ML19340E709

Technical Evaluation of the Susceptibility of Safety- Related Sys to Flooding Caused by Failure of Noncategory I Sys for Indian Point 2.

ML19340E709
Person / Time
Site:	Indian Point
Issue date:	11/30/1980
From:	Latorre V, Victor R LAWRENCE LIVERMORE NATIONAL LABORATORY
To:
Shared Package
ML100321279	List: ML19340E709
References
NUDOCS 8101150496
Download: ML19340E709 (16)

Text

.

SELECTED ISSUES PROGRAM TECHNICAL EVALUATION OF, THE SUSCEPTIBILITY OF SAFETY-RELATED SYSTEMS TO FLOODING CAUSED BY THE FAILURE OF NON-CATEGORY I SYSTEMS FOR INDIAN POINT UNIT 2 Occket No. 50-247 by Victor R. Latorre Richard A. Victor l

l l

November 1980 l

f ENGINEERING RESEARCH OIVISION ELECTRONICS ENGINEERING DEPARTMENT LAWRENCE LIVERMORE NATIONAL LABORATORY i

tilo115041.k - .1

ABSTRACT This report documents the technical evaluation of the Indian Point 2 Nuclear Power Station. The purpose of this evaluation was to determine wnether the f ailure of any non-Class I (seismic) equipment could result in a condition, such as flooding, that might adversely affect the performance of the safety-r' elated equipment required for the safe shutdown of the f acility, or to mitigate the consequences of an accident. Criteria developed by the U.S. Nuclear Regulatory Comission were used to evaluate the acceptability of the existing protection system as well as measures taken by Consolidated Edison Company of New York (CECMY) to minimize the danger of flooding and to protect safety-related equipment.

Based on the information supplied by the licensee, it is concluded that the licensee, CECNY, has demonstrated in its analysis that the Indian Point 2 Power Station has the capacity and capability to manage and mitigate any single incident, such as flooding, from a non-Class I system component or ,

pipe, so that this flooding will not prevent the safe shutdown of the facility.

l I

l t

i iii i

( . . - .-. . .. . .- . . _ _ . . _ _ _ . _. . _ _ . .

i FOREWORO This report is supplied as part of the Selected Electrical, Instrument-ation and Control Systems Issues (SEICSI) Program being conducted for the U.S. Nuclear Regulatory Comissicn (NRC), Office of Nuclear Reactor Regulation, Division of Operating Reactors, by the Lawrence Livermore National Laboratory, Engineering Research Division of the Electronics Engineering Department.

The NRC work is funded under the authorization entitled " Electrical, Instrumentation and Control System Support", S&R 201904 031. FIN A-0231.

l l

l v

~

e

"* -* w m.v. ,~-,. , , __

TABLE OF CONTENTS Page Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Foreword ..............................v

1. Introduction ......................... 1

2. . .luation .......................... 3 2.1 General Cons iderations . . . . . . . . . . . . . . . . . . 3 2.2 Diesel Generator Building ................ 3 2.3 Fuel Storage Building .................. 4 2.4 Service Water Pump Area ... .............. 4 2.5 Con tro l Bui l di ng . . . . . . . . . . . . . . . . . . . . . 5 2.6 Turbine Hall . . . . . . . . .............. 6 2.7 Primary Auxiliary Building . . . . . . . . . . . . . . . . 7 2.8 Au x i l i a ry Feed P ump Ro om . . . . . . . . . . . . . . . . . 9

3. Conc l us i on s . . . . . . . . . . . . . . . . . . . . . . . . . . 10

4. References ..........................11 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 l

l i

l I

I vii i

I r

"' " "-WF ,w

• _

1. INTRODUCTION Three separate reviews of the Indian Point Unit 2 were concucted by the Consolidated Edison Company of New York (CECNY) between 1972 and 1980.

Initially, at the request of the U.S. Nuclear Regulatory Comission (NRC) in 1972, the licensee reviewed both Indian Point Units 1 and 2. Subsequently, Unit 2 was again reviewed at the request of the NRC and the potential sources of flooding and safety-related equipment which could be affected by flooding were identified.

The sources of potential flooding identified by the licensee in its reviews include the following listed non-Class I(l) water systems:

(1) Circulating Water System CLASS III (2) See Protection System Class III (3) Refueling Water Storage Pool Class III (4) Spent Fuel Pit Cooling Loop Class II (5) Sampling System Class II (6) Chemical Volume Contal System Class II Portion (7) Primary Water Make-Up System Class II Portion l

The arets which are subject to flooding from failure of non-Cla<3 I water systems --9 identified to be:

(1) Diesel Generator Building (2) Vapor Containment f (3) Fuel Storage Building

[

(4) Intake Structure (5) Control Building (6) Turbine Hall (7) Primary Auxiliary Building (8) Auxiliary Boiler Feed Pump Room (1) Class I, II and III systems are defined in the Indian Point Unit 2 FSAR, Appendix A (Ref. 7].

Indian Point No. 2 Class II equipment is designed for the operating basis earthquake, (i.e. ground acceleration of 0.05g acting in the vertical and 0.1g acting in the horizontal planes simultaneously). l.cading com0inations for the operating basis earthquake are actually more stringent than those for shutdown earthquake. Also, Class II piping has been installed and supported using the same criteria as Class I piping.

3 k

e 1

9

't

2. EVALUATION 2.1 GENERAL CONSICERA7!ONS This evaluation only includes flooding of the areas outside containment.

The evaluation of 'the licensee's review of the flooding issue is performed on an area basis rathe? 1han an equipment basis and includes all areas containlag safety-related equipment that could be affected by flooding.

Existing protection from flooding as well as additional steps taken by the licensee to protect the safety-related equipment from the effects of flooding damage are addressed.

2.2 DIESEL GENERATCR RUILDING The safety-related equipment within the Diesel Generator Building requiring protection from the effects of flooding are:

1. Diesel Generators

2. Day Tanks .

3. Control Panels The fire protection system in the Diesel Generator Building has the potential to cause flooding. This system consists of wet pipe automatic '

sprinklers installed in the sump area beneath the diesel engines and on the day tanks. Actuation of the fire protection system would not, however, endanger the safety-related equipment since the drainage provisions include 5 sump pits provided in the floor at the 67' elevation. These sump pits are connected to a 12" drain whien runs to the circulating water di; charge tunnel. The adequacy of the drainage system was noted in CECNY's letter of December 18,1972 [Ref. 3] and also in NRC's Fire Protectio, Safety Evaluation Report issued on January 31,1979 [Ref. 8]. In addition, the diesel

{

engines / generators and control panels are located five feet above the 67' floor elevation.

Actuation of the fire protection system in the Diesel Generator Building is annunciated and alarmed in the Central Control Room (CCR) to alert the Control Room operator of the system's actuation. The CCR operator would also receive alarms from the fire detection system.

Operator action to protect the diesel generators from flooding is not required since the crains in the Diesel Generator Building are sized sufficiently to preclude buildup of any flood level.

We conclude that the above features and procedures are adequate to prevent flooding of safety-related equipment in the Ofesel Generator Suilding.

2.3 FUEL STORAGE SUILDING There is no equipment in the Fuel Storage Building susceptible to damage Ly flooding that is required for safe shutdown of the reactor or mitigation of the consequences of an accident. The water available for flooding is limited since the pump suction connection is near the top cf the spent fuel pit.

Water from a break in the loop would either drain back into the pit, flow to the trailer truck area and out the overhead door to the yard at the 80' elevation,'or else be carried away by the floor drains located at the 70' and 80' elevations of the Fuel Storage Building. '

A break in the spent fuel pit cooling loop would be indicated to the CCR operator by a spen fuel pit level alann and/or a spent fuel pit high

temperature alarm. Pit temperature is also indicated locally. For these reasons, unacceptable flooding would not t? caused by f ailure of the spent l

fuel pit cooling loop.

Operator action would not be required to protect essential equipment from flooding caused by failure of the spent fuel pit cooling loop. We conclude that there is no flooding danger to safety-related systens in the Fuel Storage Building.

2.4 SERVICE WATER PUMP AREA The Service Water Pump area is located outside the buildings and the piping is underground. Flood water from a Class III piping failure would flow along the ground, to the river, without posing a threat to the Service Water Pumps.

l 4

1

2.5 CONTROL BUILDING The licensee determined that if the Fire Protection System is actuated in the electrical tunnels (cable trays) of the Control Building, water will drain from the trays througn a 10" drain in the tunnels. In addition, alarms will sound in the Central Control Room, alerting the operator.

Flooding from a break in a circulating water line would affect performance of the 480 volt switchgear at the 15' elevation of the Control Building if the water level were to rise to an elevation of 15'6". The 480 volt switchgear is the only safety-related equipment that could be adversely affected by uncontrolled release of the circulating water. Operator action would be required to keep the flood level below the 15'6" elevation. This action would consist of shutting down the circulating water pumps by operating the pump breakers from either the CCR or locally at the 6.9KV Breaker Panel on the 15' elevation of the Turbine Building. Flooding could also be relieved by locally opening the 15' rollup doors to the yard. These doors are at the north and south ends of Unit 2 Turbine Building and at the south end of the Unit 1 Turbine Building.

Redundant level alarm switches have been installed in the condenser pit area of the Unit No.1 Turbine Building that alerts the Control Room ocarator if flooding occurs in the area. The redundant switches are mounted in opposite sides of Je pit and are set to actuate if the water level in the pit rises to 6 inches above the deck; i.e. to the l'6" elevation. Measures have been taken to assure that a single failure would not disable the flood alarm system. The conduit and cable runs for the two switches are physicall'y separated and go to two completely separate annunciator panels in the Control l Room. The level alana switches in the Indian Point Unit No. I condenser pit

! will alert the CCR operator of a break in a Unit No. 2 circulating water line.

l The level switches are Magnetrol Model No. TF-201-FEpvp-XY-SIM3DC. They .

are furnished with an explosion and vapor proof switch housing and employ magnet actuated dry contact switches. The level switches are designed for a maximun liquid temoerature of 250 F and are therefore appropriate for the

! operating environment. The electrical power for the level alarms is provided frnm two ind'ependent Indit . Pcint Unit No. I batteqr systems.

( The switches and CCA annaticators a e tested at monthly intervals.

l Testing may be perfor: rad during normal reactor operation.

A break in a Unit No. 2 circulating water line would actuate the lewl alarm switches in the Unit No. I condenser pit about three minutes after the ,

break. The operator in the Control Room would have approximately seven minutes to turn-off the circulating water pump in the broken line or open a door to the yard to prevent the flooding from reaching an unacceptable level.

The 'aven-minute figure is a minimum value since there is a nuclear plant l

operator (NPO) assigned on a 24-hour basis to the conventional portion of the pl an t. It is reasonable to assume that this NPO would notify the Control Room operator of the flooding situation prior to actuation of the level alarm switches. The Control Room operator would therefore have fro.n 7 minutes to 9 l

l minutes to turn off the circulating water pump or open a door to the yard

, before the flooding would reach an unacceptable level.

l In the event that the 480 volt switchgear is flooded, the reactor can l

j still be placed and maintained in hot shutdown by the alternate safe shutdown capability which is being installed and will be completed by the end of the fourth refueling outage (early 1981). This capability is described in the l

NRC's Safety Evaluation Report for Fire Protection which was issued on January 31,1979 [Ref. 8]. Shutdown will be possible independent of the .

Sw'tchgear Room, the electrical penetration area, the Electrical Tunnel, the Cable Spreading Room and the Control Room. This capability will include instrumentation for pressurizer pressure and level and for steam generator level, control and power for auxiliary feedwater, and control and power for reactor coolant makeup and boration. Additional details of the alternate safe shutdown capability are in Section 4.10 of the Safety Evaluation Report.

It is concluded from the above discussion and the Fire Protection Report, that, since other essential equipment in the Control Building is at higher elevations (for example, the essential batteries are located at the 33' level), the Indian Point 2 Control Building's safety-related equipment will not be adversely affected by flooding, and that the plant can be safely shut down.

2.6 TURBINE HALL The licensee stated that no safety-related equipment was located in the Turbine Hall. A pcrtion of the alternate shutdown system, which is presently being installed, will hcwever, be routed through the Turbine Hall at an elevation of approximately 28'(12' above floor). Flooding due to a break in a circulating water line in the Turbine Building (elevation 15') would not affect performance of tnis system.

2.7 PRIMARY AUXILIARY BUILDING Safety-related equipment in the Primary Auxiliary Building (PA8) includes the charging pumps, the boric acid tanks and transfer pumps, the containment spray pumps, the safely injection pumps, the component cooling heat exchangers and ptsnps, residual heat rexval pumps, and safety-related motor control centers and control panel.

The PAS is designed so that flocding from any elevation will result in the water draining to the lowest elevation in the building (elevation 15').

This is assured by the numerous 4" floor and t .2 drains provided throughout the PAS and also by the stairwell flow areas. Revision I to CECNY's report

" Review of Indian Point Station Fire Protection Program," submitted to the NRC on April 15, 1977, discusses in detail, on an area by area basis, the drainage provided in the PAB as well as in other portions of the plant. The only safety-related equipment that could potentially be affected by flooding are the residual heat removal (RHR) pungs located at the 15' elevation.

Performance of the RK', pumps would be affected if the water level reached the 19' elevation. Flooding to this elevation is precluded by modifications made to the door to the transformer yard. The 4-1/2" high and 44" wide flap installed at the bottom of the door will allow water to drain to the yard at the 18'8" elevation and prevent any adverse buildup of flood level, thus protecting the RML pumps from flood damage.

A complete failure of the non-Class I pipe in the PA8 with the largest nominal flowrate would cause flooding at a rate of 200 gpm. The drainage provisions of the building outlined above will preclude damage to any safety-related equipment in the event of such a failure.

Non-Class I tanks and other components which may potentially cause flooding have a combined volume that is so small that their failure would cause negligible flooding. Flooding consequences from f ailure of the other l

components and associated lines are also negligible.

l t

{

i I

Flooding in the PAB would be indicated to plant personnel in several ways. First, significant loss of water from a break may cause abnormal reidings from the system's process instrumentation. Also, since any' flooding in the building will drain to the lowest elevation, major flooding would be indicated by water flowing out of the door to the y ,rd at the 18'8" elevation.

Finally, there is a nuclear plant operator (NPO) assigned on a 24-hour basis to the nuclear portion of the plant. This NPO makes routine tours through the PAB and other nuclear-related areas of the plant, and would observe any abnormal leakage from the plant systems.

The sampling system provides samples of reactor coolant and other liquids for laboratory analysis. Sanoling lines of 3/8" stainless steel tubing run from various equipment to the Sampling Room at the 80' elevation in the Primary Auxiliary Building. Lines from the primary containment are provided with containment isolation valves which, with the exception of the steam generator blowdown lines, are normally closed. Samples from outside containment .are also routed to the Sampling Room in the PAB. Local sampling points are provided at various locations. All Seismic Class II lines and components of the Sampling System were reviewed to determine the possible flooding effects due to their f ailure. Considerations included the sitt of the lines and c.omponents, their location with respect to safety-related equipment, nominal flowrates of the lines and the drainage provided in the buildings. It was determined that potential flooding due to failure of the Sampling System would not adversely affect the performance of safety-related equi pmen t.

Class II portions of the Chemical Volume Control System (CVCS) include the boric acid batching tank, the chemical mixing tank, the monitor tanks, the monitor tank pumps and associated piping. The batching tank and chemical mixing tank are on the 98' elevation of the PAB. These tanks are small, 400 and 5 gallons, respectively and their failure would not cause any adverse flooding. The three (3) monitor tanks each hold 7500 gallons and are located outdoors at the 81' elevation on a concrete deck above the Waste Hold-Up Pit, directly east of the PAB. The ticee (3) monitor tank pumps are located at tha 68' elevation of the PAB. Each punp has a flowrate of 60 gpm. Consideration was given to failure of the monitor tanks, the monitor pumps suction lines, and the monitor ptsnps discharge lines during pump operation. Taking into account the location of the monitor tanks, the overly adequate drainage system

l of the PAB, and the location of safety-related equipment, it was determined Utat potential failure of the monitor tanks and associated piping /comconents would not adversely affect the performance of safety-related equipment.

The only appreciable flooding could be caused by failure of a primary water make-up pumo discharge pipe during pump operation or f ailure of the discharge pipe from the flash evaporator product cooler. The primary water make-up pumps are located at the 68' elevation of the PAB and the flash evaporator product cooler is on the 80' elevation of the PAB. The flowrate in the dischage line of the pumps could be as high as 150 gpm while the flow from l

' the flash evaporator product cooler could be 91 gpm. It has been determined that the drainage features of th-1 PAB (i.e., numerous 4" floor drains and open stairwells) could handle such flow and prevent any damage to safety-related er.ipment.

In summary, CECNY has reviewed the Seismic Class II components / systems of the plant and has investigated the potential flooding effects that could be associated with their f ailure. We have concluded, therefore, that the performance of safety-related equipment in the PAB would not be adversely affected by flooding.

2.8 AUXILIARY F'ED E PUMP ROOM This building contains the following safety-related cauf pment: two notor-driven auxiliary feed pumps, a steam-driven auxilf fry feed pump, associated valves and electrical cabling, power and control cables for the atnospheric relief .alves, and one of the panels used for shutdown if the Control Room is uninhabitable. The licensee has indicated that the main feedwater line would result in flooding to the 18'6" level if it failed.

Since CECNY states that to assure there is a sufficient flow area to preclude flooding to the 19'8" level, they have modified the usars in the same manner as the transformer yard door, and since there is no safety-related equipment below the 19'8" level, we conclude that the Auxiliary Feed Pump Rcom t

is not susceptible to flooding.

O

3. CONCLUSIONS The Indian Point 2 nuclear power plant is designed so as to mitigate or prevent the potential damage caused by flooding of safety-related equipment required for the safety and/or safe shutdown of the facility. Modifications made to facilitate the rapid renoval of flooding water include the installation of: Level Alarm Switches in the Unit I condenser pit, a flag panel in the PAB door to the transformer yard, and a flap panel in the door of auxiliary feed pump room at an elevation of 19'8".

The licensee in his documentation has concluded that flooding of the condenser pit in from 7 to 9 minutes could threaten the 480 volt switchgear at an elevation of 15' in the Control Room Building. The licensee's proposed modification to install an alternate safe shutdown capability independent of the 480 volt switchgear early in 1981, coupled with existing adninistrative procedures for mitigating the consequences of this flooding is considered adequate.

It is concluded that with the modifications and administrative proceduras described above, the "NRC Guidelines for Protection from Flooding of Equipment Important to Safety" ( Appendix A) have been satisfied.

4 REFERENCES

1. Letter dated September 26, 1972, from R. C. DeYoung of the Nuclear Regulatory Comission (NRC) to William J. Cahill, Jr. of Consolidated Edison Company of New York (CECNY).

2. Letter dated October 31, 1972, fromWilliamJ.Cahik1,Jr.ofCECNYto Donald J. Skovholt of NRC.

3. Letter dated December 18, 1972, from William J. Cahill, Jr. of CECNY to R chard C. DeYoung of MRC.

4. Letter dated December 18, 1974, from George Lear of NRC to William J.

Cahill, Jr. of CECNY.

5. Letter dated January 20, 1975, from Carl L. Newman of CECNY to George Lear of NRC.

6. Letter dated February 18, 1975, from William J. Cahill, Jr. of CECNY to George Lear of NRC.

7. Appendix A of Indian Point Unit 2 Final Safety Analysis Report.

8. NRC Fire Protection Safety Evaluation Report, January 31, 1979.

9. Letter dated May 20, 1980, from Steven A. Varga of NRC to Peter Zarakas of CECNY.

10. Letter dated July 14, 1980, from Peter Zarakas of CECNY to Steven A. Varga of NRC.

APPENDIX A GUIDELINES FOR PROTECTION FROM FLOODING OF EOUIPMENT ,IMPORTANT TO SAFETY Licensees are required to investigate their facilites to review their designs to assure that equipment important to safety will not be damaged by flooding due to rupture of a non-Class I system component or pipe such that engineered safety features will not perform their design function. No single incident of a non-Class I system component or pipe failure shall prevent safe shutdown of the f acility.

Review of responses to the letters should assure that the plants meet the following guidelines:

1. Separation for redundancy - single failures of non-Class I system c:xnpenents or pipes shall not result in loss of a system important to safety. Redundant safety equipment shall be separated and protected to assure operobility in the event a non-Class I system or component fails.

2. Access doors and alarms - watertight barriers for protection from flooding of equipment important to safety shall have all access doors or hatches fitted with reliable switches arid circuits that provide an alarm in'the control room when the access is open.

l

[

3. Sealed water passages - passages or piping and other penetrations through I walls of a room containing equipment important to safety shall be sealed against water leakage from any postulated failure of non-Class I water l

sys tem. The seals shall be designed for the SSE, including seismically induced wave action of water inside the affected compartment during the SSE.

4 Class I watertight sturctures - walls, doors, panels, or other compartment I closures designed to protect equipment important to safety from damage due to flooding from a non-Class I system rupture shall be designed for the SSE, including seismically induced wave action of water inside the affected compartment during the SSE.

l l 1

5. Water level alarms and trips - rooms containing non-Class I system components and pipes whose rupture could result in flood damage to equipment important to safety shall have level alarms and pumo trips (where necessary) that alarm in the control room and limit flooding to within the design flood volume- Redundance of switches is required.

Critical pump (i.e. hign volume flow, such as condenser circulating water pumps) trip circuits should meet IEEE 279 criteria.

6. Class I equipment should be located or protected such that rupture of a non-Class I system connected to a tower containing water or body of water (river, lake, etc.) will not result in failure of the equicment from flooding.

7. The safety analysis shall consider simultaneous loss of offsite power with the rupture of a non-Class I system component or pipe.

The licensees' responses should include a listing of the non-Class I systeps considered in their analysis. These should include at least the following systems:

Firewater Demineralized Water Service Water Drains Condensate Heating Boiler Condensate Feedwater Ccndenser Circulating Water Reactor Building Cooling Water Makeup Tureine Building Cooling Water Potable Water If the licensee indentifies deficiencies, he should describe interim and final corrective action to be taken and provide a schedule for completion of any required modifications. All corrective action should be completed as expediticusly as is practicable.

- _