ML19003A352
| ML19003A352 | |
| Person / Time | |
|---|---|
| Site: | Turkey Point  |
| Issue date: | 12/21/2018 |
| From: | Florida Power & Light Co |
| To: | Office of New Reactors |
| Shared Package | |
| ML19003A318 | List:
|
| References | |
| L-2018-237 | |
| Download: ML19003A352 (18) | |
Text
3.5-1 Revision 0 Turkey Point Units 6 & 7 - IFSAR 3.5 Missile Protection General Design Criterion 4 of Appendix A to 10 CFR 50 requires that structures systems and components important to safety be protected from the effects of missiles. The AP1000 criteria for protection from postulated missiles provide the capability to safely shut down the reactor and maintain it in a safe shutdown condition. The AP1000 criteria also protect the integrity of the reactor coolant system pressure boundary and maintain offsite radiological dose/concentration levels within the limits defined in 10 CFR 50.34.
Missiles may be generated by pressurized components, rotating machinery, and explosions within the plant and by tornadoes or transportation accidents external to the plant. Potential missile hazards are eliminated to the extent practical by minimizing the potential sources of missiles through proper selection of equipment, and by arrangement of structures and equipment in a manner to minimize the potential for damage from missiles. Potential missiles due to failures of nonseismic items are addressed in Subsection 3.7.3.13. Heavy load-drop evaluations are described in Subsection 9.1.5.
The following are definitions for missile protection terminology:
Internally Generated Missile - A mass that may be accelerated by energy sources continuously present on site.
Single Active Failure - Malfunction or loss of a component of electrical or fluid systems. The failure of an active component of a fluid system is considered to be a loss of component function as a result of mechanical, hydraulic, pneumatic, or electrical malfunction, but not the loss of component structural integrity.
High-Energy System - Fluid systems that, during normal plant conditions, are operated or maintained pressurized with a maximum operating temperature greater than 200°F and/or a maximum operating pressure greater than 275 psig, as discussed in Subsection 3.6.1.
The following criteria are applied in the identification of missiles and the protection requirements that must be satisfied:
A missile must not damage structures, systems, or components to the extent that could prevent achieving or maintaining safe shutdown of the plant or result in a significant release of radioactivity.
A single active component failure is assumed in systems used to mitigate the consequences of the postulated missile and achieve a safe shutdown condition. The single active component failure is assumed to occur in addition to the postulated missile and any direct consequences of the missile. When the postulated missile is generated in one of two or more redundant trains of a dual-purpose safety-related fluid system, which is designed to seismic Category I standards and is capable of being powered from both onsite and offsite sources, a single active component failure need not be assumed in the remaining train(s), or associated supporting trains.
Walls, partitions, and other items that enclose safety-related systems, or separate redundant trains of safety related equipment, must be constructed so that a postulated missile cannot damage components required to achieve safe shutdown nor damage components required to prevent a release of radioactivity producing offsite doses in excess of 10 CFR 50.34 limits.
A postulated missile from the reactor coolant system must not cause loss of integrity of the primary containment, main steam, feedwater, or other loop of the reactor coolant system.
3.5-2 Revision 0 Turkey Point Units 6 & 7 - IFSAR
A postulated missile from any system other than the reactor coolant system must not cause loss of integrity of the containment or the reactor coolant system pressure boundary.
Other plant accidents or severe natural phenomena are not assumed to occur in conjunction with a postulated missile (except for tornado).
Offsite power is assumed to be unavailable if a trip of the turbine-generator or reactor protection system is a direct consequence of the postulated missile.
Safe shutdown is accomplished using only safety-related systems with a coincident single active failure, although nonsafety-related systems not affected by the missile are available to support safe shutdown.
Missiles are postulated to occur where the single failure of a retention mechanism can result in a missile, unless the missile is not considered credible as discussed later. Missiles created by the independent failures of two retention mechanisms are not postulated.
The energy of postulated missiles produced by rotating components is based on a 120 percent overspeed condition, unless such an overspeed condition is not possible (such as a synchronous motor).
Equipment required for safe shutdown is located in plant areas separate from potential missile sources wherever practical.
Spatial separation may be used to demonstrate protection from missile hazards when it is shown that the range and trajectory of the generated missile is less than the distance to or is directed away from the potential target.
The AP1000 passive design minimizes the number of safety-related structures, systems, and components required for safe shutdown. Systems required for safe shutdown are identified in Chapter 7. Safety class structures, systems and components, their location, seismic category, and quality group classifications are given in Section 3.2. General arrangement drawings showing locations of the structures, systems, and components are given in Section 1.2 The areas required for safe shutdown, and the major systems and components housed therein that are required to be protected from internally and externally generated missiles for safe shutdown, are summarized below:
The containment vessel, including the reactor coolant loop, and passive core cooling system inside containment
The shield building, including the passive containment cooling system
Containment penetration areas, including containment isolation valves and Class IE cables
The control complex including the main control room, reactor protection system, batteries, and dc switchgear
The spent fuel pit The AP1000 relies on safety-related systems and equipment to establish and maintain safe shutdown conditions. There are no nonsafety-related systems or components that require protection from missiles.
3.5-3 Revision 0 Turkey Point Units 6 & 7 - IFSAR Evaluations are performed to demonstrate that the criteria are satisfied in the event a credible missile is produced coincident with a single active component failure. These evaluations include the following:
For those potential missiles considered to be credible, a realistic assessment is made of the postulated missile size and energy, and its potential trajectories.
Potentially impacted components associated with systems required to achieve and maintain safe shutdown are identified.
Loss of these potentially impacted components coincident with an assumed single active component failure is evaluated to determine if sufficient redundancy remains to achieve and maintain a safe shutdown condition. If these criteria are satisfied, no further protection is required for the identified missile. If these conditions are not satisfied, additional protective features are incorporated (for example, plant layout is modified, or barriers are added).
3.5.1 Missile Selection and Description 3.5.1.1 Internally Generated Missiles (Outside Containment) 3.5.1.1.1 Criteria for Missile Prevention Equipment for the AP1000 is selected to minimize the potential for missiles to be generated. Missiles are postulated as described in Subsection 3.5.1.1.2. The following items are the major equipment selection considerations with regards to missile prevention:
Safety-related rotating equipment is designed so that the surrounding housings would contain fragments in the event of failure of the rotating parts.
Valves that have only a threaded connection between the body and the bonnet are not used in high-energy systems. ASME Code,Section III valves with removable bonnets should be of the pressure-seal type or have bolted bonnets.
Valve stems of valves located in high-energy systems have at least two retention features. In addition to the stem threads, acceptable features include back seats on the stem or a power actuator, such as an air or motor operator.
Thermowells and other instrument wells, vents, drains, test connections, and other fittings located in high-energy systems are attached to the piping or pressurized equipment by welding. The completed joint should have a greater design strength than the parent metal.
Threaded connections in high-energy systems are avoided.
High-pressure gas cylinders permanently installed in safety-related areas are constructed to the criteria of ASME Code,Section III or Section VIII. Portable and temporary cylinders and cylinders periodically replaced in safety-related areas are constructed and handled in accordance with applicable Department of Transportation requirements for seamless steel cylinders.
3.5.1.1.2 Missile Selection 3.5.1.1.2.1 Missiles not Considered Credible This subsection describes internally generated missiles (outside of containment) not considered credible. Missiles not considered credible include the following:
3.5-4 Revision 0 Turkey Point Units 6 & 7 - IFSAR
Catastrophic failure of safety-related rotating equipment (such as pumps, fans, and compressors) leading to the generation of missiles is not considered credible. These components are designed to preclude having sufficient energy to move the masses of their rotating parts through the housings in which they are contained. In addition, material characteristics, inspections, quality control during fabrication and erection, and prudent operation as applied to the particular component reduce the likelihood of missile generation.
Catastrophic failure of nonsafety-related rotating equipment is not considered credible in situations where measures similar to those just described for safety-related rotating equipment are applied to them. Protection from nonsafety-related equipment will normally be provided by separation. In special situations, equipment features may be used to prevent missile formation.
Provisions to preclude generation of missiles due to failure of the turbine generator are discussed in Subsection 3.5.1.3.
Missiles originating in non-high-energy fluid systems are not considered credible because these systems have insufficient stored energy.
The valve bonnets of pressure-seal, bonnet-type valves, constructed in accordance with ASME Code,Section III, are not considered credible missiles. The valve bonnets are prevented from becoming missiles by the retaining ring, which would have to fail in shear, and by the yoke capturing the bonnet or reducing bonnet energy. Because of the conservative design of the retaining ring of these valves, bonnet ejection is unlikely.
The valves of the bolted bonnet design, constructed in accordance with ASME Code,Section III, are not considered credible missiles. These bolted bonnets are prevented from becoming missiles by limiting stresses in the bonnet-to-body bolting material according to ASME Code,Section III requirements, and by designing flanges in accordance with applicable code requirements. Even if bolt failure would occur, the likelihood of all bolts experiencing simultaneous complete severance failure is not credible. The widespread use of valves with bolted bonnets, and the low historical incidence of complete severance failure of the bonnet, confirm that bolted valve bonnets are not credible missiles. Safety-relief valves in high energy systems use the bolted bonnet design.
Valve stems are not considered as credible missiles if at least one feature (in addition to the stem threads) is included in their design to prevent ejection. Valve stems with back seats are prevented from becoming missiles by this feature. In addition, the valve stems of valves with power actuators, such as air-or motor-operated valves, are effectively restrained by the valve actuator. Valve stems of rotary motion valves, such as plug valves, ball valves (except single-seat ball valves) and butterfly valves, as well as diaphragm-type valves are not considered as credible missiles. Because these valves do not have a large reservoir of pressurized fluid acting on the valve stem, there is little stored energy available to produce a missile.
Nuts, bolts, nut and bolt combinations, and nut and stud combinations have only a small amount of stored energy and thus are not considered as credible missiles.
Thermowells and similar fittings attached to piping or pressurized equipment by welding are not considered as credible missiles where the completed joint has a greater design strength than the parent metal. Such a design makes missile formation not credible. Threaded connections are not used to connect instrumentation to high-energy systems or components.
3.5-5 Revision 0 Turkey Point Units 6 & 7 - IFSAR
Instrumentation such as pressure, level, and flow transmitters and associated piping and tubing are not considered as credible missiles. The quantity of high energy fluid in these instruments is limited and will not result in the generation of missiles. The connecting piping and tubing is made up using welded joints or compression fittings for the tubing. Tubing is small diameter and has only a small amount of stored energy.
ASME Code,Section III vessel ruptures and ruptures of gas storage vessels constructed without welding using ASME Code,Section VIII criteria are not considered credible due to the conservative design, material characteristics, inspections, quality control during fabrication and erection, and prudent operation.
Rotating components that operate less than 2 percent of the time are not considered credible sources of missiles. Components that are excluded by this criterion include motors on valve operators and pumps in systems that operate infrequently, such as the chemical and volume control makeup pumps. This exclusion is similar to the exclusion mentioned in Subsection 3.6.1.1, that is, of lines from the high-energy category of lines that have limited operating time in high energy conditions.
Valves, rotating equipment, vessels, and small fittings not otherwise considered to be credible missiles due to design features or other considerations are not considered to be a potential source of missiles when struck by a falling object.
3.5.1.1.2.2 Explosions Missiles can potentially be generated by a hydrogen explosion. Missiles that could prevent achieving or maintaining a safe shutdown or result in significant release of radioactivity are precluded by design of the plant systems that use or generate hydrogen.
The battery compartments are ventilated by a system that is designed to preclude the possibility of hydrogen accumulation. Therefore, a hydrogen explosion in a battery compartment is not postulated.
Gaseous hydrogen is supplied to the nuclear island from bottles (high-pressure tanks) adjacent to the turbine building and near the nuclear island. The hydrogen supply is not located in an indoor compartment that contains safety-related systems or components. The quantity that could be released in the event of a failure of the hydrogen supply would not lead to an explosion even if the full contents of the connected storage is assumed to remain in the compartment in which it is released. Mixing within a compartment is achieved by normal convection caused by thermal forces from hot surfaces and air movement due to operation of HVAC systems. The hydrogen supply line is not routed through compartments that do not have air movement due to HVAC systems.
The bulk gas plant storage area for the plant gas system (PGS) stores liquid hydrogen for use in generator cooling. This storage area is located sufficiently far from the nuclear island that an explosion would not result in missiles more energetic than the tornado missiles for which the nuclear island is designed. The liquid hydrogen is converted to gas in the storage area and then piped to the generator in the turbine building. The turbine building includes sufficient ventilation to prevent an explosive concentration of hydrogen in the event of a leak.
A detonation of a flammable vapor cloud (delayed ignition) due to the accidental release of hydrogen from the PGS bulk gas storage area would not result in missiles more energetic than the tornado missiles for which the nuclear island is designed.
3.5-6 Revision 0 Turkey Point Units 6 & 7 - IFSAR 3.5.1.1.2.3 Missiles to be Considered The following missiles are considered:
Nonsafety-related rotating equipment, not excluded above,
Pressurized components, not excluded above, located in high-energy systems
High pressure gas storage cylinders that may experience a failure of the outlet pipe or valve if accidentally impacted.
3.5.1.1.2.4 Credible Sources of Internally Generated Missiles (Outside Containment)
The consideration of missile sources outside containment that can adversely affect safety-related structures, systems or components is limited to a few rotating components inside the auxiliary building and a few pressurized components in the chemical volume and control system. The safety-related systems and components needed as described in Section 7.4 to bring the plant to a safe shutdown are located inside the containment shield building and auxiliary building, both of which have thick structural concrete exterior walls that provide protection from missiles generated in other portions of the plant. Safety-related systems and components located in the auxiliary building, including the main control room, are protected from missiles generated in other portions of the auxiliary building by the structural concrete interior walls and floors. Protection against potential missiles from the turbine-generator is discussed in Subsection 3.5.1.3.
Rotating components located inside the auxiliary building that are either safety-related or are constructed as canned motor pumps would contain fragments from a postulated fracture of the rotating elements. These are excluded from evaluation as missile sources. Rotating components used less than 2 percent of the time are also excluded from evaluation as missile sources. This exclusion of equipment that is used for a limited time is similar to the approach used for the definition of high-energy systems. Nonsafety-related rotating equipment in compartments surrounded by structural concrete walls with no safety-related systems or components inside the compartment is not considered a missile source. Rotating equipment with a housing or an enclosure that contains the fragments of a postulated impeller failure is not considered a credible source of missiles. For one or more of these reasons the nonsafety-related rotating equipment inside the auxiliary building is not considered to be a credible missile source. Nonsafety-related rotating equipment in compartments with safety-related systems or components that do not provide other separation features have design requirements for a housing or an enclosure to retain fragments from postulated failures of rotating elements.
The high-energy system inside the auxiliary building that includes pressurized components in the high-energy portions that are constructed to standards other than the ASME Code criteria outlined in Subsection 3.5.1.1.1 is the chemical and volume control system. The high-energy portion of this system inside the auxiliary building that is not constructed to ASME Code criteria outlined in Subsection 3.5.1.1.1 is from the makeup pumps to the containment and system isolation valves. The nonsafety-related, high-energy portion of this system is not required to be protected from missiles.
The nonsafety-related, high-energy portion of the chemical and volume control system is not to be considered a missile source. It includes the design features that are outlined above to exclude components from consideration as missile sources. These considerations include features such as a pump housing or enclosure that contains fragments of a postulated impeller fracture, valve design requirements, vessel design requirements, or enclosure requirements. See Table 3.6-1 for a list of the high-energy systems.
Falling objects (i.e. gravitational missiles) heavy enough to generate a secondary missile are postulated as a result of movement of a heavy load or from a nonseismically designed structure,
3.5-7 Revision 0 Turkey Point Units 6 & 7 - IFSAR system, or component during a seismic event. Movements of heavy loads are controlled to protect safety-related structures, systems, and components, see Subsection 9.1.5. Safety-related structures, systems, or components are protected from nonseismically designed structures, systems, or components or the interaction is evaluated. See Subsection 3.7.3.13 for additional discussion on the interaction of other systems with Seismic Category I systems. Valves, rotating equipment, vessels, and small fittings not otherwise considered to be credible missiles due to design features or other considerations are not considered to be a potential source of missiles when struck by a falling object.
The outlet pipes and valves for the air storage bottles for the main control room are constructed to the ASME Code,Section III, requirements and are designed for seismic loads. The attached pipes and valves are not credible missile sources due to an accidental impact. The air storage bottles are located within a structural steel frame and are in an area with no activity directly above. For the reasons noted above, secondary missiles are not considered credible missiles.
3.5.1.2 Internally Generated Missiles (Inside Containment)
Selection of equipment for the AP1000 considers provisions to minimize the potential for missiles to be generated. The considerations previously discussed in Subsection 3.5.1.1 are also applicable to equipment inside the containment.
3.5.1.2.1 Missile Selection 3.5.1.2.1.1 Missiles not Considered Credible Potential missiles are not considered credible when sufficient energy is not available to produce the missile, or by design the probability of creating a missile is negligible. The following are not considered credible sources of internally generated missiles:
Reactor coolant pump design requirements are established so that any failure of the rotating parts would be retained within the casing at specified overspeed conditions. This is discussed in Subsection 5.4.1.3.6.
Catastrophic failure of rotating equipment such as pumps, fans, and compressors leading to the generation of missiles is not considered credible as described previously in Subsection 3.5.1.1.2.
Failure of the reactor vessel, steam generators, pressurizer, core makeup tanks, accumulators, reactor coolant pump castings, passive residual heat exchangers, and piping leading to the generation of missiles is not considered credible. This is due to the material characteristics, preservice and inservice inspections, quality control during fabrication, erection and operation, conservative design, and prudent operation as applied to the particular component.
Gross failure of a control rod drive mechanism housing, sufficient to create a missile from a piece of the housing or to allow a control rod to be ejected rapidly from the core, is not considered credible. This is because of the same reasons listed above for the reactor vessel and other components and is based on the following:
The control rod drive mechanisms are shop hydrotested to 125 percent of system design pressure.
The housings are hydrotested to 125 percent of system design pressure after they are installed on the reactor vessel to the head adapters. They are checked again during the hydrotest of the completed reactor coolant system.
3.5-8 Revision 0 Turkey Point Units 6 & 7 - IFSAR The housings are made of Type 304 or 316 stainless steel, which exhibits excellent notch toughness.
Stress levels in the mechanism are not affected by system thermal transients at power or by thermal movement of the coolant loops.
The welds in the pressure boundary of the control rod drive mechanism meet the same design, procedure, examination, and inspection requirements as the welds on other ASME Code,Section III, Class 1 components.
A nonmechanistic control rod ejection is considered in the safety analyses in Chapter 15 and the design transients in Subsection 3.9.1.1. The integrated head package and control rod drive mechanisms are not designed for the dynamic effects of a missile generated by a rupture of the control rod housing.
Valves, valve stems, nuts and bolts, and thermowells in high-energy fluid systems and missiles originating in non-high-energy fluid systems are not considered credible missiles as discussed previously in Subsection 3.5.1.1.1.
3.5.1.2.1.2 Explosions Missiles can potentially be generated by a hydrogen explosion. Missiles that could prevent achieving or maintaining a safe shutdown or result in significant release of radioactivity are precluded by design of the plant systems that use or generate hydrogen.
Hydrogen is supplied by the chemical and volume control system inside containment. The quantity that could be released inside containment in the event of a failure of the hydrogen supply line is limited to the contents of a single bottle. One bottle at a time is connected to the hydrogen supply line. This quantity would not lead to an explosion even if the full contents of a single bottle are assumed to remain in the compartment in which it is released. Mixing within a compartment is achieved by normal convection caused by thermal forces from hot surfaces and air movement due to operation of HVAC systems. The hydrogen supply line is not routed through compartments that do not have air movement due to HVAC systems.
3.5.1.2.1.3 Missiles to be Considered The following missiles are considered:
Nonsafety related rotating equipment, not excluded above,
Pressurized components, not excluded above, located in high-energy systems 3.5.1.2.1.4 Evaluation of Internally Generated Missiles (Inside Containment)
The consideration of credible missile sources inside containment that can adversely affect safety-related structures, systems, or components is limited to a few rotating components. The safety-related systems and components needed to bring the plant to a safe shutdown are inside the containment shield building and auxiliary building both of which have thick structural concrete exterior walls that provide protection from missiles generated in other portions of the plant.
Rotating components inside containment that are either safety-related or are constructed as sealless pumps would contain fragments from a postulated fracture of the rotating elements and are excluded from evaluation as missile sources. Rotating components in use less than 2 percent of the time are also excluded from evaluation as missile sources. This exclusion of equipment that is used for a
3.5-9 Revision 0 Turkey Point Units 6 & 7 - IFSAR limited time is similar to the approach used for the definition of high-energy systems. This includes the reactor coolant drain pumps, the containment sump pumps and motors for valve operators, and mechanical handling equipment. Non-safety-related rotating equipment in compartments surrounded by structural concrete walls with no safety-related systems or components inside the compartment is not considered a missile source. Rotating equipment with a housing or an enclosure that contains the fragments of a postulated impeller failure is not considered a credible source of missiles. For one or more of these reasons the nonsafety-related rotating equipment inside containment is considered not to be a credible missile source. Non-safety-related rotating equipment in compartments with safety-related systems or components that do not provide other separation features has design requirements for a housing or an enclosure to retain fragments from postulated failures of rotating elements.
The high-energy portions of high-energy systems inside the containment shield building except for a portion of the chemical and volume control system are constructed to the requirements of the ASME Code,Section III. The nonsafety-related, high-energy portion of the chemical and volume control system between the inside containment isolation valves and the outermost reactor coolant system isolation valves is not required to be protected from missiles and is not to be considered a missile source. It includes design features outlined above to exclude components from consideration as missile sources. In addition most of the nonsafety-related portion of the chemical and volume control system is contained in a compartment located away from safety-related equipment. See Table 3.6-1 for a list of the high-energy systems.
Falling objects heavy enough to generate a secondary missile are postulated as a result of movement of a heavy load or from a nonseismically designed structure, system, or component during a seismic event. Movements of heavy loads are controlled to protect safety-related structures, systems, and components (see Subsection 9.1.5). Design and operational procedures of the polar crane inside containment precludes dropping a heavy load. Additionally, movements of heavy loads inside containment occur during shutdown periods when most of the high-energy systems are depressurized. Valves, rotating equipment, vessels, and small fittings not otherwise considered to be credible missiles due to design features or other considerations are not considered to be a potential source of missiles when struck by a falling object. Secondary missiles are not considered credible.
Striking a component with a falling object will not generate a secondary missile if design of the component precludes generation of missiles due to pressurization of the component. Safety-related structures, systems, or components are protected from nonseismically designed structures, systems, or components or the interaction is evaluated. Nonsafety-related equipment that could fall and damage safety-related equipment during an earthquake is classified as seismic Category II and is designed and supported to preclude such failure. See Subsection 3.7.3.13 for additional discussion on the interaction of other systems with Seismic Category I systems. There are no high-pressure gas storage cylinders inside the containment shield building. For the reasons noted above, secondary missiles are not considered credible missiles.
3.5.1.3 Turbine Missiles The turbine generator is located north of the nuclear island with its shaft oriented north-south. In this orientation, the potential for damage from turbine missiles is negligible. Safety-related structures, systems and components are located outside the high-velocity, low-trajectory missile strike zone, as defined by Regulatory Guide 1.115. Thus, postulated low-trajectory missiles cannot directly strike safety-related areas.
The turbine and rotor design is described in Section 10.2. Protection is provided by the orientation of the turbine-generator and by the use of robust turbine rotors as described in Section 10.2. The rotor design, manufacturing, and material specification and the inspections recommended for the AP1000 provide an acceptably very low probability (see Subsection 10.2.2) of missile generation. Turbine
3.5-10 Revision 0 Turkey Point Units 6 & 7 - IFSAR rotor integrity is discussed in Subsection 10.2.3. This discussion includes fatigue and fracture analysis, material selection, and the maintenance program requirements.
The potential for a high-trajectory missile to impact safety-related areas of the AP1000 is less than 10-7. Based on this very low probability, the potential damage from a high-trajectory missile is not evaluated. The probability of an impact in the safety-related areas is the product of the probability of missile generation from the turbine; the probability, assuming a turbine failure, that a high-trajectory missile would land within a few hundred feet from the turbine (10-7 per square foot); and the area of the safety-related area. In the AP1000, the safety-related area is contained within the containment shield building and the auxiliary building.
The potential for a turbine missile from another AP1000 plant in close proximity has been considered.
As noted in Subsection 10.2.2, the probability of generation of a turbine missile (or P1 as identified in SRP 3.5.1.3) is less than 1 x 10-5 per year. This missile generation probability (P1) combined with an unfavorable orientation P2 x P3 conservative product value of 10-2 (from SRP 3.5.1.3) results in a probability of unacceptable damage from turbine missiles (or P4 value) of less than 10-7 per year per plant which meets the SRP 3.5.1.3 acceptance criterion and the guidance of Regulatory Guide 1.115.
Thus, neither the orientation of the side-by-side AP1000 turbines nor the separation distance is pertinent to meeting the turbine missile generation acceptance criterion. In addition, the shield building and auxiliary building walls, roofs, and floors, provide further conservative, inherent protection of the safety-related SSCs from a turbine missile.
The five steam turbine generators associated with Units 1 through 5 are oriented along a North-South axis and are located far enough north of Units 6 & 7 that there is no turbine missile hazard from Units 1 through 5.
The turbine system maintenance and inspection program is discussed in Subsection 10.2.3.6.
3.5.1.4 Missiles Generated by Natural Phenomena Tornado missiles are defined in accordance with Standard Review Plan, Section 3.5.1.4. The velocities are adjusted to the maximum wind velocity defined in Section 3.3. The following missiles are postulated:
A massive high-kinetic-energy missile, which deforms on impact. It is assumed to be a 4000-pound automobile impacting the structure at normal incidence with a horizontal velocity of 105 mph or a vertical velocity of 74 mph. This missile is considered at all plant elevations up to 30 feet above grade. In addition, to consider automobiles parked within half a mile of the plant at higher elevations than the plant grade elevation, the evaluation of the automobile missile is considered at all plant elevations up to the junction of the outer wall of the passive containment cooling water storage tank with the roof of the shield building. This elevation is approximately 193 feet above grade. This evaluation bounds sites with automobiles parked within half a mile of the shield building and auxiliary building at elevations up to the equivalent of 163 feet above grade.
A rigid missile of a size sufficient to test penetration resistance. It is assumed to be a 275 pound, eight inch armor-piercing artillery shell impacting the structure at normal incidence with a horizontal velocity of 105 mph or a vertical velocity of 74 mph.
A small rigid missile of a size sufficient to just pass through any openings in protective barriers. It is assumed to be a one inch diameter solid steel sphere assumed to impinge upon barrier openings in the most damaging direction at a velocity of 105 mph.
3.5-11 Revision 0 Turkey Point Units 6 & 7 - IFSAR In addition to the missile spectrum specified above, the impact of tornado-driven sheet metal siding on the shield building is evaluated. The evaluation considers siding representative of the siding used on the turbine building, radwaste building, diesel generator building, and portions of the annex building. The evaluation considers a flat steel sheet, which bounds the corrugated siding design used on the buildings adjacent to the nuclear island.
Hurricane missiles are defined in accordance with Regulatory Guide 1.221. The hurricane missile parameters considered for Units 6 & 7 are summarized in Table 3.5-201.
3.5.1.5 Missiles Generated by Events Near the Site As described previously in Section 2.2, the site interface is established to address site specific missiles as discussed in Subsection 3.5.4. The AP1000 missile interface criteria are based on the tornado missiles described in Subsection 3.5.1.4. Additional analyses are required to evaluate other site specific missiles.
The sally port, administrative building, security buildings, warehouse, maintenance shop, structures related to water services, diesel-driven fire pump/enclosure, and miscellaneous structures are common structures at a nuclear power plant. They are of similar design and construction to those that are typical at nuclear power plants. Therefore, any missiles resulting from a tornado-initiated failure are not more energetic than the tornado missiles postulated for design of the AP1000.
Explosion overpressure effects described in Subsection 2.2.3 do not exceed the 1 psi (7 kPa) criterion of Regulatory Guide 1.91. Because overpressure is the controlling effect and its criterion is not exceeded, blast-generated missile effects are not considered further.
3.5.1.6 Aircraft Hazards As described previously in Section 2.2, the site interface is established to address aircraft hazards as discussed in Subsection 3.5.4. The AP1000 missile interface criteria are based on the tornado missiles described in Subsection 3.5.1.4. Additional analyses are required to evaluate other site specific missiles. Aircraft crash probability, and the effects of this hazard on the plant, is determined as described in Section 2.2.
Regulatory Guide 1.206 and NUREG-0800 state that the risks as a result of aircraft hazards should be sufficiently low. Further, aircraft accidents that could lead to radiological consequences in excess of the exposure guidelines of 10 CFR 50.34 (a)(1) with a probability of occurrence greater than an order of magnitude of 1E-07 per year should be considered in the design of the plant. In accordance with NUREG-0800, there are three acceptance criteria for the probability of aircraft accidents resulting in radiological consequences greater than the 10 CFR Part 100 exposure guidelines to be less than an order of magnitude of 1E-07 per year:
Meeting plant-to-airport distance and projected annual operations criteria
Plant is at least 5 statute miles from the nearest edge of military training routes
Plant is at least 2 statute miles beyond the nearest edge of a federal airway, holding pattern, or approach pattern The aircraft facilities and airways are described in Subsection 2.2.2.7. There exists one airport, Homestead Air Reserve Base, located approximately 4.76 miles from the Units 6 & 7 site with projected annual operations that do not meet the plant-to-airport acceptance criteria. Regulatory Guide 1.206 requires that the Homestead Air Reserve Base be considered regardless of the projected annual operations because the plant-to-airport distance is less than 5 miles. The
3.5-12 Revision 0 Turkey Point Units 6 & 7 - IFSAR Homestead Air Reserve Base has approximately 36,429 annual operations and this projection is not expected to change over the period of the license duration.
Additionally, the Units 6 & 7 site is located closer than 2 miles to the nearest edge of a federal airway, V3. The site is approximately 5.98 nautical miles from the centerline of airway V3. The width of a federal airway is typically 8 nautical miles, 4 nautical miles on each side of the centerline, placing the airway approximately 1.4 miles to the nearest edge.
Therefore, an analysis was performed in order to determine whether the accident probability rate is less than an order of magnitude of 1E-07. Details of the analysis are provided in Subsection 2.2.2.7.
This assessment led to a total impact frequency of 3.86E-06 per year when considering both the airport and non-airport operations, which is an order of magnitude greater than 1E-07 per year.
Therefore, an evaluation against a second criterion (core damage frequency, CDF, less than 1E-08 per year) was performed. This evaluation is presented in Subsection 19.58.2.3.1 and concludes that no further evaluation of aircraft impact is required, given that the core damage frequency associated with aircraft impacts is less than 1E-08 per year.
3.5.2 Protection from Externally Generated Missiles Systems required for safe shutdown are protected from the effects of missiles. These systems are identified in Section 7.4. Protection from external missiles, including those generated by natural phenomena, is provided by the external walls and roof of the Seismic Category I nuclear island structures. The external walls and roofs are reinforced concrete. The structural design requirements for the shield building and auxiliary building are outlined in Subsection 3.8.4. Openings through these walls are evaluated on a case-by-case basis to provide confidence that a missile passing through the opening would not prevent safe shutdown and would not result in an offsite release exceeding the limits defined in 10 CFR 50.34. The evaluation of site-specific hazards for external events that may produce missiles more energetic than tornado missiles is discussed in Subsection 2.2.1.
Evaluation of turbine missiles is provided in Subsection 3.5.1.3. Evaluation of tornado missiles is provided in Subsection 3.5.1.4. Conformance with regulatory guide recommendations is provided in Appendix 1A.
Regulatory Guide 1.221 hurricane wind velocities are based on an annual exceedance probability of 1.0E-07, the same as that for tornado wind velocities in Regulatory Guide 1.76, Revision 1. The 1.0E-07 annual exceedance probability hurricane wind speed of 260 mph at the Turkey Point site based on Regulatory Guide 1.221 is bounded by the design tornado wind speed given in Subsection 3.3.2.1. Thus, using the tornado wind and missile structural acceptance criteria for the Regulatory Guide 1.221 hurricane wind and missile evaluations is appropriate.
The comparison between the Tier 1 Table 5.0-1 tornado-generated missile parameters and Regulatory Guide 1.221 site-specific hurricane-generated missile parameters are summarized in Table 3.5-201. The site-specific hurricane-generated missiles evaluation can be summarizes as follows:
The vertical velocity per Regulatory Guide 1.221 is less than the vertical tornado missile velocities in all cases in Tier 1 Table 5.0-1. The Schedule 40 pipe vertical hurricane kinetic energies are enveloped by those associated with the armor piercing artillery shell tornado kinetic energies.
For the 1-inch diameter sphere, the Turkey Point site-specific hurricane-generated missile horizontal velocity is 128.5 mph. For this Turkey Point site-specific sphere missile velocity, the concrete perforation and scabbing is calculated to be 0.86 inches and 1.86 inches, respectively. Per Subsection 3.5.3 the minimum thicknesses of the nuclear island exterior
3.5-13 Revision 0 Turkey Point Units 6 & 7 - IFSAR walls above grade is 24 inches. Based on the evaluation, it was concluded that the nuclear island is adequately protected against the hurricane-generated 1.0-inch-diameter sphere missile impact.
For the 6.625-inch diameter pipe, the Turkey Point site-specific hurricane-generated missile horizontal velocity is 144.5 mph. For this Turkey Point site-specific missile velocity, the concrete perforation and scabbing is calculated to be 16.4 inches and 23.1 inches, respectively. Per Subsection 3.5.3, the minimum thicknesses of the nuclear island exterior walls above grade is 24 inches. Therefore, it was concluded that the nuclear island is adequately protected against the hurricane-generated 6.625-inch diameter pipe missile impact.
For the 4000-pound automobile missile, the Turkey Point site-specific, hurricane-generated missile horizontal velocity is 180 mph. Therefore, for the hurricane-generated automobile horizontal missile, an evaluation was performed to determine whether the nuclear island exterior walls are adequate to withstand the effect of the automobile impact. Reference 201 provides the evaluation of the tornado-generated automobile missile and Reference 202 provides the evaluation of the hurricane-generated automobile impact on the nuclear island.
The horizontal hurricane-generated automobile missile velocity at Turkey Point is greater than the horizontal tornado-generated automobile missiles used in Reference 201 (180 mph vs. 105 mph). Reference 201 considered the auxiliary building walls 30 feet and higher above the grade elevation up to approximately 193 feet above grade. For the Turkey Point site, evaluations above the grade elevation up to 180 feet of the auxiliary building (relative to AP1000 DCD grade level of 100'-0") were considered. The Turkey Point punching shear calculation is based on ACI 349-01, Section 11.12.1.2 requirements. The evaluation determined that the maximum shear stress on the walls is 51.42 k/ft (Reference 202), which is below the allowable stress of 54.69 k/ft (Reference 202) and the maximum ductility factor of 1.10 for flexure is well below the allowable limit of 10. Shear ductility is not considered because elastic shear behavior is maintained. Thus, it was concluded that the nuclear island is adequately protected against the hurricane-generated automobile missile impact.
In summary, the following is concluded for the hurricane missile evaluations for the site:
All of the external missile velocities for the hurricane are enveloped by the tornado missiles except for those generated by horizontal hurricane wind. The comparison of the Regulatory Guide 1.221, Revision 0 hurricane missile velocities to those for the tornado missiles given in Tier 1, Table 5.0-1 shows that the automobile hurricane missile, the Schedule 40 pipe (6.625 inch diameter) hurricane missile, and the 1-inch solid sphere hurricane missile have a greater velocity than that shown in Tier 1, Table 5.0-1.
The postulated hurricane missiles for horizontal impact above grade on the nuclear island were evaluated for the increased hurricane wind speed in those cases where the hurricane wind speed exceeds the tornado wind speed. It was determined that the AP1000 nuclear island structural integrity is maintained for the higher hurricane external missiles.
Automobile impact was found to be the bounding scenario and was evaluated in dynamic analyses of impact on representative external walls of the auxiliary building. The representative exterior walls were selected to evaluate impacts at mid-span, edges, and corners. Both flexure and shear were evaluated and shown to be within the ACI 349-01 acceptance criteria. Reactions on the supporting interior walls and floors were also evaluated. The results of the analyses of the walls, and for impact directly over these supporting elements, were found to be acceptable. (Reference 202)
3.5-14 Revision 0 Turkey Point Units 6 & 7 - IFSAR 3.5.3 Barrier Design Procedures Missile barriers and protective structures are designed to withstand and absorb missile impact loads to prevent damage to safety-related components.
Formulae used for missile penetration calculations into steel or concrete barriers are the Modified National Defense Research Committee (NDRC) formula for concrete and either the Ballistic Research Laboratory (BRL) or Stanford formulae for steel.
Concrete (Modified NDRC Formula) where x
=
penetration depth, inches W
=
missile weight, lbs d
=
missile diameter, inches N
=
missile shape factor = 1.0 V
=
impact velocity, feet/sec K
=
experimentally obtained material coefficient for penetration =
fc
=
concrete compressive strength Scabbing thickness,
, and perforation thickness, tp is given by:
d 1000 V
KNWd 4
=
x 1.8 0.5 2.0 d
x for
d +
d 1000 V
KNW
=
x 1.8
2.0 d
x for
cf 180 ts d
x 1.36
+
2.12
=
d ts 11.75 d
x 0.65 for
d x
5.06 d
x 7.91
=
d t
2 s
0.65 d
x for
d x
1.24
+
1.32
=
d tp 13.5 d
x 1.35 for
)
d x
(
0.718
- )
d x
(
3.19
=
d t
2 p
13.5 d
x for
3.5-15 Revision 0 Turkey Point Units 6 & 7 - IFSAR Steel (Stanford Formula)
Where:
E
=
critical kinetic energy required for perforation, foot pounds D
=
effective missile diameter, inches S
=
ultimate tensile strength of the target (steel plate), pounds per square inch T
=
target plate thickness, inches W
=
length of a square side between rigid supports, inches Ws
=
length of a standard window, 4 inches The ultimate tensile strength is directly reduced by the amount of bilateral tension stress already in the target. The equation is good within the following ranges:
0.1 < T/D < 0.8, 0.002 < T/L < 0.05, 10 < L/D < 50, 5 < W/D <8, 8 < W/T < 100, 70 < V < 400 Where:
L
=
missile length, inches V
=
impact velocity, feet/second Steel ( BRL Formula )
Where:
tp
=
steel plate thickness for threshold of perforation, inches
T W
W 1,500
+
T 16,000 46,500 S
=
D E
s 2
(
)
D 672 E
t 3.2 k
p =
3.5-16 Revision 0 Turkey Point Units 6 & 7 - IFSAR D
=
equivalent missile diameter, inches Ek
=
missile kinetic energy, foot pounds
=
M V2/2 M
=
mass of the missile, lb-sec2/ft.
In using the Modified NDRC, BRL and Stanford formulae for missile penetration, it is assumed that the missile impacts normal to the plane of the wall on a minimum impact area and, in the case of reinforced concrete, does not strike the reinforcing. Due to the conservative nature of these assumptions, the minimum thickness required for missile shields is taken as the thickness just perforated.
Structural members designed to resist missile impact are designed for flexural, shear, and buckling effects using the equivalent static load obtained from the evaluation of structural response. Stress and strain limits for the equivalent static load comply with applicable codes and Regulatory Guide 1.142, and the limits on ductility of steel structures as given in Subsection 3.5.3.1. The consequences of scabbing are evaluated if the thickness is less than the minimum thickness to preclude scabbing.
The thicknesses of the exterior walls above grade and of the roof of the nuclear island are 24 inches and 15 inches, respectively. The roof is constructed using left-in-place metal deck. These thicknesses exceed the minimum thicknesses for Region II tornado missiles specified in Standard Review Plan 3.5.3.
3.5.3.1 Ductility Factors for Steel Structures Ductility factors for the design of steel structures are as follows:
3.5.4 Combined License Information The evaluation for those external events that produce missiles that are more energetic than the tornado missiles postulated for design of the AP1000 is addressed in APP-GW-GLR-020 (Reference 1).
The Turkey Point Units 6 & 7 site satisfies the site interface criteria for wind and tornado as discussed in Subsections 3.3.1.1, 3.3.2.1 and 3.3.2.3 and will not have a tornado-initiated failure of non-standard plant structures and components that compromises the safety of Units 6 & 7 safety-related structures and components (see also Subsection 3.3.3).
Subsection 1.2.2 discusses differences between the plant specific site plan (see Figure 1.1-201) and the AP1000 typical site plan shown in Figure 1.2-2.
For tension due to flexure, < 10.0
For columns with slenderness ratio (L/r) equal to or less than 20, < 1.3
For columns with slenderness ratio greater than 20, < 1.0 Where:
L
= effective length of the member r
= the least radius of gyration
For members subjected to tension, <.5*(eu/ey)
Where:
eu = ultimate strain ey = yield strain
3.5-17 Revision 0 Turkey Point Units 6 & 7 - IFSAR There are no other structures adjacent to the nuclear island other than as described and evaluated in this document.
Missiles caused by external events separate from the tornado are addressed in Subsections 2.2 through 2.2.3, 3.5.1.5, and 3.5.1.6.
3.5.5 References 1.
APP-GW-GLR-020, Wind and Tornado Site Interface Criteria, Westinghouse Electric Company LLC.
201.
APP-GW-GLR-133, Summary of Automobile Tornado Missile 30' Above Grade, Rev. 1.
202.
TPG-GW-GLR-001, Supplement to RAI-6544, Non-Proprietary, Rev. 4.
3.5-18 Revision 0 Turkey Point Units 6 & 7 - IFSAR Table 3.5-201 Comparison Between AP1000 DCD Tornado and Site-Specific Hurricane Missile Parameters Missile Description AP1000 DCD Tornado Missile Velocity(a)
(a)
Tier 1 Table 5.0-1.
Units 6 & 7 Hurricane Missile Velocity(b)
(b)
Based on Regulatory Guide 1.221 Table 2 and Figure 2.
Automobile (4,000 lbs) 105 mph horizontal 74 mph vertical 180 mph horizontal 58 mph vertical 8-in. shell (275 lbs) 105 mph horizontal 74 mph vertical
6.625-in. diameter pipe (287 lbs)
144.5 mph horizontal 58 mph vertical 1-in. diameter steel sphere (0.147 lbs) 105 mph in most damaging direction 128.5 mph horizontal 58 mph vertical