ML19339A685

Fire Hazard/Safe Shutdown Evaluation, Resolving SER Open Items

ML19339A685
Person / Time
Site:	Surry
Issue date:	10/31/1980
From:	Virginia Power (Virginia Electric & Power Co)
To:
Shared Package
ML18139A793	List: ML18139A792 ML18139A794 ML19339A685
References
NUDOCS 8011040527
Download: ML19339A685 (59)

Text

1 0,,,

-_a 4__

'E I

ATTACHMENT I

'I I

I I

I SURRY FIRE PROTECTION S AFE SHUTDOWN EV ALU ATION g

oct&r M,1980 I

)

i

!I

I I

30 \\ \\o Mos A~1 1

T ABLE OF CONTENT _S_

I A.

S AFE SHUTDOWN EVALUATION 1.

Emergency Switchgear and Relay Rooms 2.

Outside Containment Penetration Vaults, Cable Tunnels and Service Building Cable Vaults 3.

Auxiliary Building - Elevation 2 Feet 4.

Auxiliary Building - Elevation 13 Feet 5.

Auxiliary Building - Elevation 27 Feet 6.

Auxiliary Building - Elevation 45 Feet 7.

Reactor Containment Buildings 8.

Containment Spray Pump and Auxiliary Feedwater Pump Buildings 9.

Intake Structure l

10.

Turbine Building B.

ALTERNATE SHUTDOWN METHODS 1.

Reactivity Control 2.

Reactor Coolant Inventory Control 3.

Decay Heat Removal 4.

Auxiliaries 5.

Control and Instrumentation CONCLUSIONS I

D.

VERIFIC A TIONS I

4 E 3.2.3 SAFE SHUTDOWN A.

SAFE SHUTDOWN EVALU ATION I,

The following is a reevaluation of safe shutdown capabilities by plant area as specified in the Fire Protection Safety Evaluation Report for Surry Power Station dated September 19, 1979.

This evaluation demonstrates the operational procedures that would be used to bring the plant from power operation to safe hot and cold shutdown under the following requirements:

(1) Placing the reactor in a suberitical condition and maintaining the reactor suberitical indefinitely.

(2)

Bringing the reactor to hot shutdown condition and maintaining it at hot shutdown for an extended period of time (i.e., longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) using only normal sources of cooling water.

(3) Maintaining the reactor coolant system inventory indefinitely using only normal sources of make-up water.

(4)

Bringing the reactor to cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

4 This evaluation takes into account the available fire protection systems and the modifications required by the Safety Evaluation Report to deter-mine the adequacy of the upgraded fire protection systems. Each of the I

ten fire areas are addressed separately.

A brief description of the area is presented followed by a discussion of the existing fire protection system and the fire protection modifications required by the Safety Evaluation Report.

The consequences of a fire in each area are considered and the effect on reactivity control, reactor coolant system inventory control, and decay heat removal are investigated and alternate methods of safe shut-down are presented.

Where procedures involve operatcr actions, the I

i logistics of these actions can be demonstrated by walk-throughs and use of the simulator, l

I

E I 1.

EMERGENCY SWITCHGEAR AND RELAY ROC 61S Description of Area - Figure 1A & B I

Separate areas located below the control room and the machine shop are pro-vided for each unit's emergency switchgear and control relays. Each area is composed of two emergency switchgear rooras, one for each division, and a single relay room.

Each room has approximately 2500 square feet of floor space.

The rooms within each area adjoin each other in a "L" shaped config-uration with open passageways between them. There is also an open passage-I way with a three-hour fire-rated sliding door between the Unit 1 and Unit 2 areas.

The sliding fire door is held open by a fusible link.

The emergency switchgear and relay rooms contain safety-related switchgear and control relays, includir.g redundant equipment required for safe shutdown, and the remote hot shutdown control panels for each unit.

Large quantities of safety-related power and control cables are routed above the switchgear I

cubicles and relay boards throughout the area and in the open passageways between rooms.

The emergency 125 volt de batteries are also located in the area in separate rooms within their associated division switchgear rooms.

The combustible materials in the area consist of a large amount of electrical cable insulation and parts of electrical components in the switchgear cubicles and relay boards.

There is also a potential for a small amount of transient lubricating oil to be transported via the Unit 2 switchgear rooms to mechanical equipment room No. 3.

i I

I I

t I

5 d

}

I h.3 I

4 lE f

O-e

.a I

ss

.g

~

j '*,--

{-",

f** )

~

2, 4

l n

3

}1 Q

J N

I f37Q$?, ' i *~'a 'S, ', ' '. ',1' d z

i f

-i

,a 8-I u _;T_

2 7

>4 f h_

[ f 3...

j~ T " "q.

I f

2 3

4, l1Y

~

W i.;;

Iie 1@

s w

g l

d

"" # I c1 q

CC e

~

e k

I

% n. t - [,

_J y

a t

c I

3 m

2

• 4 m

v2

- Q !

.,D 9%a

,k i

w'

~

d'

%T p

if*

).'

.,?.

,N e E

w k's bL.

~

. ~~

a

.4 M

I., ~

~

,E) I

_4_-

3 r-9 I

.c a

I I

)

N i

T f02 i

T- ;

4 S '.,d.

5 r>w5-#

e' i

11

- t 53 L,.

[**,Jg

.. q =(

d ra

/-

Ig 7 ', /*.j Iw{

e

- f, j 3 5 I

• 3

),

s T

-1

_e.1 -5 a-3 o

g

p.y l

^ i

\\((

,f 2.,

L 1

g3 (.2 l

i

~~

I g t?

9 f

i i

'. l.' -

.ms s s s ;

I

=.4 g

4 t

1 1

1' 1

E "12 "3'Ill g

I

.a p

,l' l

O.

l OJ il{

Ta' E its I

..i

• a.

t w' 1.

, o.

f D

c a.

g.:

'ra-i r:,.

r m x s.,

!=i g

.-i u,

'd

.[

i j

l w' 4

=

5 f ' t.. -

t.

1.: a

~1, o is.

A

• I

• J

~

u - a-he 4 f t"T.r n

s. R,

8

,v

,7

>-< 1..

l

.cn J

m, 33 h..

-l s :c 2

w,e e

i; ie=

2 1

.1 e. sYi

1.1, 7

.',: i,

=

e La e

a o

=

ll+

.I x

t N.

J.

6 L-9 b... )

S o

r d

".4-m,-.

o.

a 4

s J

1 F

r

~

l?

g

)

's s'

a

-. s j i i

1 l

.d I.; l,,p g

i l

ut 3

V.

2

I

/.!

%g l 5

f r

)

j) h...

], ll '

15 I

,,e I

it{. I__!

g

(

w >

un r..

n i e IiI i

l 2

-* hl 5

t v!

e y _.i i

.I

,s 5{

4 e

i e

S

' ):

e

,, l g

,j

.;}

I 1

f

+.

N i

g

!'s N

{

N

'. a.t )3 llh *

._id s

'l 3

8 I

h,3 la f

-s L'.b, g

't

'l

~

Jr 4 -

g

,y

.e,

,${

2 L.. g f t g

.n U

2 o, 1'

3'

"' 'l' 2

'N

' s O

e.

1 I g, 2 5; s-I l

j2Ul I 6i j t-g

,2 g

3,

,v

..i l..

1

2

.. h. '. t w

-v a. c

ai'

., z v.

I J,

(

e

'4 F

i 3

I I

i 1 Fire Protection Systems I

Tite emergency switchgear and relay roort areas for each unit are bounded on all sides by concrete which provides a three-hour fire barrier.

The individual I

rooms within each area are also separated by three-hour rated concrete walls.

(These walls are penetrated by open passageways.)

Both the Unit 1 and Unit 2 area floor space are sufficiently clear to permit access by fire fighters and smoke can be exhausted through the turbine building roof fans or into the cable vault and tunnel area to T1CC rooms and outside.

However, the ceiling area above the switchgear cubicles and relay I

boards is extremely congested with electrical power and control cables in conduits and cable trays are stacked approximately six feet high.

Fortable carbon dioxide extinguishers are located in both areas and a 150 pound wheeled, dry chemical extinguisher is located in the Unit 2 area. Also, a 11 inch hose station is located in the turbine building just outside the entrance to the Unit 2 area.

Fire Protection Modifications 1.

The charging systems for Units 1 and 2 will be modified so that their charging pumps may be cross-connected.

In the event of fire in the emergency switchgaar and relay room of one unit, the charging pumps of the other unit will be capable of carrying out the safe shutdown function.

2.

A panel will be installed in the cable spreading room above the control room to provide an alternative capability for monitoring parameters required for safe shutdown, namely, reactor coolant hot leg temperature and pressurizer pressure and level and steam generator level.

This alternate shutdown provision will be independer.t of instrumentation cables located in the emergency switchgear and relay rooms.

I t

I 3.

An early warning smoke detection system will be provided in each emer-I gency switchgear room and in the relay room of each unit. This system will alarm in the control room.

4.

All ventilation ducts which penetrate the emergency switchgear and relay rooms will be equipped with three-hour fire-rated dampers.

5.

All non-fire-rated doors in the fire barrier surrounding the Unit 1 and 2 emergency switchgear and relay rooms will be replaced with three-hour fire-rated doors.

6.

A dry standpipe hose station will be installed in each service building cable vault.

These hose stations will be provided with low capacity, variable gallonage fog nozzles with ball valve shutoff.

7.

A portable carbon dioxide fire extinguisher will be provided in each train J emergency switchgear room adjacent to the door to the cable vault.

8.

Solid tray covers will be installed on all cable trays where minimum separation does not meet the guidance of Regulatory Guide 1.75.

9.

Fire stops will be provided in cable trays passing through openings between the switchgear room and the relay room.

10.

A fire-rated sliding door with a smoke actuated release will be provided between Unit 1 and 2 emergency switchgear rooms.

I Consequences of a Fire An unmitigated fire in either the Unit 1 or Unit 2 area could damage the fol-lowing safe shutdown equipment.

1.

Auxiliary Feedwater Pump Breakers and Power Feeds I

2.

Component Cooling Water Pump Breakers and Power Feeds a

I !

l 3.

Charging pump Breakers and Power Feeds 1

4.

Ri!R Pump Breakers and Power Feeds I

In order to assure safe shutdown, the following is a discussion of a fire in the emergency switchgear room and the effect on:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay Heat Removal.

.i Reactivity Control There are three charging pumps per unit, only one of which is required for long term reactivity control.

Operation of the charging pump requires the charging pump cooling water and service water subsystems to be functional.

The charging pump cooling water system provides a source of cooling for the charging pump mechanical seals. This system is cooled in turn through one of two redundant heat exchangers by the charging pump service water subsystem.

I The charging pump service water subsystem also provides cooling directly to the charging pump lube oil cooler.

Because of the separation provided, a fire would not damage redandant charging pumps themselves. However, the charg-ing pump service water pumps for both units are located in the mechanical equipment room number 3 in close proximity to each other and a single fire could disable the charging pump service water systems of both units.

A design change package has been initiated to tie the station fire water into the charging pump service water supply header to provide an alternate means of cooling the charging pumps.

The modification has not as yet been implemented; but in the interim, fire water can be manually tied into the supply system utilizing I

jumper hoses and necessary connectors.

The charging pump service water system requires 30 gpm maximum per charging pump; therefore, this amount of water is insignifcant compared with the capa-city of the fire pump (2500 gpm).

Fire stops are being installed to prevent fire from passing from one unit's switchgear to another via the cable trays.

In addition, an early warning smoke detector system will be installed along I

with a dry standpipe in the cable vault.

There are no other components in the Emergency Switchgear Rooms required to function to control reactivity to reach and maintain safe shutdown.

I I

Reactor Coolant Inventory Control i

The charging pumps are required for reactor coolant inventory control. The above discussion concerning the charging pumps applies.

In addition, at the I

time the charging pump cross-connect becomes operational, procedures will be developed and a walk-through will prove the adequacy of the system to control reactor coolant inventory.

There are no other components in the Emergency Switchgear Rooms required to function to control reactivity to reach and main-tain safe shutdown.

I Decay Heat Removal A fire in the emergency switengear room could disable the unit's component cooling pump breakers.

However, two pumps are available from the opposite unit and would be available for component cooling needs.

The Residual Heat Removal system (RHR) is normally required to bring the I

plant to cold shutdown and a unit's RHR breaker could be damaged by the fire.

It has been verified that damaged RHR pump, cables and breakers can be replaced in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

In addition, pressurizer heaters are normally required for safe hot shutdown. The quantity of pressurizer heaters that are required to function to maintain hot shutdown (125 kw) is small in comparison that are required for at power transients. It has been veri 5ed that damaged pressurizer heater cables can be replaced in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The maintenance of reactor coolant system pressure is necessary to ensure adequate subcooling. The use of the pressurizer heaters is one of two methods available to maintain system pressure.

I The other method is operating the plant in a water solid mode.

Since TMI, this mode of pressure control has become a viable method.

A fire in the emergency switchgear room could disable the unit's motor-driven feedwater pump breakers.

For the continued use of the steam generator for decay heat removal, it is necessary to provide a source of water and means of delivering that water. TPr nuxiliary feel pumps (two motor-driven pumps and I

one turbine-driven pump per unit) are provided to deliver the necessary water to the steam generators.

The turbine-driven auxiliary feedwater pump has j

lI

< l-3 l

redundant steam supply valves.

One supply valve is a MOV and is powered from the emergency bus.

The redundant valve is an air operated valve that will fail open upon loss of either electrical power or air.

A fire in the emer-gency switchgear room could disable the power and control cables for the

)

'I motor-driven auxiliary feedwater pumps.

A fire in the area could also disable the power and control cables for the steam supply to the turbine driven aux-iliary feedwater pump.

However, as stated previously, a loss of electrical power to the redundant steam supply air operated valve would cause this valve to open thereby admitting steam to the turbine driven auxiliary feedwater pump.

There are no other components in the Emergency Switchgear Rooms required to function to control decay heat to reach and maintain safe shutdown.

lt I

I I

I I

I I

I t

a I

2.

OUTSIDE CONTAINMENT PENETRATION VAULTS CABLE TUNNELS AND SERVICE BUILDING CABLE VA ULTS I

l Description of Area - Figure 2 The outside containment penetration vaults, cable tunnels, and service build-ing cable vaults are adjoining spaces within each unit used as cable spreading and routing areas.

The penetration vaults and service building cable vaults are connected by the cable tunnels.

These three spaces constitute a single fire area.

Separate areas are provided for each unit on either side of the auxiliary building between the service building and the unit containment build-ing.

l All of the spaces within these cable spreading and routing areas contain a large number of safety-related cables, including control and power cables for equipment required for safe shutdown.

The outside containment penetration I

vaults also contain the redundant hydrogen recombiners power supply units and emergency motor control centers.

I I

I 1

1 1

h 1

I

8 j

1 D**]D ~ *]D T A

i o o M e M.11 o

E;.

l i

5--;,.:::

p::

q

- l

'iii EUf l

• al~

.-g l

I M

4 J'

N I

\\N l

e o

N e

• J e

u a[

J 8

E 1+1

/

1 ;

1 I

M W

a

=

.+ee.

g t

w

},

'g g

[j

-m

~.

t..,.

+e**

f.,

/

1 %7

.7. "1 p

...e s'y 8

I I

W*

D w

J

/

l _

dw

..d l

4 d

• N 6

J j

j

's, J

\\.* 3.,

I a

i' l J' w

I i

- ) )

.a I i 4.!

d

.s

<o 1

/

e d

i D

I f

an

,r Sz

.c

-.y-w -

3,J y

cr e

1 4-iI d

5 n

g i

~l @

9h{

\\

3 3l-H-l4 3

3 lh 4

sa

/

e r

x 2

h s

e rs li si_1 E

E

'4 e

i I:.n-* -

e

=

4 c

y 6-2' E

a Sgt s

?

s p

5 h

l f,

)

3 "j

!s 3

e e

/%

~-

==

_g I

Fire Protection Systems i

The separate cable spreading s'id routing area provided for each unit is bounded on all sides by concrete or concrete blocks which provide a fire barrier surrounding all three spaces within the unit.

Each area is provided with a total flooding automatic carbon dioxide suppression system and a sepa-rate fire detection system which alarms in the control room.

The automatic carbon dioxide system is backed up by a manual suporession capability using portable extinguishers located in the area and water hoses from yard hydrants and the hose stations in the turbine building. The areas can be accessed at one end from the outside yard via the motor control center rooms and a spiral staircase down to the outside containment penetration vaults, and at the other end from the turbine building via one of the emergency switchgear rooms.

Smoke and heat can be exhausted up the spiral staircases and through the doors of the motor control center rooms to the outside.

Adequate floor space is available to permit a,: cess by fire fighters to all locations within the areas.

However, the upper elevations of the service building cable vaults are so congested with cables that it may not be possible to manually apply suppres-I sion agents to all of the cables at these elevations.

Fire Protection Modifications I

1.

The charging systems for Units 1 and 2 will be modified so that the systems may be cross-connected.

In the event of damage to charging I

systems cables as a result of a fire in this area, the charging pumps for the other unit will be available to carry out the safe shutdown functions.

2.

A panel will be provided in the cable spreading room above the control room to independently monitor reactor coolant hot leg temperature and pressurizer pressure and level and steam generator level.

These para-meters must be indicated for safe shutdown. The cables from this panel I

will be routed to the containment via a penetration that is remote and independent from the outside containment penetration vault.

I I

l

~

l I l

3.

Manually actuated sprinkler systems will be installed in the ceiling of the service building cable vault and cable tunnel.

The sprinkler system in the vault will be an open head, dry pipe system, and that in the cable tunnel will be a closed head system located over the aisle way of the I

tunnel.

4.

Additional nozzles will be provided for the automatic total flooding carbon dioxide suppression systems in the outside containment cable penetration vaults and service building cable vaults.

The additional nozzles will be located at the highest elevations of these spaces to assure more effective coverage of all the cables.

5.

All penetrations will be sealed to provide a three-hour barrier.

6.

One additional Class C protable fire extinguisher will be provided in each outside containment penetration vault and service building cable vault.

I 7.

A ladder will be provided in the outside containment cable penetration vault.

The ladder will have sufficient height to reach the upper most cable trays to facilitate manual fire fighting.

I Consequences of a Fire An unmitigated fire in either the Unit 1 or Unit 2 area could damage a signifi-cant number of safety-related electrical control and power cables, including cables required for safe shutdown.

I The following is a list of equipment cables routed through the cable tunnel required for safe shutdown:

1.

Charging Pump 2.

Component Cooling Ptaps 3.

Auxiliary Feedwater Pumps I

4.

RHR Pumps 5.

Pressurizer Heaters I

1 I f l

6.

Reactor Coolant Pressure, Temperature Indication 7.

Pressurizer Level Indication 8.

Steam Generator Level Indication L

In order to assure safe shutdown, the following is a discussion of the effect of a fire in the cable vault and tunnels and the effect on:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay Heat

[

Removal.

l I

Reactivity Control The charging pumps are required for reactivity control and a fire in the cable vault could disable a unit's pump.

However, the charging system is capable

[

of being cross-connected and this has already been discussed.

There are no other components in the cable vault and tunnel required to function contrcl

{

reactivity to reach and maintain safe shutdown.

F Reactor Coolant Inventory I

i I

The cables that could become damaged by a fire in the cable tunnel that would affect safe shutdown relating to reactor coolant inventory control are:

l 1.

Pressurizer Level Indication Cables 2.

Charging Pump Power Feeds The charging pump cross-connect which, in the event of the destruction of I

one unit's power cables, would allow safe shutdown as has been discussed.

Pressurizer level is also required for reactor coolant inventory. If the cables

(

to the control room indicator are destroyed by a fire in the cable tunnel, a second indicator will be available on the monitoring panel located in the cable spreading room in the control room.

There are no other components in the cable vault and tunnel required to function to control reactor coolunt inventory ER to reach and maintain safe shutdown.

I I

I Decay lleat Removal I

The cables that could become damaged by a fire in the cable tu wel that would affect safe shutdown relating to decay heat removal are:

1, Auxiliary Feedwater Pumps 2.

Component Cooling Pumps 3.

RHR Pumps 4.

Steam Generator Level Indication The auxiliary feed pumps (two motor-driven pumps and one turbine-driven I

pump per unit) are provided to deliver the necessary water to the steam generators.

The turbine-driven auxiliars; feedwater pump has redundant steam supply valves.

One supply valve is a MOV and is powered from the emergency bus.

The redundant valve is an air operated valve that will fail open upon loss of either electrical power or air.

A fire in the cable tunnel room could disable the power and control cables for the motor-driven auxiliary feedwater pumps.

A fire in the area could also disable the power and control I

cables for the steam supply to the turbine driven auxiliary feedwater pump.

However, as stated previously, a loss of electrical power to the redundant steam supply air operated valve would cause this valve to open thereby admitting steam to the turbine-driven auxiliary feedwater pump. The residual heat removal system is required for long term maintenance of the reactor coolant system temperature at cold shutdown.

However, there are other methods available to cool down the reactor coolant system without the use of I

the residual heat removal system.

Using steam from either the auxiliary boilers or the opposite unit's auxiliary steam system, a vacuum can be estab-I lished and maintained in the main condenser.

A vacuum can be drawn in the steam generators by manually establishing a flow path to the condenser via the condenser steam dump system.

This method is commonly referred to as

" single loop cooldown".

Procedures are in effect for this mode of operation.

I The component cooling pumps are required for cold shutdown.

However, a fire in the cable tunnel room would not damage breakers to both unit's com-I ponent cooling pumps. Only one pump is required for cooldown.

In addition, I

I

. I RilR pump power cables could be damaged in a fire; however, it has been verified that damaged RiiR cables can be replaced in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Steam generator level is also required for decay heat removal.

If the cables I

to the control room indicator are destroyed during a fire in the cable tunnel room, a second indicator will be available on the monitoring panel located in the cable spreading area over the control room.

The wire to this panel is routed through the fuel building penetration and then across the 45-feet level of the auxiliary building and into the cable spreading area.

g There are no other components in the cable vault and tunnel required to func-E tion to control decay heat removal to reach and maintain safe shutdown.

I f

i i

I 1I lI 1

I I

I

_ tl l

3.

AUXILIARY BUILDING - ELEVATION 2 FEET I

l Description of Area - Figure 3 l

This elevation of the auxiliary building is composed of large open floor areas and separate equipment cubicles.

There are separate concrete compartments l

for the safety-related seal water heat exchanger, non-regenerative heat exchanger and the demineralizers, and for the non-safety-related boron recovery system equipment and liquid waste system equipment.

The six charging pumps (3 per unit) are located in separate cubicles with concrete B

walls in the center of the floor area.

The charging pump cubicles are com-pletely enclosed on this elevation; access to the pump cubicles is on elevation 13 feet.

The two charging pump cooling water pumps per unit are located l

Just outside the charging pump cubicles at elevation 2 feet.

One charging pump and one charging pump cooling water pump per unit are required for safe hot shutdown.

Safety-related equipment in the open floor areas includes the four component cooling water pumps, and pipes and valves.

The component cooling water pumps are cross-connected to serve either unit; one pump per unit is required for safe shutdown.

The equipment cooled by the component cooling water system includes reactor coolant pump thermal barriers, reactor containment air recirculation coolers, spent fuel pit coolers and the excess letdown, non-regenerative, seal water and residual heat removal heat exchangers.

Cables for red-1, dant divisions of safety-related and safe shutdown equipment g

3 are routed through many areas of this elevation.

1 1

1 I

l I

E

~ f ][]

~ 3

~

g

@/mm}a 6M.A }A L

[

r A

L 5,.

t.t, I +i 1

l5!

f!

3 IU

!)

, 1 -:,-

l r

_- 3 jr.aJ5 i, i

o k

D to e

P tt I

if 0]I 'l O " g, ji E

N P as I.i cn i.,

t Q

t

%- =- y iho

.c a

lo I

k ' ~~d h-

'?

()

4 e n_

a g__

,e"

. i u.

m I

n Ia y

I

-J i

v o

j

.I i o

10

,i.

g i

_I D-5 j 'l).

a Il00 OI.7

' I

$c 5

N i

j

-p-

=

e a-t s

)

3."

ab

,N

'k. h I

1 5

3

~

~

l) 13, W.aas ~ ~ --

??

^

{

l ii' "j k 3

J 1

l 10

{

MllM '

I I

3 i>

a

= "n #

[I i

->l If c

In 0:1~ :ll fl e n== J:1 l

3

.elJo '.._j

{

g c:

I, f-pl i

i

,'; n an a a

I

![h I

.(

t uo E

e f:

II C

l

~

l 5

)I I

iI 1I lI

1 Fire Protection Systems Fire hose stations are provided on this elevation for manual fire fighting.

Floor drains are available for removal of fire suppression water.

Fire Protection Modifications l

1.

Smoke detectors will be installed in the Auxiliary Building general area exhaust ventilation ducts.

2.

The charging systems for Units 1 and 2 will be modified so that the charging pumps can be cross-connected in the event that the charging pumps ce charging pump cooling water pumps for one unit are disabled by fire damage to pumps or their cables.

E 3.

All trash containers in safety-related areas of the plant will be provided with suitable metal covers.

4.

Covers will be installed on cable trays where minimum separation does not meet the requirements of Regulatory Guide 1.75.

1 5.

Additional portable dry chemical fire extinguishers, A B C type, will be provided per National Fire frotection Association Standard 10.

G.

Water spray shields will be provided for the component cooling water pump motors.

1 Consequences of a Fire A fire on this elevation could not damage redundant charging pumps because I

of the barriers between the individual pumps and between the pumps and other i

areas on this elevation.

However, all the charging pumps for one unit could ga be disabled by the loss of redundant charging pump cooling water pumps I

which are located in close proximity to each other. Loss of all charging pumps for a reactor could prevent safe shutdown of that reactor.

I I

The component cooling water pumps are mounted on pedestals and are sepa-rated by 15 feet. It is not expected that a postulated fire could damage more than one of these pumps because of the separation between pumps and the open hatch above tne pumps which would prevent local heat buildup.

Cables for the charging pumps cooling water pumps for both units are located I

on this elevation as *;. ell as the cables for all four component cooling water pumps.

In order to assure safe shutdown, the following is a discussion of a fire in the Auxiliary Building - 2 feet elevation and the affect on:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay Heat Removal.

I Reactivity Control The two charging pump cooling water pumps for each unit are located outside the charging pump cubicles and a single fire could disable both pumps. Power and control cables for the charging pumps and charging pump cooling water pumps are routed through the same fire areas in the auxiliary building, and service building cable vault, and the emergency switchgear rooms.

Adequate I

cable separation exists such that a single fire could not disable the cooling pumps for both units.

It has been verified that the control and power cables for the Unit I charging and cooling pumps are not routed in the same cable tray raceways or conduit that the Unit 2 cables are routed.

In fact, the cables are routed on the opposite sides of the Auxiliary Building and penetrate the respective switchgear I

rooms in separate penetrations. Therefore, a single fire could not disable the charging pumps of both units.

The charging systems of both Units will be cross-connected such that the charging pump (s) of the opposite Unit can be used for negative reactivity insertion into the core.

I I

, I There are no other components in the Auxiliary Building (2 feet elevation) re-quired to function to control reactivity to reach and maintain safe shutdown.

Reactor Coolant Inventory The equipment that could become damaged by a fire in the Auxiliary Building (elevation 2 feet) that would affect safe shutdown relating to reactor coolant inventory are:

1.

Charging Pumps i

2.

Charging Pumps Component Cooling Water Pumps The loss of these components has been discussed.

There are no other com-ponents required to function in the Auxiliary Building (elevation 2 feet) to control reactor coolant inventory to reach and maintain safe shutdown.

I Decay Heat Removal I

The four component cooling pumps are located in the Auxiliary Building (2 feet elevation).

The power cables for three of the pumps run in the same raceway.

However, one of the component cooling pump's power feeds are routed on the opposite side of the building, and the nearest these power feeds approach the other pump's power feeds is where they terminate into the pumps (approxi-mately 15 feet).

There are no other components in the Auxiliary Building (elevation 2 feet) required for decay heat removal to reach safe shutdown.

I I

I I

I I

_-_ ____ __ _ ______ _ _ __ I 4,

AUXILIARY BUILDING - ELEV ATION 13 FEET I

Description of Area - Figure 4 I

The six charging pumps are located in separate concrete cubicles in the middle of the open floor area.

The front walls of the cubicles are open on this elevation; the back walls of the three pumps for one unit face the back walls of three pumps for the other unit.

One charging pump per unit is required for safe hot shutdown.

I Three boric acid tanks and four boric acid transfer pumps are located in the open floor area.

These tanks and pumps provide the normal source of boric acid for safe shutdown of both units.

An alternative source of borated water is in the refueling water storage tank which is located outside the building.

I I

I I

I I

I I

I I

I

vyg ma a

l

. J)..k lfb U w a

I

!I I

l f

ft

[:g8859999099909E9@88Ej$

I O

LJ l

3. J; {

l o l, _. -

i

=ra, l =-

g...

l

,9..

i.

.... m, I

'f

^

C i;

2 9 o.

""'"...b

' * ~ *

'C..

..-l[ - -

-.J

-~*

}

I m m mkm

)

=e

_m_

m m' 3

I c..;0 i i

,3 p.ti...

'C.i<./

~ E.

O-h[

, gogg gg g Ta g y3 u o.

cf.

_h.w.o"

.p

'w 1% 98 GM*

I Yd ad EL 0.O' I

I I

I I

.m_ _1sc_m_.

I I

I I Fire Protection Systems

)

1.

Smoke detectors will be installed in the Auxiliary Building general area exhaust ventilation ducts.

2.

Ionization-type smoke detectors will be provided in the charging pump cubicle exhaust ventilation ducts with alarm in the security building. The effectiveness of the proposed detection system to provide early warning of fires in the charging pump cubicles or in areas that may pose a fire hazard to the charging pumps will be demonstrated through testing.

3.

The charging systems for Units 1 and 2 will be modified so that the charging pumps can be cross-connected.

4.

Covers will be installed on cable trays where minimum separation does not meet the requirements of Regulatory Guide 1.75.

5.

The doors to the Unit 1 and 2 cable vaults will be replaced with fire-rated i

doors.

6.

All hydrogen lines in the Auxiliary Building will be identified by color coding or labels.

'I 7.

All penetrations in the walls between the Auxiliary Building and other fire areas are sealed to provide a 3-hour fire barrier.

8.

Additional portable dry chemical fire extinguishers, ABC type, will be g

5 provided per National Fire Protection Association Standard 10.

I Consequences of a Fire Although the front walls of the charging pump cubicles are open, it is not expected that a fire in one cubicle would affect adjacent charging pumps I

because of the floor-to-c alling concrete barriers between pumps on this 13 I

I I l

elevation.

Also, because of the grating floor at elevation 13 feet, charging pump lube oil leakage would collect at elevation 2 feet where the cubicles are com-pletely enclosed.

The four boric acid transfer pumps are 8 feet apart and redundant pumps could be damaged by a trandent combustible liquid spill; only minor amount of lubricants are associated with the pumps themselves.

Loss of redundant pumps would not prevent safe shutdown because of the alternate boration capability provided by direct supply of borated water from the refueling water storage tanks.

I In order to assure safe shutdown, the following is a discussion of a fire in the Auxiliary Building - 13 feet elevation and the effect on:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay Heat Removal.

I Reactivity Control The two charging pump cooling water pumps for each unit are located outside I

the charging pump cubicles, and a single fire could disable both pumps.

Power and control cables for the charging pumps and charging pump cooling water pumps are routed through the same fire areas in the Auxiliary Building, and service building cable vault, and the emergency switchgear rooms.

Ade-quate separation exists such that a single fire could not disable the cooling pumps for both Units.

I It has been verified that the control and power cables for the Unit I charging and cooling pumps are not routed in the same cable tray raceways or conduit that the Unit 2 cables are routed.

In fact, the cables are routed on the opposite side of the Auxiliary Building and penetrate the respective switchgear rooms in separate penetrations. Therefore, a single fire could not disable the charging pumps of both units.

I There are no other components in the Auxiliary Building (13 feet elevation) required to function to control reactivity to reach and maintain safe shutdown.

I

. I Reactor Coolant Inventory I

The equipment that could become damaged by a fire in the Auxiliary Building

(

(elevation 13 feet) that would affect safe shutdown relating to reactor coolant 5

inventory are:

1.

Charging Pumps 2.

Charginst "' imps Component Cooling Water Pumps The loss of these components have been discussed. There are no other com-ponents in the Auxiliary Building (elevation 13 feet) required for reactor coolant inventory to reach safe shutdown.

I Decay Heat Removal I

The four component cooling pumps are located in the Auxiliary Building (2 feet elevation). The power cables for three of the pumps run in the same raceway on the 13-feet level.

However, one of the component cooling pump's power ieeds are routed on the opposite side of the building, and the nearest these power feeds approach the other pump's power feeds is where they terminate into the pumps (approximately 15 feet).

There are no other components in the Auxiliary Building (elevation 2 feet) required to function to control decay heat removal to reach and maintain safe shutdown.

'I I

I I

,I I

I

_-. I 5.

AUXILIARY BUILDING - ELEVATION 27 FEET

!I Description of Area - Figure 5 The safety-related equipment on this elevation includes the component cooling

{

surge tank, volume control tanks, boric acid tanks, and boric acid filter.

The

~

component cooling surge tank and the volume control tanks are in separate concrete cubicles; the other safety-related equipment is located in the open floor area.

i The non-safety-related gaseous waste disposal equipment, ::olid waste disposal equipment, and some sampling system equipment e.re also located in separate cubicles on this elevation.

Cables for safety-related equipment are routed through many of the open floor areas on this elevation in conduit and in cable trays with corrugated metal top covers.

I 4

I P

'I

's lI

. I I

I I

I I

y k eg2 ga v

. G,

=

I I

I

'I y

~

abd Ll!.JD0 06Hi cU U e o Juu L J.I I

v

= m.

~ = % ! = = _2 D & 1_a r=Bq[O b.el -

g I

I.

u g ! 1***'4 T-g..-4

]

u

- -a,-

1 f=== aa A =

= s. w..

C "'C D}

-*' l s=. -

l C,

L I

8:::

=l]

==+st

=....ig it i,,,;

p-l 1,..-

0"~

4,

.[ M,

=

-. ~

as I

w.p I

'7(,g t-h*4% l

• wN p m. M,4 cm.T h4:.. p" 9

l i

~'

._Jy B!_.n I.

~1: Jet"-- 1 c,...

.a 6; e

-... s. s

-li b

I

\\w.,,%

{LC l o ***;' 'tq ** g:-* it..

h!

f-'*

ll r

- ------* i

) i,,, 4,

' h .Tel'E *l*z - ]

\\){

l

_..A.P 'd V;6

..tr.w *...

.)

I J.

S.-

y..m...... ~,..,

( - * -1

-='

N 8* 6** T*

J

,y.,-.2 L,.-i...,., d. _:

1

. ti - a ;,

l-I

--fp '

.3

' ' '. ' f (h :

' - c J 'M/, 'I V. M :==, ;

f

~i.

J a

PLA4 ELEl [

I I

I lI i

- - AUXILIARY BUILDING - Figure 5

'I lI

' I Fire Protection Systems

I Fire hose stations and portable extinguishers are provided on this elevation for manual fire fighting. In addition, this elevation is accessible to yard hose g

!a facilities via two exterior doors in the general area and an exterior door from the drumming room.

Floor drains are provided for removal of fire suppression water.

The gaseous waste system charcoal filter can be air cooled if a temp-erature rise due to decay heat is detected by operators.

I Fire Protection Modifications I

1.

Smoke detectors will be installed in the Auxiliary Building general area exhaust ventilation ducts.

2.

Ionization-type smoke detectors will be installed in the solid waste drum-ming room.

3.

Heat detectors will be installed in the gaseous waste charcoal filters to alarm in the security building when the filter temperature reaches 190oF.

4.

Covers will be installed on cable trays where minimum separation does not meet the requirements of Regulatory Guide 1.75.

5.

The door to the health physics area hallway in the service building will be replaced with a fire-rated door.

6.

The storage of all unnecessary combustible materials in the Auxiliary Building, including the temporary storage of reactor coolant pump lube oil, will be discontinued.

7.

All hydrogen lines in the Auxiliary Building will be identified by color coding.

8.

All penetrations in the walls between the Auxiliary Building and other fire areas are sealed to provide a 3-hour fire barrier.

I

i i

i 1

s

+ L I

{

Consequences of a Fire Because of the separation from combustible materials and low fire load, an unmitigated fire would not be expected to damage the safety-related equipment (tanks and boric acid filters) on this elevation.

I l

In order to assure safe shutdown, the following is a discussion of a fire in the Auxiliary Building - elevation 27 feet and the effect on-(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Delay IIeat Removal.

Reactivity Control

[

There are no components in the Auxiliary Building (27 feet elevation) required to function to control reactivity to reach and maintain safe shutdown.

l Reactor Coolant Inventory l

Thcre are no components in the Auxiliary Building (27 feet elevation) required l

to function to control reactor coolant inventory to reach and maintain safe shutdown.

Decay lleat Removal i

I The oaly component on the Auxiliary Building (27 feet elevation) required to l

function for decay heat removal to reach safe shutdown is the component cool-ing pump surge tank.

A fire could damage the power etble to the air operated l

make-up valve to the Component Cooling pump surge tank.

Ifowever, this valve has a manual operator on it.

In addition, make-up to the tank is infre-l quent. Therefore, a fire in the Auxiliary Building 27 feet elevation would not affect a safe shutdown.

I L

1I 1

I G.

AUXILIARY BUILDING - ELEVATION - 45 FEET I

l Description of Area - Figure 6 I

Components of the safety-related Auxiliary Building Ventilation System, includ-ing redundant charcoal filter trains, are located on this elevation.

Fuel building, decontamination building charging pump area and safeguards area ventilation equipment is also located on this elevation along with the contain-ment purge supply and exhaust fans.

Safety-related cables in conduit and cable trays are routed through the area.

The combustible materials on this elevation include cable insulation, protective I

clothing in drums, plastic sheeting, wood and cardboard boxes.

Each train of l

the Auxiliary Building Ventilation System filters contain 2520 pounds of charcoal.

l Non-fire protection modifications to the Auxiliary Building Ventilation System will include an additional charcoal filter unit.

I I

I I

I I

I

I I

!00R ORggq I

I l

9

=

4 ruetsun.c m I,,.

m.

r

f,-

.N4 n

..s I

1. f.,*0 ',#f2A.

e

...,.,,... w P9V

[ -

t"*'*"*"

r ' li, 32

. to j=,;,;p

's. y 5 =

~/

O F-4j p

/g../.

sa --

N~

~

-a

.**...,'O. g-*.fa, o I

I 1%

[1 t

q i

', p y..:

.1 2

3-noor er noo,u t

me me q

c u A.

.,,w

.n v._

y I

g-P, 0

,n w

n-O m.u,,-.

i D

!I 1

0 I

e l

roca h-l l

h'S t**

,,,,.ss...4 a.w s e

.., ~

1,

&e..... -

C.: '.'r%,..

[E c.1L'

_u

,C

~-

Jg m =1 w,_w I

j.;..,..

c.ca; -t t

..(-

g,.

.u se r 6 5

.f b.b o

-=-

_3 -

e ery...r -

I

- iou I

ie m m x sezte1se -,1s...

e I

i

' Fire Protection Systems Fire hose stations and portable extinguishers are provided on this elevation for manual fire fighting.

Floor drains are available for removal of fire sup-

'g E

pression water.

The Auxiliary Building Ventilation System charcoal filters are protected by separate total flooding carbon dioxide suppression syste ns.

These suppression systems are manually actuated and are provided with heat detectors which will alarm in the control room at a filter temperature of 225 F.

Fire Protection Modifications 1.

Smoke detectors will be installed in the Auxiliary Building general area exhaust ventilation ducts.

2.

Covers will be installed on cable trays where minimum separation does not meet the ' requirements of Regulatory Guide 1.75.

3.

The door to the fuel building will be replaced with a fire-rated door.

4.

All penetrations in the walls between the Auxiliary Building and Fuel Building are sealed to provide a 3-hour fire barrier.

'I 5.

The storage of all unnecessary combustible materials in the Auxiliary Building will be discontinued.

l I

6.

The new Auxiliary Building Ventilation System general area charcoal filter will be provided with automatic sprinkler systems.

I Consequences of a Fire Each charcoal filter unit is in a separate metal enclosure and completely en-closed in separate co.ncrete cubicles with open doorways.

An unsuppressed fire in one filter would not propagate to the redundant unit nor would it I

I damage other safety-related equipment or cables. The inlet and outlet dampers j

can be shut to prevent radiation release and the redundant unit can continue to operate.

In order to assure safe shutdown, the following is a discussion of a fire in the Auxiliary Building - 45 feet,10 inch elevation and the effect on:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay Heat Removal.

Reactivity Control There are no components in the Auxiliary Building (45 feet,10 inchs) required to function to control reactivity to reach and maintain safe shutdown.

Reactor Coolant Inventory The instrumentation wires to the pressurizer level indicator located on the new panel in the cable spreading room above the control room cross this level of the Auxiliary Building.

However, this cable routing is the alternate routing and the normal indication would not be affected.

There are no other components in the Auxiliary Building (45 feet elevation) required to function to control reactor coolant inventory to reach and maintain safe shutdown.

I Decay Heat Removal The instrument wires to the steam generator level indicator located on the new panel in the cable spreading room above the control room cross the level of the Auxiliary Building.

However, this cable routing is the alternate routing and the normal indication would not be affected.

I I

I I

7.

REACTOR CONTAINMENT BUILDINGS Description of Area - Figure 7 I

The reactor containment buildings for each unit are essentially identical struc-tures.

The containment building is divided by the polar cross wall into an outer annula section and a central section.

The central section is further subdivided into equipment cubicles which are connected to each other and to the outer annulus by open archways, grating floors and unsealed penetrations.

The entire containment can be considered a single fire area.

Safety-related equipment located inside containment includes the regenerative and excess letdown heat exchangers, steam generators, redundant residual heat removal pumps and heat exchangers, containment recirculation spray pumps and heat exchangers, safety injection accumulators, pressurizer, reactor vessel, and rod drive mechanism. Non-safety-related iodine charcoal filters, filtration fans inside the containment.

Power, control and instrument cables for safety-related and non-safety-related equipment are located in the central compartments and are routed around the perimeter of the containment in the octer annulus, in some areas of the annulus, there are considerable quantities of cables in open ladder trays with approximately 10 inches of separation between the trays in a stack. The trays are fitted with sheet metal covers that are raised approximately 1 inch above' the top of the tray.

Various safe shutdown functions are served by the cables in containment. Redundant divisions of pressurizer and steam generator pres-I sure and level instrument cables are routed through the annulus. Redundant divisions of pressurizer heater cables and power cables for the residual heat removal pumps are routed from the annulias cable penetration area to their respective components inside central containment areas.

i lI lI

9g~3'T QQ c]--(b 5

c6 l

1 4

/'

/

1

,e a

I Mas c.st4 s.

Ek W-f.

n.

I k

g L

an pass. ~

.a se Smha I

j ea r.

ce ter.c

-5o

. '?

c=

p

. n.-

ll

• suen wag

.,--k~eu, g

r

,8 l8 f-

~ sierais

,1 i

g,,,

A l-

] '.....8-l

. 1

/.?

.i.

1 I

t I

e 5 :.f: %At.r,.a.n t

c.

., --l-n

t.. j

" 4.g 'I

, [..,t

. l-l<,t' I

'i,,

I Id

- }.9 r

y,.a I

y 4'i l

1 d

i r

-- i,

l-e a I

. :.g

-.,__.m.

c.

,M

• %s.-.._.

O t.

.z

, li j

' I to 8

I.

. c, V

,. j k:'.'J.

../

j.

I!

3. %

x;.. m s.. :

gl.

f F.--_.....

t

,' i. tx..r., ;

J[t w/

l f. ac,.n' -

w s c

'~

s.c. n m l,,. l.

m _:. :

,.x._

, l.

=u _ _

t

.-.-.m....

I

,. ! l, L_. _ _*,

,.9 4

te.,

i eu.-

.c...e.

4 j

_$y, ~

i =:: :

! - Q. W

[.I f

._.1

,_!...- f.1 -,.

5 u.c..1, l-

..,i z, 2;

I l.-

..n.,,.,

I

+-

I 3

i.

I 4

CONTAlmtENT - Figure 7

,I I

i 1

I Fire Protection Systems Temperature sensors are provided on each reactor coolant pump to detect pump overheating.

Portable fire extinguishers are provided in containment for manual fire fighting.

Some areas of the ccntainment building would be acces-sible from Auxiliary Building hose stations via the personnel hatch and from yard hoses via the equipment hatch.

I Fire Protection Modifications 1.

Early warning smoke detectors will be installed in the containment recir-culation ventilation system and in the cable penetration areas to alarm in the security building.

2.

A dry standpipe hose station system will be installed in each containment I

building to reach all safety-related areas with a maximum of 100 feet of hose.

3.

An oil collection system will be installed to collect reactor coolant pump lube oil from potential leakage sites.

4.

A panel will be installed in the cable spreading room with separate instni-ment wires routed through a separate containment penetration area to provide alternative indication capability for the following parameters:

I a.

Reactor coolant hot leg temperature, b.

Pressurizer pressure, c.

Pressurizer level, and d.

Steam Generator level I

Consequences of a Fire The combustible materials in containment, with the exception of the reactor coolant pump lube oil, do not constitute a severe enough fire loading to damage safety-related fluid systems components such as heat exchangers, safety injec-tion accumulators, reactor vessel and pressurizer.

I The iodine charcoal fliters are enclosed in separate structures with 18-inch thick concrete walls and roofs.

An unmitigated filter fire would have no I

direct effect on safety-related equipment or cables.

Redundant residual heat removal pumps are separated by 15 feet and are located in an area where the only combustibles are moderate amounts of cables.

Damage to redundant pumps is not expected even for an unmitigated fire.

In order to assure safe shutdown, the folicwing is a discussion of a fire in the containment and the effect gn:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay Heat Removal.

.I Reactivity Control The only equipment in the containment required for reactivity control required to function for safe shutdown is the rod control system.

Faulting in the rod control system circuits or the Reactor Protection System will trip the reactor.

Following a reactor trip Xenen, a posion, will build up in the reactor core thereby adding negative reactivity and wili peak in approx-imately eight to ten hours.

Twenty-four hours after a reactor trip, boric acid should be inserted into the reactor core to compensate for the decay of Xenon.

The source of boric acid will be obtained from outside the containment.

I There are no other components in the containment required to function to control reactivity to reach and maintain safe shutdown.

Reactor Coolant Inventory The only equipment in the containment required for reactor coolant inventory to reach safe shutdown is the pressurizer level indication.

A remote panel will be installed with separate instrument cables routed through separate g

3 containment penetrations to provide alternative indication capability for reactor coolant hot leg temperature, prissurizer pressure and level and steam gene-rator level.

I I

Therefore, a fire in the containment cannot destroy both the primary and alternate pressurizer level indication.

I There are no other components in the containment required to function to control reactor coolant inventory to reach and maintain safe shutdown.

I Decay Heat Removal i

The equipment that could become damaged by a fire in the containment that would affect safe shutdown relating to decay heat removal is:

I 1.

Pressurizer heaters 2.

RHR pumps 3.

Steam generator level i

The residual heat removal system is required for long term maintenance of the reactor coolant system temperature at cold shutdown.

Redundant residual heat I

removal pumps are separated by 15 feet and are located in an area where the

(,nly combustibles are moderate amounts of cables.

Damage to redundant pumps is not expected even for an unmitigated fire.

In addition, there are other methods available to cool down the reactor coolant system without the use of the residual heat removal system.

I Pressurizer heaters are normally required for safe hot shutdown.

The quantity of pressurizer heaters that are required to function to maintain hot shutdown (125 kw) is small in comparison that are required for at power transients. The maintenance of reactor coolant system pressure is necessary to ensure adequate subcooling.

The use of the pressurizer heaters is one of two methods available to maintain system pressure.

The other method is operating the plant in a water solid mode.

Since TMI, this mode of pressure control has become a viable method.

It has been verified that damage RHR pump cables and pressurizer heater g

cables can be replaced in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

I

., s Steam Generator level indication is required to maintain hot shutdown.

Conse-quently, steam generator level will be added to the panel providing alternate I

indication capability.

Steam Generator pressure is not required for safe hot F

shutdown since this pressure is dependent upon and can be determined from i

RCS temperature and pressure and Steam Generator level.

Also the Steam Generators are protected from an overpressure condition by the code safeties located in safeguards which are not susceptable to damage by fire.

Also, if the fire was not in the safeguards building, local indication of Steam Generator pressure is available and could be utilized.

There are no other components in the containment required to function to control decay heat removal to reach and maintain safe shutdown.

I 1

1 1l 1I 1I 1I 1I lI l

5 lI t

-3a-l 8.

CONT AINMENT SPR AY PU'iP AND AUXILI ARY FEEDWATER PUMP BUILDINGS i

Description of Area - Figure 8 l

The containment spray pump and auxiliary feedwater pump buildings for each unit are essentially identical structures located adjacent to their respective unit's reactor containment building.

The two containment spray pumps are located at ground level in one compartment.

The two electric motor-driven auxiliary feedwater pumps and the steam turbine-driven auxiliary feedwater g

pumps are located in an adjacent compartment.

A grating is located above the g

auxiliary feedwater pumps.

This grating floor provides access to the decay heat release valve, the main steam atmospheric dump valve, nonreturn valve, safety valves and trip valves.

A basement area under the pump compartments contains auxiliary feedwater booster pumps, service water pipes and safety-related and non-safety-related cables.

The cables are for the equipment in the building plus cables for the low head safety injection pumps and containment I

recirculation spray pumps, and associated valves, located in the adjacent safe-guards equipment building.

The auxiliary feedwater pumps are required for safe hot shutdown.

The other equipment and cables are required to mitigate the consequences of a loss-of-coolant accident.

I Fire Protection Systems Portable extinguishers are provided in this building for manual fire fighting.

The fire hose at a yard hose cabinet could be used to fight a fire in the building.

I Fire Protection Modifications i

1.

Smoke detectors will be installed in the ventilation exhaust ducts from the area to alarm in the security building.

I 8

I

bo o

s t

I

- k

Pr"='I4' ZO i ll,.a

-l I'$,"*I?.ile'; A U

i ETIn #o' gb~J'I?s D5'.g

.. f

[

I g

Q

/

MTb'trar ncm, O

g N

i 7

er/~cv,^"U ny r_M.

n I-e s

• v y,.

\\

g s'. a*

c :a6 m,.. y aa

.n

=

,a I

I

't f RC P

'V g

5

$p; i.S 4

r..'

'/

e...s. --

I 3

7..-

-s

e. or.

spaw

.w o n.. w.w. easos

_/

g y

t b

• -o**

3 I

I SAFEGUARDS AREA - Figure S I

lE 5

2.

The following equipment will be added to the closet yard hose cabinet:

I (a) sufficient lengths of 23 inch hose to reach the exterior door to the containment spray pump building, I

(b) sufficient lengths of li inch hose to reach all areas of the building from the exterior door, (c) one gated wye, 2}" x li" x 13",

(d) two li inch adjustable spray nozzles.

Consequences of a Fire An unmitigated fire in the containment spray pump compartment could damage redundant containmen't spray pumps and their cables.

An unmitigated fire in the basement of the building could damage redundant feedwater booster pumps and their cables and redundant divisions of cables for the auxiliary feedwater pumps, main steam valvss and for pumps and valves located in the safeguards building.

A fire in the auxiliary feedwater pump area could damage redundant auxiliary feedwater pumps.

In order to assure safe shutdown, the following is a discussion of a fire in the Containment Spray Pump and Auxiliary Feedwater Pump Buildings and the effect on:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay Heat Removal.

I Reactivity Control There are no components in the Containment Spray and Auxiliary Feedwater Pump Buildings required to function to control reactivity to reach and maintain safe shutdown.

I E

I l

I l

Reactor Coolant Inventory There are no components in the centainment spray pump and auxiliary feed-water pump buildings required to function to control reactor coolant inventory I

to reach and maintain safe shutdown.

ll l

Decay Heat Removal A major uncontrolled fire in the main steam valve house could disable both the motor driven and turbine driven auxiliary feedwater pumps.

There are I

redundant ',10V's located in the opposite unit's auxiliary feedwater pump area that could be used to direct auxiliary feedwater to the affected unit's steam generators. The motive force for this operation would be from the independent auxiliary feedwater pumps of the opposite unit.

The power for the above mentioned ',10V's is also from the opposite unit's emergency bus.

These 110V's are controlled from the control room.

I The normal water source for the auxiliary feedwater pumps is the 110,000 gallon vertical emergency condensate storage tank.

There is also a 100,000 gallon horizontal emergency condensate storage tank that with the aid of redundant booster pumps can provide a source of water to the auxiliary feedwater pump suctions.

The power supply for the booster pumps is from the respective unit's emergency bus and therefore would be available in the event of a loss of offsite power.

An additional supply of water is available, via gravity feed, to both the 110,000 gallon and 100,000 gallon storage tanks from two 300,000 gallon main condensate storage tanks.

I Existing procedures are in effect that provide the necessary instructions for the operation of the auxiliary feedwater cross-connect and alternate condensate water supplies.

I There are no other components in the containment spray pump and auxiliary feedwater pump buildings required to function to control decay heat removal to I

reach and maintain safe shutdown.

I

.__________ 9.

INTAKE STRUCTURE Description of Area - Figure 9 The intake structure is located approximately 11 miles from the main plant buildings.

Two separate buildings are located on top of the intake struc-tu re.

One building contains non-safety-related cables,

4Kv switchgear and motor control centers.

The other building contains the three safety-related emergency service water pumps, and a fuel oil tank cubicle.

The fuel

)

I oil tank supplies the diesel engines which drive the emergency service water J

pumps.

One of the pumps can also be driven by an electric motor wMch is not supplied by an emergency power bus.

The motor control center for this motor is also in the pump building.

The emergency service water pumps I

provide a long-term source of cooling water for plant shutdown in the event of a loss of offsite power. The three pumps are shared by both units.

l 1l 1l 1

B 1

E 1l

\\

B

>I ll I

E w

l I

.E I

I b

t t

O a

[

I l

{

l

A.

.t.

+

l

@Cs li!?

I If =

e 55 i

,.W i

)

s, e.

.W e

I

(=

t

~

t m

$h fll

'A Ei f}lllIIIIIl *

~

\\

g b

/

't l-8

c 3

a u

0 e0 1

1

=

9 s

=

ae.

r I

I r

L t

=

i O I

i E

e.-

a t

r!

h,i e

5 i

o

(

3 OL

-<N*:

g E

3 I

ow i

l I

h 1

3 :l wy

+-

0 l

i I Fire Protection Systems I

Smoke detectors which alarm in the control room are provided in the electrical equipment compartment and in the emergency service water pump compartment.

The fuel oil tank cubicle is protected by a total flooding carbon dioxide sup-pression system supplied by a bank of carbon dioxide cylinders in the pump room.

The carbon dioxide system is automatically actusMd by rate-of-rise detectors.

Actuation of the carbon dioxide system pneumatically closes vent dampe rs, releases doors and sounds a predischarge alarm.

Discharge is alarmed in the control room.

After intitial discharge, additional carbon dioxide may be released by manual operation of the system.

I Portable and wheeled fire extinguishers are provided at the intake structure.

The screenwell pumps at the intake structure could be used to supply fire suppression water.

Fire hose would be brought to the intake structure in response to a detector alarm or in response to a call from a plant operator who inspects the area once every four hours.

I Fire Protection Modifications 1.

The door to the fuel oil tank cubicle will be replaced with a three-hour fire-rate door.

2.

The 11-hour fire damper in the fuel oil tank cubicle wall will be replaced I

with a three-hour fire-rated damper.

3.

Storage of the kerosense-fuel portable heating units in the intake struc-ture will be discontinued.

I Consequences of a Fire A fire resulting in damage to all the cables in the electrical equipment compart-I ment would have no effect on safety-related or safe shut town systems.

An unmitigated fire in the electrical equipment compartment would not spread to the emergency service water pump compartment.

I

4

{

The walls between the fuel oil day tank and the emergency service water pumps I

are three-hour barriers.

Ilowever, there is a non-rated door and 11-hour rated damper in one of thest walls.

A fire in the fuel oil tank cubicle could

{

spread to the pump area via these barrier penetrations.

l The emergency service water part ps are located in an open floor area and are not separated from each other by barriers.

A fire at a pump involving a leak-l ing fuel supply line to a diesel engine could damage all three pumps.

I l

Reactivity Control 1

There are no components in the low level intake structure required to function to control reactivity to reach and maintain safe shutdown.

ll Reactor Coolant Inventory There are no components in the low level intake structure required to function to control reactor coolant inventory to reach and maintain safe shutdown.

B l

Decay Heat Removal 1

A fire in the emergency service water pump room at the low level could possi-l bly render all three pumps inoperate.

This, in conjunction with a loss of offsite power, results in loss of make-up to the intake canal.

In this situation, the only service water loads required to reach hot shutdown are the control I

and relay room air conditioning and the charging pump service water system.

The flow requirements for these systems amount to 400 gpm.

The intake canal 6

j at 18 feet, elevation containing 25 x 10 gallons of water.

The amount of water 6

useage by the above systems over a 72-hour period is less than 2 x 10 gallons which is less than minimum available inventory in the canal.

T here-l fore, additional fire protection in this area is not required.

l B

1I 1

. _ _ _ _ _ l l

10.

TURBINE BUILDING I

~

Description of Area - Figure 10 l

The turbine building is a steel-framed structure with the lower portions of the exterior walls constructed of masonry and the upper portions of uninsu-l lated metal siding.

The roof is metal decking covered with insulation and four-ply asphalt and gravel roofing.

The building is divided into two identi-cal sections except for the operating floor, each measuring approximately 330 feet long by 150 feet wide housing the turbines and generators for Units 1 and I

2.

The operating floor is reinforced concrete supported on steel framing.

The I

mezzanine Icvel and platforms are steel framed with metal floor grating. Stair-ways between floors are constructed of metal grating.

1 The turbine building is bounded on the west side by the office building and on the south side by an exposed exterior wall and by the condensate polishing building on the east site.

The north side shares a common wall with a portion j

of the service building which contains the safety-related diesel generator rooms, I

emergency switchgear rooms, control room, and battery room 28.

Other non-safety-related areas of the service building opening off the turbine building l

include:

the warehouse, shop area, labs, locker and wash rooms.

I l

Cafety-related equipment located within 'he turbine building includes: control room and switchgear area emergency ventilating units; component cooling water l

heat exchangers; instrument air compressors; service water valves; and charg-l ing pump service water subsystem manual valves.

Most of this equipment is located at elevation 9 feet 6 inches.

Valves and their cables for the non-l safety-related circulating water system isolation valves are also located in the turbine building.

These valves isolate the main condensers from the intake l

canal to conserve water in the canal for shutdown.

B lI 1I 1I l

i dth g

gi a r Ty r-r3

[

y-N

' o

~i le o ni g

d I

- +O N

(1 4

-p '

c A

\\

I 4 ]; -

4j cEm 5

0 9. 0 <,> (-w.' ( %

+ :,

+

a r'

y a,

g N

y

.l.f.i l,i U. 00 p

I

^

I L}

3 i

/=.h U-

}

L_ _J i

1

.I o. d, o!C.j -d

' d I

1

-.t--

- I Je %._

]1 a

1 2.

01 a

"-*f,g p]1"

~,', e igi 1 W = 8-

e '-

L n 0 j.:

G.[

M 5'

W d

! l i

,l g

'!![

1 3

i; 2

l'j i

l L if !

(

c:' I i

i I

i)t A

2g w !,

y l

{*,

gt

':H

=

1

/

Pi i

3.E!

3 i

g ~~~'1 f.JL co p.

4.__

I t-l

,8 1

2 c

[;w

f

(

s p

1

~

'O f

5 e -b.

? u$

~

i

.. r.

e;}

e,

1 c p s

"l

.e,

o

-=:m

-- : 1.

m_ _0 '"'c Q ;

'Oa ',.. _ _ _ _,I..

,s 1

e l..

.-t r//

y P1 l

4 g

V*

-.a u

.n... _ ' l8... ( /' 4 I

l l

m

. I 4-e.=,,,,j:

C '

\\

. i.

r......{.

... _ S

.f aOc.,t jl g l a a,'

3

"~

-- ~ -

0, s

i.

-h v

if (

s<

=-

If 3

vi it e

Oy.p--- : g- --Q,

- I

,f.

't"-

l' s It

- { 4,. _ -

v-d,

' - n. - a:

i l

i,

.a

.: m.s 3

_ CN C,

ij a

i,au 2-

~

{,s id1

]

' I l

\\ 4 O.

l - '.^.,.*./.

f o

G t

• tr lg.

4 Q

l' f.

q A

E

• 1

• r

~

• C. ~

l

[,92[ -

- ;ef.6~,.

}a t

E

=

Q

.so

~

W,[:.p[a.[

s..._..

a==

'o e 1i4

.\\\\

J l.......

r e

- 5 8

r-1

] ! o, "t:

.i

(

th [i

< l

.n. :

n. a al r

I

- l,0 _ _0 3 g" ___

_.2 9

' p n t-i C

,.1, 1

I 2

-]

ch d.

t il3 n-sq0

[

.i t

m i

l' l r---

1-I

Y 6

U U b

g-p:.,

s p r. -- y - -se a.

y

[ r, i,6.=_.5.....

l

].] o l

l 1

8 ;

7 5

i a

,4

[

p ni

}

g o'

-).

m;p:g!1 I

i

=

g e t -l ;a;p >

i 7:

g 7-.

(

-a

-i

]

• -b--._..-.?

e h]m 3

s_,

I 7%

I h

_n

_r 1 i

gl I

Fire Protection Systems I

The operating floor of the turbine building is an open area containing both the Unit 1 and 2 steam turbines and generato rs.

A fire barrier having a I

three-hour rating is provided to separate Units 1 and 2 below the operating floor.

The turbine building is separated from the safety-related portions of the service building by reinforced concrete walls, although the openings to the diesel generator rooms, control room, battery room 2B, and the emergency switchgear area are not provided with fire-rated doors.

Other areas of the service building are separated from the turbine building by 12 inch thick

g masonry walls.

!g The turbine generators contain lube oil and hydrogen at the bearing enclo-sures.

These areas are provided with fixed, low-pressure carbon dioxide l

suppression systems automatically initiated by temperature detectors when the enclosure temperatures exceed 4S0oF.

The systems may also be manually initiated at the control room or locally.

Sprinkler protection is provided at all levels of the turbine building except for the operating deck.

Back-up fire fighting capability is provided by manual hose stations located in various areas of the building and from the hydrant / hose houses in the yard as well as _ portable extinguishers.

I Fire Protection Modifications i

1.

T hree-hour fire doors will be provided at the openings to the diesel generator rooms, control rooms, battery room 2B, and the emergency l

switchgear area, all of which communicate with the turbine building.

lI I

lI I

l l 1

l 2.

A three-hour fire door will be provided at the opening in the east wall of the lube oil storage room.

The ventilation openings to this room will also be upgraded by installing three-hour fire-rated dampers.

l 3.

The painted fusible link controlling automatic closure of the sliding fire l

door at the lube oil storage room will be replaced with a new fusible link.

l 4.

A dike will be provided surrounding lube oil conditioning units sufficient in height to contain the entire contents of the units plus a 10 per cent margin for containment of fire suppression water.

5.

liydrogen pipe lines will be color coded or labeled.

l 6.

An analysis has been made of the manual hose station placement in order l

to verify that all locations on the 29 feet, 6 inch elevation of the turbine building can be reached by a maximum of 100 feet of Il inch hose attached to interior hose stations or attached to 23 inch hose from a yard hose cabinet.

Four additional hose stations have been provided.

7.

Sprinklers under open gratings will be provided with heat collectors.

i Consequences of a Fire i

in order to assure safe shutdown, the following is a discussion of a fire in the turbine building and the effect on:

(1) Reactivity Control, (2) Reactor Coolant System Inventory Control, and (3) Decay lleat Removal.

Reactivity Control There are no components in the turbine building required to function to control reactivity to reach and maintain safe shutdown.

1 L

I 1

\\ lI l

Reactor Coolant Inventory I

There are no other components in the turbine building required to function to control reactor coolant inventory to reach and maintain safe shutdown.

1 Decay Heat Removal l

The equipment that could become damaged by a fire in the turbine ballding that would affect safe shutdown related to decay heat removal is:

1.

Circulating Water MOV'S 2.

Component Cooling Water Heat Exchangers I

The circulating water MOV'S would be required to be throttled in the event of loss of offsite power and a fire requiring shutdown.

This would conserve the use of water in the intake canal.

I The MOVS can be hand operated to close in the event any power cables were des troyed.

Two of the MOVS power feeds (orange train) are routed togeth< >

I and the other two MOVS (purple train) are routed via the opposite end of the turbine building.

Collapse of the turbine building cannot destroy safety-related equipment in the turbine building.

The following is an excerpt from Section 15 of the FS AR:

Turbine Building I

By design, building collapse will not damage any Class I structures and components during earthquake or tornado resistant structures and components during tornado.

There are no other components in the turbine building required to function to control decay heat removal to reach and maintain safe shutdown.'

I I

I I

D.

ALTERNATE SHUTDOWN METHODS There are several combinations of safe shutdown systems available in either unit that are capable of shutting down the reactor and cooling the I

reactor core unit during and subsequent to a fire.

The combinations available in a fire situation will depend upon the location of the fire and the effects of the fire on such systems, their power supplies and their control stations.

Safe shutdown of the reactor plants can be assured by those systems and components which:

(1)

Insert negative reactivity into the reactor core.

I (2) Remove reactor core's decay heat.

(3) Maintain the reactor coolant system liquid inventory.

The general functional requirements for safe shutdown, and the system auxiliaries, major components and instrumentation required to fulfill these requirements are as follows: reactivity contrcl, reactor coolant inventory control, decat heat removal, auxiliaries and control and instrumentation.

1.

Reactivity Control I

The control of the reactor's reactivity is provided by two diverse methods. These methods are:

(1) the controls rods and their asso-ciated control circuits, and (2) the soluble poison (boric acid) injection system.

The rod control system is of a fail-safe design.

Faulting in the red control system circuits or the Reactor Protection System will trip the reactor.

Following a' reactor trip xenon, a

g 5

poison, will build up in the reactor core and will peak in approxi-mately eight to ten hours.

Twenty-four hours after a reactor trip additional negative reactivity should be inserted into the reactor core to compensate for the decay of Xenon.

The injection of boric acid will provide this additional negative reactivity.

This is accomplished by using a charging pump to inicet borated water into the reactor coolant system.

The boric acid is normally transferred from the I

boric acid tanks by the boric acid transfer pumps to the suction of the charging pumps.

Borated water can also be supplied directly to the suction of the charging pump from the refueling water storage I

. _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ tank of either unit.

The discharge path of the charging system I

contains an independent source of boric acid.

This source is the Boron injection Tank which contains at least 900 gallons of concen-trated boric acid.

The operation of this tank can be accomplished II both remotely and locally.

3 There are three charging pumps per unit, only one of which is required for long term reactivity control.

Operation of the charging pump requires the charging pump Cooling Water and Service Water systems to be functional.

The charging pump cooling water system provides a source of cooling for the charging pump mechanical seals.

I This system is cooled in turn throu7h one of two redundaat heat exchangers by the charging pump service water subsystem.

The charging pump service water subsystem also provides cooling directly to the charging pump lube oil cooler.

Because of the separation provided, a fire would not damage redundant charging pumps them-selves.

However, the charging water service pumps for both units I

are located in the mechanical equipment room number three in close proximity to each other.

Therefore, a single fire could, after a period of time, disable the charging systems of both units.

A design change package has been initiated to tie the station fire water into the charging pump service water supply header to provide an alternate means of cooling the charging pumps.

The modification has not been implemented; however, in the interim fire water can be menually tied into the supply system utilizing jumper hoses and neces-sary econectors.

I The two charging pump cooling water pumps for each unit are located outside the charging pump cubicles and a single fire could disable both pumps.

However, adequate separation exists such that a single fire could not disable the cooling pumps for both Units.

I Power and control cables for the charging pumps and charging pump cooling water pumps are routed through the same fire areas in the auxiliary ballding, and service building cable vault, and the emer-

)

gency switchgear and relay rooms.

I I

It has been verified that the control and power cables for the Unit 1 charging and cooling water pumps are not routed in the same cable 1

trays raceways or conduit that the Unit 2 cables are routed.

In fact, the cables are routed on the opposite sides of the auxiliary building I

and penetrate the respective switchgear rooms via separate penetra-tior Therefore, a single fire could not disable the charging pumps of both units.

In the event a fire which did in fact disable the cooling pumps for a single unit, the charging pumps could remain functional for a perit of time.

Operating the charging system in an "on-off" mode, con-I sistent with Reactor Coolant System makeup requirements, and alternating available charging pumps the seal cooling temperature can be maintained below its maximum value.

This can be demon-strated on the training simulator.

Ultimately, the charging systems of both Units will be cross-connected such that the pump (s) of the opposite Unit can be used for negative reactivity insertion into the core.

2.

Reactor Coolant System Inventory Control Following a reactor shutdown or trip, the reactor coolant system water inventory is maintained by the operation of the charging pumps.

During normal plant operations reactor primary grade water is mixed with boric acid to provide a supply of makeup water to the reactor coolant system in order to compensate for any primary coolant leakage.

The automatic pressurizer level control program is design to comperi-I sate for the shrinkage that is experienced immediately following a reactor trip, i.e.,

change in Taverage from full power to no load value.

Primary grade water is transferred from the primary grade water tanks by the primary water supply pumps to the suction of the charging pumps.

The primary grade water supply pumps are not

'I safety-related, and a loss of offsite power which would disable these pumps.

However, consistent with the reactivity control requirements discussed above the use of the primary grade water system is not I

' I required.

The Boric Acid Transfer pumps are powered from the emergency bus and muld be available in.he event of a loss of I

offsite power.

If the normal Boric Acid Transfer system is not available, due to fire damage, either unit's Refueling Water Storage Tank will supply water to the charging pump suction thereby provid-ing the necessary makeup requirements.

I The purpose of the main letdown system, in harmony with the charg-ing system, is to provide automatic inventory control, i.e., to I

maintain pressurizer level.

The system also provides a means of reactor coolant purification.

Tbe charging system flow is adjusted I

to compensate for changes in letdown flow and RCP seal injection flow.

If normal letdown is lost, the plant can be shifted to excess letdown which is capable of handling the makeup inventory due to seal injec-tion.

In this situation, normal charging flow is isolated and seal injection adjusted to match excess letdown capability.

The plant can be operated without normal and excess letdown by using the excess volume available in the pressurizer and dperatinst the charging system I

in an "on-off" mode to make-up for any leakage.

Reactor coolant system inventory can therefore be maintained with a loss of letdown.

The loss of seal injectio'1 would not result in adverse pump operation since water from the coolant system would flow up pass the thermal barrier and into the seal area to provide the necessary lubricatien for an operating (rotating) Reactor Ccolant Pump.

However, with a I

coincident loss of Component Cooling flow to the thermal barrier, the loss of cooling necessitates pump shutdown within two minutes. The possibility of a loss of Reactor Coolant Pump seal Integrity is of primary concern when the pump is operating.

The most probable mode of seal failure is the overheating of the seal caused by loss of cooling inconjunction with heat generated by the rotating seal.

Gross I

leakage from a mechanical seal is prevented by the floating ring seals.

With a loss of offsite power the reactor coolant pumps will stop operating (rotating).

With the termination of forced flow, natural I

circulation would be established.

Existing procedures are in place to operate the reactor coolant system in this mode.

The seal water injection system consists of manual valves used for flow control, one Motor Operated Block Valve (MOV) and one air operated valve ( AOV).

I lI The MOV will fail as is, which is in the open position.

With a loss of electrical power or air the AOV will fall in the normally open post-tion. Therefore, even with severe fire damage to the components of I

this system, seal water injection to the reactor coolant pamps can be assu red.

1 The charging systems of both units will be cross-connected such l

that the pump (s) of the opposite unit can be used for reactor coolant system inventory control.

3.

Decay Heat Removal I

Following a normal plant shutdown, the condenser steam dump system bypasses steam to the condenser to remove the decay heat.

If con-denser steam dump is not available, remotely and/or automatically controlled atmospheric steam dump (PORV) valves on the main steam lines will remove the decay heat by relieving main steam to the atmosphere.

These atmospheric dump valves which can be manually I

operated locally and are backed up by coda safety valves on each steam generator.

For the continued use of the steam generator for decay heat removal, it is necessary to provide a source of water and means of delivering that water. The auxiliary feed pumps (two motor-driven pumps and one turbine-driven pump per unit) are provided to deliver the neces-sary water to the steam generators.

The turbine driven auxiliary feedwater pump has redundant steam supply valves.

One supply valve is a MOV and is powered from the emergency bus.

The redundant valve is an air operated valve that will fail open upon loss of either electrical power or air.

A fire in the emergency switchgear room could disable the power and control cables fc,e the motor-driven auxiliary feedwater pumps.

A fire in this area could also disable the power and control cables for the steam supply valves for to the turbine driven auxiliary feedwater pump.

However, as I

stated previously, a loss of electrical power to the redundant steam supply air operated valve would cause this valve to open thereby admitting steam to the turbine driven auxiliary feedwater pump.

A I

l I

major uncontrolled fire in the main steam valve house could disable l

l both the motor driven and turbine driven auxiliary feedwater pumps.

I There are redundant MOV's located in the opposite unit's auxiliary l

feedwater pump area that can be used to direct auxiliary feedwater l

to the affected unit's steam generators.

The motive force for this l

operation would be from independent auxiliary feedwater pump (s) of the opposite unit. The power for the above mentioned MOV's is also l

from the opposite unit's emergency bus. These MOV's are controlled from and indication provided for in the control room.

1 The normal water source for the auxiliary feedwater pumps is the I

110,000 gallon vertical emergency condensate storage tank.

There is also a 100,000 gallon horizontal emergency condensate storage tank that with the aid of redundant booster pumps can provide a source l

of water to the respective unit's auxiliary feedwater pump suction.

The power supply for the booster pumps is from the respective unit's emergency bus and therefore would be available in the event of a loss of offsite power.

An additional supply of water is available, via gravity feed, to both the 110,000 gallon and 100,000 storage tanks from two 300,000 gallon main condensate storage tanks.

Procedures are in effect that provide the necessary instructions for the operation of the auxiliary feedwater cross-connect and alternate condensate water supplies.

For cooldown of the reactor coolant system to a temperature of less than 200 degrees Fahrenheit, the residual heat removal system is normally utilized.

T he rasidual heat removal system consists of redundant heat exchangers, pumps and associated piping, valves and instruments.

The residual heat removal system is required for long term main-tenance of the reactor coolant system temperature at cold shutdown.

However, there are other methods available to cooldown the reactor

I coolant system without the use of the residual heat removal system.

Using steam from either the auxiliary boilers or the auxiliary steam system, a vacuum can be established and maintained in the main lI

1 'I condenser.

A vacuum can then be drawn in the steam generators by l

manually establishing a flow path to the condenser via the condenser I

steam dump system.

This method is commonly referred to as " single loop cooldown".

Existing procedure are in effect for this mode of I

operation.

Pressurizer heaters are normally required for safe hot shutdown. The quantity of pressurizer heater that are required to be functional to maintain hot shutdown (12 5 kw) is small in comparison that are required for at power transients.

The maintenance of reactor coolant system pressure is necessary to ensure adequate subcooling.

The I

use of the pressurizer heaters is one of two methods available to maintain system pressure.

The other method is operating the plant in a water solid mode. Since T51I this mode of pressure control has become a viable method.

I It has been verified that damage RHR pump cable and pressurizer heater cables can be replaced in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

4.

Auxiliaries Auxiliaries that are normally required for safe hot shutdown include:

(1) gravity feed service water supply to the Charging Pump Service Water subsystem,

(2) Charging Pump Service Water subsystem, (3) Charging Pump Component Cooling system,

(4) Containment Instrument air system, (5) Station Instrument Air System. and (6) appropriate instrumentation and power supplies.

I Auxiliaries that are normally required for safe cold shutdown include those systems required for hot shutdown and the main Component Cooling system.

I alultiple outside sources of power are available to the plant for both normal operation an<*

Mutdown function.

I I

I I

The Vepco distribution system supplies power, from multiple incoming lines and transformers, to three reserve station (startup) trans-formers (RSS).

The RSS is the normal supply for the emergency buses during operating and shutdown conditions.

The RSS directly I

powers the normal station service buses during shutdown operations.

During at power operation, the unit's generator output supplies power to the respective station service buses.

At power, the unit's gene-rator output, in parallel with the all other Vepco generators, will indirectly power the emergency buses.

If normal power is lost to the emergency buse 5, independent diesel generawrs will automatically

.I supply power to the emergency buses.

Upon loss of power to the emergency buses, the diesel generators initially do not supply loads that are used for cold shutdown operations, i.e., main Component Cooling and RHR pumps.

When required, the Main Component Cool-ing Pumps and RHR pumps can be reconnected to the emergency bus.

I All safety-related equipment is powered from the emergency bus and I

the power supplies to redundant equipment are electrically separated.

Instrumentation and controls are powered from the DC distribution system.

The normal power source for the DC distribution system is the emergency bus via redundant battery chargers.

If power is lost to the battery chargers, the battery charges fail, batteries are provided to maintain continous DC power.

The Charging Pump Component Cooling system is an independent system including a separate head tank. This system is not dependent upon the motive force of the main component cooling system, and

'I therefore, a loss of power to or fire damage affecting the main component cooling system, will not cause the Charging Pump Com-ponent Cooling system to be inoperative.

The component cooling system loads include the letdown system, RHR, Reactor Coolant pumps, containment air recirculation fans and miscellaneous rad-waste components.

As previously discussed, the

.I letdown system and reactor coolant pumps are not required for safe I

shutdown. The radwaste system is not required for the safe operation or shutdown of the units. The RiiR system is required for the long-term maintenance of the reactor coolant system at cold shutdown.

Three of the four power cables to the component cooling pumps are not adequately separated. However, as stated, the component cooling pumps are not required for hot shutdown.

The reactor coolant pump seal water return cooler is not required for safe shutdown. This cooler provides two functions:

(1) cool the RCP seal leakoff fluid for reuse, and (2) cool the charging pump recircu-I lation RCP seal leakoff can be isolated from the containment as evidenced by the automatic isolation during Safety Injection.

During normal operations, the inlet temperature to the charging pumps is 80-100oF.

Whenever the suction for the charging pumps is shifted to the RWST, the inlet temperature drops to approximately 45 F.

With the combination a loss of component cooling to the seal water cooler and a lower inlet temperature, the temperature of the fluid that is pumped by the charging pumps is not expected to increase significantly.

The Containment Air Recirculation cooler's function is to maintain the bulk temperature of the containment.

The maintenance of con-tainment temperature is required only to define the " operating" envelope for containment pressure (vacuum).

If the containment pressure (vacuum) cannot be maintained within a given range the reactor is required to be shutdown.

The equipment inside the

I containment that is required to function to maintain the reactor in a safe condition is qualified to an environment more severe than could occur due to a loss of these coolers.

The station instrument air system is fed from the emergency buses and is therefore available in the event of a loss of offsite power.

These compressors are located in the turbine building basement.

,I The containment instrument air compressors are located in the safe-guards building basement with power supplied from station service motor control centers above the cable vault.

The new compressors l

are not fed from the emergency buses.

A single fire could not disable I

l both the station instrument air compressors and containment instru-ment air compressors.

Also, a single fire could no't damage the cables for each system since routing is through and terminates in two separate fire zones (above the cable vault and switchgear rooms).

The components supplied by the instrument air system were designed to fall in the safe (emergency) modo upon loss of air.

Air operated valves in the letdown system fail close to preclude the loss of reactor coolant system inventory.

Valves ir the charging and seal water I

injection system fail open to provide a makeup path to the reactor coolant system.

The valves in refueling water storage tank cross-connect system fail open to insure a supply of borated water to the charging pumps from either RWST.

The air operated valves in the RilR system fail in positions that will provide maximum flow through the RHR heat exchangers.

The Power Operate Relief Valves for I

each steam generator will fail closed.

However, five code safeties per steam generator will remain functional and are not dependent upon electrical power or air.

The PORV's can be manually operated I

if required.

In general, any valve that fails closed upon loss of air can be manually operated, if required.

I A fire in the emergency service water pump room at the low level could possibly render all three pump inoperate. This, in conjunction with a loss of offsite power, results in loss of make-up to the intake canal.

In this situation, the only service water loads required to I

reach hot shutdown are the control and relay room air conditioning and the charging pump service water system.

The flow requirements for these systems amount to 400 gpm.

The intake canal at 18 feet 6

elevation contains 25 x 10 gallon of water.

The amount of water useage by the above systems, over a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> period, is less than 2 x 10 gallons, which is less than the minimum available inventory in the canal.

Therefore, additional fire protection in this area is I

not required.

I I

I

____ - __ _ 5.

Control and Instrumentation An auxiliary shutdown panel is located in each emergency switehgear room and has control switches for the following functions:

(1) Emergency boration MOV I

a.

This function can also be performed locally and is used to compensate for the decay of Xenon.

(2) Decay heat release valve

.I a.

As stated in the FS AR this valve is not require until 30 minutes after shutdown.

o.

The mechanical code safeties will maintains the plant at hot shu tdo'an.

I (3)

Auxiliary feedwater pumps (4)

Auxiliary feedwater MOV's (5) Charging pumps (6)

Charging flow control (7)

Pressurizer heaters I

a.

The emergency heaters are powered from the emergency bus.

I b.

Only 125 kw of the approximately 450 kw available are re-quired to support hot shutdown.

A remote panel will be installed with separate instrument cables routed through separate containment penetrations to provide alterna-tive indication capability for reactor coolant hot leg temperature, and pressurizer pressure and level.

Steam Generator level indication is required to reach and maintain hot shutdown.

Consequently, steam generator level will be added to the panel providing alternate indication capability. Steam Gene-rator pressure is not required for safe hot shutdown since this pressure is dependent upon and can be determined from RCS tem-perature and pressure and Steam Generator level.

Also the Steam Generators are protected from an overpressure condition by the code safeties located in safeguards which are not susceptable to damage by fire.

Also, if the fire was not in the safeguards building, local indication of Steam Generator pressure can be made available and could be utilized.

i i"

i

!I I

I

.I

'I 4!I I

I C. CONCLUSIONS The preceding safe shutdown evaluation analysized all areas where equip-ment vital to cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is housed.

The conclusion of this report is that with the alternate shutdown method described in Section B of this report and the fire protection modifications required by the Safety Evaluation Report, the station can be brought to cold shutdown as defined below with a fire in any area of the plant.

I (1) Placing the reactor in a suberitical condition and maintaining the reactor subcrictical indefinitely.

(2)

Bringing the reactor to hot shutdown condition and maintaining it at hot shutdown for an extended period of time (i.e., longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) using only normal sources of cooling water.

I (3) Maintaining the reactor coolant system inventory inuefinitely using normal sources of make-up water.

(4)

Bringing the reactor to cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

I I

.I I

ll

'm,

l D.

VERIFIC ATIONS 3.1.24 Penetrations All pgnetrations between boundaries of fire areas (cable, pipe, and ventilation duct) are sealed to have a fire rating at least equivalent to the test criteria described by the Surry Fire Protection Anle,is.

3.2.1 Auxiliary Boller Room The floor drainage system does not communicate with other areas of the plant.

3.2.2 Fire Dampers A three-hour fire damper has been installed in the wall shared with the turbine building and mechanical equipment room No. 3.

Therefore, this concern is complete.

3.2.4 Charcoal Filter Hazard The only safety-related cable that is located near the control room emer-gency ventilation charcoal filter is the power fed to the respective fan motor.

i 1

I I