ML20004C386

Forwards marked-up Draft Input to SER Submitted as Request for Addl Info on Auxiliary Sys Design Conformance Per SRP, NUREG-75/087.Draft Concludes That Condensate & Feedwater Sys Failures Will Not Affect Safe Shutdown

ML20004C386
Person / Time
Site:	Comanche Peak
Issue date:	05/19/1981
From:	Youngblood B Office of Nuclear Reactor Regulation
To:	Gary R TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC)
References
RTR-NUREG-75-087, RTR-NUREG-75-87 NUDOCS 8106030374
Download: ML20004C386 (63)

Text

{{#Wiki_filter:* /f/~G j(p"% 3 fg . UNITED STATES t- >w g NUCLEAR REGULATORY COMMISSION j WASHINGTON, D. C. 20555 %, v*....f MAY:191981 D m Docket Nos.: 50-445 g g and 50-446 Q N g3 @ [ ~-- 6. B 9 Mr.. R. J. Gary Z ,,s $p - j Executive Vice President and M General Manager - Texas Utilities Generating Company. s D 2001 Bryan Tower p Dallas, Texas 75201 ]18

Subject:

_ Request for Additional Information for Comanche Peak Steam Electric Station, Units 1 a;d 2 The' Auxiliary Systems Branch, Division of Systems Integration has reviewed the Final Safety Analysis Report (FSAR) for Comanche Peak Steam Electric Station Units 1 and 2. ' Based on our review of this information, we have prepared a draft input to the Safety Evaluation Report. In this draft to the Safety Evaluation Report we have identified areas for which sufficient information has not been submitted to determine how the design of certain auxiliary systems conform to the guidance provided in the Standard Review Plan, NUREG-75/087. We are enclosing a copy of the draft to the Safety Evaluation Report (Enclosure 1) to assist you in understanding our require-ments for additional information. Please note that this draft is incomplete; i.e., Sections 3.6.1, 9.2.2, 10.4.9, and TMI. II.E.1.1 normally provided by the Auxiliary Systems Branch are not included. 'n order to expedite resolution of these matters we have not taken the time to examine alternative solutions to the positions stated in this document. After your staff has had an opportunity to review these items, we will be available to discuss how the designs satisfy the functional objectives of the systems in question. The areas where sufficient information has net been provided will remain open items until such time that these matters may be resolved by discussions between us, or until Texas Utilities Generating l i Company provides the necessary information. l Please expedite your review of this request for additional information in order that we may resolve these open items prior to the issuance of the Safety Evaluation Report. l l 8106 03 o 37#j

F - m ~ f%'..s(!jk; ~ Mr. R. J.' Gary. EA copy of the enclosure to this.letiter was given to Mr. Richard Werner of ~

your

staff on Wednesday, May. 13, 1981, during his visit to our offices.

Should you have questionsiconcerning this~ request for additional information

' or desire-to meet with us on'this matter, please contact us. Sincerely, /LLs\\ ? B.J./Yongbloo, Chief Licensi g Branch No. 1 '0ivision.of Licensing

Enclosures:

-Draft Input,.to the Safety Evaluation Report. /cc'w/enci.: See next page 1 I {

r &= ,s g-i [ os. n. v. ne s 'y Evacutive Vice Presiaaat and General Menager. Texss "tilitic: C:r.:--*' ; te=;2nv ZGGl. Bryan Tower

alias, Texas 75c..

fM:h:!::_ S. P.eyne'de. E!q. Mr.. Richard L. Fnure Debevoise & Liberman Citizens for Fair Utility Regulation .1200 Seventeenth Street 1668-B Carter Drive Washington, D. C. euud6 Arlington, Texas. 70010 Spencer'C. Relyea, Esc._ Resident Inspector /Lomanene Peak - .Worsham, Forsythe & Sampels' Nuclear Power Station - -2001 Bryan Tower . c/o U. S. Nuclear Re9ulatory Commiss;w.. Dallas, Texas 75?01' P. O. Box 38 Glen Rose, Texas 76043 Mr. Homer C. Sch..id. Manager - Nuclear Service. Texas Utilities 3es vices, I.ic. - 2001 Bryan Tower Dallas, Texas 7;;;. Mr. H. R. Rock Gibbs and Hill, Inc. 393' Seventh Avenue New York, New York 10001 Mr. A. T. Parker Westinghouse Electric Corporation P. O. Box 355 Pittsburgh, Pennsylvania 15230 David J. Preister Assistant Attorney General Environmental Protection Division P. O. Box 12548, Capitol Station -Austin, Texas 78711 Mrs. Juanita Ellis, President Citizens Association for Sound Energy 1426 Soud. Polk Dallas, Texas 75224 Geoffrey M. Gay, Esq. West Tex s Legal Services 100 Main Street (Lawyers Bldg.) Fort Worth, Texas 76102 4 1 --rr-v .,,,,,c-,-

. ~.. 3;p.- te ay 7, g :., jy ../ : , ( + s i ,t ,r 2:

• t.

t " + - 1 A Enclosure 4 -Draft' Input.to, the Safety Evaluation Report. 4 .for the E ~ ComancheTeak Steam Electric Stat' ion, Units 1 & 2 Prepared by the Auxiliary Systems' Branch A Request for Additional Information E ? n 'b l 4 1 b 3 b 3 4 t t ... ~, + k +- ,T e.+.,,E-.,-- r vs-c.+%-,wo,-r,,-c ~+%.,-,0m+i.--we w -w 4,r ec-v e, ,-*..,--wry.,.wre w we e-w m y'y-wr w wgt-ev

s.

A 3.4 Water Level (Flood) Design Our review included the applicant's design to protect safety-related systems, . structures and components from flood damage and to maintain the capability for a safe facility shutdown during a design basis flood. The calculated probable maximum flood level for the facility is elevation 789.7 feet. Although portions of the service water intake structure are below ,.he e,4e.6s %A tentro\\s; w this elevation, the safety-related service water pump motors;are above the maximum flood. There is essential equipment in the safeguards building below %was c y the maximum flood level,btrt the grade eleyation for the f.afeguards)[uilding g is at grade elevation-810.0 feet; no doors or entries to the safeguards building are located below the maximum flood level. Water stops are used in all construction joints below grade and safety-grade sump pumps are provided for the safeguards building. The lowest elevations of the auxiliary building and fuel building are above the maximum flood level. The only area of concern with regard to exterior flooding involves the safety chilled water system pumps mL and condensers located on elevation 778 feet of the electricalacontrol building. This elevation of the electrical and control building has direct access to the turbine buildings. It is not clear that the safety chilled water system could not be disabled by h!gh flood waters originating in the turbine building. One path for flood water into the turbine building could be through the circulating water system pipe tunnel which is open to the turbine building at elevation 758 feet 6 inches. The protection afforded essential structures, systems and components from the Ace. effects of precipitation is acceptable. There is no roof piping inside safety g related structures. Relief openings in roof parapets and downspouts are pro-l [ vided to limit water buildup on the roofs to eight inches for the probable l maximum precipitation condition. - l-

<=- 3 The protection afforded essential equipment from the effects of interior Nec f ilcukg)ources is discussed in sections 9.3.3 and 10.4.5 of this Safety Evaluation Report. The licensee should provide verification that the safety chilled water pumps and chillers are adequately protected against the effects of the probable maximum flood. As a result of our review, we conclude that the facility design, with the exception of the safety chilled water system, meets the requirements of Cri-terion 2 of the General Design Criteria with respect to protection of essential equipment from the effects of the probable maximum flood and pmbable maximum aa is,hretom, ace-edak precipitation. We will provide resolution of the flood protection for the safety A chilled water system in a ' supplement to this Safety Evaluation Report. 1. - - _.

p + 3.5.1.1 Internally Generated Missiles (Outside Containment) Protection aghinst postulated internally generated missiles outside containment associated with plant. operation, such as missiles generated by rotating or pressurized equipment is provided by any one or a combination of barriers, separation, restraint of potential missiles, strategic orientation, and equip-ment design. The primary means of providing protection to safety-related equip; ment is through the use of plant physical arrangament. The majority of safety-related systems are physically separated (within separate compartments) from nonsafety-related systems and the redundant components of safety-related systerr are physically separated such that a potential missile could not damage both trains of the safety-rtlated system. However, redundant trains of safety chilled water system pumps and chillers are located in the same com-partment and it is not clear that adequate missile protection has been provided componenh to these yantments. The safety chilled water system is required for plant shutdown in the event of a loss of offsite power or design basis accident.- As recommended by Regulatory Guide 1.13. " Spent Fuel Storage Facility Design Basis," the spent fuel is protected from internally generated missiles by the fuel pool walls and by designing the fuel handling system such that a seismic event will not result in missile generation. The fuel handling system is discussed furtiier in section 9.1.4 of this Safety Evaluation Report. The applicant should provide verification that adequate missile protection has been afforded the safety chilled water system where components in redundant 1 l l I I l

-s e trains are located in the same compartment. Thr.' applicant should verify that~ at least one train will be available to support shutdown of its associated reactor unit in the event of any internally generated missile outside contain-ment. We have reviewed the adequacy of the' applicant's design necessary to maintain the capability for a safe shutdown in the event of any internally generated missile outside containment. We have concluded that, except for the safety chilled water system, the design is in conformance with Criterion 4 of the General Design Criteria as it relates to structures housing essential systems and to the capability of the systems to withstand the effects of internally- .i generated missiles, and Regulatory Guide 1.13 as it relates to protection from internal missiles, and is, therefore, acceptable. We will report on the ade-quacy of the protection afforded the safety chilled water system from inter-nally generated missiles outside containment in a supplement to this Safety Evaluation Report. i I i

a:,- e m L 3.5.2 Structures. Systems, and Components to be Protected from Externally Generated Missiler; . General Design Criterion 4 requires that alll components essential to the safety of. the plant be protected frcm the effects of. externally generated missiles.. The appitcant has ' stated that all seismic Category I structures are designed : to withstand postulated tornado missiles without damage to safety-related . equipment. To show confonnance with General Design Criterion 4 the applicant has iden-tified all safety-related structures, systems and components that need to be 7 protected from externally generated missiles. With the exception of certain'

piping located outside the seismic Category I structures, essential systems and components are adequately protected from all postulated externally generated missiles. The licensee wil1~ verify that essential piping from the outdoor

-reactor water storage tank, condensate storage tank and reactor makeup water storage-tank are protected throughout their length by seismic Category I pipe tunnels which will prevent damage by externally-generated missiles. The evaluation of the adequacy of barriers or structures designed to withstand the effects of missiles can be found in section 3.5.3 of this Safety Evaluation Report. We have reviewed the applicant's list of safety-related structures, systems and components to be prote.ted from externally generated missiles and the adequacy of protection provided for these structures, systems and components. P n i ~ .-.. ~

r

-}

o-s ? We' conclude that the applicant has identified all safety-related structures, systems and components that' need protection frrr. externally ganerated missiles and has provided adequate protection in accordance.with General Design Cri-terion 4 except for certain essential piping located outside. We[therefore[ conclude that, except for the outside piping, that. they are acceptable. We will report on the adequacy of the protection afforded the essential piping runs from the safety-related tanks to seismic Category I buildings in a ' supplement to this Safety Evaluation Report. b b 4 h ~t 1 i t 6- .~,, -m...-, .-,.._,,---,,-,+.---.,,,,,_u- = --. =~~-r - - -. -,, = -, * - - - * -

AUXILIARY SYSTEMS BRANCH COMANCHE P2AK 182 SAFETY EVALUATION REPORT- -9.0 Auxiliary Systems We reviewe'd the design of the auxiliary systems, including their safety-related objectives, and the manner in which these objectives are achieved. We reviewed the auxiliary systens which are necessary for safe facility shutdown. - These. include the station service water system, component cooling water system. Ultimate heat sink, condensate storage facilities, portions of the chemical and. - volume control system._ safety-related ventilation systems, and safety chilled . water system. We reviewed the systems necessary to assure safe handling of fuel and adequate cooling of spent fuel which include the new and spent fuel storage' facilities, portions of the spent fuel pool cooling and cleanup system, portions of the fuel handling system, and the fuel building ventilation, system. We reviewed the equipment and floor drainage system and ventilation systems, whose failure would not prevent safe shutdown, but indirectly could be a poten-tial source of radiological release to the environment. 5 We also reviewed certain auxiliary systems whose failure would neither prevent safe shutdown nor result in potential radioactive releases but could affect l l safety-related systems. These irIclude the pressurizer relief discharge system, i demineralized and reactor makeup water system, potabla and sanitary water system, i surface water pre-treatment system, plant chilled water system and the non-safety-related ventilation systems. The acceptability of these systems was. _. _ ~ -...

c_ x- ~ 20 lbased on our' determining that: (a) where the system interfaces or. connects to ~ a seismic Category'I system or components.. seismic Category I isolation valves will be provided to physically separate.the non-essential portions from the - essential system or components, and (b) the failure of non-seismic systems or portions of;the systems will not preclude the operation of safety-related sys-tems or components located in close proximity. We find the above listed systems meet our criteria and, therefore, find them acceptable. I 4 i r t - l i

= ~ - 9 .?N. e ./ 9.1 Fuel' Storage and Handling 9.1.l' New Fuel Storage The new fuel storage pit, shared by both reactor units, provides dry storage - capability for:132 fuel assembifes, two-thirds of the fuel assemblies in a full. core load. -The fuel assemblies are stored in racks which are bolted to the. 3 floor of the pit.. The design of the rack precludes the insertion of fuel assem-- blies in other..than prescribed locations. The spacing maintained between fuel ' assemblies will limit the effective multiplication factor to 0.98 with fuel of the highest anticipated. enrichment, assuming optimum moderation (under dry or. r [ floode:I conditions). The racks are de::igned to seismic Category I requirements and will withstand an uplift force equal to the maximum force which can be exerted by.the fuel handling bridge crane. The fuel racks are also designed to withstand the impact of a. fuel assembly ' dropped from the maximum lift heigh 2 of the fuel handling bridge crane without causing an unsafe geometric spacing of the new fuel _ assemblies. The new fuel storage pit is located within the fuel building which is a controlled air-leakage building designed to seismic Category 4 I requirements.. The fuel building structure protects the new fuel storage facility from the effects of tornadoes and tornado-generated missiles. ) I We have reviewed the adequacy of the applicant's design for the new fuel storage i facility necessary to maintain a subcritical array during normal, abnomal and accident conditions. In general, the design provisions of the facility are i sufficient to the above stated objective. However, the applicant has not veri-i fied that the analysis used to detemine the maximum ef fective multiplication l factor of 0.98 considered the moderating effects of water fogging and spray. l j 1 i l ~ i 9._ i

' fe-eddttMhe-14censee-has-not-ver"f ed that-the-new feel storage-pit bas - p ovisions 4 e water drainage. We have concluded that, pending verification of the considerations noted above, the design of the facility is in confomance with Criteria 5 and 62 of the General Desigr, Criteria and the positions of s Regulatory Guide 1.13. " Fuel Storage Facility Design Basis," and is, therefore, acceptable. - _.

p , : o m Ci * '9.l' Fuel Storage and Handling

9. l ~.1 New Fuel Storage The new fuel storage pit, shared by both reactor units, provides dry storage capability for 132 'fual assemblies. two-thirds of. the. fuel assemblies in a full core load. The fuel assemblies are stored in racks which are bolted to the floor of the pit. The design of the rack precludes the insertion of fuel assem-blies in other than prescribed locations.. The spacing maintained between fuel assemblies will limit the effective multiplication factor to 0.98 with' fuel of-t the highest anticipated enrichment, assuming optimum moderation (under dry or flooded conditions). The racks are designed to seismic Category I requirements and will withstand an uplift force equal to the maximum force which can be exerted by the fuel handling bridge crane. The fuel racks are also designed to withstand the impact of a fuel assembly dropped from the maxicum lift height of the fuel handling bridge crane without causing an unsafe geometric spacing of the new fuel assemblies. The new fuel storage pit is located within the fuel building which is a controlled air-leakage building designed to seismic Category.

I requirements. The fuel building structt:- protects the new fuel storage L:.s.R:t I facility from the effects of tornadoes and tornado-generated missiless .y We have reviewed the adequacy of the applicant's design for the new fuel storage facility necessary to maintain a subcritical array during normal, abnomal and accident conditions. k-generah'The design provisions of the facility are sufficient to the above-stated objective. However, the applicant has not veri-fied th'at the analysis-used to detemine the maximum effective multiplication I factor of 0.98 considered the moderating effects of water fogging and spray. f _.. . I

.o .i .4 In' addition,:the licensee has not verified that the.new fuel storage pit has provisions for water drainage. We have concluded that, pending verification of the considerations noted above, the design of the facility is in confonnance with Criteria 5 and 62 of th'e General Design Criteria and the positions of-Regulatory Guide 1.13. " Fuel Storage Facility Design Basis," and is, the.efore, . acceptable. 7 e t i .f l i i i I L i ;

~. i.. h 9.1 Fuel Storage and Handling

1. 5 4

9.1.1 New Fuel Storage The new fuel storage facility includes the new fuel assembly storage racks and the concrete storage pit that contains the storage -- a ck s. The new fuel storage pit, shared by both reactor units, pmvides dry storage capability for 132 fuel assemblies, two-thirds of the fuel assemblies in a full core load. Thus, there is storage capacity for one-third of a core for each reactor and the requirements of General Design Criterion 5 " Sharing of Structures, Systems and Components" are satisfied. The new fuel storage pit is housed within the fuel building which is a seismic Category I structure. The new fuel storage racks are also designed to seismic Category I requirements. The fuel building protects the new fuel storage facility from the effects of tornadoes, tornado-generated missiles and flooding (refer to Sections 3.4.1 and 3.5.2 of this SER). Thus, the requirements of General Design Criterion 2 " Design Bases for Protection Against Natural Phenomena" and the guidance of Regulatory Guide 1.29 " Seismic Design Classification" are satisfied. The compliance ui the design relative to the requirements of General Design Criterion 4 " Environmental and Missile Design Bases" is discussed in Section 3.6.1 of this SER. The facility is designed to store unirradiated, low emission, fuel assemblies. Accidental damage to the fuel would release relatively minor amounts of radioactivity that would be accomodated by the fuel building ventilation system (refer to Section 9.4.2 of this SER). Thus, the requirements of General Design Criterion 61 " Fuel Storage and Handling and Radicactivity Control" are satisfied. 1,* ..r..-g Wehavereviewedtheadequacyoftheapplicant'sdesignforthen)whuel storage facility necessary to maintain a subcritical array during-nonna1, abnonnal and accident conditions. The fuel assemblies are stored in racks bolted to the floor of the pit such that a center-to-center spacing of 21-inches is maintained between assemblies. This spacing will limit the effective multiplication factor to 0.98 with the fuel of the highest anticipated enrichment, assuming optimum moderation (under dry or flooded conditions). However, the applicant has not verified that the moderating effects of foam ~ and water fogging and spray were considered in the analysis used to deter-mine the maximum effective multiplication factor of 0.98. The design of the yacks precludes the insertion of fuel assemblies in other t.han the pre-scribed locations. The racks are designed to withstand an uplift force equal to the maximum force which can be exerted by the fuel handling bridge 2 crane. The fuel racks are also designed to withstand the impact of a fuel-assembly dropped from the Maximum lift height of the fuel handling bridge crane without causing an unsafe geometric spacing of the new fuel assemblies. Thus, except for the uncertainty in the calculation for maximum effective multiplication factor, the requirements of General Design Criterion 62 " Pre-vention of Criticality in Fuel Storage and Handling" are satisfied. t Radiation monitoring equipment for the new fuel storage area is provided and is evaluated in Section 12 of this SER thus satisfying the requirer.ients of General Design Criterion 62 " Monitoring Fuel and Waste Storage." In order to satisfy the requirements of General Design Criterion 62, the i l applicant should verify that the calculation for the maximum effective multiplication factor of 0.98 included the moderating effects of foam and I n. .,-,e._, ,..--n.

f .o h . 3,c '3-f$',b.w. 44~ M water fogging.and spray or ver}fy that the ddh4gn of the new fuel storage facility will preclude these effects. Based on our review, we concluda that the new. fuel storage facility is in conformance with the requirements of General Design Criteria 2, 5, 51 and ~ 36,.; 3 d eu.~4t.1 syW, 63 as they relate to new fuel protection against natural phenomena.gradia-tion protection and radiation monitoring, and the guidelines of Regulatory Guide 1.29 relating to seismic design. The adequacy of the design relative to protection against missiles and pipe breaks as r2 quired by General Design Criterion 4 is discussed in_ Section 3.6.1. Upon receipt of verifi-cation regarding the effective multiplication factor, we will report on the adequacy of the design relative to the requirements of General Design Criterion 62 for prevention of criticality in a supplement to t'nis SER. 6 9 i

L

!L _1.. 7E uMM g.q 9.1.2 Spent Fuel StbMge Spent fuel will be stored underwater in the two spent fuel pools in the fuel building. The fuel assemblies will be placed in racks which are bolted into the floor of the pools. The spent. fuel storage racks and damaged fuel con-for tainers will provide a total on-site storage capacity pf 1166 fuel assemblies: 1116 assemblies in'the pools and 25 assembifes in each containment cavity. This capacity exceeds the required capacity of 1-2/3 cores (322 assemblies).- The racks maintain a spacing between fuel assemblies sufficient to limit the maximum effective multiplication factor to 0.95, even if unborated water is used to fill the spent fuel storage pool. Space between storage positions is blocked to prevent storage of a fuel assembly in other than prescribed loca-tions. The storage racks can withstand the impact of a dropped spent fuel assembly from the maximum lift height of the fuel handling bridge crane with-out unacceptable damage to the fuel or change in the geometric spacing between assemblies. The storage racks can also withstand an uplift force equal to the uplift force of the spent fuel pool bridge hoist. The spent fuel racks and the fuel building structure are designed to seismic Category I requirements. The r,reat fuel building structure protects the new fuel storage facility from the s effects of tornadoes and tornado-generated missiles. l We have reviewed the adequacy of the applicant's design for the spent fuel storage facility necessary to maintain a subcritical array during all operating conditions. Our evaluation of the fuel cask handling is provided in Section 9.1.4 of this Safety Evaluation Report. We conclude that the design for the spent fuel storage facilities is in conformance with the requirements of Criteria 5, 61 and 62 of the General Design Criteria and the positions of a r. y. ./kN r Y20$jq 'c.-gegulatory Guides 1.13 and 1.29, ircluding the positions on seismic design and missile protection, and.-therefore..is. acceptable. F 5 e t } h t ~l t 1 i i L f a . ~

9.1.3 Spent Fuel Pool Cooling and Cleanup System e,www The spent fuel pool cooling andpurification) system is designed to raintain the clarity and purity of the water'in the spent fuel pools, the transfer canal, the refueling water storage tank (p.WST) and the refueling cavities, and to. remove heat generated by M spent fuel elements stbred in the fuel poM s. 1he fue1 pool cooling system is designed to Quality Group C and seismic Cate- ~ gory I requirements. It consists of two redundant cooling loops, each c'apable of simultaneously servicing both of the spent fuel pools. Each cooling loop includes a pump, heat exchanger and associated piping, valving and instrumentation. The fuel pool cooling pumps are powered from the Class 1E electrical system. The fuel pool heat exchangers can be cooled by the Quality Group C, seismic Category I portion of the component cooling water system associated with either reactor unit. There are no drain lines that could lead to inadvertent draining of the spent fuel pools. Spent fuel pool cooling suction lines are located four feet below the normal pool water level. Although the cooling system return lines teminate about 20 feet below normal water level, antisiphon holes in the lines prevent siphoning more than 12 l bd inches below the nomal water. Thus, except for a failure of the gates between the spent fuel pools and the fuel transfer canal, the design of the i spent fuel pool fluid systems ensure that at least 10 feet of water will Sa. cover the t6p of active fuel. Failure of the gates between the fuel pools y and transfer canal would drop the spent fuel pool water level to within three j feet of the top of the active fuel. The gates are not listed as seismically designed equipment and could be presumed to fail in an earthquake. i i r t [.I b With both -spent fuel pool cooling trains operating, the pool water temperature can be maintained at 137 degrees Fahrenheit with the maximum design heat load. The maximum design heat load results from the decay heat from one full core at 150 hours af ter shutdown, one-third of a core at 150 hours after shutdown, one-third of a core at 480 hours after shutdown and the remainder of hoth spent fuel pools filled with fuel assemblies from twelve normal rafuelings involving one-third of a core each. The resulting maximum heat load temperature is below the maximum acceptable temperature of 140 degrees Fahrenheit. The spent fuel pool water temperature can also be kept at or below 135 degrees Fahrenheit with' ane loop _ out of service and a normal ~ design heat load, that is, the decay heat resulting from the same number of fuel assemblies listed above except for the full-core emergency unload. The spent fuel pool temperature can be maintained at or below an acceptable temperature of 169 degrees Fahrenheit for the maximum deaign heat load with one spent fuel pool cooling train out of service. The r.onnal makeup water supply to the spent fuel pools is from the nonnuclear-safety grade demineralized water system. A redundant makeup water source is provided by the seismic Category I reactor makeup water system. Water can also be supp1 fed to the spent fuel pools from the refueling water storage tanks through vartoes piping paths. 4 The spent fuel pool cooling system is located within the seismic Category I fuel building. The fuel building structure protects the spent fuel pool cooling system from the effects of tornadoes and tornado missiles. The redundant spent fuel pool cooling pumps are located in separate compartments away from the path of travel of the fuel building crane.

r Il e The spent fuel pool purification system is a nonseismic Category I_ system connected to, but manually isolatle from the spent fuel pool cooling system by-Quality Group C, seismic Category I valves. Manual isolation is acceptable because of the redundancy provided by the spent fuel pool cooling system and spent fuel pool makeup system. Two spent fuel pool purification loops are provided to remove fission products and other contaminants from the pool water by filtration and ion exchange. Operation of either loop provides sufficient purification capability for both spent fuel pools to pemit unrestricted access to the spent fuel storage area..The failure of either or both purification loeps does not have an adverse affect on any safety-related system. To provide assurance that at lost 10 feet of water will cover the active fuel stored in the spent fuel pools under all conditions, the applicant should verify that the gates between the spent fuel pools and the fuel transfer canal will remain watertight during a safe shutdown earthquake. Based on our review, we conc 7ude that, except for the spent fuel pool gates, the design of the spent fuel pool cooling and cleanup system is in confomance with Branch Technical position ASB 9-2 with respect to decay heat loads, the guidelines of Regulatory Guides 1.13 and 1.29 including the positions on availability of assured makeup sourcet, the seismic design and missile protec-tion, and the requirements of Criteria 5, 61 and 62 of the General Design Criteria. pending satisfactory resolution of the seismic design of the spent fuel pool gates we, therefore, find the fuel pool cooling and cleanup system acceptable.

[ J . 9.1.4 ' Fuel Handling System The fuel' handling systs.m, in conjunction with the fuel storage area, provides a means of transporting,' handling and storing of fuel. The fuel handling- ' system consists of equipment necestary for the safe handling of: the spent fuel-cask and for. safe disassembly, hand'ing, and reassembly of the reactor vessel head and internals during refueling operations. The system also includes additional equipment designed to facilitate the periodic refueling of the-reactor. The major components of the fuel' handling system are the refueling machine, fuel transfer system, fuel handling bridge crane, containment polar crane and fuel building crane. The refueling machine, a Fidge crane spanning the refueling cavity, is designed for the safe handling of fuel assemblies inside containment. The refueling machine main hoist is provided with two independent braking systems: an electrical brake on the motor shaft and a mechanically- . actuated brake internal to the hoist gearbox. Fuel assemblies are conveyed between the containment and fuel building by the fuel transfer system. -The fuel transfer car runs on rails between' the containment fuel storage area and 1 i the fuel transfer canal in the fuel building via the fuel transfer tube. The 4 fuel handling bridge crane is used to transfer single fuel assemblies within the spent fuel pools, refueling canal and cask pit. Lift-limiting devices on the refueling machine and fuel handling bridge crane, along with handling tool configuration, assure that spent fik.1 assemblies are not lifted above the safe sh.. ding depth provided by the water in the refueling cavity, refueling canal and spent fuel pools. Redundant interlocks are provided for 1. l.

a , the refueling machine, fuel transfer system and fuel handling bridge crane to prevent simultaneous motion of fuel assemblies in more than one direction or motion of the fuel essembifes when an unsafe equipment configuration exists. The containment polar crane, fuel building crane, refueling machine and fuel handling bridge crane are designed, tested and maintained--in accordance with applicable sections of Specification 70 of the Crane Manufacturers Association of America, Inc. The spent-fuel handling tool and fuel transfer system compo-nents are designed to seismic Category I requirements. The refueling machine, containment polar crane, fuel handling bridge crane and fuel building crane are designed to stay in place during the safe shutdown earthquake. Additional dis-cussion' of the polar crane and fuel building crane is provided below, bhg The fuel hadlk; bMdggerane has three hoisting systems on the trolley rated fo. 3 0 tons, 17 tons and 5 tons. The heaviest load to be handled by this crane is the spent fuel shipping cask. The range of travel of tMs crane includes the spent fuel cask loading area, new fuel storage pit, cask handling area, new fuel receiving area and the railroad loading and unloading area. Its range of travel does not include the spent fuel pools or the fuel building area housing the spent fuel pool cooling pumps and heat exchangers. The crane is i prevented by interlocks from moving over the new fuel pit during cask handling operations. The closest areas of travel during cask handling operations are more than 15 feet from the spent fuel pools and are separated by concrete walls from the pools. The concrete floors can withstand a fully loaded cask drop from the maximum lifting height of 29.25 feet. i f I ~, <

. The containment polar crane is rated for 175 tons for refueling or maintenance operations. The heaviest load expected to be lifted is the reactor vessel head assembly. Various accident cases (i.e. dropping a reactor vessel head assembly in the refueling cavity) were analyzed to determine the consequences. Thase analyses have been provided in WCAp-9198, dated January 1978. The staff has not completed its review of this report. Based on our review, we conclude that the fuel handling system can adequately perform its intended function. Further, based on the design of the fuel building crane, we conclude that handling of spent fuel and the consequences of a cask drop will not impair safe shutdown capability nor result in unaccept-able damage to the spent fuel stceage facility and is, therefore, acceptable. We will report on the adequacy of the containment polar crane design in a supplement to this Safety Evaluation Report after our review of WCAP-9198. We will require the applicant to upgrade the capabilities of this crane as neces-sary after our. review of the reactor vessel head drop analyses. h b l I l i i t = i e

n g ~ i 9.2.1 Station Service Water System, The station service water system supplies cooling water to the plant from the safe shutdown impoundment, which is the ultimate heat sink discussed in Section 9.2.3 o'i i.i.5s Safety Evaluation Report. The station service water system coolsLthe component cooling water heat exchangers, emergency diesel generators, lube oil coolers for the safet.y injection and centrifugal charging pumps'and bearing coolers for the containment spray pumps. All of the above I looling loads are required for plant shutdown and/or for mitigating the effects of.a loss-of-coolant accident; no other cooling loads are serviced by this system. The station service water system can also be used as a backup water supply for the auxiliary feedwater system tod the fine protection booster h I pumps. t The station service water system consists of two separate and independent full I capacitytrainsforeachreactorunit; cross-connechareprovidedbetween trains for flexibility. Each train has one full-capacity pump which can be i supplied from a separate emergency diesel-bus. One train is in operation at all times during nomal operation to supply cooling for one train of the 4 1 essential heat loads listed above. If the operating station service water pump trips, the other pump automatically starts and is operative within 60 seconds to cool the redundant train of essential equipment. During normal i cesecubMea gw M.tre3.n.emah we dh L.A.ne.be.adu.o.hvt Mngkb. unit cooldown and the post-LOCA[ injection phase, only one station service ~Qt-{o] l water system train is used. h The station service water system is designed to Quality Group C and seismic l t Category I requirements. Connections to other nonessential systems are l isolated by Quality Group C, seismic Category I valves that are nomally shut. l l The valves to the fire protection system are locked closed. Components of the : ~ - -..

.o . a system are located in seismic Categcry I structurg which provide protection against tornadoes and tornado-generated missiles. Station service water system piping between the pumphour,e and.the auxiliary building and between the auxiliary building and the safe shutdown impoundment is buried to protect the piping from tornado missiles. Pump motors, valve operators and controls in the pumphouse are located above the postulated level of the probable maximum flood. 'The station service water system operates 'during normal operation; therefore it does not require additior.al periodic tests and inspection of the system de safety functions. Howevar, the components in operation are interchanged 0$Ig]p d s,e periodically to enable testing and inspection. Recirculation loops are r provided around the pumps for testing of these components. Valves, controls and instrumention are also tested periodically. The performance of the heat exchangers in monitored periodically to detect excessive scale formation. t Based on our review, we conclude that the station service water system is in conformance with the requirements of Criterion 44 of the General Design Criteria regarding the ability to transfer heat from safety-related components to the ultimate heat sink and regarding the single-failure criterion. It I is also in confornance with requirements of Criteria 45 and 46 of the General Design Criteria regarding the system design for periodic test and inspections, incluaing functional testing and confirmation of heat transfer capabilities. We, therefore, conclude that the system is acceptable. l h -y

e a 9.2.3 Ultimate Hea_t Sink The ultimate heat sinh provides cooling water to the service water systems of both reactor units for nonnal cooldown and for post-accident shutdown and serves as a backup water source for the auxiliary feedwater systems via the service water systems. The ultimate heat sink (safe shutdown impoundment) is an enclosed body of water fomed from a cove of the Squow Creek Reservoir and retained by a seismic Category I dam. The service water pumps take suction from the safe shutdown impoundment at the service water intake struc-ture. After serving its plant cooling function, wanner service water is returned to the impoundment. The service water intake structure and service water discharge outfall are separated by over 1800 feet to promote thennal mixing. The service water system is discussed further in section 9.2.1 of this Safety Evaluation Report. The safe shutdown impoundment and dam can withstand the effects of the safe shutdown earthquake, tornadoes, tornado-generated missiles and the finod conditions of the probable maximum flood. Makeup to the safe shutdown im-poundment is provided by an cqualization channel between the impoundment and the Squaw Creek Reservoir which maintains the impoundment water level at elevation 775 feet during nonnal operations. The impoundment water level would fall to the elevation of the bottom of the equalization chanel, i.e., 769 feet 6 inches, in the event of a failure of the pionsafety-related Squaw Creek Reservoir dam. The safe shutdown impoundment is sized to perform its design function after 40 years of sedimentation. t i l The applicant has shown by analysis that the ritimate' beat sink has the -

n-capability to provide adequate water inventory and-provide sufficient-heat dissipation to keep service water system operating temperatures within acceptable limits. The analysis considered the~ heat rejected.as a result of simultaneous shutdown and cooie.own of both reactor units as well as post- ~ design-basis-accident cooldown of one unit concurrent with shutdown and cooldown of the other unit. The ultimate heat sink is designed to accomo-date the latter set of conditions which are more severe. The analysis con-sidered no makeup of water to the impoundment for 39 days following a design basis accident in one unit. The most severe meteorological conditions for a thirty-year period were used in the analysis such that ti;2 maximum impound-ment temperature calculated at eight days after the accident includes maximum heatup from plant cooling loads superimposed on the maximum tempera-ture due to meteorological conditions. The decay h' eat rates used the analysis are based on the ANS 5.1 fission product curve for a reactor operat-ing time of 16,000 hours for both reactor units. A check uf decay heat rates used for selected times in the transient indicate that the values used are consistent with the acceptable curves of total fission producfr decay heat and heavy element decay heat in Branch Technical Position ASB 9-2, " Residual Decay Energy for Lighi. Water Reectors for Long Tenn Cooli..g". Based on our review, we conclude that the design of the ultimate heat sink meets the positions of Branch Technical Positoln 9-2, the requirements of Criterion 5 of the General Design Criteria and the guidelines of Regulatory f Guide 1.27 and, therefore,'is acceptable. i i t s ;

_ 9.2.4 Condensate Storage Facility ~ The. condensate. storage facility consists of one 500,000-gallon-storage tank-per reactor unit located outdoors next to the diesel generator building for its respective reactor unit. The condensate storage tanks are reinforced concrete, stainless steel-lined tanks designed to seismic Category I and Quality Group C-requirements. The tanks are also designed to withstand tornadoes'and missile impact. Each tank-provides'a reserve capacity of 276 000 gallons which constitutes the primary supply to the auxiliary 3 feedwater system. 1.c.W5 The aux"liary feedwater system reserve supply is maintained byj=ing all non-safety-grade connections to the tank above the 276,000 - gallon level. All conne,tions below this level are Quality Group C and seismic' Category I including the auxiliary feedwater supply line. Inadvertent drainage of the Ar... tank is prevented by locked-closed double valves. 'In addition, automatically-s operated valves isolate all other uses of the consensate storage tank when auxiliary feedwater operation is required. Redundant level indicators are provided in the control room for the condensate storage tanks. Indication is also provided locally at the tanks. Level alarms are provided at high-high, low and low-low tank levels. Makeup can be prqvided to the condensate storage tank from the demineralized and reactor makeup water storage system. i Based on our review, we conclude that the consensate storage facility is designed to meet its_ intended safety function and is, therefore, acceptable. 1 - . - -... ]

-J 3 - -9.3 frocess Auxiliaries 9.3.1 Comoressed Air System The compressed air system consists of the instrument air system and the service air system. The instrument air system is supplied by one nonlubricated, , F., euk ce.a.. ca. A tu Am..\\ ico-rumt se..% c..we55e9 - e single-stage, water-cooled reciprocating air compressor;is available on standby to provide ir.strument air for either reactor unit. The compressors associated with a react-anit are cooled by the non-essential component cooling water loop-of that unit. The standby compressor 'is cooled by the nonsafety-grade turbine plant cooling water system. The instrument air system also includes three aftercoolers and one accumulator, air dryer and filter set per' unit. The serkce air cystem, shared by both reactor units, is supplied by two air e.geew.c s cec. crc,. The service air system can serve as a backup to the instrument air system. The instrument air syste, although serving air operated safety-related actuation e devices and controls, is not required for the saft shutdown of the plant. Valves are designed to move to a fail-safe position on loss of air. In addition, the auxiliary feedwater flow control valves, steam supply valves to the turbine-driven auxiliary feedwater pump and the control room air dampers are provided y .with air accumulators. The air accumulators, the associated air piping between fv f the first check valve and the pneumatic control valve, and the associated valves are Quality Grcup C and designed to seismic Category I requirements. All other system piping is nonsafety-grade except for the containment penetration piping and isolation valves which are Quality Group B and seismic Category I. To improve instrument air system availability, the compressor associated with a reactor unit can be manually loaded onto an emergency bus. However, the compressor 4 is tripped from the emergency bus in the event of a safety injection signal. _

~3 w -- __ s a The. design of the compressed air system is'in'accordance with Regulatory Guides 1.26 and 1.29 with regard to Quality Group and seismic Category ~ classification of the~ safety-related portions of the system and provides a. continued supply of air to safety-reldted components as necessary during ~ anticipated plant operating conditions. We, therefore, concluda. that the system.is. acceptable. F t d, l

w -9.3.3 Equipment and Floor Drainage System. The equipment and floor drainage system 'accomodates drains from potentially radioactive sources and from non-radioactive. sources. The radioactive sumps 'and drains systemscollect potentially radioactive liquid waste from equipment 'and floor drainage, including wasteresulting from piping or tank ruptures, in the containment buildings, safeguards-buildings, auxiliary building, fuel-building and electrical and control building. These potentially radioactive wastes are, except as noted below, discharged to the floor drain tanks, waste holdup tanks or laundry and hot shower tanks of the liquid waste processing -system. The liquid waste processing system is discussed in Section 11 of th'is-Safety Evaluation F:eport. Drains from non-radioactive sources, such as the turbine building and diesel generator rooms, are normally aligned for discharge to the evaporation ponds. However, the' turbine building sump is provided with a radiation monitor which would indicate and alarm a leak of radioactive material into this sump in the event of equipment' failure or accident conditions. Dis-charge from the turbine but1 ding sump to the evaporation ponds can-be manually terminated from the contral room if turbine building sump discharge radioactivity becomes excessive. 3 There are two areas of concern with regard to the control of potentially radio-active liquid. Drainage from the letdown, letdown chiller, seal water contain- ~ P ment spray and residual heat removal (RHR) heat exchangers and from the contain-i ment spray and RHR pumps can be diverted directly, or from the component cooling water drain tank room sump number 3, into the discharge piping from the component cooling water system to the evaporation pond. It has not been verified that there are provisions to prevent a discharge of radioactivity to the evaporation pond via this flow path. In addition, drainage collected in the auxiliary building i t,

i - - floor drain sumps' number 11 can be puroped directly to the evaporation pond -via the turbine building drainage discharge path. -It has not-been verified that radioactive contamination in floor drain sumps. number 11 would be ' detected before discharge-into the evaporation pond. In general,- the floor drainage systems serving essential equipment is segre- . gated'into independent header and sump systems so that flooding' of one train .of essential ~ equipment will. not backflow into the compartments containing the B v redundant train'. fackflow jfalves are also provided for floor drains. The asategouas W **, compartments housing engineeredisafeguards building are designed to contain h ~ a11eadage rate of 50 gpm for. 30 minutes without causing-flooding of adjacent areas, assuming all floor drains from this area are clogged. Redundant full-capacity sump. pumps are provided to transfer drainage from building sumps. to the drainage tanks. Sump pumps start automatica11; on high sump level. Instrumentation and alams are provided for high sump. level and sump pump oper-ationalistatus in the safeguards building, auxiliary building and diesel gen-eiator area floor drain systems. The safeguards building sump pumps and their discharge piping are fesigned to Quality Group C and seismic Category I -requirements. Containment building drain system piping and isolation valves at the containment penetrations are designed to Quality Group B and/y-eismic Category I requirerents. The remainder of the system piping and backflow valves l are not designed to seismic Category I criteria. This presents a concern in those areas where floor drains for redundant essential equipment rooms are i connected to the'same drain header. This is the case for the floor drains for f all three auxiliary feedwater pump rooms and for redundant centrigugal charging pump rooms. (This condition may also exist for redundant component cooling water pump rooms; system drawings do not show floor drains for all of these rooms). 1 '

m. t ; 'It has not been verified that failure of a non-seismic ' drain piping system. e due 'to a safe shutdown earthquak# will not cause flooding of redundant essential equipment rooms where such rooms share the.same drain header.. k.ikewise,the drain piping design basis, i.e. a 50 gpm leak for 30 minutes,has not been;justi-fied. 4 The-applicant should provide the following information to demonstrate the -adequacy of the eq0ipment and floor drainage system: 1. Verification that the discharge of drainage from the areas served by component cooling water drain tank room sump number 3 and auxiliary building floor drain sumps number 11 will not result in the dis:harge. sa of excessive rp.ioactive contamination to the evaporation pond. 2.. -Verification that a pipe break in any compartment plus a failure of the. non-seismic drain systen will not cause flooding of compartments containing redundant trains of essential equipment. 3. Justification for use of the floor drain piping design basis of a 50 gpm leak for 30 minutes or verification that a larger leak will not cause flooding of redundant essential equipment. Q g listed abye cou b b tbi tk egut.pmed % A b or Areno.ge sgstem is 3 we adepde % pd.e.d sddy-reckel area.s ul c.omponenh Crorn bebo ed to gre. vent A b.14eAca. ce.\\eue. 0 r$Ae dwe hgeh h tke. ewWome.d oA is, Leefore, ac.c.49.ble.. 4 -

9.3.4l Chemical and Volume Contro1 System The chemical and volume control system is designed to control and maintain reactor coolant inventory and to control ;the boron concentration in.the reactor. coolant ~ through the process of makeup and letdown. The system purifies the primary coolant by demineralization. An essentia11 portion of.the system consists of'two centrifugal charging pumps ~ per reactor unit. These pumps are _ used for. high pressure _ safety _ injection when the emergency core cooling system is required to function. This' function is evaluated in Section 6 of this Safety Evaluation Report. The positive displace-ment. charging pump providrd for each reactor unit provides charging flow during normal operations although either one of the centrifugal charging pumps can also be used. i BoricL acid at approximately four percent by weight is used for chemical reactiv,ty control. The reactor makeup control system supplies a preset mixture of reactor makeup water and boric acid solution to the volume control tank or directly to the charging pump suction header to maintain the reactor coolant boron concen- . trat. ion and volume control tank inventory. Boric acid solution and reactor ' makeup water can be blended in varying proporth 5 or used separately to change the reactor coo' ant boron concentration. l A separate chemical and volume control system is provided for each reactor unit. The boric acid batching tank and two boric acid tanks are shared > Units ' and 2. The boric acid solution is made up in the batching tank and is transferred l 1 , l

to the boric acid tanks as needed.- Sufficient boric acid solution is stored in the boric acid tanks to accommodate a refueling in one unit and a cold shut- .down in the other unit with 'the most reactive control rod not inserted. As a backup, borated water from the refueling water storage tank can be used for reactivity control. All portions of the chemical and volume control syste that contain concentrated boric acid '(four weight percent) are either located in ' heated. rooms or are _ heat traced to maintain the solution temperature high enough to prevent precipitation of boron. Redundant temperature alarms are provided to assure room temperature does not go below 65k deres WA*u - Control of the coolant inventory and maintenance of proper water chemistry is achieved by a continuous feed and bleed process during which the feed rate wul b be, automatically modulated by the pressurizer level. The letdown flow from the reactor coolant system is reduced in pressure, cooled in heat exchangers and processed through one of two mixed-bed demineralizers. If the inlet fluid temperature exceeds 140 degrees Fahrenheit, the flow bypasses the demineralizers to protect the resin bed. From the deaiaeralizers, the flow is routed to the volume control tank where hydrogen is added to inhibit fonnation of oxygen in the coolant. Alternatively, flow from the demineralizers can be directed to the boron thennal regeneration system before being routed to the volume control tank. From the volume control tank, the 1e:down flow is charged back into the l eactor coolant system by the charging pumps. If the coolant inventory needs [ to be reduced, part or all of the letdown flow can be routed to the boron recycle system. i l l i i i I

e Other chemicals that are added to the primary coolant via the chemical and ' volume control system _ are hydrazine to scave;nge oxygen during startup,and lithium hydroxide for pH control. The boron thermal regeneration subsystem is designed to control the changes in reactor coolant boron concentration to compensate for xenon transients during load following operations,without adding makeup for either boration or dilution. Storage and release of boron is controlled by the temperature of the fluid entering the thermal regeneration demineralizers. The-chemical and volume control ' system also supplies seal water injection flow for reactor coolant pump seal cooling and collects the controlled leakoff from - the reactor coolant pump seals. In addition, it provides a means of filling. draining, and pressure testing of the reactor coolant system. The portions of the system required for safe shutdown of the reactor are decigned to meet' seismic Category I requirements, the single failure criteria and are Powered from essential buses. Based on our raview of the chemical and volume control system and the require- [ ments for system perfonnance of necessary functions during normal, abnormal, and accident conditions, we conclude that the design of the chemical and volume i control system and supporting systems is in conformance with the NRC's regull-j i j tions as set forth in Criteria 2, 4. 5 and 33 of the General Design Criteria and meets the guidelines of Regulatory Guide 1.26, " Quality Group Classifications t ] 1 i

g ' h..- e ~and Standards for Water, Steam, and Radioactive-Waste-Containing Components of Nuclear Power Plants," and Regulatory Guide 1.29 " Seismic' Design Classification," and, therefore,-is acceptable. A 6 t-4 5 j f i l l l-37 - 1 l ? .=

9..; y 9.4. Heating,' Ventilation and Air Conditioning 9.4.1 Control Room Area Ventilation System - The control room area ventilation system serves the combined Unit 1/ Unit % control room as_ well as.the adjacent supervisor's office, kitchen,and ancillary spaces. System components and duct work are designed to Quality Group C and seismic Category I requirements. The system is equipped with four 50-percent- - carecity air' dondi tioning' units. Each 7 air of air conditioning units is I powered from an independent Class lE bus and is physically separated from the redundant pair by a fire wall. The system is also equipped with redundant full-capacity makeup air supply fans, exhaust fans, emergency-pressurization air _ supply filtraticn units and fans, and emergency filtration units and fans. Redundant fans and 'iltration units are powered from independent Class lE bus,es. These provisions assure adequate air handling capability in the event of a single failure of a system component. All of the air handling equipment is i . located within a seismic Category I structure which is designed to withstand tornedo loads and tornado-generated missiles. The two air-intake 1cuvers are designed to prevent passage of tornado missiles into the air handling equip-ment rooms. I The control room area ventilation system is designed to maintain the area within the environmental limits required for operation of plant controls and i l uninterrupted safe occupancy of required manned areas during all operational I modes including the design basis accident conditions. The system is designed to maintain the control room under positive pressure. l l l l l 1 - i

e a i i .. Redundant radioactivity, ch'lorine and smoke detectors are provided in the air intakes to the control room area. In addition, area radioactivity and smoke- ' detectors are provided in the control room and chlorine monitors are located in the vicinity of the circulating and service water chlorine containers. The ' operators can manually switch from the normal ventilation mode to the emeroency recirculation mode upon receipt of alams from any of the above detectors. The control room area ventilation 'systam automatically switches L to emergency recir-culation upon failure cf instrument' air or offsite power, or upon receipt of a control room high radiation s4nal, a stack high radiation signal, a safety-injection signal, a high-level-of-chlorine-gas-escape signal or a smoke detec-tion signal. In the emergency recirculation mode all exhaust fans stop, exhaust dampers close, the outside air intake damper nearest the accident unit closes, and the air flow is recirculated through the emergency filtration units. If no chlorine gas is detected, the operators will replenish control room air by ~ initiating emergency makeup to supply filtered outside air. We have reviewed the design of the control room area ventilation system and conclude that it meets the requirements set forth in Criterion 19 of the General Design Criteria with regard to the capability to operate the plant from the control room during nomal and accident conditions, that it meets the single failure criterion and, therefore, is acceptable. -.

=.. 9.4.2 Fuel Handling Building ' Ventilation Systein ' The function of the fuel.handlir.s building ventilation system is to maintain a suitable environment for personnel and equipment during nonnal plant operations and schedulk shutdowns, and to. limit potential radioactive release to the atmos-phere during ' normal operation and postulated fuel handling accident conditions. A slight negative pressure is maintained in the-fuel handling building to prevent the outflow of unfiltered, contaminated air to the environment. "During nonnal operation, air is supplied to the fuel handling building by the supply-units of the nonsafety-related primary plant ventilation system. Exhaust ducts in the spent fuel pool area and other fuel handling building spaces return. the air. to the exhaust filtration units of the primary plant ventilation system. . Prior to refueling operations, the fuel handling building exhaust is d'*ected to the two fifty-percent-capacity engineered safety features (ESF) exhaust filtration units. In the event of a fuel handling accident, air supply to the building is tennia(ited by closing supply dar@ers; in this event one ESF exhaust filtration unit is adequate to maintain a negative pressure in the fuel building. Heat is dissipated from the spent fuel pool cooling pump rooms during loss of offsite power or following a fuel handling accident by using emergency fan coil units which are discussed further in section 9.4.4 of this Safety Evaluation Report. The supply ducts and primary plant ventilation supply system components are all classified as nonnuclear-safety grade. The supply ducts are designed to remain i in place and thus not pose a hazard to safety-related equipment in the event of f..

-? e y

a safe shutdown. earthquake.: The fuel handling' exhaust ducts'are designed to Quality Group C and seismic Category I criteria up to the exhaust. fan discharges'.

.The_ primary plant. exhaust filtration-units and ESF exhaust filtration units ~are 4 designed to-Quality Group C and seismic Category I requirements. In general, a single failure'in the fuel handling building ventilation system ~ will;not preclude performance of its-safety-function.- However, if either.the nonnuclear-safety ' grade supply damper fails open or the single exhaust dampern fails; shut, the system will not be able to maintain a negative pressure'in ,the building. ( ~ Redundant radiation monitors are provided in the exhaust ducts downstream of the primary plant and ESF exhaust filtration units to alarm an excessive release of radioactivity. The location of these monitors downstream of the filtration units and exhaust dampers does not provide the capability to isolate the system 4 before radioactivity is released to the environment. The applicant.should make the follcwing modifications to the fuel handling building -ventilation syste.?,: 1. Redundant exhaust flow paths should be provided through the wall separating the fuel building and the auxiliary building. A seismic Catoonry I damper should be provided in each duct at the dividing wall. The dampers should be designed to fail open on loss of offsite power or instrument air. 2. Redundant seismic Category I dampers should be provided in the fuel building supply duct, one on each side of tne wall separating the fuel building from the auxiliary building. These dampers should be designed to fail shut 4 41 -

9' e fh of offsite power or instrument air and to shut automatically in tkibNi

on lose

.~avent of a release of radioactivity in the fuel building.'. The. supply duct- ~ between the dampers'should also be designed to Quality Group C and seismic Category-I criteria. F 3. The exhaust stack radiation monitors should be relocated. and the primary plant exhaust system modified as necessary to provide automatic isolation of the nonnal exhaust flow path before the first contaminated airborne particles and gases reach the exhaust, plenum in the event of a release of radioactivity in the fuel handling,. auxiliary or safeguards building. The radiation monitors and associated ducting and controls should be designed - to Quality Group C and seismic Category I criteria. Based on our review of the design of the fuel handling building ventilation system, we conclude that, after incorporation of the above-listed modificaticns, i it meets the single, failure criterion and the guidelines of Regulatory Guide 1.29 and, therefore, is acceptable. r i i f

is ?:y, M;{%M4 9.4.3' Auxiliary Building'and Radwaste Area Ventilation System The function of the auxiliary building (controlled access area) and radwaste areIventilation system'is to maintain suitable and safe ambient ~ conditions for operating equipment and personnel during nonnal plant operation and to maintain ~ a slightly negative pressure with respect to the environment during all modes of operation. During nonnal operation, air supply and exhaust is provided by the primary plant ventilation system. After a loss of offsite power or follow-ing a design basis accident, a slightly negative pressure is. maintained in the building by securing the nonsafety-related supply system and exhausting the air via the engineered. safeguards features (ESF) exhaust filtration units. Emergency fan coil units are provided to cool the component cooling water pump rooms and charging pump rooms under accident conditions. The emergency fan coil. units are discussed further in section 9.4.4 of this Safety Evaluation report. The supply ducts and primary plant ventilation supply system components are all classified as nonnuclear-safety grade. However, the supply ducts are designed to remain in place during a safe shutdown earthauake and thus not pose a hazard ^ to safety-related equipment. The auxiliary building and radwaste area exhaust system is of seismic Category I and Quality Group C design up to the exhaust filtration units fan discharge. The primary plant exhaust filtration units and ESF exhaust filtration units are designed to Quality Group C and seismic Category t ( I criteria. The auxiliary building and radwaste area ventilation system, in-cluding the primary plant ventilation system and ESF exhaust filtration uints, is located within the auxiliary building which is a seismic Category I structure. The inlet lokvers and associated ducting are designed to seismic Category I requirements and are designed to withstand tornado loads and tornado-generated missiles. [ I

i. '

b ^ V i,.Ni,

p

.y The ' redundant ESF-exh,aust filtrationknits'are powered from separate Class IE emergency buses.

In general, a single failure in the auxiliary building and radwaste area ~ ventilation system will not preclude performance of its safety function.. However, it has not been verified that the safety-grade portions of the. ventilation system will-.be able _to maintain a -negative pressure in the auxiliary building if supply-air flow is not. isolated from the nonsafety-related' ., u.s.4.NN e.-e-ventilation supply system,. In addition, failure of auxiliary building exhaust damper CRX-VADPOC-77 in the closed _ position could prevent flow to the exhaust ~ filtrationLunits and subsequent loss' of_ the negative pressure in the building. - Also. failure of damper CPX-VADPOC-83 in the closed position would block flow-to the suction of the ESF exhaust filtration units with similar consequences. The applicant should make the following modifications to the auxiliary building and radwaste area ventilation system: 1. Dampers should be provided in the air intake louvers in the auxiliary build-ing and they should be designed to fail shut on loss of offsite power or instrument air and to shut automatically in the event of a release of radio-activity en the areas served by the primary plant ventilation system. The dampers and upstream ducting should be designed +o Quality Group C and i seismic Category I criteria. Alternatively, the applicant should verify i that a single ESF exhaust filtration unit is adequate to maintain a negative 4 pressure in any area served by these units even if tSe ventilation supply to these areas is not blocked. 2. To ensure exhaust flow capability to the ESF exhaust filtration units, redundant exhaust ducts should be provided from the auxiliary building to i a header upstream of the primary plant exhaust air intake plenum. Each exhaust duct should be provided with a damper designed to Quality Group C -

zo - . ~.. Y d5Y andsetE(NY.? t. itdC$tegory I criteria and designed to. fail-open on loss of off-19 site F4wer or. instrument air. A branch-duct should be provided from the header upstream of the dampers directly to the suction of-the ESF exhaust filtration units such that a flow path is available to these units'even in the event of a single active failure in the exhaust system. Based on our review of the design ~ of the auxiliary building and radwaste' area -ventilation: system, we. conclude that, after incorporation of the above-listed - modifications, it meets the single failure criterion and the guidelines of Regulatory Guide 1.29 and, therefore, is acceptable. o 4 f l 4.-

a 'q-Y 4 9.4.4 ' Safeguards Building Ventilation System i i The safety-related portions of the safeguards building ventilation system in-clude _ parts of the engineered safety features ventilation system and the electrical areas fan cooling units. The function of the engineered safety features ventilation system is to provide suitable ambient conditions for per-sonnel and equipment and to maintain the mechanical equipment areas of the safe-guards building at a negative pressure with respect to the environment. The -electrical areas ventilation system safety function is to cool the safeguards electrical areas in the event of a loss of offsite power or a loss-of-coolant-accident. The normal ventilation for the mechanical equipment areas is provided by the primary plant ventilation system; during a loss of offsite pcwer or loss - of coolant accident a negative pesssure is maintained by the engineered safeguards features (ESF) exhaust filtration units. The primary plant ventilation system an'd ESF exhaust filtration units are discussed in section 9.4.2 and 9.4.3 of this Safety Evaluation Report. Cooling for both the mechanical and electrical equipment areas is provided by fan coil units in the event of a loss of offsite power or loss of coolant accident. The exhaust ducts for the mechanical equipment areas are designed to Quality Group C and seismic Category I criteria as are the ducts associated with the fan coil units in the electrical area:. All other ducting and ventilation equipment in these areas are designed to rernain in place during a safe shutdown earthquake and thus will not pose a hazard to safety-related equipment. The emergency fan coil units in the safeguard building are designed to Quality Group C and seismic Category I criteria as are the fan coil units discussed in sections 9.4.2 and 9.4.3 of this Safety Evaluation Report for the fuel building and auxiliary building, respectively. Each emergency fan coil unit that must operate in the event of a loss of offsite power or loss of coolant accident is powered from the same Class 1 -

1 .e p IE emergency bus as the equipment it serves.. Each emergency fan coil unit is designed to start simultaneously with the eq0ipment it serves. Cooling for the emergency fan coil units is provided by the safetyvelated chilled water system discussed in section 9.4.5 of.this Safety Evaluation Report. In general, a single failure of the safeguards building ventilation system will not preclude performance of its safety function. A single failure of any emergency-fan coil unit, its power supply or its cooling water supply will not preclude performance of the essential functions needed for safe shutdown or accident mitigation in'the event of a loss of offsite' power or loss of coolant accident. Separate and redundant emergency fan coil units are provided for redundant divisions of essential equipment. However, it has net been verified that the safety-grade portions of the ventilation system will be able to maintain a negative pressure in the controlled access areas of the safe building if supply air flow is not isolated. In addition, the exhaust system drawingsdo not indicate an available flew pith to the suction of the ESF exhaust filtration units; the only exhaust flow path shown is to the primary plant exhaust air intake plenum. The applicant should make the following modifications to the safeguards building ventilation system: 1. Redundant Quality Group C, seismic Category I dampers should be provided in the safeguards building supply duct, one on each side of the wall separating i the safeguards building from the auxiliary building. These dampers should be designed to fail shut on loss of offsite power or instrument air and should shut automatically in the event of a release of radioactivity in the safeguards building. The supply duct between these two dampers should be designed to Quality Group C and seismic Category I criteria. Alternatively, the applicant l ' l

}e .I should verify ~ that a single ESF exhaust filtration unit is adequate to paintain a negativ'e pressure in any ' area se cved by these units, even if the ventilation supply to these areas is not blocked.-

2.. To ensure exhaust flow capability to the ESF exhaust filtration-units,- the safoguards building exhaust header should be-relocated:to feed directly to.

~ the suction of these units. -The safeguards building exhaust flow to the primary plant exhaust air. intake plenum.should pass through isolation damper CPX-VADPOC-83. Based on our. review of, the' design of the safeguard building ventilation system, zwe conclude that, after incorporation of the above-listed modifications, it . meets the single failure criterion and the guidelines of Regulatory Guide 1.29 and, therefore, is acceptable. t 1 - 48

+ i 9.4.5 Miscellaneous Building Ventilation and Cooling Systems The safety-related portions of the miscellaneous building ventilation and. Cooli[1g systems. consist of the service water intake structure ventilation system, the ' diesel generator buildint ventilation syst( the battery room exhaust system, 3 the plant' ventilation' discharge vent and the safety chilled water system. The service water intake structure ventilation system maintains the safety-related service water pump area temperature low enough to pennit continuous oper-ation of the service water pumps. The service water intake structure ventilation system is designed to Quality Group C and seismic Category I criteria and consists of eight 50-percent capacity exhaust fans along with their associated ducting and dampers. There is adequate redundancy in equipment and Class IE power supplies to assure operation of at least one service water pump per reactor unit .for all modes of operation. The exhaust fans can be manually started on an emergency bus in the event of a loss of offsite power or loss of coolant accident. Individual exhaust fans are started by the operator in response to a service water pump area high temperature alarm in the control room. Outside air is drawn through grated openings in the floor of the intake structure near the base of the service water pump motors. The system is located in a seismic Category I structure which provides protection against tornadoes and tornado-generated missiles. The diesel generator building ventilation system is designed to maintain the diesel generator room temperature low enough for continuous operation of the diesel generators and to provide outside air for diesel combustion. Each diesel generator rooci is provided with a full-capacity ventilation system consisting of intake and exhaust louvers and an exhaust fan. The system is designed to Quality l Group C and seismic Category I criteria and is powered from the same safety-.

4 'u related electrical busla's the~ diesel that is serves. The diesel generator building ventilation system is located in.a seismic Category I structure ~and' is protected from the effects of. tornadoes and tornado-generated missiles. ~ The battery room exhaust systen is designed to ensure a minimum number of air; s changes per hour in the: battery rooms to keep the hydrogen concentration in the rooms below the lower 11annability limit'. Each battery ' room is provided with a separate exhaust. system consisting of two full-capacity centrifugal fans and' their associated dampers and ducting. One fan per battery room operates contin-uously; the standby unit is automatically actuated on receipt of an operating fan differential pressure [ trip signal. - Failure to start is alarmed in the control room. The battery room exhaust system is designed to. seismic Category I and Quality Group C-criteria and is located in a seismic Category -I structure. The roof exhaust' vent.is protected against the effects of missiles. The plant ventilation discharge vents, while not themselves safety-related, are thedischargepathsforthesafety-relatedventilationsyste(servingthefuel building, auxiliary building and radwaste area, and the safeguards buildings. The applicant has not provided an adequate description of these vents to provide assurance that their failure would not obstruct exhaust. flow from the safety-related ventilation systems. Obst uction of exhaust flow could preclude the maintenance of a negative pressure, relative to the environment, in the fuel building, auxiliary building and radwaste area,and safeguards building. The safety chilled water system provides cooling water to the fan cooling units l which remove heat from the compartments housing engineered safeguards features pump motors and electrical switchgear. The safety chilled water system for each reactor unit consists of two 100-percent capacity chillers, two 100-percent l capacity chilled water recirculation pumps, a surge tank and the associated fan i

A n> g., E coil units, piping, valves and instrumentation'. The chillers and recircula-tion pumps are separated into two redundant trains; the' chiller condenser for each train is cooled by the respective train of the essential portion of'the component cooling water system. Each train of the-safety chilled water system is powered from independent Class IE emergency buses. One surge tank is shared by the two-chilled water trains, but.the surge tank partition assures an independent surge volume for each train.. The safety chilled water system is sufficiently redun-dant to assure an adequate supply of chilled water in the event of a single failure for all modes of plant operation. However, since redundant recircula-tion pumps and chillers ~ are located in the same compartment, there is a concern that a pfpe crack or internally-generated missile could incapacitate redundant trains of the safety chilled water system. The system is designed to Quality ' Group C and seismic Category I criteria and is located within seismic Category I structure which offer protection against tornadoes and tornado-generated missiles. The applicant should provide the following information to demonstrate the acceptability of the plant ventilation discharge vent and safety chilled water system: 1. Verification that the design of the plant ventilation vent will ensure that the vent cannot fail so as to obstruct flow from the engineered safety features exhaust filtration units. 2. Verification that a pipe crack or internally-generated missile cannot disable both trains of the safety chilled water system. Based on our review of the design of the miscellaneous building ventilation j system, we conclude that, except for the plant ventilation discharge vent, they meet the single failure criterion and the guidelines of Regulatory Guide 1.29. -.w - *, - - - - - + -,. + <, - - + - - -

e ja and,'- therefore,.are _ acceptable. - We 'will report on the acceptability of Jthe plant ventilation discharge vent and safety chilled water system in 'a supple-ment to this Safety Evaluation Report. 1 4 4 4 52 - . ~

ie 4 10.3 _ Main Steam Supply System 10.3.1 ' Design-The function of the main steam supply system is to convey steam from.the .t. the high. press are b we3 steam generators (and other auxiliary equipment for power generation. A main steam line from each of the four steam generators conveys the steam to the high-pressure turbine. Each main steam line contains a main steam isolation.We v 3 pstream of the. pressure equalizing header that connects the u main steam lines. The portions of the main steam lines from the steam generators, out through containment, and up to the first moment restraint beyond the main steam isolation valves a e Quality Group B and seismic Category I. The main steam isolation valves, the integral bypass valves and bypass piping .are Quality Group A and sefsmic Category I. The main steam isolation valve actuators are Quality Group B. The main steam isolation valves and bypass valves are designed to. close in five seconds upon receipt of a main steam ' isolation valve closure signal. The isolation valves and bypass valves are designed to stop flow from either direction. Failure of one main steam isolation valve to close, coincident with a steam line break, will not result in the uncontrollad blowdown of more than one steam generator. The initiation and control of main steam isolation is redundant and electrically and physi-cally separated. Seismic Category I, Quality Group B safety valves and power-operated relief l valves are provided for each steam generator immediately outside the contain-ment structure upstream of the main steau isolation valves. The power-operated relief valves are air-operated and fail in the closed position on loss of air

g LsanT

• A" - w f e.s.)

i w,p:.h A.a.,co m J A q & f L. [ M o.\\M4A-Yoon .O }o A- ~ T Q - p n. M a ALA &. %,L. 3/AaA41 m g9M % Lid 4 @ A % 6 m\\da. kg M q.~ha. f 1 A y & 4 , a J Lab.. Le d a L % A Jp L. % A ALL. -pi. J;. L. JQ eAh - A t.mm u rd.AtLaLf.a k.mous aao.up M Aka akgwh,hg b Af A g e *, as u % A a g t aia - - Q 1 - p q A d a re

z. -n m aa~ka. u -,A.L g t t

% vdoto.,% 4 A & _.A,,a -.

~ g .u T oses.t s' - xo iso.s.t l h$<+ks wth b foo m e

s. It m W Al ik M A f & W 9

9 A L % Apaw e. m g TD % fs k. k %*. & u L.4.s uk ey + Q s. L QL & dy gd ukken A L A. J % vda, A ~.

2

supply. Thus, the power-operated relieffvalves cannot be operated from the control room in the event of loss of offsite power or failure of the com-e

~ pressed air supply systems. Although handwhe/1s are provided for local manual operation of the' power-operated relief valves, it has not been verified that these' valves could be operated manually in time to support shutdown of the plant if required. (The-applicant 4hould-verify-that-the power-operated relief-valve-are-accessible, and -that-suff* Ment-manpower-would-be-available assuming-minimum shift personnel, I such that these-valves-can-be-operated -manually-in-time-to-support plant shut-dcun S the-event-ef-loss-of-offsite-power-or failure-of-the-compressed-gas 9 ,systemh 4 Based on our review, we conclude, upon satisfactory resoletion of the power-- operated. relief valve concern, that the main steam supply system design, up to and including the main heam isolation valves, is in confonnance with the i-single failure criterion, the position of Regulatory Guide 1.29 related to seismic design, and main steam isolation valve closure time requirements and 1 is, therefore, acceptable. I i 1,

.O

9 10.4.5 Circulating Water System The circulating water system associated with each reactor unit is designed to remove the heat rejected from the main condenser, auxiliary condensers, tur-bine plant cooling water heat exchanger,' and condenser exhausting vacuum pump heat exchangers.

The heat sink and water supply for the circulating water system is the Squaw Creek Reservcir. The circulating water system is#not re-- I quired to maintain the facility in a safe shutdown condition mitigate' the consequences of accidents. Failure of the main condenser circulating water expansion joint can cause rapid flooding of the turbine building sump. The primary means for detecting such a leak would be an alarm in the control room of turbine building sump high water level. The applicant has not provided an analysis to adequately demonstrate that an expansion joint failure would not flood safety-related equipment. Flooding confined to the turbine building would have no adverse consequences to plant safety as no safety-related equipment is located in the turbine building. However, it is not clear that an expansion joint failure, if not isolated in a timely manner, would not cause flooding of safety-related equipment in the electrical and control building, auxiliary building or safeguard buildings. Flooding above elevation 778 feet would flood equipment in the central portion cf the electrical and contrcl building. ( The flood protection afforded the safety chilled water system equipment on this elevation by the compartment walls has not been addressed by the licensee. Fle,oding above elevation 790 feet 6 inches could affect safety-related equip-ment on this elevation of the auxiliary building, and, via direct access from the auxiliary building, safety-related equipment in the safeguards building. l l L t

[, o 2-The applicant should provide the results on an analysis to demonstrate that-flooding caused by failure of the main condenser circulating water expansion joint can be teminated before safety-klated equipment would be disabled. We will provide resolution of this item in a supplement to this safety Evaluation Report. i O J 'l + i l

4 e 10.4.7 Condensate and Feedwater Systems The condensate and feedwater systems were reviewed on the basis that their failure should not result in the loss of any essential equipment and should not affect safe shutdown of the facility. They were also reviewed to assure that adequate isolation is provided for these systems where they connect to seismic Category I systems and that system design minimize the potential for hydraulic instabilities. The only safety-related portions of the condensate and feedwater systems are the condensate storage tank and part of the feedwater system. The condensate storage tank is discussed in section 9.2.4 of this Safety Evaluation Report. The safety-related portion of the feedwater system is designed to Quality Group B and seismic Category I criteria and extends from the steam generator nozzle back to and including the check valve upstream of the containment isolation valve. Each individual main feedwater line to a steam generator incorporates a feedwater bypass system whose function is to minimize the potential for water hammer. The feedwater bypass system is also Quality Group B and seismic Category I. FeedwGer system isolation valycs end feedwater bypass system isolation valves are automatically closed to isolate the safety-related portion of the feedwater system upon receipt of a steam generator high-high level signal, a safety injection signal or a low average temperature signal with reactor trip. The applicant has stated that the geometrical configuration of the main feedwater system will preclude the occurrence of erious flow instability (waterhamer) in the feedline. The main feedwater inlet nozzle is located close to the steam I generator tubesheet and a feedwater bypass system has been provided to minimize the potential for waterhamer. The applicant will provide a test report to..,

s demonstrate the adequacy of the feedwater configuration to reduce.or eliminate water hamer. We have reviewed the design of these systems and conclude that adequate isolation is provided between seismic Category I portions and nonsafety-related systems. We also conclude that failure of the condensate and feedwater systems ~ will not affect safe shutdown of the facility. We will discuss'the adequacy of the design to minimize water hamer in a supplyment to this Safety Eys'.uation Report after staff review of the test report to be submitted.by the applicant. t' ~. ...}}