AECM-81-413, Forwards Description of Sys Interaction Programs,Per Unresolved Safety Issues A-17

Forwards Description of Sys Interaction Programs,Per Unresolved Safety Issues A-17

ML20069B101
Person / Time
Site:	Grand Gulf
Issue date:	12/21/1981
From:	Dale L MISSISSIPPI POWER & LIGHT CO.
To:	Harold Denton Office of Nuclear Reactor Regulation
References
REF-GTECI-A-17, REF-GTECI-SY, TASK-A-17, TASK-OR AECM-81-413, NUDOCS 8112240104
Download: ML20069B101 (24)

Text

MISSISSIPPI POWER & LIGHT COMPANY Helping Build Mississippi P. O. B OX 164 0. J AC K S O N, MIS SIS SIP PI 3 9 E O S s.

NUCLE AA PROoUCDON DEPARTVENT Y

4,

\\

U. S. Nuclear Regulatory Cornission ggO

~\\

L

' M ii,

'i SS7gI" Division of L1 censing w q Office of Nuclear Reactor Regulation

~*.J'p;$.j;p.

i.

y s

Washington, D.C.

20555

/'

s Attention: Mr. Harold Denton, Director

,g p

SUBJECT:

Grand Gulf Nuclear Station Units 1 and 2 Docket Nos. 50-416 and 50-417 File 0260/0862 Ref: ".. AECM-81/290, 8/7/81

2. AECM-81/308, 8/21/81

3. AECM-80/316, 12/29/80

4. AECM-81/267, 7/31/81

5. AECM-81/291, 8/7/81

6. GGNS FSAR Unresolved Safety Issue A-17 Systems Interactions AECI-81/413 In response to a request received during our cecting with cembers of your Staff on August 27, 1981, we have reviewed our response to Unresolved Safety Issue A-17, Systems Interactions, submitted in AECM-81/290, dated August 7, 1981. We have evaluated our Systens Interaction program for Grand Gulf Nuclear Station in detail, and we conclude that appropriate attention and controls have been established from the project inception to allow for maxinum Systems Interaction efforts and awareness. The enalosed at*.achment delineates the GGNS program and various tasks that have been and will remain a portion of the Systens Interaction effort.

If you have any questions, please advise.

Yours truly, p

f. F. Dale L

j Manager of Nuclear Services of 3

RMS/SHH/JDR:ph Attacheents j

[

cc:

(See Next Page) 8112240104 811221 PDR ADOCK 05000 A

Member Middle South Utilities System

3 MI!OISSIPPI POWER O LIGHT COMPANY AECM-81/413 Page 2 cc:

Mr. N. L. Stampley Mr. R. B. McGehee Mr. T. B. Conner Mr. G. B. Taylor Mr. Victor Stello, Jr., Director Office of Inspection & Enforcement U. S. Nuclear Regulatory Commission Washington, D. C. 20555 l

l l

l I

1 I

l k

UNRESOLVED SAFETY ISSUE A-D SYSTEMS INTERACTIONS IN NUCLEAR POWER PLANTS BACKGROUND AND DEFINITIONS The term " systems interaction" has had a broad rarge of definitions since its inception in 1974. In their June 1981 report, "The Approach to Systems Interactions in LWRS," the NRC defined the characteristics of systems inter-action as follows:

1.

A system interaction could lead to the defeat of at least one basic safety function.

2.

Multiple failures from a system interaction are dependently caused through either a process coupling in the system design or a spatial coupling in the system layout.

3.

A system interaction is a precondition that causes systems to be simultaneously influenced which both serve a safety function and were intended to be independent.

The basic safety functions selected for the systems interaction program are listed below. These basic safety functions include the elements of both the systems and the actions they serve. A plant can fail a basic safety function without losing all the systems serving an action.

1.

The systems relied upon to maintain the primary coolant inventory shall be unimpaired.

2.

The systems relied upon to transfer decay heat from the reactor to the ultimate heat sink shall be unicpaired.

3.

The systems relied upon to render and keep the entire core suberitical shall be unimpaired.

A15ph1

. 4.

The Engineered Safety Features, including those for the control of radioactive material, ehall be unimpaired.

The NRC divides systems interactions into two basic categories based on their mode of coupling:

1.

Externally Caused.

Externally caused systems interactions are cocmon cause events initiated by external phenomena such as carth-quakes, tornados, fires, etc.

These types of spatial systems interactions are distinguished by systems sharing a spatial domain-which allows a single initiating event to couple the systems within that space.

2.

Internally Caused.

Internally caused systems interactions originate from a malfunction occurring within systems that are connected either through the sharing of components or a process coupling between the systems. Possible process couplings between systems include electrical, hydraulic, pneumatic, and eet.hanical connections.

Also included in this scope are " dynamic errors,"

i.e., those erroneous operator actions taken based on false or conflicting information because of failures or spurious indications on vital instrumentation.

PURPOSE The purpose of a systems interaction program is to ensure that a precondition within the plant does not exist that would fail a basic safety function as a consequence of both an intersystems dependency and an initiating malfunction.

On Grand Gulf, various measures are emplo;ed to ensure that adverse systems interactions will not occur. Early in the design, emphasis was placed on prevention through design reviews and project procedures.

In the current stage of the Project, emphasis is placed on detection through numerous A15ph2

-m programs which independently review the as-designed, as-built plant configura-tion.

EARLY EFFORTS

_j' During the initial design phase of Grand Gulf, emphasis was placed on proper design to prevent adverse systems interactions. This is accomplished wit'

.t the framework of documented project procedures.

The Project Procedures Manual and the Project Engineering Procedures' Manual provide the required guidance for interface between MP&L, CE, Be'chtel and s

vendors. Specifically, the Project Procedures Manual identifies the divislatit. -',

.f; s

of responsibility between MP&L, GE (NSSS supplier), Allis-Chalmers Powep.

,4 x, a --

r, Systems (ACPSI) (Turbine Generator supplier) and Bechtel. These respons$ bili-ay' ties consist of establishing Design Criteria, Final Design, Design Reviewy

(]'

s Procurement, T.nstallation and Testing Services, Start-Up Services, and Safety Sr 8

}

Analysis Reports. The Project Procedures Manual also identifies the Mzterial q

s i %

Assignment Schedule which specifies procurement responsibilities between MP&L, s T 3

Bechtel-Jobsite, and Bechtel-Gaithersburg. The Project Engineering Procedures Manual identifies Bechtel's design interface requirements. These requirementp control internal, external, and interdiscipline design review processes which T

.nelude interface between the Bechtel Engineering Team, MP&L, GE, A-CPSI, suppliers / subcontractors, and consultants. These processes contain provisions with regard to communications, documentation and change control.

In addition, the interface between Bechtel, General Electric, and Mississippi Power & Light is tracked by the Project control log. A control number from the log is assigned to any Q correspondence that requires action by the recipient. This control number enables the Q-item to be tracked and ensures a follow-up on any open item for which a response has not been received.

A15ph3

sc, y

?

a The fun. C ?

7 dauental plantidesign philosophy at Grand Culf is that safety-related

-v

- /

,n

>\\, systehs are to b( redundsat, independent, and spatially separated. The A

'm Splamenfation of this philosophy _is accomplished by the initial design and i

,A Q~

n'imerous design revieus as specified by Project procedures. Design provisions

\\.

include 1,acating safety-relcted equipment of redundant divisions within separats areas or rooms, minimicing the rse of shared safety-related components, eg

+

rou(ing power. and instrumentation cables for redundant divisions in separate racew'ays, 'and providing each safety-related division with its own safety-

. s.g _

' N r'el: tg d ' support-sygems. Adversehpntialandprocesscouplingsystemsinter-y,

,g-action's 'are brt* er precluded by detailed design checks, multi-discipline q

g

\\ ';

l desjgn ;eviews on and off Project, and multi-organization reviews.

j:m j -

-1 y Cer. s\\.

tain ' aspects of huma factors considerations were employed in the initial A

desi'gn of the control room. Criteria were established for the functions to be

~

performed from the control room and specific functions to be performed at l

variouscontzolpanels.

System controls and displays were assigned tc cach t

.s panel in order to be able to carry out the design functions. Controls,

.g displays, and annuncictors for each system were located together and in a logic 31 fauhion. Mimics were used where appropriate. Consistunt color coding and left-right switch and indicating light positions have been used throughout the control room. The result has been a well-designed control room for which only minor changes have been iraplemented as a result of the formal human

$actorsreviewprocess.

y In 1975 and 1976, MP&L conducted a design review of all plant systems. Prelinin-ary designs were reviewed by examining mechanical, electrical, civil, and instrumentation and control design documentation. The purpose of these reviews was was to examine the systems for operability, maintainability, and A15ph4

-7..

The ERT is composed of representatives from Mechanical, Electrical, Control Systems, Plant Design, Light Structures, Field Engineering and other disci-plines as determined by the Project ERT coordinator.

- The walkdown is performed on a room by room basis. Room numbers are carried through on each document generated by the ERT.

Upon completion of the walkdown of a given area, the ERT signs a walkdown cover sheet, safety-related equipment list sheet, and any particular ERT reports pertaining to that area. These items are filed as a package in the Project files. Any ERT reports are logged, assigned for disposition, and eventually added to their respective room packages after being closed out.

Project procedures explicitly outline the steps to be taken to ensure'the proper flow of documentation resulting from ERT walkdowns.

The preliminary ERT walkdowns have been completed. The purpose of the prelimin-ary walkdown was to identify the majority of problems early, in order to allow time to correct the condition. The areas walked down were approximately 90%

complete. These walkdowns resulted in a total of 808 reports. Approximately 75% of these reports have been closed out.

The majority of these reports identified "11 over 1" concerns as the hazardous condition; these are presently being corrected. The final walkdown is to assure that no additional hazardous conditions were caused during the completion of an area.

A brief discussion of the ERT cffort was provided to the NRC in Reference 1.

2.

Instrumentation and Control Systems In order to examine the potential for adverse spatial, process coupling, and human systems interactions in this arca, several sub-programs, as described below, have been implemented.

A15ph7

. a.

Control Systems Failures This study covers the spatial, process coupling and human types of systems interactions.

In this study, a list of control systems have been established (e.g., pressure regulator system, feedwater control system, etc.) which upon failure could cause the consequences of transients and accidents evaluated in Chapter 15 of Reference 6 to be more severe. An evaluation of the spectrum of control grade system feilures was performed. This evaluation was based on control grade system failures only (those instruments that are not safety-related) and common sensor line failures.

The power source for each instrument causing the event to cecur was determined. These power sources were then tabulated not only by individual breakers but also through the Motor Control Center (MCC) and to the load control center and to the specific bus.

This information is being evaluated as to the effect of multiple control systems failures due to the loss of a common power supply.

The results of these control system failures are compared to the Chapter 15 analyses.

If the control systems failures are not bounded by Chapter 15 events, the analysis will be added to Chapter 15 or modifications will be administered such that the safety limits are not violated. The intent of the progran is to verify that the design of Grand Gulf is enveloped in the accident analysis presented in the FSAR. The study is scheduled for completion prior to fuel load. This study and its scheduled completion have been identified to the NRC in Reference 2.

b.

lE Bulletin 79-27 This study covers the spatial, process coupling, and human types of systems interactions, This study identified (by MCC) the safety and non-safety-related equipment / instruments from each breaker on the MCC; identified power failure modes (i.e.,

control power loss, fuses, power supplies, A15ph8

, inverters, etc.); and listed all control room indications / alarms, control. devices (i.e., instrument power supplies, pumps, valves, etc.), all instruments receiving power through that failure device, any other indications available (i.e. ' valve status lights going out, indicators reading downscale, upscale, etc.), the primary effects of each failure (i.e., what has been immediately lost), the secondary effects caused by the primary effects (evaluated until no additional secondary effects can be postulated), and any remarks (i.e., redundant system available, etc.) as a result of the failures.

This information is presented on over 450 drawings (grouped together by MCC). Failures in the NSSS or steam turbine areas have been evaluated. All power failures and primary effects have been evaluated and all the drawings have been completed. FT&L is presently using these drawings to review plant operating procedures. The evaluation of the primary and secondary effects is scheduled for completion prior to fuel load. The results of the procedural development, procedure review against the above evaluations and any forthcoming modification will be completed prior to the end of the first refueling outage. This study and its scheduled completion have been identified in Reference 2.

c.

Human Factors This study covers human types of systems interactions, and the scope has been limited to the control room design.

MP&L contracted with an independent human factors engineering consultant, the Ersex Corporatit.4, to conduct a human factors engineering evaluation of the Grand Gulf control room. The purpose of this evaluation was to identify and prioritize human engineering discrepancies and to recommend possible corrections. Action has A15ph9

' ~

been initiated to correct s'ome of the major findings, such as the annunciator clearing sequence and reflash capabilityi In addition,.

an extensive panel label and mimic replacement has been undertaken.

Thefresults of the study and the corrective action were sent to the I

NRC's Humsn Factors Engineering Branch which conducted a. design review / audit'of the Grand Gulf control room. The NRC identifiedL I-additional human engineering discrepancies'and' assigned priorities to these items. MP&L and the'NRC have reached agreement on which' items must be corrected prior to fuel. load (References 4 and 5)._

i The final, complete review of the control room design must be completed within one year of the issuance of NUREG-0700, as required-by the NRC.

t i

A detailed plan for accomplishing the. review is being prepared.

d.

IE Notice 79-22 This study is intended to caver spatial and process coupling types and systems interactions.- A matrix is being developed which shows the effects, if any, of high energy line breaks on control systems. If interaction is discovered, the impact of failure of the applicable system on the safety' analyses will.be evaluated. The stu'dy:is scheduled for, completion prior to fuel load. This study and its scheduled completion date have been identified in Reference 2.

3.

Fire Protection - Safe Shutdown Analysis To ensure that adverse spatial and process coupling systems interactions would not exist, a safe shutdown analysis was performed for all areas of the plant in which safety-related-equipment, components, or cables'are installed. Specifically, the-intent of the safe shutdown analysis was to ensure that no single fire will A15ph10

. prevent the plant from being safely shut down and from being maintained in a safe shutdown condition. Safety-related equipment areas reviewed during the safe shutdown analysis are located in the auxiliary, control, containment, diesel generator, and standby service water pumphouse buildings.

For each area, the analysis addressed possible ignition sources, installed and transient combustibles, and flame spread. Where inherent design features of safety-related-equipment and installation were not adequate to comply with the Grand Gulf defense-in-depth fire protection design concept, additional fire protection measures were provided.

To protect against the possibility of an exposure fire affecting redundant safe shutdown-related cables in Division 1 and Division Il concurrently, the routing of all safe shutdown-related cables in either conduit or trays was evaluated as part of the safe shutdown analysis.

Safe shutdown-related cables were identified as those cables necessary to ensure the function of the minimum safety-related equipment necessary to bring the plant to a cold shutdown condition and maintain the plant in a safe condition after shutdown.

The equipment identified either: is operable from both the control room and the remote shutdown panel; is automatically started without operator action; or, as in the case of ECC3 room coolers, is started automatically when the associated safety-related

' omponent is started automatically or manually from either operating c

station. Cables' analyzed for the effects of an exposure fire are part of the folivaing systems:

a.

Automatic Depressurization System, A and B b.

Residual Heat Removal System; A, B, and C, LPCI, Suppression Pool Cooling, and Decay Heat Removal Modes c.

Reactor Core. Isolation Cooling System A15ph11 d.

Standby Service Water System, A and B e.

Diesel Generators, A and B f.

ECCS Rooms HVAC g.

ESF Switchgear HVAC h.

Standby Service Water Pump House HVAC i.

Diesel Generator HVAC j.

All indicating instrumentation common to the remote shutdown panels and the control room To ensure that a postulated exposure fire can not increase the probattlity of a loss of coolant accident, cables essential to maintaining isolation at the primary coolant high to low pressure interfaces were also included in the exposure fire analysis.

l Each exposure fire area was investigated by analysis and by walkdown of problem areas, for the routing of any Division I or Il cable associated with the above listed safety-related systems, whether the cables were routed in trays or conduit. The identified cables were then reviewed to determine whether the cable was essential to safe shutdown and, where cables in Division I and II were routed through the same or adjacent exposure fire areas, a redundancy evaluation was performed.

The results of analyses are reported in Reference 6, Appendix 9A, Section 7.

4.

Internally Generated Missiles In order to examine the potential for adverse spatial systems interactions in this area, a complete evaluation, supplemented by site walkdowns as part of the ERT, were conducted. The following criteria were used for the evaluation of internally generated missiles (IGMs):

A15ph12

'a.

No loss of containment function b',

.No direct loss of reactor coolant c.

No loss of-function-to systems required'to shut down the reactor and' f

~

maintain it in a safe shutdown condition, or mitigate.the consequences of the missile damage. assuming:

I

^

(1); No. equipment is allowed to be damaged in'one safety-related-

~

division, e.g., Division 1, from internally generated missiles originating from another safety-related division, e.g.

Division 2.

(2) ' Missiles: generated from non-safety-related equipment shall not damage'any safe shutdown equipment.

l (3) Offsite power is not assumed to be in operation during the p-shutdown of the plant.-

d.

No offsite exposure exceeding the guidelines of 10 CFR 100 e.

No loss offintegrity of the' spent fuel pool i

-Protection of essential structures, systems, and. components to meet the above criteria is afforded by one or more of the following methods:

+

a.

Locating the system or component in an individual missile-proof ~

structure

.. b.

Ph'ysically separating redundant systems or components of the system away'from the missile trajectory path or calculated range c'.

Providing' localized' protective shields or barriers for systems and components.

~

A15ph13 m

u 1

4

• d.

Designing the particular structure or local protective shield / barrier to withstand the impact of the most damaging missile e.

Providing design features on the potential missile source to prevent missile generation f.

Orienting the potential missile source in such a manner as to prevent unacceptable consequences due to missile generation There are two general categories of postulated-IGMs; they are rotational and pressurized sources.

The following is a brief description of missile selection.

a.

Rotational. Missile selection was based on th'e following conditions:

(1) All rotating components not having synchronous motors which operate during normal operating plant conditions were considered capable of becoming missiles.

(2) All rotating components not having synchronous motors that operate during norral plant conditions have been evaluated to determine if their couplings can become missiles. The motors will not become missiles because the rotation speed is limited to within design speed should the coupling suffer instantaneous failures. The pump impeller or fan blades will not become missiles during coupling failures because braking forces applied by the process fluids will limit the rotational speed to less than the normal operating speed should a coupling failure occur. The coupling will remain inside the pump coupling guard or fan housing should the coupling fail.

The following general categories of system rotating components were reviewed:

A15ph14

. (1) Pumps (2) Fans (3) Compressors (4) Turbines b.

Pressurized. Missile selection was based on the following conditions:

(1) Precsurized components in systems whose service temperature exceeds 200 F or whose design pressure exceeds'275 psig were evaluated as to their potential for becoming a missile.

Piping which exceeded 200 F or 275 psig for 2 percent or less of the time the system is in operation (or if the system was exposed to pressures or temperatures higher than the above limits for less than 1 percent of plant operation) was excluded' from missile evaluation.

(2) A single failure of any fitting, weld, er component in these systems that could result in a postulated missile was considered.

In cases where multiple failures must occur before a postulated missile is generated, these cases were not considered in the evaluation.

In general, the majority of cases where missiles were postulated, resulted in one of the following conclusions:

a)

Barriers were required, or b)

Consequences were acceptable.

In addition, the effects of secondary missiles (i.e., missiles generated by targets (e.g., components) impacted by postulated internally generated missiles) were evaluated.

A15ph15

. Further details are provided in Reference 6, Section-3.5.

5.

Pipe Whip Evaluation The evaluation of high energy pipe whip begins early in the job to facilitate the design and installation of pipe whip restraints. The magnitude of pipe whip loads must be factored into the building design since it is often the governing local load. This evalua-tion focuses on the potential for adverse spatial systems interactions.

Associated with the necessity to define restraint locations early, was the conservative determination of the number of breaks without the benefit of the results of final pipe stress analysis. Breaks were postulated throughout the high energy piping systems to provide a conserva-tive pipe break protection program. An evaluation was performed to determined those components affected by the whip, and to assess the protection required from a spatial and functional standpoint.

This involved a multi-discipline review.

Pipe whip restraints were then installed to protect all components required to safely shut down the plant or nitigate the cons 2quences of a LOCA.

In the later stages of construction, field routed components were also reviewed to assure that components required to safely shut down the plant or mitigate the consequences of a LOCA, were not located in the region of travel of the broken pipe / whip restraint system. Additionally, y

a11' unrestrained high energy pipes were reviewed to assure that components routed in the later stages of construction are not adversely affected by them. Those unrestrained pipes are minimal and are located in areas adequately separated from important components. These reviews involve field walkdowns as part of the ERT cffort.

A15ph16

. Final stress analysis results will be reviewed in November 1981, to verify that"the break locations have 'not changed. ~ These commitments appear in Reference 6, Section 3.6 and Appendix 3C.

6.

Pipe Break Flooding Review Flooding due to pipe break, was reviewed on a room by room basis to ensure that adverse spatial systems interactions would not occur. Consideration was given to open floor grating, vent shafts, pipe classes, waterproof doors, etc., in assessing the msximum possible flood level for the worst break or crack. Any flooded components important to safe shutdown were evaluated by the respective discipline.

Based on spatial considerations and functionality, the components were either relocated or their water tightness demonstrated.

Since most rooms have the provision to drain, the. lowest elevations were most susceptible.

The results of the review are provided in Reference 6, Appendix 3C.

Additionally, confirmation of design adequacy is part of the ERT effort.

7.

Jet Impingement and Spray Evaluation in order to examine the potential for adverse spatial systems interactions in this area, two sub-programs-have been implemented.

Jet impingement is one of the phenomena associated wit.h high energy a.

line break. The evaluation was performed through the use of piping composite drawings specially prepared to show the jet impingement These drawings are routed to each discipliner including field cone.

engineering to perform 'nter-discipline reviews to establish whether the important impacted items are capable of withstanding the jet force and wetting, or whether they require protection. Protection was primarily in the form of barriers or spray shields. However, some impacted components were relocated.

A15phl7

~_.

[ '

4

.The' primary check of the design was accompl'ished by the ERT which-traced each jet cone during walkdowns. The evaluation is: forecast for completion in October 1981.

The commitment to evaluate and. protect the components from jet impingementLeffects appears in Reference 6, Section 3.6.

b.

-Spray originates from the moderate energy pipe crack and is usually

~ of little~ consequence in areas such'as the containment where equip-ment is designed to withstand the more limiting effects of high energy line breaks. Reviews were performed and the results published in Reference 6, Appendix 3C for all buildings.-

A. final check was conducted during.the ERT walkdowns. Only a few spray shields were l

required.

8.

Analysis of Non-Seismic Equipment and Components (Category II) over Spismic-Categoyy I Equipment and Components-(II/I) To the 4

extent possible, separation of safety and non-safety-related equipment

'has been utilized to eliminate interaction between the two categories of systems. However, separation is not always a practical solution.

In' order to evaluate the potential for adverse spatial systems interactions and.to identify situations where separation cannot be provided, a failure modes analysis was performed. This analysis identified non-safety-related components and equipment which, upon failure, could have a, detrimental.effect on safety-related equipment. Equipment identified during tFe analysis was supported in!accordance with the criteria discussed below.

Although there is no specific requirement.to' maintain the pressure boundary integrity-of non-seismic (Category 11) piping in a:II/I A15ph18

n

._ configuration,'the structural integrity-of the piping and its support

. system is. maintained. :In order to accomplish this, the pipe stresses due-

- to the: faulted loading combinations were.kept below 'a.value of 2.4 S

^(from Code Case 1606) and piping deflections were kept within a' reasonable-value.

In addition, stresses' during ' normal operating conditions were

.kept within. normal operating allowables.

Pipe supports were_ designed using the total maximum faulted loads. -'The stress allowables for support-

-~

~

members did not exceed the' limits specified in ASME Section III, Sub-section NF.

J The above procedure has been followed'for all 11/1 piping analysis. Some:

analyses are still in process. All II/I analyses will.be complete. prior'-

to fuel load. The confirmation of the II/I design and the need for1 further analyses is determined during.the-ERT.walkdowns.

l I

9.

IE Bulletin-80-11 S>bsequent to the issuance of the NRC's information

{

request on Category I masonry walls, dated April 21, 1981,~ IE Bulletin:

4 80-11 was originated. Although:this' bulletin applies only-to power-reactor facilities with an operating license, a reevaluation of concrete -

masonry walls in Category I structures at Grand Gulf was initiated to-ensure that adverse spatial systems interactions did not exist.

To'date, the following work has been completed:

A comprehensive field survey was conducted between November-1980:and a.

January 1981..This survey identified all safety-related items p

attached to or located in proximity to masonry walls at that' time.

i

~

In addition, data was recorded to determine the wall geometry, location of penetrations and type of closures, location and magnitude of attachment loads, type of wall support, and any' additional information which could affect the structural integrity of.the j

Ewalls.-

+

"A15ph19

p

' b..

Upon completion of the survey, the information obtained was.used to'

.re-evaluate the ability of these walls to perform their intended function. during.all post'ulated loadings, without impairing the

~ integrity of Category I systems and components attached to or in

. proximity to these walls. Criteria were generated for the.re-evalua-tion, which consider present state-of-the-art analysis and design techniques, as well as licensing commitments contained in the FSAR.

c.

Any masonry walls which.did not conform ~with the criteria were modified as required, and-appropriate design drawings were issued to implement these modifications.-

During the fall of 1981,-a'second field survey was initiated. The purpose of this survey is to identify. any additional wall attachments or changes in wall configurations subsequent to the first. survey. The walls will then be re-evaluated as necessary, and modifications,.if required, will be issued.

In' December,1981, a formal report will be submitted on the re-evaluation of concrete masonry walls at Grand Gulf. This. report will contain all information requested in IE Bulletin 80-11, as well as a comparison of the Grand Gulf masonry wall design criteria with Revision'l of the NRC's "SEB Interim Criteria for Safety Related Masonry Wall Evaluation" (July 1981).

10.'. NUREG-0588 During early 1981, Grand Gulf reviewed the adequacy of all safety-related electrical equipment against the environmental qualifica--

tion criteria of NUREG-0588. Although the primary focus of the ef fort

~

vas. equipment enviro 1 mental qualification,.the review provided assurance LA15ph20:

-.; that adverse spatial and human systems' interactions would not' occur'in the folicwing areas:

a.

'An initial step in the review consisted of developing room-by-room environmental conditions in the containment and auxiliary building as a result of high energy line breaks. These environmental-condi-tions were used to confirm that. safety-related electrical equipment was,'in fact, qualified for its intended safety function. Forther-more, the resulting environmental conditions confirmed that the plant was designed so that a high energy.line break' would -not simultaneously inhibit the operation of redundant safety-related divisions.'

.b.-

As part of the' effort, display instrumentation'in the plant emergency procedures was listed. The-adequacy of the instrumentation-

's qualification was'then reviewed to ensure that, following a.high energy line break, erroneous indications would not mislead the-operator.

The results of the Grand Gulf NUREG-0588 review were provided to the NRC' in a 4-volume submittal on July 1, 1981.

11.

NRC Inspection and Enforcement Documents Each event significant to nuclear plant safety which occurs at an operating plant, including those events involving or due to systems interaction, is reported on an NRC' Inspection.and Enforcement Bulletin, Circular or Infornation Notice.

Examples of IE Documents pertinent to systems interaction include seismic analysis of' piping (IEB & IEN 79-14), anchor bolt analysis (79-02),

masonary walls analysis (IEB 80-11), snubber surveillance (IEB 81-01),

A15ph21~

l

~

-22--

equipment-floodingE(1EC 78-06), and'several which address component

-defects concerning multiple systems.

As-required per MP&L Internal Procedures, all-NRC Inspection and Enforce-ment Bulletins, Circulars and information Notices are evaluated for applicability to GGNS and corrective actions are implemented to preclude occurrenceofsimilar. events,minimizetheir[impactornitigatetheir effects.

. Reviewers of.IE Documents include General Electric, Bechtel, Plant Staff, Nuclear Plant Engineering, Quality Assurance', Licensing or~ any group or.

~.

contractor providing input.to GGNS design, construction 'or operation.

Complete files of transmittals, responses, details of corrective actions-implemented, and closeout documents are establishe'd by MP&L's Nuclear f

Safety Group..

4 CONCLUSION The discussions above described the MP&L program to prevent and' detect adverse systems interactions. As can be seen, numerous sub-programs (IE Bulletins,.

Notices,. Circulars, etc.) representing the expenditure of tens of thousands of

. engineering hours, provide this. assurance, independent of the extensive-efforts early in the design phase to prevent adverse interactions. The:

4 e

results of this program give a high degree of confidence that'no adverse systems intractions will occur on Grand Gulf.

+

I i

i i.

i l

1A15ph22:

a