemblies.
- 3. Regulatory Guide l.27, as related to the ultimate heat* sink and
- connecting conduits capable of withstanding the effe~ts of internally generated missiles.
lI I.
RELATED SAFETY TOPICS ANO INTERFACES Review Areas Outside the Scope of this Topic As stated previously, this review *Specifically excluded the following:
- l. SRP Section 3.6. l,.
11Plant Design for Protection* Against Postulated Piping Failure.. in Fluid Systems Outside Containment" - This matter will b~ covered under safety topic III-5.B 11Piping Break Outside Containment.
11
- 2.
SRP Section 3.6.2, 11Determination of Break Locations and Dyna!'(lic Effects Associated with the Postulated Rupture of Piping** - This matter will be covered under safety topic III-5.A "Effects of Pipe Break on Structures, Systems and Components Inside Containment."
.J
,1; 3.
Natural Phenomena -
Thi~ matter will be* covered under safety topic III-6, "Seismic Design Considerations" and III-4.A, "Tornado Missiles."
- 4.
Turbine Missiles - This matter will be covered under safety topic III-4.B, "Turbine Missiles."
Interfaces with Other SEP Safety Topics Satisfactory resolution of the following safety topics will depend, at least in part, on satisfactory resolution of this topic:
1.* Topic VIl-3 "Systems Required for Safe Shutdown"
- 2.
Topic VII-4 "Effects of Failure in Non-Safety Related Systems on Selected. Eng.i neered Safety Features" 3..
Topic IX-l "Fuel Storage
- 4.
Topic IX'-3 "Station Service* and Cooling Water System"
- 5.
Toi?iC 1I-3~C '.'Safety-Related Water Supply" (Ultimate Heat Sink)
IV.
REVIEW GUIDELINES
- l. Systems. and components needed to perform safety functi ens were i denti fi ed as those listed in SRP Section 3.2.2, "Systems Quality Group Classifica-ti on"
. *-* *- -*--- --** ----~-.
---~---*- -
jy_~~gl!ILQ~e9e9 _tOJ)_e.r.fClDil. safe.ty functions (safe plant shutdown or accident
_mi ti.~ti QO=S:..:.: __ _
~
Eme.r~!l£1.. Cor_g;_J:oQJ.i.o.g_S,.y.s.tem* -~* --........... * -..,....
- c.
ca~tainment ~mergency Cooling Systems
- d.
Chemical and Volume Control System
e..
- f.
- g.
- h.
- i.
- j.
- k.
- 1.
- m.
.n.
Residual Heat Removal System Component Cooling Water System Service Water System Compressed Air System Diesel Generator Auxiliary Systems Diesel Fuel Oil System Main Steam System (portions of)
Feedwater and Condensate Systems (portions of)
Auxiliary Feedwater System Venti.lation.System for Areas such as Control Room and Engineered Safety Features Equipment Rooms o ** Condensate Storage System p*. *Combustible Gas Control System
- 2.
Systems whose failure may result in release of unacceptable amounts of radi cacti vity :*
- a. Spent Fuel Pool Cooling and Cleanup System
- b.
Sampling System
- c.
Liquid Waste Processing System
- d.
Gaseous Waste Processing System
- e. Containment Waste Processing System
- f. Containment Purge System
- 3. Additionally_, electrical-systems \\*Jhich are necessary to support those fluid systems needed to perform safety functions are:
aa.
Diesel Generators b~. Station Batteries cc.
2400V and 480V Switchgear and Relay Rooms dd.
Control Room ee. *Cable Spreading Room V.
REYIEW AND EVALUATION
- 1. Systems need. to perfonn safety functions:
- a.
PRIMARY COOLANT SYSTEM The primary coolant system serves as the pressure retaining boundary for*
- the primary coolant and is comprised of a reactor p-ressure vessel and~ two parallel heat transfer loops.
Each loop contains one steam generator and
- t\\'IO pumps, connecting piping: and instrumentation. A pressurizer and associated safety valves are connected to one of the reactor ou_tle~ pipes.
The purpose of the pressurizer is to maintain primary coolant pr~ssure and compensate for coolant volume changes as the heat load changes.
All compo-nents of the primary coolant system are located within the containment building.
Overpressure protection is provided to assure the cool ant system pressure does not exceed design 1 imits.
- The reactor vessel head is secured-to the reactor vessel by special hydraulic stud tensioners *. It is unlikely that any of the studs would become a missile since they are not subjected to reactor pressure and, therefore, are not exposed to sufficient pressure to create an accelerating force sufficient to cause them to become. missiles.
~.L 1 The pressurizer relief valves have the potential for becoming missiles.
Both the power operated relief valves and the primary relief valves are mounted on top of the pressurizer. The position of the pressurizer above the loops and in a concrete compartment is such that any parts blown off the relief valves would strike above or to the side walls and is not
.. likely to damage other components. or piping of the primary coolant system.
Control rod drive modules are mounted on the top of the reactor vessel and are considered as an extension. of the rea.ctor vessel head.
Each module is bolted to a flange on the reactor vessel head and seal welded.
The modules are all structurally tied together for seismic reasons and*
ta provide lateral stability. Because of this design,. we do not con.sider the modules as likely missiles for these reasons.
Further9 *a 24 11 thick concrete, cover* is placed over the control rods during operation as..
further protection against potential missile damage to safety systems.
Instrumentation generally requires.some penetration into the reactor coolant system. These penetrations are usually small and take the form of welded wells.
We considered the orientatidn of the wells and con-cluded that they are not likely candidates for missiles but should one fail, that it will not cause serious.destructive damage to the reactor coolant system or compromise. its safety *
. we als.o examined the possibility that missiles may also result from destructive overspeeding of one of the primary coolant. pumps in the event of a pipe break in the pump discharge.
We concluded that poten-tially damaging impeller missile ejection from the broken pipe is
...;,~:-***--**... *-****,.,.. _ --~----**;~~--** *....
J
~.'.:,.
- minimized by a massive steel pump casing. Generation of missiles from overspeed of both the motor, flywheel and the impeller is a generic prob 1 em whi.ch wi 11 be reviewed under Task Action Pl an B-68, 11 Pump Over-s peed During a LOCA.
11 We believe that the probability of missiles from*
overs peed of both the motor and impeller of a primary coolant pump that could result in damage to safety-related equipment is acceptably low to allow continued operation of this plant. Should th~ results of our generic study indicate the need for any design modifications, Pa 1 i sades wi 11 be required to satisfy these requirements.
Detailed discussion of primary coolant pump flywheel integrity is given in SEP Topic III-10.B.
The two steam generators have manways held in position by studs on the primary and.secondary sides of the shell *. These studs are not subjected to
- sufficient pressure to result in a significant missile source.
We, there-
_foie~-do not consider the steam generators as likely missile generat.ing,.
source* *.
In summary,. in considering the primary coolant system, because of its*
equipment design features and component arrangement, it is our judgement that this system's function will not be detrimentally affected considering internally generated missile sources from the reactor.coolant system as identified abo~e~ Further, should a missile create a break in the pri-mary coolant system, the emergency care cooling system will keep the core cooled.
- b.
EMERGENCY CORE COOLING SYSTEM The Palisades emergency core cooling system (ECCS) serves as the means of injecting water for core protection in the event of primary coolant system water loss and consists of a high-head subsystem, a low-head subsystem, and safety injection tanks.* ECCS flow is provided from these three subsystems into the reactor coolant system through the four cold-leg reactor i ril et pipes. The high-head subsys tern consists.of three pumps, each rated at 300 gpm.
The low-head. system consists of two pumps, each rated at 3000 gpm.
Four passive safety injection tanks containing borated water are provided inside the containment building.
The initial source of water for the high-head and low-head pumps is the Safety Injection and Refueling Water Storage Tank. This tank is located cut*of-doors on the roof of the auxiliary building above the control room.
The high and low head subsystem piping follows a common pipe chase from the pumps:, passes through containment penetrations and stays below the*
operating floor as the piping branches out to the four cold-leg reactor inlet pipes.
The four safety injection tanks are positioned inside containment about
-.~- -----*** --- - -- *-......... -- --
TOO feet above the containment floor in separate quadrants of containment.
These four tanks also connect to the four cold-leg reactor inlet pipes.
During our visit to the site we were not able to enter certain areas of the plant.
From bur discussions with.the licensee and his contractor, we determined that except for the safety injection tanks and the Safety Injection and Refueling Water Storage Tank, th~ main components of the ECCS redundant trains are located in two separate engineered safety feature
. (ESF) rooms below ground level outside containment. The high-head and low-head subsystems are arranged such that sufficient active components
. are located in each room to meet the design basis requirements of the system.
Each ESF room has a sump pump and a ventilation system, each of which is powered from the emergency buses (see safety topic IX-5 "Venti-lation System").
We. concluded that the most likely source of missiles in the ESF rooms was fro~ the high-head pump.
This pum~ is a 400 H.P. horizontal multistag~
centrifugal pump operating at 3600 rpm.
We believe that this pump will
. not become a source of missiles because the impeller~ if brokeni is not likely to penetrate the, thick steel casing. The other pumps {low-head) io the rooms operate at Towe.r* speeds and are thus less likely to generate missiles. Should missiles be generated. in one of the two ESF rooms, those missiles are not likely to penetrate the barrier wall between rooms and result in the loss of the redundant ESF equipment.
The separa-tion of redundant pumps and other associated*ECCS equipment into the*
separate ESF rooms thus reduces the likelihood of simultaneous loss of more than one train of ECCS equipment by a postulated missile.
The positioning of the Safety Injection and Refueling Water Storage Tank on the roof of the. Auxi ii ary Bu.i 1 d.i ng would~ tend to make the tank safe from internally generated missiles other than those which might originate from the turbine generator (see safety topic III-4.B "Turb.ine Missile~").
The tank is not tornado missile. proof (see safety topic III-4.A "Tornado
- Missiles"). however, the building roof and parapet construction provide some inherent tornado ~issile protection.
'. Once the piping from the two ESF rooms enters containment it is kept below the operating floor be.fore separating and* connecting to the four reactor inlet (~old} legs. While this piping may be subject to damage from internally generated missiles, a single missile should not damage more than a limited area of a single. train of piping.
Further, depending on where the pipe damage is encountered, upstream or downstream of the va 1 ve nearest to the primary system,. determines the extent of the effect on the primary system. If the damage (break} occurs downstream of the
- valve, a demand would be placed on the. ECCS {LOCA) and the system will perform its design function once. the affected line is isolated.
I.f the break occurs upstream of the valve, no demand will be placed on theECCS as. the valves are tnitially closed* and no LOCA results, however, the plant will be* shutdowr:r and the piping repaired.
The four safety* injection tanks are 1 oca ted well away from each other.
This physical separation and the elevation of the tanks provides inherent protection against damage to more than one tank from internally generated **
..r missiles inside containment~ Further, loss of one of the four tanks (safety injection tank spillage) was taken into consideration in the ECCS performance (LOCA) analyses.
In summary, in considering the ECCS, because of its functional design, redund~nt features, separation and equipment design features, it is our judgement that this system will be capable of performing its design.
function considering internally generated missile sources as discuss.ed above.
- c.
- l.1-CONTAINMENT EMERGENCY COOLING SYSTEMS The containment emergency cooling systems consists of two independent systems - an air reci rcul at ion and cooling system and a SP.ray system.
The containment air recirculation and. cooling system consists of four heat exchanger fan units, and the spray system consists of three half-capacity pumps, spray headers, and nozzles.
The source of water for the spray system is the Safety Injection and Refuelin.g Water Storage Tank
. (see section b. Emergency Core Coo 1 i ng System).
The: four recirculation heat exchanger fan units are positioned. inside con-tainment in separate quadrants. Therefore,. because of this separati.on, it is unlikely that a single-* missile could fail more than one of these units~ The spray system headers and nozzles are split into redundant halves.... The spray nozzles are* located high inside containment.
There-fore, it is questionable that any missiles would reach these components *.
Should one-half of the. nozzles be damaged, some amount of containment cooling,. utilizing the-sprays could be provided using the redundant half of the nozzles.
The spray system pumps are located separately in the two engineered
- safety feature rooms (see section b. Emergency Core Cooling System).
We concluded in section b. that the most likely source of missiles in that room was from the* high-head pump.* Should a missile fail one of the spray system pumps,. the remaining spray system pumps would continue
. to function.
Further, the four* re.circulation heat exchanger fan units have adequate cooling capacity to perform the emergency containment cooling.
In: surranary, in considering the contaioment emergency cooling systems, its redundant features and separation, it is our judgement that this system will be capable of performing its design function considering internally generated missile sources as. discussed above.
- d.
CHEMICAL AND VOLUME CONTROL SYSTEM The chemical and volume control system (CVCS} controls and maintains reactor coolant system inventory and purity through the process of makeup and let-
- down.
The system consists of a regenerative heat exchanger and letdown heat. exchanger to cool: the excess coolant taken from the primary system du.ring plant heat up and plant operation. The coolant is reduced in temperature and pressure and passed to purification and deborating demineralizers where corrosion and. fission products are removed.
The coolant. is then returned to the volume. control tank~ The charging pumps return the coolant to the prima_ry system from the volume control tank.
Additional water or boric acid is supplied to the charging pumps as necessary *.
The equipment for this system other than the regenerative and letdown heat exchangers is located in the auxiliary building in individual rooms which contains no equipment from other systems which might produce missiles.
The heat exchangers are both located inside containment at approximately
- El. 607 feet.
During our wa.lk through of the plant and discussions with the licensee and his contractors we \\'lere not ab 1 e to i den ti fy any potenti a 1 *sources of missiles which could endanger the CVCS.
The system, however, is not fully
..... redundant and a missile.coutd disable the system.
Should this happen, the plant could still be shut down safely in a normal manner using the auxiliary fee_dwater system and the residual heat removal system.
We, therefore, conclude that while the possibility of internal missile damage to the eves is very low, such an event will" not result in an unacceptable release of radioactivity or endanger the safe shutdown of the plant.
We-conclude that additional protection is not requ{red-.
- e.
RESIDUAL HEAT REMOVAL SYSTEM The shutdown cooling (_residual heat removal) function of the safety injection system is brought into use during plan~. s~utdown \\-Jhen the pri-
_mary coolant temperature and pressure.fall below. 325°F and 270 psi'a.
At. that time certain valves are remote manually aligned to allow primary coola.nt flow through the shutdown cooling, heat exchangers.
The. residual heat removal system consists of the shutdown cooling heat exchangers and the ass6ciat~d valves and piping. The reactor coolant is circulated through the shutdown cooling heat. exchangers using the LPSI pumps and is then pumped back to the cold leg inlet of the reactor. The shutdown cooling. heat exchanger transfers decay heat tn the component cooling water system which in turn transfers its heat to the service water system which discharges into Lake Michigan, the ultimate heat sink.
While the residual heat removal system is not redundant, the components of* the system are located in the ESF rooms such that the potential for missiles striking the system is low. -Should a miss~_le strike the system, the plant can be safely shutdown using the auxiliary feedwater system.
I
.,. In our judgement the pl~nt can. be safely shutdown considering a missile strikes the system piping or components.
- f.
COMPONENT COOLING WATER SYSTEM The component cooling water system fs a closed system wtth three motor
=---=-~-=-*-:::-
driven pumps rated at 300 *HP and 6000 g~rn and t~*!O hori zonta 1 counter flow heat exchangers.
This equipment is grouped at floor EL. 590 1 -0 11 in a room directly outside of containment in the auxiliary building. Heat transferred to the component cooling water system is transferred to the service water system through the two horizontal counter fl ow heat exchangers and~ is
- released into Lake Michigan (see also topiC' IX-3. "Station. Service and Cooling Water System)
- The compo.nent coo 1 i ng water system removes: heat from* the shutdown cooling.
heat exchangers, engineered safeguards pump jackets and seals, letdown heat exchanger and reactor coolant pump seals and bearings.
Two branch loops of the component cooling water system provide cooling for the spent fuel heat exchanger and for the reactor primary shield cooling system which is a closed loop subsystem designed to keep the concrete in the reactor shield within design temperature.
From our review of the component cooling water system we conclude that it is unlikely that this system would be a source of missiles since it is operated at less than 106 psig and ~he pump speeds are only 1750 rpm.
Further, we did not identify any potentia.1 misstle sources which*
might endanger the component cooling water system. Sliotil d *a missile strike the component cooling. water system, it \\<1ould be necessary to shut the reacto.r down.
The auxiliary feedwater system \\<1ould be used (see section c. "Resi-dual Heat Removal System") *.
Should a missile strike the br.anch loop which cools the reactor primary shield cooling system, its loss is not of imme-diate concern as the temperature rise in the concrete is slow.
The.system would be repaired at the earliest convenient time. A missile strike into the spent fuel heat exchanger branch loop can be tolerated as the fuel pool heatup is a slow process and there is time to execute repairs or provide alternate cooling before the pool temperature becomes excessive.
We conclude that the component cooling water system is adequately protected from internally generated missiles.
g~ SERVICE WATER SYSTEM The service water system consists of three 350 HP 8000 gpm 50%. capacity vertical motor driven pumps located in the intake structure. (See also SEP Topic IX-3 "Station Service and Cooling Water System.) These pumps a.re located approximately four feet apart,. take their suction from the intake structure (Lake Michigan) and discharge into a corrmon header.
Isolation valves are provided at each pump.
The common discharge header contains s~ctiona1tzing valves operable from the control room if isola-tion of a portion of the system is required. Critical service water is taken from each end* of the common discharge header.providing two 24-inch critical service-water lines. These two critical service water line~ are routed underground to. the auxiliary bui 1 ding. A th i.rd. 24 inch l i ne supplies service water to non-critical systems.. The two 24 inch crittcal
..
- service water lines enter the auxiliary building in its substructure.
The piping and valv"ing is sectionalized such that one line provides \\*Jater to the containment air coolers and one emergency diesel gen:e ra tor. one control room air conditioner. two air compressor after coolers, engineered safeguard room coolers, and engineered safeguard pump seals. The other critical service line. supplies the component cooling water heat exchangers and one emergency diesel generator heat exchanger, one control room air conditioner, two air compressor after coolers, engineered safeguard room coolers. and engineered safeguard pump seal cooling.
He conclude that the. three. 350 HP 8000 gpm vertical motor driven service water pumps are unlikely missile generators because of their enclos~re (casing) and submergence in the intake structure, their low operating speed
- (1140 rpm) and, low operating pressure ( <100 psig) and would: not endanger th~ critical service water system piping and valves in the intake struc-ture. At the intake structure there is one electric driven fire pump and two diesel driven fire pumps along with the controls. for the traveling.
screens and a screen wash pump.
We do not corisider this equipment as Ti kely sources of mi ssi-1 e generation because they are 20 to. 30 feet away from the main service water pumps and are small low capacity pumps such that even if they failed it is unlikely they would cause destructive damage to the criti_cal service water system.
The pip.ing inside of the auxiliary building consists of relatively short pipe runs between valving to permit cross connections between.headers, branch system isolaiion and conn~ctiori to the back up fire protection system~ Our review of this area did not disclose missile sources or
- _,* targets that would contribute to loss of functfon of the system.
- Further, we could not identify any potential missile generators posing a threat to the two 24 inch lines between the intake structure and the auxiliary building since the piping is underground.
In the event of loss of this system, decay heat removal could be accom-plished by use of the auxiliary feedwater system.
The reactor could be placed in a natural circulation mode utilizing the steam generators for
Fire protection water could al so b~ used as a service.
water substitute depending on the location of' the damage to the service water system.
W~conclude that the service water system is not a potential source of damaging missiles nor is it susceptible to the loss of function due to missile damage and meets. our requirements for design against missiles.
~-
COMPRESSED AIR SYSTEM The compressed air system is designed to supply oil free air to both the instrument air and service air systems.
Three full capacity nonlubricated compressors ar~ provided with separate after coolers and air receivers.
The air receivers are interconnected.
Two air headers leave the air receivers, one to supply instrument air after filtering and drying, the other to supply the service air system.
Both headers have branch lines routed to the various buildings associated with the reactor facility.
One high pressure compressor with after cooler drier and receiver is located in each of the engineered safety features room to supply air to safety-related valves. A separate backup air header is routed from the high pressure compressor in the turbine* generator building to the engineered
.. safety feature rooms to operate the air operated valves.
The manual cross ties between these systems are normally closed and under admini-strative control.
The safety-related compressors are protected by their location in the engineered safety features rooms.
The normal air supply system functions at about 100 psig.
The high pres-sure system is designed for 325 psig and is protected against missiles by its location beneath the main turbine at floor El. 590'-0"~ The air distribution headers are protected from missiles by routing the piping through protected structures until they reach their terminal point., _
The largest potential missil*e g~nerator is the air receivers but these are ASME Code Vesse*ls protected by relief valves set well below the air receiver rupture pressure~
Our assessment of this system is that it is unlikely to produce missiles
- or be impacted by missiles because of the protection provided by the surrounding. structures utilized in their routing. The equipment lccation and routing of headers in our judgement affords adequate protection against missiles. In our judgement this system will be capable of perfonning its design function considering internal missiles as described above~
- i. DIESEL GENERATORS AUXILIARY SYSTEMS Two diesel generators are located in the NW wing of the auxiliary building.
The two units and their auxiliaries are separated by walls and the ele-vated diesel oil tanks are located in ac-concrete enclosure in a corner of the room.
- _.--' Due to independence and separation of the diesels and their associated auxiliary systems, it is our judgement that the diesel generator auxiliary systems will be capable of performing their function considering internal missiles.
- -***-*-** -***r*-- *
- k.
MAIN STEAM SYSTEM ( porti ans of)
The main steam system consists of two steam generators, two 36-inch steam lines or headers, and main steam isolation valves.
The steam generators are located inside ccintainment (see section a. "Primary Coolant System").
The two main steam lines penetrate containment at El. 617.
The main.
steam isolation valves, safety valves, and atmospheric dump valves are located outside the containment at this point. The steam lines are then routed into the turbine bufldingwhere the two lines are split into 4 lines just prior to joining the turbine: *.
The point of entry into the. turbine building for the main steam 1 i nes is below the turbine floor. The main steam. lines are heavy walled, well supported and; protected from internally generated. missiles from other sources by their physical location behind structural walls. and* floors *.
We conclude from our review: of.the* main steam system that this system will not produce* missiles due to its heavy walled design and construction.
Should a missile from other sources cause damage to the main steam system downstream of the main steam isolation valve,. the valve would be closed and the plant would be shutdown.
Should the missile damage occur upstream of th~ valve* o~ at the valve itself, the plant can b~ safely shutdown as one of the design basis accidents for* the plant is a steam generator blowdown~
I In summary, in considering the main steam system, its features and pro-tection from internally generated missiles due to plant layout, it is our Judgement that this system will be capable of performing its design function considering internally generated missiles as described above.
- 1.
FEEDWATER. ANO CONDENSATE SYSTEMS (portions of)
The main feedwater system consists of two turbine driven pumps which pump water to the two steam generators. Condensate from the hot well is pumped by two 50% capacity motor driven pumps through the air ejectors and gland seal condensers and then through several stages of preheating in parallel to the turbine driven main feedwater pumps.
The only area
. -. *--. *~.... -
of concern for this system iS that portion of the system from the steam gener~tor to the isolation valves.
We believe the likelihood of missile damage to this area of the system is low due to its location and protection by surrounding equipment.
- Further, if the system were damaged in this area, that steam generator would probably blowdown.. The plant. could, however, be cooled down using the second steam generator and the auxiliary feedwater system.
- m.
AUXILIARY FEEDWATER SYSTEM*
The auxiliary feedwater system consists of two trains of equipment; one train contains an electrical-driven pump and the second train contains a turbine-driven pump.
Both pumps are rated at 450 gpm.
The auxiliary feedwater system pumps take their suction from the condensate storage tank (see section w~ "Condensate Storage System").
The discharge* from the pumps combines beyond the pump stop and check valv.es and then splits again in order to feed both steam generators.
.I
' From our review of the auxiliary feedwater system we conclude that the most likely-source of missiles would be the pumps themselves.
The two pumps are located side by side but are removed from other high energy sources.
The pump casings are steel.
We conclude from our review of the construction of the pumps that there is a low probability that missiles would get outside of the casings.
In summary, in considering the auxiliary feedwater system, its redundant features and protection to internally generated missiles due to plant layout (separation), it is our judgement that this system will be capable of performing its design function considering internally generated
- missiles.
- n.
VENTILATION SYSTEM FOR AREAS SUCH AS THE CONTROL ROOM AND ENGINEERED SAFETY FEATURE ROOMS a) Engineered Safeguards Room
- The equipment in the engineered safeguards room is designed to -operate at 135°F.
Normally fresh filtered air is brought in via a blower and a series of discharge subheaders one of which is directed to the engineered safeguards room.
Two independent water cooled fan units are a 1 so provided in these two equipment spaces for emergen.cy operation.
The exhaust air from the engineered safeguards,room is. directed to filters and fans which mix the air with other air going up the vent stack.
b)
The Control Room The control room is independently air conditioned by two completely separate units. Air is recirculated and fresh air is added to create a sligh_t positive pressure in the control room.* Both fresh air and recirculated air is filtered prior to admittance to the control room *.
( Our review did not reveal any potential missiles being generated by the ventilation system for either the engineered safety feature rooms or the control room.
While duct work can be penetrated by missile_s, the total cooling capability is. not lost for either area, a*nd time is available for action to restore adequate ventilation.
In summary, in considering* the ventilation systems for the b:o areas, it is our judgement that these systems will be capable of performing their design function considering. internally generated missiles.
- o.
CONDENSATE STORAGE SYSTEM The* condensate storage system consists of a 125,000 gallon tank for* storage of makeup water for the main feedwater system and as a source of auxiliary feedwater.
By virtue of the.tank's location in the station yard (not in a building),
we conclude that the tank is not subject to.internally generated missiles nor is it a source of missiles.
- p.
COMBUSTIBLE GAS CONTROL SYSTEM An electrical recombiner system has been provided as part of the engi-neered safety system consisting of two electrically heated units inside of containment.
The units are passive, redundant in that only one unit is necessary for combustible gas control of the containment volume, and operate by natural convection circulating the air inside of containment.
From our re_view of this system, we conclude that it is not a missile generating system nor is it subject to the impact of missiles~ The
... system is not needed to -shut the plant down.
Should a missile strike the system, its repair could be scheduled in a. timely manner so as to not interfere with plant.operation.
- 2. Systems whose failure may result in release of unacceptable amounts-of radioactivity:
- a.
SPENT FUEL COOLING SYSTEM The spent fuel cooling system is a closed loop system consisting of two
- half capacity pumps, two full capacity heat exchangers in series, a by-pass filter,. a bypass demineralizer, a booster pump, piping valves and instrumentation. Heat from the spent fuel pool is transferred by means 6f th~ above heat exchangers to the component cooling water system (see.
section f. "Component Cooling Water System").
The equipment is divided tnto three shielded cells in the spent fuel pool equipment room at £1.
590 1-0 11 near the center of the auxiliary building.
- Tha spent fuel cooling system is a low energy system unlikely to generate
. missiles or be impacted by them because of the compartmentalization of system components.
Discussions with the applicant and their contractor.
indicated that the compartmentalization of this system make it unlikely that. missile generation could damage surrounding equipment or that damage by outside missiles to the system could occur. Should the equipment become* inoperable due to that missile damage, there is sufficient time to effect repair or arrange for alternate cooling.
In our judgement,. this system will be capable of performing its function considering. internally
~enerated missiles as desired above.
.. b.
SAMPLING SYSTEM Reactor coolant system fluid samples are passed through a cooler, pressure reducing coil, flow controller and finally an analyzer.
Grab samples are also taken for later analysis in the chemistry lab. All of the reactor coolant sampling operations are performed in a room with concrete walls.
The sampling equipment is in a separate room.
The likelihood of missles from any source causing damage to the sampling system is considered highly*
unlikely.
We conclude the above system meets our requirements for design
. against missiles.
- c.
LIQUID HASTE PROCESSING The liquid waste system is divided into three sections:
--*-(ll Clean *wastes (high activity low sol ids)
(2)
Dirty wastes (3)
Laundry wastes The liquid waste system is located in shielded vaults which provide pro-tection agafnst internally generated missiles. The largest pumps are in the order of 75 HP at 3500 rpm and 100 psig, and, therefore, is not lfkely to generate missiles. Further, should a missile damage this system and if contents are drained, the.resulting liquid release would.be
- .......-*...;z retained in the building long enough to allow a clean-up.
- d.
GASEOUS WASTE PROCESSING SYSTEM The gaseous waste system is divided into two sections:
(1)
Gas Collection Header (2). Waste Gas Processing System
\\.
y The waste gas system is.operated at pressures less than 120 psig. The total.gas volume at pressure is less than 1000 ft3* Thus, the system is not likely to be a source of internally generated missiles. All of the compressors ind storage tanks are behind shield walls and include shield walls between clusters of equipment.
Our revi.ew of this system verified that this system was protected from internally generated missiles from outside s*ources and the pptential for
- internally generated missiles from the system itself was small.
Further
- missile damage to the system will not affect the safe shutdown of the facility.
- e.
CONTAINMENT WASTE PROCESSING Drainage inside containment is collected in the containment sump.
From.
the containment sump, it flows by gravity to the dirty waste drain tank 1,
in* the auxiliary building.
From our review of this system we could not identify a method by which it could produce missiles. Should a missile damage the system, there is adequate time to make repairs..
- f.
CONTAINMENT PURGE SYSTEM The containment purge system is provided. to periodically purge the contain-ment.prior to entry. The system consists of three* fans. filters, duct work and isolation valves. All of these components except portions*of the. duct work and the isolation valves are located in a* common room in the auxiliary building.
\\.
{J..
- 3. The licensee states that the system is only operated with the reactor shutdown. It follows that this system could only be considered a poten-tial missile producer at that time.
From our review we conclude that the probability of this system producing missiles or being damaged by a missile is very low. Should a missile damage this system, there would be ample time to perfonn reapirs.
We, therefore, conclude that the missile protection provided for the system is acceptable.
El.ectrical Systems which are necessary to support those fluid systems needed to a) b)
perform safety functi ans:
DIESEL GENERATOR See Section V.l.i
- STATION BATIERIES The two station batteries are in separate rooms both of which are located in the cable spreading room.- Their supporting auxiliary systems such as the chargers, busses, and ventilation system are independent._ From our examination of the two station battery* rooms we conclude that there is a very low potential for a missile being generated in these two rooms.
We
. were* i nfonned* that the cells of the batteries have caps designed to minimize the possiblity of hydrogen explosions.
Should a missile be -generated in one of the two rooms and damage the battery, it.is questionable that the missile would penetrate the wall between the rooms and damage the second battery.
From our review of the two station batteries we conclude that the separate rooms for the two batteries provide protection from internally generated missiles.
c) 2400V and 480V SWITCHGEAR There are three 2400V load centers, two of which are integral parts of the plant engineered safeguards electrical system.
These two load centers are located in separate rooms, on different floors of the auxiliary building.
The fire protection system, is the only potential source of missiles in these areas, and since it is a low pressure system, it is not a likely missile source.
- The 480V switchgear consists of one double-ended load center and two motor control centers which are part of the plant engineered safeguards elec-trical system.
The 480V switchgear is located in the cable spreading room (see section* ee. "Cable Spreading Room"}.
As is stated in that section. the cable spreading room does not contain any piping or other pressurized sources which might produce missiles.
We conclude that the location of 2400V and 480V switchgear provide ade-quate protection from internally generated missile ~ources.
d)
CONTROL ROOM The control room is located in the north\\-1est corner of the auxiliary building.
From our walkdown of the plant we were concerned that large portions of two walls of the control room are glas~. We concentrated our efforts on looking for.missile sources outside of these two glass areas.
We did not identify. any potential missile generators outside the control room ~rea whith could result in damage to the control room:
Also our wa1k* aroun~ of the control room itself did not disclose. any sources which might produce missiles other than possibly fire extin-guishers.
We do not consider these items as sources of potentially damaging missiles.
We concluded that there are no missile sources which could affect the proper functioning of the control room.
e)
CABLE SPREADING ROOM The cable ~preading room is located directly below the control room.
This room contains the electrical cables, the 480V switchgear, the two battery rooms (see section bb.. "Station Batteries) and the control rod contactor panel.
The cables are routed through this room on their way to the con.trol room.
The.cable spreading room does not contain any piping or other pressurized sources or rotating equipment which might produce missiles. The fire protectfon system in this room is low pres-sure and thus is not capable of generating potentially damaging missiles.
We conclude that there are no potential missile sources in this area
- whiCh could affect safety related equipment.
VI.. CONCLUSIONS from o*ur review of the sys terns and components needed to perform safety functions, we conclude that the design of protection from internally generated missiles meet the intent of the criteria listed in Section II REVIEW CRITERIA and are, therefore, considered to be acceptable *
....... **-