ML20032B160
| ML20032B160 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 09/30/1981 |
| From: | Udy A EG&G, INC. |
| To: | Bajwa S Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-A-6429 EGG-EA-5571, NUDOCS 8111040706 | |
| Download: ML20032B160 (21) | |
Text
_..
EGG-EA-5571 SEPTEMBER 1981 k)$ f$k EMERGENCY CORE COOLING SYSTEM REVIEW, PRAIRIE ISt.AND AM4.
NUCLEAR GENERATING PLANT, UNIT NUMBERS 1 AND 2, gg(
NI DOCXET NUMBERS 50-282 AND 50-306, TAC NU!4BER 6853 Of A)RC flStarck ad 'iIck yw fGS/Sfd *st 0 kh ff
't ll%~f'VfD a
=
- l h
14I4'k)
PRE Ry U.S. Department of Energy Idaho Operations Office
- Idaho National Engineering Laboratory r.q:.: ;g; wx Q
t f
~
t
, _,.. ga.
,j zjr>,
~,.
f
.,c/
- 7,
5 N samkwamey, k
%M,h?dEnk.i, 9=-'-myH $7d$
f
,9_
h
=w smemmesenamesmrumor k=a -pnwpn
- nw: amp l'
. g,4._ %
1]Ni ens:mut W "-~
.,_ m -
. gfb;{,#.
2
-
2 *""
n i
+.
2.s..
- a l
This is an informal report intended for use as a preliminary or working document 7
Prepared for the U.S. Nuclear Regulatory Coanission g
Under DOE Contract No. DE-AC07-761001570 E s a s ia.no FIN No. A6429 YD 0111040706 810930 1DR RES 8111040706 PDR
... - _, ~.. - _,. -.
h EGe5 n..-
FOpu EG4u yWI c., is m INTERIM REPORT Accession No.
Report No, EGG-EA-5571 Contract Program or Project
Title:
Selected Operating Reactor Issues P.ogram (III)
Subject of this Document:
Emergency Core Cooling System Review, Prairie Island Nuclear ~ Generating Plar:t, Unit Numbers 1 and 2, Docket Numbers 50-282 and 50-305, TAC Number 6853 Type of Document:
Informal Repcrt Author (s):
A. C. Udy DIte of Document:
September 1981 R2sponsible NRC Individual and NRC Office or Division:
S. S. Bajwa, Divisiori of Licensing i
Tmd document was prepared primarily for preliminary orinternal use. it has not received full review and approval. Since there may be substantive changes, this document should not be t.t..lsidered final.
EG&G Idaho, Inc.
Idanc Falls, Idaho 83415 Prepared for the U.S. Nuclear Regulatory Commission Washington, D.C.
Under DOE Contract No. DE AC07-761D01570 NRC FIN No. A6429 o
INTERIM REPORT 4
0535J EMERGENCY CORE COOLING SYSTEM REVIEW PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNIT NUMBERS 1 AND 2 Docket Numbers 50-282 and 50-306 A. C. Udy l'
Reliability and Statistics Branch Engineering Analysis Division EG&G Idaho, In::.
September 1981 i
I e
O Draft 9-18-81 TAC Number 6853 1:
r ABSTRACT This Safety Evaluation Report discusses the review of the Prairie Island Emergency Core Cooling System (ECCS), and confirms that the ECCS rnd supporting subsystems meet the single failure criterion as defined ir iEEE Std. 279-1971.
FOREWORD This report is supplied as part of the " Selected Operating Issues Program (III)" being conducted for the U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulatior, Division of Licensing, by EG&G Idaho, Inc., Reliability and Statistics Branch.
The U.S. Nuclear Regulatory Commission funded the work under the authorization BtR 20 19 01 06, FIN A6429.
4 ii
CONTENTS 1.
INTRODUCTION...................................................
1 2.
EVALUATION.....................................................
1 2.1 Emergency Core Cooling Actuation System...................
2 o
2.2 Onsite Emergency Power System.............................
3 2.3 E lectrical Equipment Qualification........................
5 2.4 Submerged Electrical Equipment............................
6 2.4.1 Submerged Motor-0perated Valves requ i red fo r ECCS...............................
6 2.4.2 Submerged Motor-0perated Valves required for Containment Isolation..............
7 2.4.3 Protection of the Electrical Distribution System from the Effects of Submergence..................................
8 2.5 Electrically Operated Fluid System Components.............
8 2.6 Electrical Interlocks.....................................
10 2.6.1 4160 VAC Interlocks.............................
10 2.6.2 43 0 VAC I nt er lock s..............................
11 o
2.6.3 120 VAC Interlocks..............................
11 2.6.4 125 VDC Interlocks..............................
11 2.7 Electrical and Physical Separation Criteria...............
12 3.
CONCLUSIONS....................................................
14 4.
REFERENCES.....................................................
15 2
iii
EMERGENCY CORE COOLING SYSTEM REVIEW PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNIT NUMBERS 1 AND 2 O
l.0 INTRODUCTION 4
-j The NRC required documentation of an analysis of possible failure modes of emergency core cooling system (ECCS) equipment and the effect of such failure on the ECCS performance. The documentation was to show that th3 ECCS and supporting 4bsystems meet the single failure criteria defined 2
in IEEE Std 279-1971 and to show that any modification needed as a result of the analysis was acceptable and implemented.
Northern States Power Company (NSP), pursuant to this request, issued a report entitled "ECCS Actuation--Compliance with the Acceptance Criteria for ECCS for Light Water Nuclear Power Reactors."3 This report was sent to the NRC on December 22, 1976.4 d
This report discusses the review of this NSP documentation and further information provided by NSP by letters dated July 17, 1981,5 August 5, 6
7 8
1981 and September 10, 1981 and by '.elephone on July 27, 1981 and August 14, 1991.9 2.0 EVALUATION The Prairie Island ECCS consists of high-head injection, low-head injection, accumulator injection and boric acid injection. These functions are automatically initiated by the ECCS actuation-system to cool the core following a loss-of-coolant accident (LOCA).
These four functions are sup-ported by the following systems: diesel-generator systems, fuel and diesel oil systems, diesel generator room cooling systems, instrument power distri-bution system, 4 kV class lE distribution system, DC power sources and dis-a tribution system, component cooling system, cooling water system, equipment
. heat removal system, chilled water safeguards system, screen house heating and vent system, battery room special ventilation system and the control, relay and computer room heating, ventilation and air conditioning system.
The operation of these systems is discussed in Reference 3.
1
e 2.1 Emergency Core Cooling Actuation System. The ECCS actuation sys-tem is part of the engineered safety features actuation system (ESFAS) which is a protection system that initiates operation of various engineered safety features equipment to mitigate the consequences of a LOCA. Each ECCS safety injection train is automatically actuated by two-out-of-three containment pressure high, or by two-out-of-three pressurizer pressure low or by either loop A or loop B steam generator steam line pressure low (each loop is two-out-of-three logic).
Independent manual actuation by the operator is also possible.
Each ECCS train is designed to be capable of mitigating a LOCA assuming that the other train does not activate.
Each train has a block signal that allows reactor depressurization.
Two-out-of-three pressurizer pressure block permissive low signals will allow the block to be engaged. The block negates the pressurizer pressure low (the bistables and setpoints effected are independent from the block-permissive signals) and the two steam line pressure low signals for that train. There is also a safety injection block switch for each train that stops an ECCS actuation after a predetermined time period.
ECCS support equipment is started by the use of auxiliary contacts on the electric starter or circuit breaker of the ECCS equipment. Train A components actuate only Train A support equipment and Train 8 components actuate only Train B support equipment.
The cooling water system normally operates in a loop configuration with one pump out of five capable of supplying sufficient cooling water for a LOCA in one unit concurrent with safely shutting-down the other unit. This cooling water loop is isolated into two components, on a safety injection signal. Additionally, a safety injection signal starts two diesel driven cooling water pumps.
One pump supplies each half of the isolated loop in addition to any operating electric pumps.
Both diesel-generators (separate from the diesel cooling water pumps) can receive cooling water from either half of the isolated loop via check valves.
A review of the information provided by the licensee shows that the present design of the ECCS support equipment and cooling water system 2
actuation circuits, in conjunction with administrative controls, meet the single f ailure criterion. The administrative controls consist of technical specification requirements except for the safety-injection pung discharge crossover valves. These are blocked open and tagged per integrated.
operations checklist Cl.l.18-1.I 2.2 Onsite Emergency Power System.
The onsite emergency power system for each unit supplies electrical power to the Engineered Safety Features (ESF) equipment when there is a partial or a total loss of offsite power.
Each unit has two redundant and independent Class lE distribution systems that have some interunit ties. Each distributic, system consists of 4160 V, 480 V and 120 V AC load centers and a 125 V DC load center. The Prairie Island station nas multiple, redundant interconnected (see Sec-tion 2.7.1) offsite power sources that supply 4160 V power when the unit generator is not accessable through either unit auxiliary transformer at the station and when offsite power is available. Redundant 4160 V buses in a unit cannot be tied together.
When no offsite or unit generator derived power is available, the Prairie Island station has two diesel-generators (DG) each automatically
~
tied to a single 4160 V Class 1E distribution system in each unit. Each OG has the capacity to supply the ESF (including the ECCS) loads for a design basis accident in one unit concurrent with a false SIS (no accident) in the other unit.
The unit ESF loads are divided between the two class lE 4160 V buses of that unit.
Each of these buses supplies a 480 V bus and associated loads via separate 4160/480 V transformers. The 480 V buses can be tied together through two series connected circuit breakers.
Each 480 V bus in turn sup-plies 208/120 V AC via separate transformers and a 125 V DC bus v'ia a bat-tery charger. Redundant 120 V AC buses cannot be interconnected.
e Each unit has two 125 V DC batteries and dedicated battery chargers (powered by the redundant 480 V AC buses). The battery chargers are the o
normal source of power, while the batteries are a redundant power source 3
r-for the DC distribution systems. There are no built in interconnection capabilities between the stations four DC batteries or DC buses.
Four inverters in each unit supply normal power for ESF instrumenta-tion.
These are normally powered by 480 ac, auctioneered to 125 V DC power if the AC source is inadequate. If an inverter is not available, a mainten-ance connection to 208/120 V AC bus 117 (217 in Unit 2) is available (this power is derived from a Class lE 480 V bus). These instrumentation buses cannot be interconnected, however, non-class lE 117 (217) could be powered (back-fed) by the maintenance connection (see Section 2.6.3).
The diesel generators are started by stored air pressure.
Two parallel selenoid valves deliver starting air to the twelve cylinder air start valves if each diesel.
Each diesel has its own air starting system, including a 480 'l air compressor and two accumulators. Redundant series connected man-ual valves normally block the interconnection of the two diesel air starting systems.
Engine coolant and lube oil are continuously heated and circulated while a diesel is not running. This is to aid in the starting ability of the diesels. These auxiliaries are powered by the 480 V Class lE bus in Unit 1 that is associated with that diesel.
No provision is made for an alternate power source, however, a failure of this system would only affect one diesel, and it would not prevent the diesel from starting.
Fuel oil for each diesel is stored in a day tank that supplies that diesel.
This supply can be sufficient for two hours of operation, and is replenisned automatically by independent fuel oil transfer systems, which are verified operable monthly.
Interconnected storage tanks supply fuel oil to the day tanks.
Technical specificiation 3.7.A.5 requires a minimum of 70,000 gallons of fuel oil to be stored on site. The day tank level 61 arms are calibrated, as is the instrumentation associated with the day tank fill circuit, on a regular basis.
NSP indicates that a failure of the clean fuel return pump (Diesel 2) could have prevented that diesel from operating.
This pump was powered by 4
a 120 Vac source associated with DGl.
NSP stated that they have changed, in May 1976,6 the power source for this pump to eliminate this potential non-conformance with the single failure criterion.
C Each distribution system is capable of furnishing pcwer to the equip-ment load groups that meet the minimum requirements to safely shutdown one reactor arid to mitigate the consequence of a design basis accident in the other unit.
2.3 Electrical Equipment Qualifications.
The qualification require-ments for safety-related equipment are a measure of the equipment's ability to withstand the design basis environmental and seismic conditions.
NSP has documented that all safety related motors, cables, instruments and other equipment lot.ated inside the containment which must operate during and subsequent to an a cident, will be capable of functioning under the fol-lowing post-accident e aditions for the time periods required:
1.
Temperature 286 F 2.
Pressure 60 psig 3.
Humidity 100%
6 4.
Radiation 1 x 10 rads /hr, gamma 10 5.
Seismic
.129 An eavironmental and seismic qualification program was implemented by Westinghouse, the Nuclear Steam Supply System (NSSS) manufacturer.10 The program confirmed that all safety related instrumentation located in the containment would satisfy the above listed LOCA conditions for the required time period.
This qualification program has demonstrated, by testing and by analysis, the operability of the instrumentation and of the electrical equipment under LOCA conditions inside containment. The temperature, pres-sure and seismic conditions tested to are in excess of the design basis I
event. The Icvel of radiation to which the equipment was exposed in this 6
program was 1 x 10 rads / hour gamma. This level of radiation exposure satisfied the then current criteria for the period of construction of this 5
plant.
Section 3.8 of the Nuclear Regulatory Commission " Equipment Evaluation Report" recommends a minimum total integrated Beta-Gamma dose of 7
4 x 10 roentgens.12 NSP has shown that the majority of the safety related motors, cables, instrumentation and other equipment, both inside and outside of the containment, which must operate during and subsequent to an accident, have been tested to minimum of 4 x 10 roentgens (inside of 6
containment) or 2.7 x 10 roentgens (outside of containment).
NSP has, for those pieces of equipment not presently shown to be qualified for this radiation dose, proposed to a) replace with equipment qualified to IEEE std 323-1974, b) test existing equipment to the higher radiation limit or c) relocate the equipment to an environment for which the equipment is qualified.
With the satisfactory completion of the above program, NSP will have shown that the safety-related motors, cables, instrumentation and other equipment located inside the containment, which must operate during and subsequent to an accident, will be capable of functioning for the required period of time.
2.4 Submerged Electrical Eauipment.
The licensee's analvsis shows that the maximum depth of water that can accumulate in the primary contain-ment building following a LOCA will be 8 f t 3 in.
This yields an upper elevation of water in the containment of 705 ft 9 in. (the base slab of the centainment building is elevation 697 f t 6 in.).
The licensee Fas surveyed the primary containment building, and all the electrical equipment that is located below the LOCA flood level (70S f t 9 in.) has been identifiea.
Some of this electrical equipment that can necome submerged is safety related. This equipment is discussed below.
2.4.1 Submerged Motor-Operated Valves Reauired for ECCS. The licensee has listed in a submittal dated October 21, 1975, those mctor-operated 6
t
1 valves associated with short or long term cooling that pre located inside of contcinment that could become submerged following.a LOCA.13 Valve i
. numbers in parentheses are for Unit 2.
a
-MV-32070 Hi Head Safety Injection (SI) Loop A and B:
MV-32068 Cold Leg Isolation Valvesa
- a (MV-32173)
.(MV-32171)
(MV-32172)
Hi Head Safety Injection' Reactor Vessel Injection Isolation Valve MV-32071 Loop A and B Accumulator Isolation Valves hV-32072 (MV-32174)
'5 (MV-32175)
.MV ~32164
. Loop A and B Hot Leg Residual Heat Removal' i
'MV-32230 Suction Isolation Valves (MV-32192)
'(MV-32232) i None of these valves are required to function following a'LOCA. Flood-f-
ing of these valves following a LOCA will not prevent proper operation of-the ECCS, and is, therefore, acceptable.
4 t
j 2.4.2 Submerged Motor-0perated Valves' Required for Containment Isolation.
NSP has indicated that no containment isolation valves will be 1
submerged following a LOCA. However terminal boxes are identified as being below the 705 ft 9 in flood level which are associated with the following-l containment isolation valves.
NSP states that these valves are the only j
safety related equipment associated with these-terminal boxes.- The first 4 valves listed are for Unit'1, the last 3 valves listed are for Unit 2.
CV-31300 11 Reactor Coolant Loop B Hot Leg Sample CV-31326 11 Regn Heat Exchinger Letdown Line CV-31326 Isolation Valves A, B, and C CV-31327 e-These valves are normally locked open.13 a.
1 7
i
- ~.-.
..n
c CV-31347 2 Letdown Orifice Isolation Valves A and B CV-31348 CV-31349 1 Letdown Orifice Isolation Valve These valves are air operated, fail closed valves.
Loss of power due to a flooded terminal box would cause the valves to isolate the containment penetration. Loss of air, isolated on a containment isolation signal would also cause the valves to close. These valves are not required to open following a LOCA. Proper operation of the ECCS will occur regardless of the flooding of these terminal boxes. Therefore, the design is acceptable for this review.
2.4.3 Protection of the Electrical Distribution System from the Effects of Submergence.
NSP has stated that terminal boxes inside of con-tainment, if immersed, could become flooded. Protective measures ensure that these terminal box'.s and the above valves will not cause the loss of vital motor control center (MCCs) because of electrical faults at these locations following submergence. The 480 V combination motor starters are provided with air circuit breakers and with overload relays. This provides penetration, cable and motor protection, and the isolation of individual cotor circuit faults so as not to affect other MCC loads. The control cir-
~
cuits associated with 480 V MCCs are protectived by individual control cir-cuit fuses that isolate electrical faults and limit the effects of such electrical short circuits to the circuits involved. The protection of the 120 Vac and 125 Vdc instrument power circuits is similar. Selective trip-ping is assured by using protective devices in these circuits that will clear a fault quicker than the bus or MCC supply circuit breaker can react.
Circuit breakers are periodically tested against calculated manufacturer curves to assure operability.9 These designs for preventing the malfunctioning of the Class lE electrical power systems as a result of submerged equipment inside of con-tainment are adequate.
2.5 Electrically Operated Fluid System Components.
The following systems were analyzed in accordance with EICSB Branch Technical Position 8
d BTP-18, " Application of the Single Failure Criterion ta Manually-Controlled -
Electrically-Operated Valves" to determine =if a s' ingle failure could result in loss of capability to perform a safety function:-
1.
Auxiliary Feedwater System i
2.
Component Cooling System 3.
Cooling Water System 4.
Fuel'and Diesel Oil 5.
Residual Heat Removal (low head safety injection)
E 6.
Safety Injection.-
Additionally, NSP has determined that the failure of the'following manually-operated single fluid system component could result in a loss of the ECCS capability to perform its safety function:
- 11 Accumulator Loop A isolation valve--Unit 1 8800 A 12 Accumulator Loop B isolation valve--Unit l~
8800 8 21
. Accumulator Loop A isolation ~ valve--Unit-2 3800 A 22 Accumulator Loop B isolation valve--Unit 2 8800 B i
o Technical specifications-allow these valves to be closed for up to one hour. Other valves were identified by NSP, howeve, they are locked in the position required for ECCS~ operation.
Each accumulator has one vent valve that,-if one failed open, could cause the ECCS action of both accumulators to not supply water the core.
This is because the final safety analysis report assumes that the contents
~
of one accumulator goes directly through the-postulated pipe break and onto 9-the containment floor.
If the vent valve of the other accumulator were to fail, it would have no. nitrogen pressure to inject this coolant into the core. Prairie Island technical specification 3.3. A.l.b requires both accumulators to be operable. With pressure and level annunciators on loss of pressure or loss of level from either of two redundant instrument sets
- a.
per accumulator, the operator'would know or an accumulator vent valve
- failure, j
1 9
r The discharge of the two safety injection pumps has a cross connection tnat has two series connected manually operated valves. Both of these valves must be open to meet the single failure criterion. While not con-trolled by technical specification, these cross-connection valves are admin-istratively controlled by Integrated Operations Checklist C1.1.18.1, and are blocked and tagged open by this procedure.
This procedure then insures that
=
either safety injection pump, by itself, has the ability to mitigate the consequences of an accident.
Based on the above analysis, it is concluded that a single f ailure wil' not result in adverse consequences to the ECCS performance, and therefore the ECCS performance is acceptable. However, should an operator inadver-tantly leave a e,afety injection pump discharge cross connection valve closed, only one safety injection pump would be immediately available to pump borated water into the core.
Should this one pump fail on demand, the operation of the ECCS system would be compromised. Therefore, the NRC should require that these valves be controlled by technical specification to minimize this possibility.
2.6 Electrical interlocks.
Electrical Interlocks are used as a means of preventing redundant divisior.s of the Class 1E distribution system from being tied together.
Electrical independence of redundant portions of the Class lE electrical distribution system is assurred by these interlocks.
There are several points in the distribution system which allow for energizing equipment from the redundant power sources. They exist at various voltage levels, and are addressed in the following paragraphs.
Interlocks provided at each voltage level satisfy the single failure criteria and the intent of Regulatory Guide 1.6, " Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution System:."
2.6.1 4160 Vac Interlocks.
There are no bus ties between redundant 4160 V Class lE buses in either unit at the Prarie Island station.
- Further, there are no 4160 V loads that can be selectively powered by either bus. At 10
the 4160 V level, the Prairie Island station meets the single failure cri-teria and the intent of Regulatory Guide 1.6.
There are bus ties between-non-redundant buses 15 and 26 and 16 and 25. The buses that can be' con-nected are in different units, and are, therefore, non-redundant. Cooling tower buses 11 and 12 also have an automatic bus tie. The bus tie breaker 7,y is interlocked with the source breakers so that redundant load groups within a unit are not connected together automatically upon,the failure'of a single electrical distribution system element. These bus ties'also satisfy the single f ailure criteria and the intent of Regulatory Guide 1.6.
2.6.2 480 Vac Interlock's. Two normally open, manually. closed bus tie breakers separate redundant 480 V Class 1E buses' 110 and 120 in Unit 1.
Buses 210 and 220 in Unit 2 are similarly separated..Since they are not automatic, and there are two independent circuit breakers between' redundant buses, this satisfies the single failure criteria. Additionally, protective relaying exists so that the two redundant power sources cannot be connected in parallel. This satisfies the requirements'of Regulatory Guide 1.6.
No other bus ties at this voltage level were evident in the NSP-submittals reviewed for this report.
s 2.6.3 120 Vac Interlocks. The four 120 Vac Class lE buses in each.-
unit are normally supplied power by four independent 480 Vac powered (with auctioneered DC backup) inverters. No interconnections exist such that the failure of one inverter or circuit breaker would cause the failure of another inverter. Shauld an inverter fail, there is a common 208/120 Vac interruptable power source-Panel 117(217 in Unit 2) for a third source of power to the bus. Technical Specification 3.7. A.7 prevents connecting more than one 120 Vac Class lE bus to this source.
Each connection to these alternate sources have two disconnecting devices. Thus, the single failure criteria and Regulatory Guide 1.6 are satisfied.
s' 2.6.4 125 Vdc Interlocks.
Each unit has two 125 Vdc buses. There are no interconnections between redundant buses, batteries or battery d
chargers. The load groups are arranged so that failure of one 125 Vdc bus will not affect the ECCS capability supplied by the other bus. The single r
S
-o
-.,rn
-~--,---,-p.,...-.y
- y.m
,y,,,,----+----,,%,.,_,...
r n,.. n m
,,-,.m.,m.,%,,,..,-erm,_,
,.-__my, w
r
- failure criteria and Re'gulatory Guide 1.6 are satisfied for this voltage level.
The switching' capability.and the interlocks provided at the Prairie a
Island station. adequately prevent the propagation of faults between-redundant Class IC buses. Therefore, it is concluded that the interlock e
- system designed-to prevent compromising electrical independence is acceptable ~.
2? Electrical and Physical Separation Criteria.
Engineered safety featu're circuit separation includes separation of power sources, control 7
and power devices, protective device senscrs and interconnecting cables.
NSP' indicates that the engineered-safety feature (ESF) 4160 V switch-
~gear and 480 V load centers are located in areas that minimize their expo-sure to mechanical fire and water damage. The 480 V motor control centers are located near areas of electrical load concentration.
The application and routing of control, instrumentation and power cables minimizes their vulnerability to damage from any source. Cables related to engineered safety features are color coded for identification and have been routed and installed to maintain the integrity of their respective redundant channels.
i Cable is carried by rigid and flexible conduit, cable tray,' junction and terminal boxes, containmer.t penetrations and raceways within equipment cabinets. The separation of redundant cables of the enginee-ed safety features system circuits is accomplished through the use of separate, 4
redundant cable carrying components.
i e
The separation distances for trays containing redundant.caH es ara as j
follows:3 y
a.
Horizontal Separation: A minimun separation of 36 inches between b
l adjacent tray side rails. Approved protective barriers are provided in missile areas so that no credible-missile will cause t
l 12 e-
, y
-*.,-m,n.w y,
-r-- %
-~ge,-
m-w--
ym tv-~~---
--e v
-v = n e-vvowe -em G.=--W.w-eeem-se-=-im----
-*r--,
n-
+-4rw*=-+-e
"-t-*e-
+
F' damage simultaneously to both redundant ESF circuits. ' Barriers are also provided where. space does not allow normal' separation,
. here a' non-safeguard tray infringes on the air space of an ESF w
tray or where two redundant ESF trays cross.
g b.
Vertical Separation:
A. minimum separation of 36 inches between t 3 redundant ESF trays or between reactor' protection channel trays is provided. A minimum separation of-15 inches between ESF and reactor protection channel trays is provided.- This dimension.is from tray be* tom to tray bottom. The minimum clear air space between the bottom Of any upper tray and the top of any adjacent bottom tray is 9 inches. Barriers are provided for the same conditions as in horizontal separation..
The ESF and Reactor Protection System (RPS) relay racks are-located. in the relay room. Train A and Train B groups are. separated by a'five foot aisle.
a Redundant ESF instruments and control stations are separated by a minimum three foot air space, have an appropriate barrier placed between them or are mounted on independent racks that are a minimum of three feet apart.
ESF and Class lE electricai system components mounted on control-boards, panels and relay racks are designed with physical separation so thac at least 4-l/2 inches exists between' redundant cables. An exception to this is the manual safety injection switches, where actuation of either switch actuates both safety injection trains.
In this case, separation is maintained at 3-1/4 inches between switches. Teflon insulated wire and cable is used for intra panel wiring.
1
- wL It is concluded that the physical independence of the electrical systems is adequate and acceptable, e
i 13
_..u_,_,,._..-
v 3.0 CONCLUS!0NS' The NSP analysis for the Prairic Island station ECCS actuation has been evaluated in Section 2 of.this-report. The changes mentioned have c
been completed. This review has determined that:
=
1.
.The design of the emergency core cooling system actuation system meets the single failure criterion and.present NRC requirements.
2.
,The onsite emergency power system meets the-single failure.
criterion.
3.
The safety-related electrical equipment is environmentally and seismically qualified except for the issue of level of radiation exposure. The NRC is investigating this separately as IE'Bulletin 79-018.
4.
The submergence of equipment inside of containment will not prevent the proper operation of the emergency core cooling system or containment isolation system nor will it cause malfunctions of the emergency power system.
5.
The redundancy of systems and valves satisfies the requirements of EICS Branch Technical Position 18, and precludes. the malfunc-tioning of the emergency core cooling system due to operator error or the single failure of electrically operated fluid system components.
However, the safety injection pump discharge cross connection valves (hand ]erated manual valves) should be controlled by technical specification, rather than by existing operating pro-cedure only. This will minimize the potential for operating the C
reactor with an ECCS lineup that is prone to a' single failure.
s' l
l 14
6.
The interlocks provided to prevent the propaga' ion of electrical faults between redundant safety buses satisfy the requirements of NRC Regulatory Guide 1.6.
7.
The electrical and physical separation between redundant divisions satisfies the separation criteria in effect during the s
construction of these units, and will not cause functional loss of redundant emergency core cooling system equipment.
In summary, the emergency core cooling system at the Prairie Island station satisfies the single failure criterion, is seismically qualified and is environmentally qualified (except for potential insufficient radi-ation testing). Therefore, the emergency core cooling system at the Prairie Island station is acceptable.
4.0 REFERENCES
1.
NRC letter, D. L. Ziemann to Northern States Power Company (NSP),
April 12, 1976.
2.
" Criteria for Protection Systems for Nuclear Power Generating Sta-tions," IEEE Std 279-1971, The Institute of Electrical and Electronic Engineers, Inc., New York, NY,1971.
3.
NSP report, "ECCS ACTUATION--Complianc with the Acceptance Criteria for ECCS for I~Tght Water Nuclear Power Reactors."
4.
NSP letter, L. O. Mayer to D. L. Ziemann, NRC, "ECCS Actuation Systems," December 22, 1976.
5.
NSP letter, D. Musolf to R. E. Martin, NRC and A. Udy, EG&G Idaho, Inc.,(EG&G), July 17, 1981.
6.
NSP letter, D. Musolf to A. Udy, EG&G, August 5,1981.
7.
NSP letter, D. Musolf to A. Udy, EG&G, Septembar 10, 1981.
8.
Telecon, D. Musolf, NSP and A. Udy, EG&G, July 27, 1981.
9.
Telecon, D. Musolf, NSP and A. Udy, EG&G, August 14, 1981.
- 10. Topical Report, WCAP 7744 Volume 1 (August 1571), And Volume 2 (January 1972), " Environmental Testing of ESF Related Equipment,"
J. Locante and E. G. Igne.
15
e 3
11.
" Safety Evaluation of the Prairie : Island Nuclear Generating' Plant-Units 1 and 2," Atomic Energy Conmission, September 28, 1972.
12.. " Equipment Evaluation Report for the Prairie Island Nuclear. Generating Plant Units 1 and 2," NRC,79-018.
13.
NSP letter, L. O. Mayer to Director of Nuclear Reactor Regulation, NRC, "Reponse to 1E Bulletin 79-01B Safety Evaluation Report,"
August. 26, 1981.
- 2"
- 14. NSP letter, L. 0. Mayer to D. L. Ziemann, NRC, " Submerged Valves Following a LOCA," October 21, 1975.
t O -
1, i
1 4
b 9
f 1
4-t h
't 4
16 i
.~. - -..
.-