ML20054F546
| ML20054F546 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 06/09/1982 |
| From: | James Shea Office of Nuclear Reactor Regulation |
| To: | Counsil W NORTHEAST NUCLEAR ENERGY CO. |
| References | |
| TASK-03-04.C, TASK-3-4.C, TASK-RR LSO5-82-06-023, LSO5-82-6-23, NUDOCS 8206170090 | |
| Download: ML20054F546 (23) | |
Text
-
June 9,1982 Docket No. 50-245 LS05-82-06-023 Mr. W. G. Counsil Vice President Nuclear Engineering and Operations Northeast Nuclear Energy Company Post Office Box 270 l
Hartford, Connecticut 061 01 l
Dear ifr. Counsil:
SUBJECT:
SEP TOPIC III-4.C. DRERNALLY GENERATED MISSILES MILLSTONE NUCLEAR POWER STATION UNIT 1 Enclosed is our final evaluation of SEP Topic III-4.C. The evaluation is based on a Safety Analysis Report you supplled on April 13, 1982 I
and other information available on Docket No. 50-245.
The evaluation concludes that Millstone Unit 1 meets the intent of the internally generated missile criteria.
The evaluation will be a basic input to the integrated safety assess-l ment of your facility. The evaluation may be revised if your facility design is changed or if NRC criteria relating to this topic are modi-fled before ebmpletion of the integrated safety assessment.
I Sincerely, I
l l
l l
James J. Shea, Project Manager l
Operating Reactors Branch No. 5 Division of Licensing
Enclosure:
As stated cc w/ enclosure:
See next page Og as5 A
)
pga 8206170090 820609 PDR ADOCK 05000245 P
pop
{
M) /
.S.EP.R..@.S.EPB.,h,7
.SEPB,k,If.
ORBf.5,,q ORB [
- unmue ) )Pers inko,:bl RHermann WRussell JShea Q DCru: hfield,,,,
.AN ornccp G
y 6/.?.:/.82....
9/.2:/82,
s/ M 82 6/&,'.82 6/. 82 6/[82 o,,,,
nac ronu aia (io-sa3 uncu c24a OFFICIAL RECORD COPY usaro isei-2329co
t
~
Millstone Unit 1 Docket No. 50-245 ~
Revised 3/30/82 Mr. W. G. Counsil cc William H. Cuddy, Esquire State of Connecticut -
. Day, Berry & Howard Office of Policy & Management Counselors at Law ATTN: Under Secretary Energy One Constitution Plaza Division Hartford, Connecticut 06103 80 Washington Street Hartford, Connecticut 06115 Ronald C. Haynes, Regional Administrator Nuclear Regulatory Commission Region I Office 631 Park Avenue King' of Prussia, Pennsylvania. 19406 Northeast Nuclear Energy Company ATTN:
Superintendent Millstone Plant P. O. Box 128 2
Waterford, Connecticut 06385
, fir. Richard T. Laudenat Manager, Generation Facilities Licensing Northeast Utilities Service Company P. O. Box 270 Hartford, Connecticut 06101 ResidentIhspector c/o U. S. NRC P. O. Box Drawer KK Niantic, Connecticut 06357 l
First-Selectman of the Town of Waterford Hall.of Records 200 Boston Post Road Waterford, Connecticut 06385 John F. Opeka Systems Superintendent Northeast Utilities Service Company P. O. Box 270 Hartford, Connecticut 06101 U. S. Environmental Protection Agency Region I Office ATTN:
Regional Radiation Representative JFK Federal Building Boston, Massachusetts 02203 O
..._.j_____..-
SAFETY EVALUATION Millstone Unit l' SYSTEMATIC EVALUATION PROGRAM TOPIC:
III-4.C INTERNALLY GENERATED MISSILES I.
INTRODUCTION Missiles which are generated
- internally to the reactor facility (inside or' ou'tside ccntainment), may cause damage to structures, systems and components that are necessary for the safe shutdown of the reactor facility or accident l
mitigation and to the' structures, systems and components whose failure could result in a significani. release of radioactivity. The potential sources of such missiles are valve bonnets, and hardware re+aining ' bolts, relief valve parts, instrument wells, pressure containing equipment such as accumu-
~~
lators and high pressure bottles, high speed rotatiiig machinery, and rotating
- ];
i i
se5ments (e.'g., impe11ers and fan blades).
Sccee' o'f Review l
The scope of review is as outlined in the Standard Review Plan (SRP) Section 3.5.1.1, " Internally Generated Missiles (Outside Containment)," and SRP Section 3.5.1.2, " Internally Generated Missiles (Inside Containment)." The
~
review specifically excludes SRP Section 3.6.1, " Plant Design for P otection Against Postulated Piping Failures in Fluid Systems Outside Containment,"
3.6.2, " Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping," as well as those SRP sections. dealing with natural phenomena (including missiles generated by natural phenomen'a),
- missiles generated outside the facility, and +wrbine missiles.
i 4
.. a
-n
~.
m
.6 II. REVIEW CRITERIA The acceptability of the design of pr'otection for facility structures, systems, and components from internally generated missiles is based on meeting the following criteria:
l 3.
General Design Criterion 4. " Environmental and Missile nesign Bases" with respect to protecting structures, systems and components
~
against the effects of internally generated missiles to maintain their essential safety functions, 2.
Regulatory Guide 1.13. " Spent Fuel Storage Facility Design Basis" as related to the spent fuel pool systems and structures being capable of withstanding the effects of internally generated missiles,
~.
and preventing missiles from impacting stored fuel asse:611es.
Regulatory Guide 1.27. " Ultimate Heat Sink for Nuclor Power Plants" 3.
\\
as related to the ultimate heat sink being capable of withstanding the effects of internally generated misiiles.
III.
RELATED SAFETY TOPICS AND INTERFACES Review Areas Outside the Scoce of this Topic' l
As stated previously, this review specifically excludes the following:
1.
SRP Section 3.6.1
" Plant Design for Protection Against Postulated Pipin Failure in Fluid Systems Outside Containment" - This matter will be covev l
under Safety Topic III.5.8. " Piping Break Outside Containment."
2., SRP Section 3.6.2. " Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping" - This matter will be covered under Safety Topic III-5.A. " Effects of Pipe Break on Structures c Systems and Components Inside Containment.
?
=
=
c' Mi*
3
~
-y 3.
Natural Fhenomena - This matter will be covered under S afety Topics III-6,.
~
" Seismic Design Considerations" and III-4.A. " Tornado Missiles.".
4.
Turbine Itissil,es - This matter will be covered under S afety Topic III-4.5, "Turbin~e Missiles."
Interfaces with Other SEP Safety Topics Satisfactory resolution of the,following safety topics will depend, at least in part, on the satisfactory resolution of this topic:
1.
Topic VII-3, " Systems Required for Safe Shutdewn" Topic VII-4, " Effects 'of Failure i,n Non-Safety Related Systems On Selected 2.
Engineered Safety Features" 3.
Topic IX-1 " Fuel Storage" 4
Topic' IX-3 " Station Service and Cooling Water System" Topic II-3.C " Safety-Related, Water Supply (Ultipate feat Sink)"
5.
~'
IV. REVIEW GUIDELINES Eystems and components needed to perform safety. functions were identified as
\\
. these listed in SRP Section 3.2.2 " Systems Quality Group Classification,"
~
1.
Systems needed to perform safety functions (safe plant shutdown or accident af,t_igations) Area
' Reactor Coolant Pressure Boundary a.
b.
Reactor Coolant Recirculation System Low Pressure Coolant Injection and Automatic Pressure Relief (APR) subsystes c.
d.
Control Rod Drive System f.
Shutdown Cooling (RHR) g.
- The Millstone i APR is similar to ADS
h.
Main Steam System f.
Feedwater Coolant Injection J.
Isolation Condenser K.
Reactor Building & Turbine Building Secondary Component Cooling 1.
Service Water & Emergency Water 9
m.
Condensate Transfer System n.
Ventilation System to Control Room o.
Reactor Head Cooling p.
Reactor Head Vent q.
Diesel Generator Auxiliary Systems r.
Diesel Fuel Oil System
.)
s.
Gas Turbine & Fuel Pumps t.
Standby Liquid Control System 2
Systems whose failure may result in release of unacceptable amounts of radioactivity.
a.
Spent Fuel Pool Cooling and Cleanup System b.
Samplin'g System c.
Liquid Waste Processing System d.
Offgas, Containment Purge, & Standby Gas Treatment Systems e.
Main Steam /Feedwater 3.
Additionally, there are instrumentation and electrical items which are necessary to support safe shutdown operations.
These items include the reactor pressure and level indications, isolation con-denser shell side level, and the power cables to the APR valves.
I
V.
REVIEW AND EVALUATION 1.
Systems Needed to Perform Safety Functions a.
Reactor Coolint Pressure Boundary The reactor coolant pressure boundary, up to the outboard main steam isolation valves and containment isolation valves, is located in the reactor building. The portion of the reactor coolant system inside the drywell is completely enclosed by a five foot thickness of reinforced, concrete, The reactor building walls r
enclosing the remainder of>the reactor coolant system up to the outboard contair. ment isolation valves are reinforced concrete 18 inches thick.
The reactor vessel is a cylindrical vessel with a gasketed removable upper head.
The vessel upper head is held in position by studs.
~
'g
')
It is extremely unlikely that any of these studs will ~become a missile because of the reactor head-vent and main steam pressure relief valves.
Therefore, these studs are not exposed to suffi-cient pressure to create an accelerating force sufficient to cause them to become missiles.
The six pressure relief valves, which include fo'or APR valves, havd the potential for becoming missiles. All of the relief valves are mounted on the main steam lines. The position of the pressure reliG is such that if any parts blow off the relief valves, they would stG and possibly disable; feedwater, reactor water cleanup, LPCI, main steam, core spray, or recirculation piping.
Loss of feedwater would be handled by:
.6 -
(1), depressurization of the vessel thru the pipe rupture 'and/or
~
the Automatic Pressura Relief (APR) system.
(2) use of ECCS to obtain a safe shutdown condition after depressuri-zation.~
The loss of either the reactor water cleanup system or the core spray system would not affect safe shutdown because these two systems are not required for safe shutdown. These two systems are discussed separately under " Core Spray" and " Reactor Water Cleanup."
The loss of the main steam system, one train of LPCI, or one recirculation piping loop could be mitigated by the same method presented for loss of the feedwater system. The two trains of LPCI and the two recirculation piping loops are separated by g
d.istance and the reactor vessel itself.
Therefore, only one train l
r of LPCI or one recirculation loop is assumed imp 3f red by an internal missile. The surviving train of LPCI is adequate to assure safe shutdown in the event of loss of main steam, one LPCI system, or a recirculation loop.
Instrumentation generally requires some penetration into the reactor coolant system. These penetrations are usually small and take the form of welded wells.
The wells are not credible
~
missiles but should one fail, they will not cause serious damage to thd reactor coolant system or compromise its safety' due to their orienta' tion and because only a small opening would result.
(
1, t
1, The possibility that potential missiles may also result from destruc-tive overspeeding of one of the primary coolant pumps in the event-of a pipe break in the pump discharge was also retiewed. Pctentially damaging impeller missile ejection from the broken pipe is minibize by a massive steel pump c'asing. We believe that;the ppobab missiles from overspeed of doth the motor and impuller of a primary coolant pump that could result in damage..to safety-related equip-ment is acceptably low to allow continued eperation of this plant.
In summary, in considering the reactor coolant pressure boundary because of its equipment design ' features, component ' arrangement
')
(i.e., separation), and alternative methods to accomplish core cooling, it is our judgement that this system's function will not be detrimentally affected considering internally generated missile sources from the sources as identified above. However, l'
should a missfie create a break in the reactor coolar;t pressure boundary, the emergency core cooling system will keep the cere cooled after vessel depressurization.
I b.
Racirculation System The recirculation system is located within the drywell area.
The recirculation system contains several potential missile s' urces.
o l
These sources include two recirculation pumps, two pump suction isolation valves, two pump discharge isolation valves, and two l
-8, ring manifold isolation valves.
It is assumed that a missile generated from the recirculation loops will remove the loop and any one of the target systems listed beloW.
h Further, it is assumed that the recirculation system is a target of the main stea'm pressure relief valves (see " Reactor Coolant Pressure Boundary).
The possible targets for mis'siles ge_nerated by the recirculatior
~
system are:
(1) Control Rod Insert and Withdrawal Lines (NE or SW Bank)
(2)
Isolation Condenser Return (3)
Feedwate} A or B (4) Shutdown Cooling.
(5) Main Steam A or B.
I* the insert or withdrawal lines are lost by a missile, then
^~
g the control rods will scram because of differential cooling water The plant can then be safely shutdown using engineered pressure.
i safe shutdown methods, e.g., APR, CRD, and/or ECCS.
For any of the other targets listed above, the reactor will scram in a normal' manner. The reactor can then be safely shutdown by the vessel depressurizing through the postulated pipe ruptures l
(or by using APR) followed by use of the ECCS.
Based on our evaluation we conclude that the recirculation system will not generate missiles that will preclude the plant from being safe'; shutdown.
l i
O e
- 9.-
Low Pressure Coolant Injection (LPCI)_
c.
The low pressure coolant injection system is provi,ded for preven-tion of fuel clad melting as a result of various postulated loss of coolant accidents. The heat exchanger and the two main system pumps for each separate, cross-tied loop are located in opposite corners of the reactor building. Shielding for protection against potential missiles is provided by routing piping along the reactor building structure walls as much as possible..Therefore, only one LPCI loop is subject to an interdal missile from any single source.
The LPCI system piping and valves are located in the reactor building and inside the drywell. The' two separate and independent LPCI loops contain one check valve and one maintenance valve each.
Missile sources in the LPCI lines are limited to these four val'ves
' )
The two LPCI loops are on opposite sides of the reactor vessel, which makes it impossible for a missile from any single source to damage the ECCS piping associated with both systems.
l LPCI generated missiles could impair:
l (1) Main Steam Lines A, B C, or 0 (2)
Feedwater Lines A or B (3)
Recirculation Manifold or Risers.
i The loss of one LPCI and any of the above targets can be mitigated by depressurizing the vessel through the postulated pipe rupture (or by Based on our APR) followed by the use of the surviving ECCS train.
~
evaluation, we conclude that the LPCI system will not generate missiles nor be struck by missiles from other sources.that will preclude the plant from being safely shutdown.
d.
The RWC is not required for safe shutdown. However, it is a source of missiles to nearby safe shutdown systems equipment.
Possible targets include:
(1) main steam (2) feedwater (3) recirculation risers (4) core spray 'A' piping.,
If core spray train A is lost due to a missile, then train B core spray (due to its separption or orientation from train A)
)
is available and all four engineered, independent shutdown paths are available. Mainstream, feedwater, and recirculation systems are discussed in separate sections within this SER and have been'found acceptable.
e.
Control Rod Drive System The Control Rod Drive (CRD) System provides for insertion and withdrawal of the reactor control rods. The mechanical portion of the CRD is located on the ground floor of the reactor building.
The CRD valves are not considered to be missile generators and therefore, not capable of damaging safe shutdown equipment. The CRD pumps are enclosed and cannot interact with any shutdown The CRD accumulators can interact with only one train systems.
' O of LPCI; however, the other LPCI train would be available because of system spacing. Even if the CRD system was damaged by a missile projectile, the standby liquid control, system serves as a backup reactor shutdown method, and is capable of making and holding the reactor core subtritical.
f.
Shutdown Coolino System The Millstone Unit 1 shutdown cooling system is the equivalent of a RHR system and it is not normally in use. Therefore, it is not essential for cold shutdown. > However, the shutdown cool'ing system has a check valve and two isolation valves, which could be potential sources of missiles.
A missile generated by the shutdown cooling system could impair the main steam, feedwater and recirculation risers. The loss of
\\
any of these systems does not preclude the plant from being safely shutdown (see " Main Steam," "Feedwater," and "Recirculatica System").
l g.
Core Spray The core spray system is not normally operating, its loss would not In result in a demand on that system nor impcir safe shutdown.
addition, the LPCI system serves as a backup to the core spray system function. Further, there are two independent core spray Each core spray system has a 100% capacity pump and the systems.
I two pumps are located in opposite corners of the reactor building.
Missiles generated by one core spray pump would not affect the Other potential core spray missile generators include other pump.
the isolation valves. The only credible target would be the i
recirculation loop B piping and isolation condenser. The plant could be safely shutdown should these systems be lost (see
" Recirculation System" and " Isolation Condenser").
h.
Main Steam The Main Steam System is contained in the drywell, steam tunnel, and turbine building.
Within the drywell, missiles could be generated from either the pressure relief valves or isolation valves. A missile from these sources could disable either the feedwater, reactor water cleanup system, LPCI, main steam, core spray, or recirculation piping.
Loss of th main steam and feedwater systems can be handled by depressurizing the vessel thru the pipe rupture and then using i
ECCS and the APR system, if necessary.
Loss of the main steam and a LPCI system or recirculation piping could be mitigated by vessel depressurization via the pipe' rupture (or APR system) and then using the surviving train of LPCI.
Loss of either the core spray or reactor water cleanup system has been previously discussed and, in addition, neither system is required for normal safe shutdown.
A main steam missile generated outside of the drywell would not affect either ECCS or the isolation condenser system because of physical separation afforded by the steam tunnel and turbine building.
Based on our evaluation, we conclude that missiles generated by the main steam system, will not preclude the-plan.t from being safely shutdown, and therefore, is acceptable.
i.
Feedwater Coolant Infection The feedwater coolant injection system is located in the reactor building and the drywell.
Inside containment, the only potential missile sources from the feedwater piping would be from a check valve and an isolation Because of valve orientation, the primary target would be valve.
the biological shield wall. However, potential targets could include main steam piping and isolation valves, recirculation pump and suction piping, and the reactor water cleanup system.
i All possible interactions have been previously discussed under
" Reactor Water Cleanu'p System," " Recirculation System," and
" Main Steam." Therefore, in the event of a feedwater system missile generated inside of containment, the reactor can be j
safely shutdown.
Outside of containment, the feedwater system is physically separated Therefore, a missile i
from the ECCS and isolation condenser system.
would not affect these safety systems and several methods of safely l
)
i l
shutting the reactor down are available.
J.
Isolation Condenser The isolation condenser system is located inside the drywell and in the reactor building.
Inside the drywell, the source of potential missiles from the isolation condenser are the isolation valves. The only target is the recirculation loop B piping. With the loss of both the loop B recirculation piping and the isolation condenser system, Safe the vessel will depressurize through the pipe rupture.
shutdown is then accomplished via the ECCS A train.
Outside containment, the isolation condenser piping is located on
- ~ "
the upper floors of the reactor building, This piping is physically seaparated from the main steam system, feedwater system, and ECCS piping and components. Therefore, a missile generated from this portion of the isolation condenser can have no affect on these sys,tems. Hence, several safe shutdown methods remain to mitigate l
this accident.
l
k.
Other Systems That Are Passive Relative to Safe Shutdown The following systems were listed by the licensee as' being needed to perform safety functions:
(1)
Reactor Building and Turbine Building Secondary Component Cooling (2) Service Water and Emergency Water (3) Condensate Transfer System
+
(4) Ventilation System to Contr61 Room (5) Reactor Head Cooling (6) Reactor Head Vent (7)
Diesel Generator Aailiary Systems
~'
(8)
Diesel Fuel Oil System (9) Gas Turbine and Fuel Pumps g
(10) Standby Liquid Control System
_ The licensee stated that'these syst' ems are either well isolated by barriers or they are not required to accomplish safe shutdown in the event of their loss.
Further, the above systems are either low energy or normally not operating and, therefore, not capable of generating missiles.
For the purpose of completeness we have issued these systems which were identified by the licensee as systems needed to perform safety functions. However, we note that certain of these systems are more in the category of operational convenience.
We have reviewed the above systems and conclude that these systems either; do not pose a missile hazard to safe shutdown systems, are well isolated by plant structures, or are not needed for l
Systems Whose Failure May Release of the Unacceptable Amounts of 2.
Radioactivity Spent Fuel Pool Cleanuo System
~
a.
The spent fuel pool cooling system removes residual heat from the spent fuel stored in the pool. The spent fuel pool coollng system is designed to clarify the pool water and to remove the residual heat produced by the stored spent fuel elements while maintaining the pool water temperature at or less than 125*F.
The spent fuel pool cooling system consists of two cooling pumps and two heat The spent fuel pool pump draws water from the pool, exchangers.
circulates it through the heat exchangers, and returns it to the Service water cools the spent fuel pool heat exchangers.
pool.
The spent fuel cooling system is a low energy system, therefore, li will not generate missile's. The pumps and heat e'xchangers are Should protected from missiles due to their compartmentalization.
~ the equipment become inoperable due to missile damage, there is sufficient time to effect repai'rs or arrange _for al' ternate cooling In our judgment, failure of this system will such as fire hoses.
not result in significant radiological consequences.
i l
i l
l
_ 17 b '.
Samoling System The licensee stated that a line break in the system piping has been evaluated under SEP Topic IX-16. The results of that analysis
~
indicated that dose consequences were a small fraction of 10 CFR Part 100 guidelines. Any break in the sampling system outside of the drywell can be controlled by valves in the drywell. A break inside the drywell side will be contained and allow for repairs without significant release.; We conclude that failure of this system will not result in significant radiological consequences.
c.
Liquid Waste Processing The. liquid waste system is not capable of generating a missile and it is enclosed by the radwaste building. Therefore, it is
')
not a target for other missile sources. However, should this system be impaired by a missile, then any leakage will be contained by the radwaste building sufficiently to allow for cleanup and repair. We conclude that failure of this system will not result in significant radiological consequences.
d.
Offgas, Containment Purge, and Standby Gas Treatment _ Systems The licensee stated that the offgas system has already been analyzed for failure and shown to result in doses that are a small fraction of 10 CFR Part 100 guidelines. That analyses stated that radio-activity in the offgas o; containment purge would be detected by the stack monitors and diverted to the standby gas treatment system.
Radioactive releases into the reactor building will be
handled by the standby gas treatment system. Breaks in either the offgas or containment purge systems outside the reactor building can be isolated by isolation valves inside the reactor
~
building. We conclude that the offgas and containment purge system can perform their functions safely given internally generated missiles. Since the standby gas treatment system is; not normally operating, separated from the offgas system, and, finally, not required for safe shutdown, then should it be impaired by an internally generated missile, safe shutdown of the plant is not in jeopardy.
In conclusion, should these systems be damaged by an internally
~'
generated missile, no threat to the public health and safety-would result therefrom.
3.
Electrical Systems Which Are Necessary to Support Those Fluid Systems Needed to Perform Safety Functions Diesel Generator and Gas Turbine Systems a.
The onsite diesel generator and the gas turbine generator each have adequate capacity to serve as an emergency electrical power The diesel generator is located in a Class I cell within source.
the turbine building. The gas turbine is located outside of the turbine building in a Class I structure. The gas turbine generator backs up the diesel generator to provide redundant onsite power supplies to all ECCS loads. These two units are physically and electrically separated as are the cables connecting them to the
I
- 19 i
station distribution system. Therefore, they are not susceptible to being damaged by a common missile nor would a missile generated by one unit strike the other unit. Each generating unit has its own fuel supply and independent starting system.
Since each of these emergency generating systems are physically and structurally separated so that internally generated missiles cannot disable both at the same tihe and, since these systems are normally not operating, we conclude, based on our evaluation, that an emergency power supply will be available onsite given an i
internal missile event. [see also items K(7), (8) and (9)]
b.
Station Batteries The 125 volt batteries supply power for operation of vital control circuits without interruption. Each station battery is sized to provide 1950 ampere-hours capacity. 'The batteries and DC switch-gear are installed in areas enclosed by fire walls. The battery and DC switchgear meet requirements for Class I equipment. The redundant DC power supply cables to 4KV and 480 volt switchgear, and motor control centers, are physically separated by a floor, i.e., one set below and one set above the mezzanine floor in the turbine building. Similar separation is provided in the reactor building.
We do not consider the station batteries to be a. credible source o'f missiles.
Further, an internally generated missile would not impair both divisions of the station batteries.
Based on our evaluation,
s we conclude that the station batteries are adequately protected and or separated to preclude damage by an internally generated missile.
Reactor Pressure / Level and Isolation Condenser Shell Side Level c.
Indications and Power Cables to APR Valves The licensee stated that the instrumentation and electrical items essential to safe shutdown are:
(1)
Reactor pressure and level indicators (2)
Isolation condenser shell side level indication (3)
Powe* cables to the APR valves The pressure and level indicators have redundant systems which.are physically separated. Also, they have duplicate indicators on each system. A loss of redundant pressure and level indications due to an
- However, internally generated missile is not considered credible.
\\
even if they were impaired, it is possible to read these parameters l
- locally at redundant instrumentation racks located on oppo' site sides of tha reactor building. The isolation condenser shell side Should this level is indicated on one channel in the control room.
channel become impaired, then this parameter can be read locally.
The APR are required for reactor depressurization in the event cf small breaks. Large breaks automatically depressurize the reactor.
Depressurization must occur before LPCI or core spray can be used High pressure makeup is provided by the feedwater coolant for cooling.
Therefore, the only situation where the loss injection system.
of the APR valves can impair a safe shutdown sequence is in the event of a loss of the feedwater system concurrent with a small
o pipe break.
In the context of internal missiles, a break in the feedwater system (12-inch pipe diameter) will depressurize the vessel independently of the APR valves.
Based on our evaluation, we conclude that the essential instrumen-tation and electrical items, and the APR. valves / cables are adequately protected or separated from internally generated missiles. Therefore, safe shutdown of the plant is not in jeopardy due to internally generated missiles.
d.
Control Room m
a The control room is located in the turbine building. There are no potential missile sources internal to the control room which could damage the control room. The control room boundary is I
protected by a concrete wall which provides protection from potential missile sources'outside th'e control room, e.
Cable Vault The cable vault is located in a reinforced concrete room directly below the control room. There are no high energy systems located in this area; therefore, the likelihood of any damaging missiles produced from this room or impacting this area is unlikely.
VI.
CONCLUSIONS Based on our review of the systems and components needed to perform safety functions, we conclude that the design of protection from internally generated missiles meet the intent of the criteria listed in Section II -
REVIEW CRITERIA.