U-603131, Application for Amend to License NPF-62,changing CPS Design Requirements for Physical Protection from Tornado Missiles for safety-related Equipment,As Described in Plant Usar. Revised USAR Pages,Encl

Application for Amend to License NPF-62,changing CPS Design Requirements for Physical Protection from Tornado Missiles for safety-related Equipment,As Described in Plant Usar. Revised USAR Pages,Encl

ML20207D532
Person / Time
Site:	Clinton
Issue date:	03/01/1999
From:	Mcelwain J ILLINOIS POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
U-603131, NUDOCS 9903100001
Download: ML20207D532 (37)

Text

. - . _ - _ - - _ ._-_-_______- - -__ __- -- - - -

Illinois Power Company

'g1 g P.O. Box 678 Clinton.IL 61727 Tel 217 935-8881 x3900 Fax 217 935-4032 John P. McElwain -

O Chief Nuclear Offger U-603131 An !!Iinova Company

' March 1, 1999 Y

Docket No 50-461 - 10CFR50.90 10CFR50.59 Document Control Desk L U.S. Nuclear Regulatory Commission

. Washington, D.C. 20555

Subject:

Clinton Power Station Proposed Amendment of Facility Operatina License No. NPF-62 (LS-98-009)

Dear Madam ~or Sir:

Pursuant to 10 CFR 50.90 and 10 CFR 50.59, Illinois Power (IP) hereby

. requests amendment ofFacility Operating License NPF-62 for the Clinton Power Station (CPS). IP requests review and approval, pursuant to 10 CFR 50.59(c), of changes to the CPS design as described in the CPS Updated Safety Analysis Report /

(USAR) for which it has been determined that an unreviewed safety question exists.

The changes concern design requirements for physical protection from tomado miss4es

/

for safety-related equipment. Because the proposed changes evaluate acceptable as-found conditions that involve an unreviewed safety question, NRC approval per 10 CFR 50.59 is required.

- The first change involves protection ofcertain safety-related systems or components due to their proximity or exposure to building / structural openings, barriers or penetrations identified as potential tornado missile targets. Analysis of these targets demonstrates that, on an individual system basis, the probability of system failure due to tornado missile damage is less than the design-basis threshold for such a failure mode to be considered credible. However, on a cumulative basis, the total tomado missile q

damage probability for all of the components is acceptable but slightly greater than the threshold currently described in the USAR. The proposed changes to the USAR will add details of an NRC-approved methodology and acceptance criteria used for ,

determining the systems and components that require physical protection from tornado missiles.

9903100001 990301 Y PDR ADOCK05000461k P PDR llg L*

_ . . _ _ . - _ _ _ _ . _ . . . _ . . _ . _ . _ . _ . . _ _ _ . . . . _ . . _ _ _ ._ .. _ _ m.

_.l I g i s

U-603131 l

Page 2 j t

l

. The second change involves revising the requirements for providing physical j protection from tornado missiles for piping connected to the Reactor Core Isolation Cooling (RCIC) system storage tank. This change is based on an evaluation performed j in response to a condition reported to the NRC via letter U-602900 dated January 2, i 1998, which transmitted Licensee Event Report (LER) No. 97-032-00 and 10 CFR 21 l Report No. 21-97-057, " Plant Outside Design Basis Due to Inadequate Tomado Missile j Protection Caused by Design Error." The change to the USAR will indicate that '

tornado missile protection is not required for the affected piping and storage tank.

{

Additional information and documents to support this application is provided as l attachments to this letter. An affidavit supporting the facts set forth in this letter and its .l sttad..w.ts is provided as Attachment 1. Attachment 2 provides the background, i evaluation, no significant hazards consideration, and evaluation for environmental - l impact consideration for the change involving physical protection from tornado missiles. l Attachment 3 provides the background, evaluation, no significant hazards consideration, and environmental impact consideration for the change involving the tornado missile protection of the RCIC storage tank. A discussion regarding operability of the affected systems, structures and components is also included. Attachment 4 provides a copy of the marked-up USAR pages for the proposed changes.

Sincerely yours, 0* af .

h John P. cElwam ChiefNuclear Officer JLP/krk Attachments cc: NRC Clinton Licensing Project Manager  !

NRC Resident Office, V-690 NRC Regional Administrator, Region III Illinois Department ofNuclear Safety  ;

I

• , s Attachment I to U-603131 Page1of1 i

George A. Hunger, Jr., being first duly sworn, deposes and says: That he is Manager - l Cimien Power Station; that this application for amendment of Facility Operating License  ;

NPF-62 has been prepared under his supervision and direction; that he knows the contents I thereof; and that to the best of his knowledge and belief said letter and the facts contained ,

therein are true and correct.  ;

l Date: This /# day of March 1999, i

Signed: N, .b

' Georfb A. Hunger, Jr. (/ 'f j I

STATE OF ILLINOIS l SS.  ;

f IkNie COUNTY j l

Subscribed and sworn to before me this l day ofMa"ch 1999.

l

• OFFICtAL SEAL

• l l

l Joseph V. Sipsk 4 Notary Public. State of Niinois ()

l l l My Commission Expwes 11/24/2001 j n AA_ Ypd4

'= __ z=_=.__- z- "

(N@ Public) r i-

3. i Attachment 2 to U-603131 Page 1 of 8 Changes Regarding Pmbabuistic Evaluation of Targets PotentiaBy Sasceptible to Damane From Tornado Missiles l Background In accordance with 10 CFR 50.90 and 10 CFR 50.59, Nuclear Regulatory Commission )

(NRC) review and approval is requested for changes to the Clinton Power Station (CPS) i design basis as described in the Updated Safety Analysis Report (USAR), when such l changes involve an unreviewed safety question. Speci6cally, Illinois Power (IP) proposes j to revise the USAR description associated with the probability threshold for when physical l protection of safety-related components from tornado missiles protection is required. The i following provides a description of the proposed changes, as well as the associated safety i analysis, evaluation for no significant hazards consideration, and operability determination j for the affected systems.  !

Probability Threshold for Physical Protection from Tornado Missiles The proposed change involves the use of an NRC-approved methodology to assess the i need for additional positive (physical) tornado missile protection of specific features at J CPS. During reviews of safety-related targets susceptible to tornado missile damage, it l was identified that some ventilation openings and doors in the control building walls,  ;

openings in the main floor of the circulating water screen house, and penetrations in the j walls and roofs of safety-related buildings are not protected from tornado missiles. An L analysis, " Tornado Missile Risk Assessment for CPS," was performed to demonstrate that ,

the probability of damage due to tornado missiles striking safety-related equipment via )

these openings, doors, or penetrations is acceptably low. This analysis was based on j Electric Power Research Institute (EPRI) Topical Report, " Tornado Missile Risk Evaluation Methodology (EPRI NP-2005)," Volumes I and II, also known as TORMIS.

The USAR changes associated with this request reflect use of the TORMIS methodology.

In this regard, the following is noted in the NRC Safety Evaluation dated October 26, l - 1983, issued for the EPRI topical report: "The current licensing criteria governing  ;

tonnado missile protection are contained in Standard Review Plan (SRP) Sections 3.5.1.4 l l

and 3.5.2. These criteria generally specify that safety-related systems be provided positive  !

tornado missile protection (barriers) from the maximum credible tornado threat.

However, SRP Section 3.5.1.4 includes acceptance criteria permitting relaxation of the above deterministic guidance, ifit can be demonstrated that the probability of damage to unprotected essential safety-related features is sufficiently small."

i "Certain Operating License (OL) applicants and operating reactor licensees have chosen to demonstrate compliance with tornado missile protection criteria for certain portions of the

plant...by providing a probabilistic analysis which is intended to show a sufficiently low

risk associated with tornado missiles. Some...have utilized the tornado missile

! probabilistic risk assessment (PRA) methodology developed by...EPRI in (the) two topical L reports [i.e., EPRI NP-2005, Volumes I and II]." The NRC concluded: "...the EPRI methodology can be utilized when assessing the need for positive tornado missile j

• , i j Attachment 2 l to U-603131 Page 2 of 8 l protection for speci6c safety related plant features in accordance with the criteria of SRP

. Sectioh 3.5.1.4."  !

l  :

The EPRI' methodology has been previously applied at CPS to resolve previously l identified missile protection issues during the initial licensing of the plant. In response to i NRC Structural Engineering Branch question 220.11 (regarding physical protection of l targets), IP responded that for elements (targets) that have less than the required amount j of soil or concrete protection, a probability analysis showed that the probability of a j tornado-generated missile striking or damaging these targets was less than 1 x 10 per j

l year. Therefore, damage from tornado missiles is not considered a design basis for these j targets. The NRC documented their acceptance of this methodology in Supplement 6 to l

the CPS Safety Evaluation Report (SER) [NUREG-0853, July 1986). .

Safety Analysis l As noted above, the rnethodology of EPRI NP-2005 was previously used at CPS for evaluation of tornado missile hazards. USAR Section 3.5.3, " Barrier Design Procedure,"

discusses buried items, and states: "For elements with less than the required amount of soil or concrete cover, the probability analysis was performed. The analysis showed that the probability of a tornado-generated missile striking or damaging these elements is less than 4

1 x 10 [per year]. Therefore, the tornado missile is not considered a design basis for these elements." As stated previously, the NRC found the results of the analysis acceptable to require no additional protection of the plant against tornado missiles for l these elements.

l Notwithstanding the above, a more recent tornado missile analysis was performed for CPS l that included new targets or targets not considered in previous analyses. The results of l this most recent tornado missile hazards analysis are such that the cumulative tornado 4 l missile hazard probability is approximately 3.4 x 10 per year for all targets. General guidance concerning the acceptance criteria for such analyses is provided in the Standard Review Plan (NUREG-0800), Section 3.5.1 A, " Missiles Generated by Natural Phenomena," and by reference Section 2.2.3, " Evaluation of Potential Accidents." In Section 2.2.3, the following guidance is provided: "The probability ofoccurrence of the initiating evcats leading to potential consequences in excess of 10 CFR Part 100 exposure guidelines should be estimated using assumptions that are as representative of the specific site as is practicable. In addition, because of the low probabilities of the events under consideration, data are often not available to permit accurate calculation ofprobabilities.

Accordingly, the expected rate of occurrence ofpotential exposures in excess of the 10 4

CFR Part 100 guidelines of approximately 1 x 10 per year is acceptable if, when combined with reasonable qualitative arguments, the realistic probability can be shown to  !

be lower." ,

l i i I

• , 1 Attachment 2 l to U403131 Page 3 of 8

. The most recent tornado missile hazards analysis for CPS contains applicable site-specific )

. assumptions, and the results are within the range described in Standard Review Plan,  !

4 i Section 2.2.3. However, the total damage probability (3.4 x 10 per year) is higher than that accepted in SER Supplement 6, Section 3.5.1.3. Although IP believes this result is acceptable for requiring no additional physical barriers (for any of the new or additional openings, doors or F.wk tions not previously considered), it does slightly increase the probability of a malfunction of equipment important to safety previously evaluated in the safety analysis report. Thus, the change involves an unreviewed safety question per 10 CFR 50.59.

In the NRC's SER dated October 26,1983, the NRC noted that licensees using the EPRI approach must consider five specific points regarding input parameters. The first four points are to be addressed in a new proposed USAR Section 3.5.2.5, "TORMIS Description," as follows.*

L e The probability of a tornado strike at CPS is based upon the broad region values associated with the Fujita F-scale.

• The Fujita scale (F-scale) wind speeds are used in lieu of the EPRI methodology l wind speeds (F'-scale) for the Fo through Fs intensities. In addition, a wind speed  ;

range from 320 to 360 MPH is used for the Fs intensity to correspond to the I tornado wind speed described in USAR Section 3.3.2.1, " Applicable Design Parameters."

l l e A more conservative near-ground profile was used than the base case TORMIS, l l- resulting in a higher tornado ground wind speed. The profile has a ground wind l speed equal to 82 percent of the' wind speed at 33 feet (i.e., V./Vn = 0.82).

l e The number ofmissiles used in the CPS analysis is a conservative value for site l

specific sources, such as laydown, parking, and warehouse areas. These were postulated by general walkdown information at CPS.

l The NRC concluded that this approach is an em*ptable probabilistic approach for demonstrating compliance with the requirements of the General Design Criteria 2 and 3 regarding protection of specific safety-related plant features from the effects of tornado )

and high wind generated missiles subject to the five points identified above.

It is IP's position that utilization af the proposed methodology, which applies both the  ;

probabilistic approach permitted in appropriate regulatory guidance and the proposed l eematear* criteria detailed in this request, is a sound and reasonable method of addressing l l tornado missile protection at CPS for the limited number ofimportant systems and

,_ compa=nts that are not protected by tornado missile barriers.

l.

• The fifth point includes providing justincation for any deviations from the EPRI calculational approach.

'Ihe CPS tornado missile hazards analysis does not have any deviations from the methodology described in EPRI NP-2005, except as noted above.

I i

i

_'t- 1- _

I Attachment 2 )

to U-603131 i Page 4 of 8

{

Proposed USAR Changes l i

The following USAR changes, in addition to new USAR Section 3.5.2.5 discussed above, j

are being proposed. The associated marked-up, annotated USAR pages are included m .i Attachment 4. I i

e USAR'Section 1.8, " Compliance to Regulatory Guides," will be revised to reflect CPS position to Regulatory Guide 1.117, Revision 1, (April 1978), " Tornado Design _;

Classification," to refer to the tornado missile analysis presented in new USAR -

' ~~

Sections 3.5.2.4 and 3.5.2.5.

l e USAR Section 3.5.2.4, " Systems /Compocents Not Requiring Unique Tornado Missile  ;

' Protection," is a new USAR section (in addition to Section 3.5.2.5) that reflects the  !

methodology used in the tornado missile analysis, and identifies the acceptance criteria l used to determine if tornado missile targets require unique barrier protection. J e . USAR Table 3.5-5," Protected Components and Associated Missile Barriers for Externally Generated Missiles," will be revised to resect that there are portions of the circulating water screen house and control building that do not require complete tornado missile barrier protection.

e USAR Table 3.5-6, " Concrete Barrier Parameters," will have a note added that penetrations in exterior walls and roofs in safety related buildings are analyzed using the analysis described in USAR Sections 3.5.2.4 and 3.5.2.5.

Evaluation for Significant Hazards Consideration In accordance with 10 CFR 50.92, a proposed change to the operating license involves no

~

significant hazards consideration if operation of the facility in accordance with the proposed change would not: (1) involve a significant increase in the probability or

. consequences of any accident previously evaluated, (.2) create the possibility of a new or different kind of accident from any accident previously evaluated, or (3) involve a signi6 cant reduction in a margin of safety.

The proposed change, i.e., revising the current USAR descriptions addressing tornado missile barrier protection at CPS, has been evaluated against these three criteria, and it has been determined that the change does not involve a significant hazard because: l l

- (1) The proposed activity does not involve a significant increase in the probability or q consequences of any accident previously evaluated. .I The associated USAR changes resect use of the Electric Power Research Institute (EPRI) Topical Report, " Tornado Missile Risk Evaluatio_n Methodology, (EPRI J NP-2005)," Volumes I and II. This methodology has been reviewed, accepted and documented in an NRC Safety Evaluation dated October 26,1983. The NRC concluded that: "the EPRI methodology can be utilized when assessing the need I

g g i Attachment 2 ;

to U-603131 Page 5 of 8 l

for positive tornado missile protection for specific safety-relsted plant features in

• accordance with the criteria of SRP Section 3.5.1.4." l l The EPRI methodology has been previously applied at CPS to resolve previously )

identified missile protection issues during the initial licensing of the plant. The NRC documented their acceptance of this methodology in Supplement 6 to the {

CPS Safety Evaluation Report (NUREG-0853, July 1986). ,

As permitted in the Standard Review Plan (NUREG-0800), the total probability of damage to plant systems or components initiated from tornado missiles leading to consequences in excess of 10 CFR Part 100 guidelines will be maintained below an  !

l acceptable level. The results of the current tornado missile hazards analysis are {

such that the calculated total tornado missile hazard probability is approximately  !

4 3.4 x 10 per year. This is lower than the value determined to be acceptable, i.e., l 4

1 x 10 per year.

Although it has been calculated that these targets have a higher total probability of being exposed to tornado missiles than that described to be acceptable in SER Supplement 6, See: ion 3.5.1.3, the revised tornado missile hazards analysis for ,

CPS has determined that this probability is acceptably low. )

With respect to the probability of occurrence or the consequences of an accident previously analyzed in the USAR, the possibility of a tornado reaching CPS and causing damage to plant systems, structures and components is a design basis event considered in the USAR. The changes being proposed herein do not affect ,

the probability that a tornado will reach the plant, but they do, from a licensing basis perspective, reflect a slightly increased, calculated probability that missiles  !

generated by the winds of a tornado might strike certain plant systems or components. The tornado missile analysis determined that there are a limited  ;

number of safety-related components that theoretically could be stmck. The t probability of tornado-generated missile strikes on important systems and  ;

components (as discussed in Regulatory Guide 1.117) was analyzed using the  ;

probability methods described above. Based on the low, calculated probability, the  ;

total (cumulative) probability of strikes will be maintained below an adequately i Iow acceptance criterion to ensure overall plant safety. On this basis, the proposed change is not considered to constitute a significantm' crease in the probability of occurrence or the consequences of an accident, due to the low probability of a  !

tornado missile striking safety-related systems or components.

Therefore, the proposed changes do not involve a significant increase in the i

( probab'dity or consequences of previously evaluated accidents.

l L

l l

l l

l 1 . i Attachmes',2 l to U-603131 i Page 6 of 8 -

(2) .. The proposed activity does not ' create the possibility of a new or different kind of i

• accident from any accident previously evaluated. l The proposed changes involve evaluation of whether any physical protection of  !

safety-related equipment from tornado missiles is required relative to the i probability of such damage without physical protection. A tornado at CPS is a j design basis event considered in the USAR, however, a tomado is not postulated j to act as 'an initiator for any new or different kind of accident, or to occur  !

- d-sh.: with any of the design basis accidents in the USAR. The low l probability threshold established for missile damage to plant systems is consistent  !

with these assumptions.

I Therefore, the proposed changes do not create the possibility of a new or different .

kind of accident. )

(3) The proposed activity does not involve a significant reduction in a margin of I safety.

Under the proposed change, physical protection of safety-related equipment from tornado missiles must be considered ifit has been determined that the calculated 4

total tornado missile hazard probability is greater than 1 x 10 per year. The proposed change to the USAR to speci6cally identify this threshold may slightly increase the probability of a malfunction of equipment important to safety previously evaluated in the safety analysis report (i.e., changing the requirements from protecting all safety-related systems and components to not requiring protection if there is an extremely low probability that a tornado missile could strike portions of safety related systems and components). However, the changes are consistent with the minimum acceptable requirements as documented in the NRC's Safety Evaluation Report dated October 23,1983. Therefore, there will be no significant reduction to the margin of safety that may be associated with the potential for safety-related equipment to be damaged from tornado-generated missiles.

Therefore, the proposed changes do not involve a significant reduction in a margin ofsafety.- ]

l Operability Determination for Affected Systems. Structures and Components l

1 Generic Letter 91-18, Revision 1, "Information To Licensees Regarding NRC Inspection i

' Manual Section On Resolution OfDegraded And Nonconforming Conditions, Change to l Current Licensing Basis," dated October 8,1997, makes the following discussion regarding changing the licensing basis to accept a nonconforming or degraded condition:  !

1

[One) situation [to consider) is a final resolution in which the licensee proposes to change the current licensing basis to accept the as-found nonconforming condition. i i

In this case, the 10 CFR 50.59 evaluation is of the change from the SAR-described i

Attachment 2 to U403131 Page 7 of 8 condition to the existing condition in which the licensee plans to remain (i.e., the

• licensee will exit the corrective action process by revising its licensing basis to

document acceptance of the condition). If the 10 CFR 50.59 evaluation concludes that a change to the TS or a USQ is involved, a license amendment must be requested, and the corrective action process is not complete until the approval is received, or other resolution occurs. In order to resolve the degraded or j nonconfonning condition without restoring the affected equipment to its original j design, a licensee may need to obtain an exemption from 10 CFR Part 50 in l l accordance with 10 CFR 50.12, or relief from a design code in accordance with 10 j CFR 50.55a. The use of 10 CFR 50 59, 50.12, or 50.55a in fulfillme'nt of Appendix .!

B corrective action requirements does not relieve the licensee of the responsibility j to determine the root cause, to examine other affected systems, or to report the i original condition, as appropriate.

In both of these situations, the need to obtain NRC approval for a change (e.g., I because it involves a USQ) does not affect the licensee's authority to operate the j plant. The licensee may make mode changes, restart from outages, etc., provided i that necessary equipment is operable and the degraded condition is not in conflict  !

l with the TS or the license. The basis for this position was previously discussed m -

Section 4.5.1. I l

l Illinois Power (IP) has performed an operability detennination ofindividual systems and  !

components affected by postulated tornado missiles to allow the plant to restan from the i

. current outage. An engineering evaluation to support operability identified targets having l cumulative tornado missile strike possibilities greater than the current design basis 4

threshold for requiring physical barrier protection (i.e.,1 x 10 per year). As discussed previously, the targets of particular concern are certain ventilation openings and doors in  !

the Control Building walls, openings in the main floor of the circulating water screen l l house, and penetrations in the walls and roofs of safety-related buildings. Potentially l affected systems and components are the diesel generators, control room ventilation, and

! shutdown service water systems. A calculation was performed that concluded that the i i probability of damage to systems and components associated with these targets, on an J 4 I individual basis, is less than 1 x 10 per year.

Therefore, potentially affected systems (e.g., diesel generators, control room ventilation, l and shutdown service water systems) have been determined to be operable with respect to l protection from postulated tornado missiles. Since the TS are satisfied (i.e., required r l' equipment is operable), and IP is correcting the degraded or nonconforming condition in a timely manner (i.e., requesting NRC approval for the change), plant stanup and plant operation do not pose an undue risk to public health and safety. j l

1  ?

A=---hment 2 to U-603131 i Page 8 of 8 Environmental Impact Consideration

-l The proposed request was evaluated against the criteria of 10 CFR 51.22 for -  !

environmental considerations. The proposed changes do not signi6 cant:y increase  ;

individual or cumulative occupational exposures, do not significantly change the types or ,

significantly increase the amounts of effluents that may be released off site and, as  !

discussed in this an-hr=nt, do not involve a significant hazards consideration. {

Considering the foregoing, it has been concluded that the proposed changes meet the criteria given in 10 CFR 51.22(c)(9) for categorical exclusion from the requirement for an .

EnvironmentalImpact Statement.  !

l

?

i I

i l

1 l.

t i

i i

_ _ . _ _ _.___.__.___________m ____1

~

1  :

Attachment 3 to U-603131 Page 1 of 8 Changes Involving Tornado Missile Protection of the Bascler ConlantationfeeliszEternac Innk

Background

l In accordance with 10 CFR 50.90 and 10 CFR 50.59, Nuclear Regulatory Commission l (NRC) review and approval are requested for changes to the Clinton Power Station (CPS)

l. - design basis as described in the Updated Safety Analysis Report (USAR), when such

! char ges involve an unreviewed safety question. Illinois Power (IP) proposes to revise the l- USAR requirements for providing physical protection from tornado missiles for piping connected to the Reactor Core Isolation Cooling (RCIC) storage tank. The following provides a description of the proposed changes, as well as the associated safety analysis, l evaluation for no signi6 cant hazards consideration, and operability determination for the I

affected systems.

l l Tornado Missile Protection for RCIC Storane T.Ank The proposed change involves the physical protection from tornado missiles for piping l

between the RCIC storage tank and the fuel building. On October 10,1997, IP identified that the safety-related piping from the RCIC storage tank to the fuel building wall (approximately 20 feet) was not protected from missiles generated by natural phenomena, l such as tornadoes, as indicated in the USAR. This condition was reported to the NRC in l Licensee Event Report (LER) 97-032-00, " Plant Outside Design Basis Due to Inadequate i Tornado Missile Protection Caused by Design Error." i Although for analysis purposes the suppression pool is the assumed suction source for the RCIC and HPCS system, the RCIC storage tank is the normally aligned source of water for the high pressure core spray (HPCS) and RCIC systems during postulated accident conditions. In the event that the RCIC storage tank water supply becomes exhausted or is not available, the RCIC tank level instrumentation senses the low water level condition l Jand provides for automatic switchover of the water source from the RCIC tank to the suppression pool. This cepability assures a water supply for continuous operation of the HPCS and RCIC systems. It should be emphasized, however, that RCIC storage tank inventory is not required for OPERABILITY of the HPCS and RCIC systems if suppression pool water level is greater than'the minimum required level. The RCIC storage tank thus serves as an alternate source for the RCIC and HPCS systems, and Technical Specification operability for these systems is satisfied via the suppression pool ,

with pool level at the minimum required levels. I t

j Portions _of the HPCS and RCIC system suction piping, and the RCIC tank level .

i instrumentation standpipe, are contained in the RCIC storage tank building located l between the RCIC storage tank and the Fuel Building. The attached figure shows the L spatial relationship between the structures, piping, and tank. The RCIC storage tank I

! building consists of a structum! steel framed, metal building mounted on a concrete slab.

i- The south wall of the building contains a five-foot high retaining wall for the purpose of I retaining the contents of the RCIC storage tank should the tank supture.

l \

t-l

'l l Attachment 3 to U 603131 j l ,

Page 2 of 8 The RCIC ' storage tank building is not designed to withstand missiles generated by a design basis tornado. However, the USAR indicates that the HPCS and RCIC systems are l

l. required to have missile protection in USAR Sections 5.4.6.1.4, " Physical Damage," l 5.4.6.2.4, " System Reliability Considerations," 6.3.1.1.3, "ECCS Requirements for  ;

j . Protection from Physical Damage," and 6.3.2.6, " Protection Provisions." r L

(' The basis for determining whether portions of systems do not require protection is based L on the requirements of Regulatory Guide 1.117, Revision 1 (April 1978), " Tornado l l  !

Design Clammification." This regulatory guide defines the systems and equipment required to be protected from the effects of tornado missiles Based on the safety-related functions .i

! of the RCIC and HPCS systems in the CPS design, these two systems are required to be i l protected from the effects of tornado missiles. The portions of these systems located j inside the fuel, auxiliary, and containment buildings are indeed protected. Only the piping {

l. located outside the fuel building is not physically protected. Regulatoiy Guide 1.117 does j l not require that the piping outside the Fuel Building and the RCIC storage tank be  !

protected from tornado missiles, except that failure of the piping and tank must not  ;

prevent the HPCS and RCIC systems from performing their design function. l Two possible scenarios have been postulated which could result in the HPCS and RCIC l

, . systems not being capable of performing their safety-related functions. In the first

! scenario, a tornado missile could pinch the RCIC storage tank level instrumentation standp*pe closed, preventing the level instmmentation from sensing a low level in the RCIC storage tank during a design basis accident. The pinched standpipe would thus e prevent the automatic transfer of supply water from the RCIC tank to the suppression l pool. As a result, the HPCS and/or RCIC pump would lose suction pressure, which would interrupt the water supply to the reactor vessel, and potentially damage the pump (s). '

The second scenario postulates that a tornado missile severs the unprotected HPCS and/or RCIC pump suction piping without a failure of the RCIC tank or RCIC tank level

instrumentation standpipe. In this scenario the pump (s) would continue to operate ,

l without the required net positive suction head (Note: this conditionis annunciated in the  !

main control room) until sufficient water was lost from the RCIC storage tank through the ruptured line(s) to reach the low level trip for the system (s) transfer to the suppression pool water supply. This condition could interrupt the water supply to the reactor vessel during a design basis accident as well as cause damage to the pump (s).

Safety Analysis L

( The NRC Standard Review Plan (NUREG-0800) requires that the RCIC and HPCS l l systems be protected against natural phenomena, external or internal missiles, pipe whip,

and jet impingement forces so that such events cannot fail both systems simultaneously. A

• I TORMIS analysis was performed on the structural steel members of the RCIC storage tank building and piping (HPCF od RCIC suction lines, and the RCIC storage tank level instrumentation line) between ta fuel Building and the RCIC storage tank. This I

_ . . _ . _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ . _ ~ _ . _ _ _ _ . _ _ .- . . _

l .'

Attachment 3 to U403131 Page 3 of 8 4

evaluation calculated a tornado missile strike probability of 3.08 x 10 per year, which is 4

below'the threshold for requiring physical barrier protection (i.e.,1 x 10 per year as discussed in At*vhama' 2 of this submittal). Since the RCIC storage tank building is not designed to withstand a design-basis tornado, it is expected that the resulting tornado damage probability would be greater than that calculated using TORMIS. An exact probability has not been determined because of the complex nature of the various failure modes of the RCIC storage tank building. However, IP has determined that the protection provisions in the USAR imply a zero probability of damage to the HPCS piping resuhing from a tornado event. On the basis that the HPCS piping is not protected, an unreviewed safety question is involved due to an increased probability of a malfunction of equipment important to safety resulting from the possibility that the piping between the RCIC storage tank and the Fuel Building could be damaged by a tornado, despite its extremely low probability. For the purposes of this evaluation, there are three postulated missile-related failures that can cause a loss of suction to the RCIC and HPCS pumps.

In the event of a tornado, the most likely failure resulting from a missile would be a partial or complete loss of the RCIC storage tank because of the relative size of the tank. The USAR states that if the RCIC storage tank water supply becomes unavailable, the RCIC and HPCS systems would automatically re-align their respective suction to the suppression pool on a low water level sensed in the tank. The instrumentation required to automatically transfer the pump suction source from the tank to the suppression pool is seismically qualified and is housed within the Fuel Building to protect it against natural phenomena or other externally-generated missiles and as such this postulated failure has already been analyzed and is part of the CPS licensing basis.

The second postulated failure is one where the lack of physical protection of the piping between the RCIC storage tank and the Fuel Building wall makes it possible, albeit highly unlikely, for the level instrumentation standpipe to become damaged by tornado missiles in such a way (i.e., the open cross-sectional area completely pinched closed) that the RCIC storage tank would empty whhout receipt of a low water level signal. This failure is highly improbable since the instrumentation standpipe is made from seamless, four-inch diameter, Schedule 40 carbon steel pipe. Since the instrument standpipe operates under essentially static conditions (i.e., no flow), its function of transmitting changes in hydraulic pressure relative to tank level can be successfully achieved with an open area ofless than 0.1% square inches (based on the 1/2 inch tubing used for the level transmitter). Given that a four-inch diameter, Schedule 40 pipe has an open cross-section of about 12.73 square inches, the instrument standpipe would have to be " pinched" to close off more than 98% of the open cross-sectional area before any impact to the level sensing capabilities would occur. Since a failure mechanism necessary to achieve this degree of plastic deformation of the pipe (without breaching the integrity of the pressure boundary and thus causing a leak of sufficient size to generate a low tank level signal and subsequent transfer of pump suction) cannot occur, this is not considered a credible failure.

4 The third postulated missile-related failure is a loss of the suction piping without a corresponding loss of the RCIC storage tank such that the RCIC and HPCS pumps could

: l Attachinent 3 ,

to U-603131 i Page 4 of 8 f

suffer a loss of net positive suction head while the water level in the RCIC storage tank was above the suction transfer setpoint.

i e By taking a conservative exposed length of 20 feet for each of the suction pipmg runs '

and multiplying this by the respective piping diameter, the total maximum effective piping area is calculated to be about 37.7 square feet (relative to the effective area {

presented to a tornado missile). Likewise, the maximum effective area of the RCIC  !

storage tank is approximately 900 square feet. Comparing the projected areas of the l RCIC storage tank and the suction piping, the maximum projected area of the RCIC l storage tank is almost 24 times larger than that of the suction pipmg.

. Also, since the piping and tank are of similar cylindrical geometry, it is useful to  !

consider their relative strength based on the ratio of the area of the metal (wall i thickness) to the transverse internal area (open flow area), per unit length. For the l RCIC piping this ratio is 0.193; for the HPCS piping this ratio is 0.101; and, for the {

RCIC storage tank this ratio is 0.00418. Given similar material properties between the  ;

objects being compared, the object with the highest ratio would have the highest  !

resistance to deformation or puncture. Since the RCIC storage tank is made from j aluminum and the piping is carbon steel, the piping relative to the tank is much more l resistant to failure than the tank. i e Another aspect to be considered is the comparative trajectories of credible missiles. l i

The RCIC storage tank and pump suction piping are adjacent to, and are protected by, safe;y-related plant buildings on two sides. The Diesel-Generator Building is on the l north side and the Fuel Building is on the west side. As such, any potential missile  !

could only pose a credible threat from the east, the south, and from above. l Additionally, the physical proximity and relationship of the RCIC storage tank to the i suction piping is such that, due to the tank's much larger projected area, it will protect the suction piping from any missiles from the easterly direction. That is, although the tank itselfis not a qualified missile-barrier, any missile from the east would essentially ,

destroy the tank (thus causing loss of water inventory and subsequently a transfer of j pump suction) prior to causing any damage to the suction piping. With respect to  !

missiles coming from the south and from above, a five-foot high, one-foot thick i concrete wall and a approximately five-foot high earthen berm provides some protection to the piping from missiles since the suction piping is situated relatively low i to the ground. Thus, the vertical axis is the only direction from which missiles could ]

reasonably be postulated to strike the suction piping. This constraint on the possible  !

directions that missiles could strike from greatly limits the probability of missile  !

damage to the pipirg.

Based on the above, it is not likel) that a failure of the suction piping would occur during a tornado without also correspw. ding loss of the RCIC storage tank. HPCS is an l emergency core cooling system, and events involving the initiation of the HPCS are design -

basis accidents (i.e., loss of coolant accidents (LOCAs) having an extremely low probability), and it is not necessary to postulate a tornado coincident with a LOCA.

HPCS is also a backup to the RCIC system, and whereas, RCIC is not an ECCS, the

l l Attachment 3 to U 603131 Page 5 of 8 events involving the initiation of RCIC are genera:ly anticipated operational occurrences, such as an isolation event in which normal feedwater is lost.

Considering the above, the following combination of events must occur at the same time for the above failure to be ofconcern (1) An event occurs causing an initation of RCIC and/or HPCS, and (2) A tornado strikes CPS with the intensity to propel a missile and strike the RCIC .

~ (or HPCS) piping in such a way that the RCIC (or HPCS) pump suction is lost prior to the low water level transfer point.

Because of the above failures that must occur, the event of concem (i.e., the occurrence of an event or transient involving RCIC and/or HPCS initiation and a loss of adequate suction that could lead to HPCS and/or RCIC failure) has a very low-probability. Based '

upon engineeringjudgement, the probability of this event is estimated to be less than lx104peryear.

Proposed USAR Channes Based on the above, the following USAR ehanges are being proposed by this license amendment request.

• USAR Table 3.2-1, "Classi6 cation of Systems, Structures, and Components," will be revised to re6ect the quality and safety classification of the piping between the RCIC storap tank and the fuel building.

• USAR Sections 5.4.6.1.4, " Physical Damage," and 6.3.2.6, " Protection Provisions,"

will be revised to reflect that the RCIC piping between the RCIC storage tank and tlie 7 fuel building is not provided ivith physical protection from tornado missiles.

• USAR Sections 5.4.6.2.4, " System Reliability Considerations," and 6.3.1.1.3, "ECCS Requirements for Protection from Physical Damage," will be revised to indicate that the HPCS and RCIC piping inside the fuel building, auxiliary building and containment building are physically separated and protected from damage.

Evaluation for Sinnificant Hazards Consideration In accordance with 10 CFR 50.92, a proposed change to the operating license involves no significant hazards consideration ifoperation of the facdity in accordance with the proposed change would not: (1) involve a significant increase in the probability or

. consequences of any accident previously evaluated, (2) create the possibility of a new or different kind of accident from any accident previously evaluated, or (3) involve a signi6 cant reduction in a margin of safety.

- ~ . . - - - - - . - - . - - - - - - . - - - - . - - - - - . - .-.

p.

]  :-

Attachment 3 to U-603131 Page.6 of 8 1

The proposed change, i.e., revismg the USAR requirements for providing physical

protecition from tornado missiles for piping connected to the Reactor Core Isolation j l Cooning (RCIC) storage tank, has been evaluated against each of these three criteria and it has been determined that the change does not involve a significant hazard because

(1). The proposed activity does not involve a significant increase in the probability or j l consequences of any accident previously evaluated. i

. With respect to the probability of occurrence or consequences of an accident previously analyzed in the USAR, the possibility of a tornado reaching CPS and .

causing damage to plant systems, structures, and components is a design basis event considered in the USAR. The basis for determining whether portions of systems do not require protection is based on the requirements of Regulatory Guide 1.117. This regulatory guide defines the systems and components required- ,

to be protected from the effects of tornado missiles. i The proposed change allows portions of the RCIC and HPCS systems (i.e., piping located in the RCIC storage tank building), not to be protected from the effects of tornado missiles for the following reasons. A tornado event is not considered an in tiating event for a loss ofcoolant accident (LOCA). Thus, it is not necessary to pcstulate a coincident tornado and a LOCA event. Regardless, the proposed changes are not considered to constitute a significant increase in the probability of occurrence or the consequences of an accident due to the low likelihood of a tornado missile striking the HPCS and RCIC suction piping and the extremely low probability of a radiological release.

Therefore, the proposed activity does not involve a significant increase in the probability or consequences of an accident previously evaluated.

(2) The proposed activity does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The proposed changes involve not providing physical protection of the HPCS or j RCIC suction piping from tornado missiles on the basis that the likelihood of a j tornado missile striking and damaging the piping in a particular way so as to prevent or delay automatic transfer of the suction sources is extremely low. A j tornado at CPS is a design basis event considered in the USAR, however, a tornado is not postulated to act as an initiator for any new or different kind of accident. ,

i l The USAR includes an evaluation of the loss of the RCIC storage tank as a result i j of a tornado. In this event, the RCIC storage tank water supply becomes l exhausted, and the RCIC tank level instrumentation provides input to

automatically transfer the water source from the RCIC tank to the suppression i- pool. Although the proposed change involves consideration of additional failure I

modes involving the tank level instrumentation stand pipe and HPCS/RCIC suction i

.L :

Attachment 3 1 to U 603131 l

Page 7 of 8 piping connected to the tank, these additional failure modes have been determined

' to be highly improbabls such that tank failure due to a tornado is still considered to be the most credible and bounding event.

Therefore, the proposed changes do not create the possibility of a new or different l kind of accident.

-(3) The proposed activity does not involve a significant reduction in a margin of safety.

The proposed changes involve not providing physical protection of the HPCS or RCIC suction piping from tornado missiles since it has been determined that the likelihood of a tornado missile striking and causing a particular failure is extremely low. Specifically, with this change it will be recognized that there is an extremely  ;

low possibility that this piping could be struck by a tornado-genereted missile and then damaged in a way that could result in a loss of a continuous suction source to the HPCS (or RCIC) pump. In the event that the RCIC storage tank water supply becomes unavailable, the automatic switchover from the RCIC storage tank to the suppression pool provides adequate assurance that a suction source will be maintained for these systems. Maintaining the suction source for these systems ensures that the HPCS and RCIC systems will perform their functions as required in the safety analysis. 'Ihus, this action will not significantly reduce the margin of safety that may be associated with HPCS or RCIC system availability.

Therefore, the proposed changes do not involve a significant reduction in a margin  !

ofsafety.

Operability Determination for Affected Systems. Structures and Components Generic Letter 91-18, Revision 1, "Information To Licensees Regarding NRC Inspection

. Manual Section On Resolution OfDegraded And Nonconforming Conditions, Change to l Current Licensing Basis," dated October 8,1997, makes the following discussion  ;

regarding changing the licensing basis to accept a nonconforming or degraded condition: J 1

[One) situation (to consider) is a final resolution in which the licensee proposes to change the current licensing basis to accept the as-found nonconforming condition.  ;

In this case, the 10 CFR 50.59 evaluation is of the change from the SAR-described condition to the existing condition in which the licensee plans to remain (i.e., the licensee will exit the corrective action process by revising its licensing basis to  !

document acceptance of the condition). If the 10 CFR 50.59 evaluation concludes tRat d Change to the TS or a USQ is involved, a license amendment must be requested, and the corrective action process is not complete until the approval is received, or other resolution occurs. In order to resolve the degraded or nonconforming condition without restoring the affected equipment to its original design, a licensee may need to obtain an exemption from 10 CFR Part 50 in accordance with 10 CFR 50.12, or relief from a design code in accordance with 10

_ _ . _ _ _ _ . ~ _ . _ - _ _ . _ _ _ . . _ _ _ . . _ . - _ _ . . . . . _ _ _ _ . _ . . _ _ _ _ .__ . _

t Attachment 3 i to U-603131 Pap 8 of 8  ;

CFR 50.55a. The use of 10 CFR 50.59,50.12, or 50.55a in fulfillment of Appendix i

' B corrective hetion requirements does not relieve the licensee of the responsibility i to determine the root cause, to examine other affected systems, or to repon the origiel condition, as appropriate. i In both of these situations, the need to obtain NRC approval for a change (e.g., l' because it involves a USQ) does not affect the licensee's authority to operate the plant. The licensee may make mode changes, restart from outages, etc., provided ,

that necessary equipment is operable and the degraded condition is not in conflict i with the TS or the license. The basis for this position was previously discussed in Section 4.5.1, i

J The HPCS and RCIC systems were determined to be operable on the basis that failure of the RCIC storage tank or suction piping located outside the fuel building will not ';

adversely affect the automatic capability of switching suction sources. Other failure j modes that could potentially result in a failure of the automatic switchover with a l

concurrent loss ofRCIC tank inventory (or suction to the RCIC/HPCS systems) were l

determined to be incredible on the basis of an expected very low probability, and are thus l not a design-basis consideration for operability. Therefore, for all credible failure modes,  !

the switchover will occur automatically as required based on RCIC storage tank level. l Thus, the capability of these systems to perform their design functions will be maintained.

Based on the above, Illinois Power has determined that the nonconforming / degraded condition is not in conflict with the TS or the license. Thus, since the TS are satisfied, and required equipment is operable, and IP is correcting the degraded or nonconforming condition in a timely manner (i.e., requesting NRC approval for the change), plant startup l and plant operation do not pose an undue risk to public health and safety.

Environmental Imoact Consideration l

The proposed request was evaluated against the criteria of 10 CFR 51.22 for environmental considerations. The proposed changes do not significantly increase 1 individual or cumulative occupational exposures, do not significantly change the types or l significantly increase the amounts of effluents that may be released offsite and, as discussed in this attachment, do not involve a significar,t hazards consideration.

' Considering the foregoing, it has been concluded that the proposed changes meet the j criteria given in 10 CFR 51.22(c)(9) for categorical exclusion from the requirement for an  ;

EnvironmentalImpact Statement.

l 1

i i

e

. ._ i p mam I

IffWEE 1E* N l'EIC

'** =

m%., /'"

/

I I g:.:.:

g::::M .

/ s n. um. ' "i n.

" " im"C9*mp'* E tt

1. g% T=,, ,=,,, ,  :

.'.+

• ..'.. . /

\_  ;

./

i e,

'* /

)  :

q nua samum WILDIE i

. .... .. .. \ I e

.'.*.* <. *.. N ,

..:.: .:.. K_ _ .

• .{e. ..'.) IICIC STEME TM

• .'.'. EME TM

.'.'{'

. '.'.*. n' '

.,.,* 4'. 5 FT. HIGH.1 FT. THICK C9mpE LL

,.,.,. (TIF ELEVATION 74141 - c

.'.'.+'

• .' *. .'.'. . L W.

'.' W. Y .. Y .'. W.Y.Y.Y.Y.Y.Y.

,w

.e.Y..Y. Y.. Y.. .. Y.. YY.Y...Y.Y. .Y.Y.. .Y.Y.. .Y..YY..*... Y . Y. .. .W Y. Y*. .'. YY. .YY. Y. .<..

W ..'.'.t Y. . Y

....g ,

w w.... .. .

v. .!!.!.!..!.!.!.*,y!.!.!.!.!.*.!.!.!.!.!.!.!!.!.!6!.!<

v.. v.. .. v....v.. v.....v.. , ... ... ...... w .. v.. ... v.. v.. v.. v.... w... v...v.<

\ mnen E um mr-Z w--

k

, - , - - - . - ~v ~

i I

T .t i Attachment 4 j

- to U-603131 i Page1ofI l Proposed USAR Changes As described in At*=chmants 2 and 3 of this license amendment request, the following .

USAR changes are being proposed:

Taracts Potentially Susceptible to Demane from Tornado Missiles (Attachment 2);

e USAR Section 1.8, " Compliance to Regulatory Guides," will be revised to 'reflect CPS position to Regulatory Guide 1.117, Revision 1, (April 1978), " Tornado Design -  ;

Classification," to refer to the tornado missile analysis presented in new USAR l Sections 3.5.2.4 and 3.5.2.5.  ;

e USAR Sections 3.5.2.4, " Systems / Components Not Requiring Unique Tornado i Missile Protection," and 3.5.2.5, "TORMIS Description," are new USAR sections that  :

reflect the methodology used in the tornado missile analysis, and identify the acceptance criteria used to determine if tornado missile targets require unique barrier protection.

• USAR Table 3.5-5, " Protected Components and Associated Missile Barriers for Externally Generated Missiles," will be revised to reflect that there are portions of the circulating water screen house and control building that do not have complete tornado j

= missile barrier protection. I e USAR Table 3.5-6, " Concrete Barrier Parameters," will have a note added that i penetrations in exterior walls and roofs in safety related buildings are analyzed using the analysis described in USAR Sections 3.5.2.4 and 3.5.2.5.

Tornado Missile Protection of the RCIC Storane Tank (Attachment 31:

e - USAR Table 3.2-1, " Classification of Systems, Structures, and Components," will be revised to reflect the quality and safety classification of the piping between the RCIC

' storage tank and the fuel building.

• US AR Sections 5.4.6.1.4, " Physical Damage," and 6.3.2.6, " Protection Provisions,"

will be revised to reflect that the RCIC piping between the RCIC storage tank and the fuel building is not provided with physical protection from tornado missiles.

• USAR Sections 5.4.6.2.4, " System Reliability Considerations," and 6.3.1.13, "ECCS Requirements for Protection from Physical Damage," will be revised to indicate that the HPCS and RCIC piping inside the fuel building, auxiliary building and containment building are pl.ysically separated and protected from damage.

Marked-up pages annotating the proposed revisions are attached.

==.:.: : - - :: - - ;r 7:;,;. ;;ur- ----- - - - - ---

lI f .)

H CPS-USAR i

~

JReaulatory Guide 1.117. Rev. 1 (Aoril, 1978) l

- Tornado Design Classification Trci;;t r;;iticr. 0;;.pf . fthC.W8%

UfWt-thabseetden- 2.0.1.2 '

1 1

3 Project Position - The project complies with the with the requirements of Regulatory Guide 1.117 with the l i [: following clarifications: l

)

The discussion contained in Regulatory Guide 1.117 states that protection of designated structures, systems, i i

and components may generally be accomplished by designing protective barr' cia to preclude tornado damage, and if protective barriers are not installed, the structures and components themselves should be

( . designed to withstand the effects of the tornado, including tornado missile strikes.

f Important systems and components (as discussed in Regulatory Guide 1.117) are generally protected. The -

limited amount of unprotected portions of imponant systems and components are analyzed using a

( probabilistic missile strike analysis consistent with the acceptance criteria in Standard Review Plan 3.5.1.4,

'/f Missiles Generated By Natural Phenomena.

( USAR Subsections - 3.5.1.4, 3.5.2.4, and 3.5.2.5 J

Q s( p-(,

i l

s l..

1.8-143

CPS-USAR TABLE 3.2-1 (Cont'd)

QUALITY QUALITY CROUP ASSURANCE SAFETY SEISMIC CLASSI- REQUIRE- ELECTRICAL PRINCIPAL COMPONENTS (s) CLASS (b) CATECORY(c) FICATION(d) lENTS(e) COMMENTS IDCATION(s) CIASSIFICATI0ft(t)

~

XIII.

RCIC System (Section 5.4.6) (v)

1. Piping, within out-board isolation valves and up to the main ,

steam 1 I A B (g) D.C.A- N/A li

2. RCIC steam piping, beyond outboard isolation valve 2- I B B (g) A N/A

3. RCIC turbine exhaust to suppression pool 2 I B B A,C N/A

4. RCIC pump suction from ,

suppression pool, piping, valves, including

- m

-=_ - - -

__B . _-

RCIC storage tank within - -- U Wd '

second isolation valve, ,

piping, valves, including isolation valve 2 I B B (g) A,F,M IE 4i

6. RCIC pump discharge to RCIC storage tank beyond

• second isolation valve, piping, valves Other N/A D N/A A.F.M . non-1E

7. Pump 2- I B B A N/A

8. Pump motors

• I N/A B A lE l

9. Valves, isolation and within 1 I A B (g) A,D- lE fi

10. Valves, other 2 I B B (g) A 1E i

11. Turbine 2 I N/A B (h) A N/A

12. Electrical modules with safety function

• I N/A B (w) N/A 1E

13. Cables with safety  ;

Function

• I N/A B N/A ,

lE  !!

m ac>c s l,S a Q ki . .

np.9vses i

l' 2

, CPS-U2AR 3.5.2- Structures.~ Systems and Connonents To Be Protectgd from Externally' Generated Missiles -

3.5.2.1 Generkl Miss'ile selection and description for those external missiles which, iffgenerated,~could damage plant structures, systems or .

components important to safety, are identified in Subsections

3. 5.1. 4 : and 3. 5.1. 5.  ;

345.2.2 Structures Providina Protection'Acainst Externale .

Generated Missiles "

Seismic Category I structures are. designed to_ withstand postu-  ;

' lated external missiles, thereby protecting the systems and 1 components located within. Protective characteristics of Seismic ,

Category I Structures ~are. summarized in Table 3.5-6.  !

~

3.5.2.3 . Barriers fother Than Structures) Providina' Protection Aaainst Externally Generated Missiles Those structures, systems.and components to be protected from cxternally generated missiles, and the missile barrier associated. _

L

'with each, are~ identified in Table 3.5-5. The missile barriers andicated are designed for tornado-generated missiles using the 't

. procedures given in Subsection 3.5.3. Structures which protect pla Q y RemsJ nd omponen y r_om missiles generated outside the.

-('Mttteav&hGU;M'5y.4 chm 36.%9,.b 8Fb6P CicMMhcaWertated systems and components not ,

located within Seismic Category I structures (i.e. outdoors) is also. identified in. Table 1 5-5.

The? location of missile barriers is shown in Figures 3.5-3 Two types of structural response to missile _ impact have been ,

investigated, as-follows:

a. Local effect in the impacted area which includes estimation of the depth-of penetration and, in the case Hof concrete barriers, the. potential for secondary.

missiles-by scabbing.

b. Overal1Lresponse of the barrier, which includes the calculation of deflection due to missile impact.

Generally,L&ll missiles (internal or external).are considered as

' impacting instantaneously with a very'short rise time relative to

.the naturaliperiod of the impacting, structure. Two types of barriers lare designed to resist missile impact, as follows:

~

3.5-17

E 1 CPS USAR p- .

~-

,7 3.5.2.4 Systems / Components Not Requiring Unique Tornado Missile Protection A' limited amount of safety-related systems and components located near penetrations in Seismic Category I structures or located outside of such structures are evaluated as not requiring unique tornado missile protection barriers. Two approaches were used in -

the evaluation (Reference 15):

I

1. Certain safety-related systems and structures are screened out using the criteria of Regulatory Guide 1.117, Tornado Missile Classification, including its Appendix, which together, detail the items that should be protected from the effects of  :

tornadoes. The criteria in the Regulatory Guide are summarized as important systems and components required to i ensure the integrity of the reactor coolant pressure boundary,  !

ensure the capability to shut down the reactor and maintain it in a safe shutdown condition, and those whose failure could i lead to radioactive releases resulting in calculated offsite j exposures greater than 25% of the guideline exposures of 10 >

t CFR Part 100 using appropriately conservative analytical l methods and assumptions. The safety-related systems and  ;

components not required to support these Regulatory Guide 1.117 guidelines are evaluated as not requiring unique tornado missile protection.  ;

2. "Important" systems and components (as discussed in Regulatory ]

Guide 1.117) are generally protected. The limited amount of J unprotected portions of important systems and components are analyzed using a probabilistic missile strike analysis as ,

permitted in Standard Review Plan 3.5.1.4, " Missiles Generated i By Natural Phenomena." _This analysis is conducted to l h determine the total (cumulative) probability per year of missiles striking important structures, systems, and ,

components due to postulated tornadoes. This information is l

l then utilized to determine the specific design provisions that )

} must be provided to maintain the estimate of strike probability below an acceptable level. i The allowable level established for the protection of such systems and components at CPS is consistent with the acceptable l s criteria in Standard Review Plan 2.2.3, " Evaluation of Potential I

Accidents," i.e., that a probability of occurrence of initiating f events (those that could lead to potential consequences in excess of the 10 CFR Part 100 guidelines) of approxieately 1 x 10-' per year is acceptable if, when combined with reasonable qualitative i l

arguments, the realistic probability can be shown to be lower. '

The CPS-specific acceptance criteria is that the total probability of tornado missiles simply striking an important system or component must be shown by analysis to be less than 1 x 10-' per year.

3.5-xx

!" l ,

CPS USAR 1 l L

v w .

This CPS-specific;criteriaLeontains the following inherent a . tcpnservatisms:

j I e

'It is assumed.that an important. system or component simply 'l being struck by a tornado missile would result in damage .

sufficient to preclude _it from' performing its intended safety i

! function, although this is not realistic for all cases.  ;

e The analysis calculates the probability of tornado missiles  !

striking penetration openings. The openings themselves are '

not targets. The true targets are the safety-related I

components' located inside the buildihgs. Some of the missile i types _ listed in Table 3.5-5 cannot enter the openings and i damage the components. 1

• The missile population is conservatively estimated. -

e All postulated missiles are conservatively estimated to have minimal restraints. .

The analysis uses an'NRC-approved methodology (Reference 13) developed by the Electric Power Research Institute -(EPRI)

(Reference 14). The methodology is-implemented using the -

computer program TORMIS,-which is described in Section 3.5.2.5. )

Should CPS evaluations using the TORMIS methodology provide results indicating that:the probability of tornado damage exceeds  ;

the acceptance criteria _of.1 x 10 per year, then unique barriers 4

i l are utilized'to reduce the. total probability to below the_

[ acceptance, criteria. Temporary removal of a protective barrier is permitted under' administrative controls, if removal is 3

l j

determined to_be-necessary. i

)

~3.5.2.5 TORMIS Description l

TORMIS-implements a-methodology developed by the Electric Power  ;

Research Institute-(EPRI). ETORMIS determines the probability of i striking wall's and roofs of buildings on which penetrations or ~

exposed portions of systems / components are located. The '

probability is calculated by simulating a large number of. tornado l strike events at the' site for each tornado. wind speed intensity scale. After the probability of striking the walls or roof is

. calculated,,the exposed surface area of-the particular components are factored.in to compute the probability of striking a .s I

particular' item.

~The TORMIS analysis for. CPS 1 (Reference 15) is an accordance with l

the TORMIS program, as described ~in Reference 14, using site-

specific' parameters-described below:

I l

1. The probability of a tornado strike at CPS is based upon the broad region values associated with the Fujita F;-scale.

N 3.5-xx 1

l ? ' i CPS USAR 1 p- q' V^T The Fujita scale (F-scale) wind speeds are used in lieu of the TORMIS wind speeds (F-scale) for the Fo through F3 intensities.  :

In addition, a wind speed range from 320 to 360 mph is used for the Fs intensity to correspond to the tornado wind speed described in Section 3.3.2.1.

3. A more conservative near-ground profile was used than the base case in TORMIS, resulting in a higher tornado ground wind speed. The profile'has a ground wind speed equal to 82% of the wind speed at 33 feet (i.e., Vo/V33=0.82).

i

4. The number of missiles used in the TORMIS analysis is a l conservative value for CPS-specific sources, such as laydown, parking, and warehouse areas. These are postulated by general walkdown information at CPS.

u i

1 I

l l

l l

l l

l 1

3.5-xx l 1

.f' CPS-UIAR

9. GE Letter Report, " Analysis of the Recirculation Pump Under l Accident Conditions," Revision 2, 'Aarch 30, 1979.

10. R. C. Gualtney, " Missile Generation and Protection in Light Water Cooled Power Reactor Plants," USAEC Report ORNL NSIC-22, September 1968. l

11. F. J. Moody, " Prediction of Blowdown Thrust and Jet Forces,"

ASME. Publication G9-HT-31, August 1969.

12. George E. Sliter, " Assessment of Empirical Concrete Impact .

Formulas," ASCE Journal, Volume.106, No. STS, May 1980.

i

/

/-- c~~

- em % 7 %  %. _

d. Id- J 1'e N6{, ,,

7

13. L.e1ler, h be-sl 6 LAf(L &)H'}In flIEL)Q E$ IGA, h'*l

\

Gutasm Rqc,+ - elua hu ka rl D*E*'t M}'.

ILtt l h. W 5 0nN(*1"j 'I'0' 9'! I'l b' ' ' '

Ases,mel Gr/Q #ic4 hela)y ," Adel Mba 24, MS3.

)u , 'w,9jale , L. A. a J T)uua, W.L, El'121 N1%us, D *'na<le 1%;te S,,atab- a J Pequ ^^"%) > l'0I"*"* "% h Fwl gep<+ cwe Amas+ 19sl. -

l Is. $ny J ml Luf fq'* W*f'""E' N'**I' N""'I /

J llses9mLJ 's< ClMhm Lec SM'"- j l

i i

3.5-23

, . , _ _ ~ _ , . - _ . . _ . ._ . - . _ _ . . . -

t I ? 1 CPS-UI?AR TABLE 3.5-5 I

PROTEC'TED COMPONENTS AND ASSOCIATED MISSILE BARRIERS

]

FOR EXTERNALLY GENERATED MISSILES J

~

COMPONEllT BARRIER  !

I A. Protected Components Within the l Plant

1. Reactor coolant pressure boundary Containment

, and other safety-related equipment structure, dry-inside containment well, internal  ;

structures, and ,

beams '

2. Emergency core cooling, contain- Containment ]

ment spray, cooling water, building, auxili-  !

ventilation, electrical, instrumen- ary building, and tation, control, and other safety- internal structures related equipment in auxiliary building ,

3. Control room and protected electri- Control building cal, instrumentation, control, and ventilation equipment in control building .

4. Spent fuel pool Fuel pool walls, fuel building

5. Emergency diesel generators and Diesel-generator diesel fuel oil system (1) building

6. Shutdown service water pumps and c&

SSW portions 3cir-associated piping culating water

• screen - house e_

7. Portion of the reactor coolant pres- Auxiliary building sure boundary in the auxiliary and auxiliary building building steam tun-nel ccw.6 pe. ww

' <, hut &

be>un steelm cww Ide> f p3 >

qh c, u;h elase act b u de AAdo te coatleE mele l

bane 6- % cfes.y a,e. aaalpal in ipe TORMtb et ulg9iS, descrbe 3.5-28 m LL % L Sec % 3.g.1,qa 4 99.2.s.

~ - ~ - ~ -

_ _ , . .:..;...._: 2 -= ._ ._

~

---

~.:

~'- - - - - - - -

g 1 .* CPS-USAR TABLE 3.5-5 (Cont'd)

. COMPONENT BARRIER -

l B. ' Protected Components Outdoors f

1.. Electrical manholes (Category I) Protected by a  !

reinforced 1-foot- -

thick concrete -

cover with steel- l plate manhole

~ covers (1-inch-thick galvanized

' plate)

2. Electrical duct banks (Category I) Protected by a ,

minimum of 5 inches '

of reinforced con-crete duct, buried a minimum of 4 feet below finish grade

3. Control building

a. Ventilation air intakes Protected by'a d minimum 2-foot-OfM v cfe. ! g.gh g.4,A thick reinforced ve' etcf MMede<fstaf% ia 4tse.

r Au- d.tal  ? #v (

C> A j O m'gf~ bconcrete i missile

~ T)'ti tlN [iaalyp sy((Scr.lya r$-bie_-

i s QTA h ere k b.G;2.f t o barrier (see {

A*6 es is ry Su.ht%g Ce.5%a+

f]a.,1 ldi3.f.7 9,a(c $>r-fteaql u 1Me'st U n d 9 a s t), 4 *tFigure O,S, 3.5-3), 4

. entitaitWP'~ehsk" Protected by a minimum 2-foot-thick reinforced concrete missile barrier (see Figure 3.5-3) 4

c. . External access doors Doors are designed vvm to withstand tornado j Nge f -fhe, <dtl rpll-@ (br wlddt. 4 missiles or they '

are protected by a re e d e d . lT16. t e d r l 'i y minimum 2-foot-thick a1st

-h t<. { TDf-tM19 netalgs.~.,,[d'r.c.g

r. M .h Lt'>All / 9 clde j 7'd MGD reinforced concrete I

\

kCI M S'J4w yA.t2 '3.'i.%.F.~%[. -

.x missile barrieryYA l

4 M hx M ary building '

a. Access doors Doors are_ designed to withstand tornado missiles or they are l protected by a min-imum 2-foot-thick I reinforced concrete l missile barrier

-3.5-29 l

. - . . - . , - - . .-. .-- _ . . . . , - - , . . - - - _ . - , . - . - ~ - - - -

. 'l ?-/

CPS-USAR 6

. TABLE'3.5-6

[

. CONCRETE BARRIER PARAMETERS Minimum

. Concrete Design Strength _ - -

Structures- Thickness at 91 Days (ksi) .I l

Auxiliary Building Walls 2'-0"' 3.5

~. Auxiliary-Building. Roof l'-6"' 3.5 Fuel. Building' Walls 2'-0" 3.5 Fuel. Building Roof 2'-0", 3.5 Control' Building Walls .2'-0" 3.5 Control-Building Roof 2'-0" 3.5 Diesel Generator Building Walls 2'-0" 3.5

~ Diesel Generator Building Roof -

2'-0" 3.5 Containment Wall 3'-0" 4.0 l Containment Dome 2'-6" 4.0 Circulating Wate'r Screen House Walls s 2'-0" 3.5 ,

Circulating Water Screen l House Roof l'-6" 3.5 l l

s~^h  % ,

-~

? NOktt '. feaidtx4lcW3 in G+NY Y MIN 0" kk 'A*S*A 6au,y, ae tuyraewyse TMwwawp s RewrM in U % d.'iecl;cw,#S.9.R nvd & 5 2 S _yw K ,M- -

• 1 l

l

/

3'.5-31

y , ,

7._ . _;__.. , ._.__.__.____._....__..___.-.7___._._._. _ _ __

. l' f CPS-USAR Revision 7

~ April 1996 l i

I position. 3. Other bypassed or otherwise deliberately rendered {

inoperable parts of the system shall be automatically indicated ,

in the control room at the sys$en level. l

~

5.4.6.1.2.2 Manum 1 Operation (Also see subsections 5.4.6.2.5.2 and'.3)

~

lIn addition to the automatic operational features, provisions are included for remote-manual startup, operation, and shutdown of the RCIC System, provided initiation or shutdown signals do not exist.

I 5.4.6.1.3 Loss of~Offsite Power' l

The RCIC System power is to be derived from a highly reliable  !

j source that.'is maintained by:either onsite or offsite power. '

(Refer tio , subsection 5.4.6.1.1)

.., . y, , r n , p .-

5.4.6.1.4 ' Physical Danmae

' i The system is designed to the requirements of Table 3.2-1 commensurate with the safety importance of the system and its equipment. T'e PfIC 1: physioeH y locatM is. . diff-r-.."

G:dr; .t -cf the react-cr MMding and utilizes different '

divisional power (and separate electrical routings) than its reduhdant system as discussed in subsec'tions 5.4.6.1.1.and 5.4.6.2.4. A m __s 5.4.6.1.5, Environment i

The system operates for the time intervals and the environmental conditions specified in section 3.11. .

i i

l l

f ie h dlC f f i y v a<l  % I2,Cid {aq' is Ic(4kd in-Cerfeneds lccalek cal %de k h g

i C.tcin%.d6.It6garel%I4kd Be Anu;\uu.y 6a.g,g,p fig.vS fp.ninluMlIy e d C 4 k f M II') '

l W % is lecde). in Se. Fue) f gete.Aded m WoIe3 h b'i'M G Qg l1. $ku b a (c y i+ d f )

Oq..ld,,

f a,> (pcm wall %

IItt. lhfutry hh} e.n il e. IAC.I C., 'Jlo(Wje 4Rak 4d t

i "ScIkdI)'ai(dieget(*6to'If/N.4bd WiW Jrotec4iew ia notoiNAW WMt 1 ( U 7 A $ h f 6 3. 6 .',2. t .

1. Q A .

5.4-42

, _ ._ _ ..._ . _ _ _ _ _ _ _ _ . _ -. _ _ . m.. _ _ _.

r 1 l . ;o ',' f CPS-USAR Revision 7 May 1996 (10). Suction _ Strainer. Sizing The suppression' pool suction strainer shall be' sized such l that;_

a. Pump NPSH requirements are satisfied when strainer is "

-50 percent plugged.

b. Particles over 3/32 inch diameter are restrained from passage into the pump and the head spray nozzles (refer to GE supplied components), .

4 5.4.6.2.3 'Anolicable' Codes and Classification l l-The RCIC' system components within the drywell up to and including the outer isolation valve are designed in accordance with ASME

. Code,Section III, Class 1, Nuclear Power Plant Components. The RCIC System is also designed as; Seismic, Category I.

The RCIC System is not required' to conform w3th General Design  !

Criterion 34. The RCIC System is an. engineered safety feature for the purpose of maintain ~ing reactor vessel water inventory, and this system is not designed to meet the single failure l criterion. Compliance with General Design Criteria 55 and 56 is presented in Subsections 6.2.4.3.2.1.1.5, 6.2.4.3.2.1.2.1, .

l 6.2.4.3.2.1.3, 6.2.4.3.2.2.1.2, and 6.2.4.3.2.2.4. There are no i l RCIC lines for'which General Design Criterion 57 is applicable.  !

l (Q&R 5.2)  ;

'_ The reactor core isolation cooling system component classifications and those for the RCIC storage system are given l in Table 3.2-1.

5.4.6.2.4

. System Reliability Considerations To assure that the RCIC will. operate when necessary and in time to prevent inadequate core cooling,'the power supply for the l system is taken from immediately available energy sources of high.

-reliability. Added assurance is given in the capability for periodic testing during station operation. Evaluation of l reliability of the instrumentation for the RCIC shows that no failure of a single initiating sensor either prevents or falsely  !

starts the system.

! In. order to assure HPCS or RCIC availability for the operational j -events-noted previously, certain design considerations are j utilized in design of both systems.

(1). Physical Independence. The two systems are located in separate areas. Piping runs are separatedtana the water delivered from each system enters the reactor vessel via different nozzles.

Qe) OwlAl %lN Qsa,t:~,a cck A )y 5.4-53

w .-._---__.: -

g l' 9 '

CPS-USAR l'. No more than one storage battery shall be connectable to a d-c power bus.

m. Each system of the ECCS including flow rate and sensing networks must be capable of being tested during shutdown. All active components shall be -

capable of being. tested during plant operation, including logic required to automatically initiate component action.

~

'n. Provisions for testing the ECCS network components (electronic, mecha~nical, hydraulic and pneumatic, as applicable) shall be installed in such a manner that they-are an integral and nonseparable part of the design.

6.3.1.1.3 ECCS Reauir== ants for Protection from Physical Dammae The emergency core cooling system piping and components are protected against damage from movement, thermal _ stresses, the affects of the LOCA, and the safe shutdown earthquake.

The ECCS is protected against the effects of pipe whip which night result from piping failures u'p to, and including, the . .

design-basis event IDCA. This protection is provided by

.esparation, pipe whip restraints, or energy absorbing materials, if required. One of these three methods will be applied to .

provide protection against damage to piping and components of the ECCS which otherwise could result in a reduction of ECCS ,

effectiveness to an unacceptable level.

The ECCS piping and components located outside the reactor building are protected from internally and externally generated missilesx g n addition, the watertight construction of the ECCS pump rooms, when required, protects against mass flooding or redundant ECCS pumps.

The ECCS is. capable of. withstanding the passive failure of valve

. stem packings and pump seals following a LOCA. The maximum

{ 1eakage due toLPCS, from &n HPCS, a failure of this or RHR pumpnature could beValve seal failure. 23 gpmstemorleakage less would be significantly less than this.

Mechanical separation outside the drywell is achieved as follows:

a. The ECCS shall be separated into three functional groups:

! 1. HPCS,

2. LPCS + 1 LPCI + 100% service water and heat xchanger, and

^ r s.,.<

Newates c~u&at(sf

. A -

s.- = == . - : L . L -..~ .  : 7M: :::."

= L L. : : : " ^ = = 2 2: :.: n ' ^~* ^ ~ '~

~~~~ "^

1 L i

.f.- 7' # l CPJ-USAR Revision 8 December 1997

3. two.LPCI, pumps + 100% service water'and heat t,

, exchanger.'

L b.= The' equipment in each. group shall be separated l from that in the other two. groups. In addition, the HPCS and RCIC.(

• 3 l 't nare M i "N ~

%$IM b -

c. b tructed between the I functional groups as required to assure that environmental disturbances such as fire, pipe

-rupture,Jfalling objects, etc., affecting one functional group will not affect the remaining groups. In addition, separation barriers have

-been provided to assure that such distu .

. not aflect IC and. HPC -

% tke. FE

& ' /hu s hu Ces mvb - ^

Flashing occur ..1.. f.1 dt d' tine .LlWdYequal. to er greater than the total pressure of the liquid at that point.

To determine if flashing can occur in any of'the ECCS pump' cuction lines, NPSH calculations-for each of the pumps were ovaluated conservatively for points between the suppression pool and the pump nozzle. In this evaluation, the minimum static-pressure that occurs at the highest elevation in the suction line l 'with the suppression pool at the minimum water level has been j . considered. 'The suppression pool is at atmospheric pressure (14.7 psia). Pressure drop due to friction is greatest at the pump' suction nozzle, which happens to be the lowest point in the cuction line. Thus, it is conservative to use this t.otal . ,

pressure drop at the intermediate point of maximum elevation. l The evaluation also includes pressure loss due to velocity. j i

The following data and assumptions were used in the analysis. j Suppression pool temperature: 212' F-Minimum. suppression pool water level: 727.08 feet Highest elevation in each of the ECCS pump suction lines:

720 feet 1

l Pump suction strainer (50% plugged) pressure loss: 1 foot Conversion factor: 1 psi at 2120 F = 2.407 feet of water Pump maximum flow: .LPCS pump 6,400 gpm i

l HPCS pump 6,400 gpm

[ RHR pump A, B, _& C 6,060 gpm / >

q i

Pump suction' lines

20-inch, 0.375-inch wall l 6.3-5

ma -- - -

= : ::=,.. -

v ==: :.== ==- = = = =: - -  :=  := m -

1

_t Pt-

)

l j

CPS-USAR Revision'7 l May 1996 6.3'2.5 System Reliability A' single failure analysis shows that no single fail'ure prevents the starting of the ECCS when required, or the delivery of coolant to the reactor. vessel. .No individual system of the ECCS .

is single failure proof with the exception of the ADS, hence it is expected.that single failures will disable individual systems of the ECCS. The most severe effects of single failures with respect to loss of equipment occur if a loss-of-coolant accident occurs in combination with an ECCS pipe break coincident with a loss of offsite power. The consequences of the most severe single failures are shown in Table 6.3-7.

A. system level limiting mode failure analysis is presented in Appendix 15A systems. .

c cc5 gmOpg%QGwctenal m,w Analy g9fA%p HrtG L o ,fmg 6.3.2.6 Pro tu/ m "M (LC R-pio g e ak erg & g$ f

$aildg /ps, g.yer n[dh t gin pygg huik ~itase Protection provisions are inclufad irtha' des'igtr'orthY CecW 2Cc873' Sa.lf'"

Protection is afforded against missiles, pipe whip, and flooding.

Also accounted for in the design are thermal stresses, loading from a IOCA, and seismic effects.

The ECCS piping and components located outside the drywell are protected from internally and externally generated missiles >c The j watertight construction of these ECCS pump rooms also protects i the equipment against flooding. The layout of the ECCS pump l rooms is described in Subsection 6.2.3.

l The ECCS'_is protected against the effects of pipe whip, which I might result from piping failures up to and including the design  !

basis event IDCA. This protection is provided by separation, l pipe whip restraints, and energy absorbing materials. These l three' methods are applied to provide protection against damage to l Piping.and components of the ECCS which otherwise could result in l a reduction of ECCS effectiveness to an unacceptable levdl. See i

'Section 3.6 for criteria on pipe whip. j The component supports which protect against damage from movement and from seismic events are discussed in Subsection-5.4.14. The methods used to provide assurance that thermal stresses do not cause damage to the ECCS are described in Subsection 3.9.3.

The leak detection capability for the ECCS is discussed in Subsections 5.2.5,and 7.6.1.4. Loss of any one train of an ECCS will not negate the function of the ECCS. Flooding of one ECCS pump room cannot cause~ flooding of a redundant ECCS pump room.

A leak _in'any-ECCS train outside these rooms would be detected by the leak detection methods described in subsections 5.2.5 and 7.6.1.4. Any ECCS train which is found to have excessive leakage

'can be isolated and a redundant train initiated.

. . - __ _ _ _ _ . _ ~f l-21 __ - . __ _

(. y 'a' $

CPS-USAR

~

l .

l

' or component will not interfere with the proper operation of its redundant / diverse counterpart. '

(2) The ADS' system is separated from the HPCS system  ;

such that no break location within the normally pressurized portion of the HPCS influent line can

' damage any component considered essential to the

! operation of the ADS.

(3) The coolant injection po?tions of the ECCS are  !

separated into the following functional groups:

. a. .HPCS with shutdown service water,

b. One ADS + LPCS + 1'LPCI with RHR heat '

, exchanger and shutdown service water.

I l

c. 'One ADS + 2 LPCI with one RHR heat exchancer and shutdown service water.

l (4) The equipment in each group is separated from that in the other two groups. In 'd' CS e, ?m .4 (5) Sr94betbtrbN2 ersNPcoPrETFUX6'd between the functional groups as required to assure the environmental disturbances (such as fire, flood, i pipe rupture phenomena, falling objects, etc.) l affecting one functional group will not affect the i remaining groups. In addition, separation barriers are provided as required to assure that such disturbances '

n* ' #e Q***h

• IC and HPCS s stem x ks M the. uel a;l,(in , b;jiary b.

7.1.2.2.5 examwde Eleka ' phe1r3na r

ra t i on Cri t e r ia wt ..

!**g 3

-q 7.1.2.2.5.1 General For general plant criteria, see Subsections S.3.1 and 8.3.2.

7.1.2.2.5.2 System Se:a ration Recuirements Redundant sensory equipment for nuclear safety-related systems is  !

identified by suffix letters in accordance with Table 7.1-10. l This table also shows the allocation of senscrs to their separated divisions. l 7.1.2.2.5.2.1 Reac~ tor Protection System (RPS)

The following separation requirements shall apply to the RPS wiring.

4 4

7.1-53

_