ML043450332
| ML043450332 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 12/03/2004 |
| From: | Widay J Constellation Energy Group |
| To: | Clark R Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| Download: ML043450332 (112) | |
Text
Joseph A. Widay 1503 Lake Road Plant Manager Ontario, New York 14519-9364 585.771.3000 Constellation Energy R.E. Ginna Nuclear Power Plant, LLC December 3, 2004 Mr. Robert L. Clark Office of Nuclear Regulatory Regulation U.S. Nuclear Regulatory Commission Attn:
Document Control Desk Washington, D.C. 20555-0001
Subject:
Response to Request for Additional Information (RAI) dated November 9, 2004, Regarding the Proposed Control Room Emergency Air Treatment System (CREATS) Modification R.E. Ginna Nuclear Power Plant Docket No. 50-244
References:
- 1. Letter from Robert C. Mecredy (RG&E) to Robert L. Clark (NRC) dated May 21, 2003, License Amendment Request Regarding Revision of Ginna Technical Specification Sections 1.1, 3.3.6, 3.4.16, 3.6.6, 3.7.9, 5.5.10, 5.5.16, and 5.6.7 Resulting From Modification of the Control Room Emergency Air Treatment System and Change in Dose Calculation Methodology to Alternate Source Term.
- 2. Letter from Robert L. Clark (NRC) to Mary G. Korsnick (R.E. Ginna NPP) dated November 9, 2004, Request for Additional Information Regarding R.E. Ginna Nuclear Power Plant License Amendment Request Relating to the Control Room Emergency Air Treatment System Modification (TAC No. MB9123).
- 3. Letter from Robert C. Mecredy (RG&E) to Robert L. Clark (NRC) dated April 22, 2004, Design Information for the Proposed Control Room Emergency Air Treatment System (CREATS) Modification.
- 4. Letter from Robert C. Mecredy (RG&E) to Robert L. Clark (NRC) dated December 1, 2003, Addendum to License Amendment Request submitted May 21, 2003.
Dear Mr. Clark:
On May 21, 2003 Ginna submitted Reference 1 related to the Control Room Emergency Air Treatment System (CREATS) modification and conversion to Alternate Source Term (AST). The attachments to this letter provide a response to the Request for Additional Information (RAls) contained in Reference 2, including an addendum to Reference 4 revising Technical Specification Table 3.3.6-1 to reflect the new setpoint methodology. This information demonstrates that the Dose Analysis, CREATS Equipment Qualification, Cable Separation, and Control Room Radiation Monitor Analytical Limit are being appropriately addressed.
Acbl leo IcaD
Very truly yours, se h A. Widay STATE OF NEW YORK TO WIT:
COUNTY OF WAYNE I, Joseph A. Widay, being duly sworn, state that I am Acting Vice President - R.E. Ginna Nuclear Power Plant, LLC (Ginna LLC), and that I am duly authorized to execute and file this response on behalf of Ginna LLC. To the best of my knowledge and belief, the statements contained in this document are true and correct. To the extent that these statements are not based on my personal knowledge, they are based upon information provided by other Ginna LLC employees and/or consultants. Such information has been reviewed in accordance with company practice and I believe it to be reliable.
Subscribed and sworn before me, a Nctary Publi£ n and for the State of New York and County of j
,this.5tl day of 1
0 0
04.
WITNESS my Hand and Notarial Seal:
/9J 1
Notary Public SHMRON L MILLER My Commission Expires:
01M160177 Date Attachments:
- 1.
Response to RAls
- 2.
Topical Design Basis - Electrical Independence
- 3.
Representative Analysis - New CREATS Cables
- 4.
Representative Analysis - Existing Cables
- 5.
Design Analysis DA-EE-2000-009, Revision 1
- 6.
Revised Submittal - Tech Spec Table 3.3.6-1
Cc:
Mr. Robert L. Clark (Mail Stop 0-8-C2)
Project Directorate I Division of Licensing Project Management Office of Nuclear Regulatory Regulation U.S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Rockville, MD 20852 Regional Administrator, Region 1 U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406 U.S. NRC Ginna Senior Resident Inspector Mr. Peter R. Smith New York State Energy, Research, and Development Authority 17 Columbia Circle Albany, NY 12203-6399 Mr. Paul Eddy NYS Department of Public Service 3 Empire State Plaza, 10 th Floor Albany, NY 12223 James M. Petro Jr.
Counsel, Generation - Nuclear Constellation Energy 750 East Pratt Street, 17th Floor Baltimore, MD 21202 Response to RAls
ATTACHMENT 1 REQUEST FOR ADDITIONAL INFORMATION R. E. GINNA NUCLEAR POWER PLANT CONTROL ROOM EMERGENCY AIR TREATMENT SYSTEM R. E. Ginna Nuclear Power Plant, LLC proposed design modifications to the Control Room Emergency Air Treatment System (CREATS), the Control Room Emergency Cooling System (CRECS), and the Containment Post Accident Charcoal Filters are based on the full scope implementation of the alternate source term (AST). The Nuclear Regulatory Commission staff has reviewed the license amendment request and has determined that the following additional information is needed.
- 1.
Dose Analysis Section 2.2 of Attachment 1 to Constellation Energy's July 14, 2004 letter states that discharges from the atmospheric relief valve (ARV) pathway were used to model a steam line break accident with the steam generator intact. However, a description of the radiological analysis for this accident has not been provided in Attachment 1. Please provide a description of the radiological analysis for the steam line break accident.
Response
The control room dose analyses use the x/Q for the for the ruptured steam header, for both the steam header and the intact SG ARV locations. The steam header x/Q values are slightly smaller than the ARV values, but the doses for the steam line break are dominated by the releases from the faulted loop steam header. The intact SG ARV accounts for only about 2% of the total activity release. If the activity releases for the steam header and intact SG (ARV) are separated and appropriate control room x/Qs applied to each, the total control room dose is estimated to increase by about 2.5%. For example, the CR dose for the accident initiated spike case will increase from 0.632 rem to approximately 0.65 rem. As such, using the same x/Q for both release points provides acceptable results even though it is a small non-conservatism, and has a minimal impact on the result as compared to the available margin to the 5 rem TEDE limit.
Section 2.6 of Attachment 1 to Constellation Energy's July 14, 2004 letter states that the tornado condition atmospheric dispersion factors at the Exclusion Area Boundary (EAB) were calculated using a distance-to-receptor value of 503 m. Please justify why the shortest EAB distance listed in Ginna Updated Final Safety Analysis Report, Table 2.3-20 (450 m for the SSE, S, and SSW sectors) was not used.
Response
The EAB distance of 503 meters, as stated in UFSAR Section 2.3.4.2.1, was the distance used by the NRC when calculating x/Q values during the Systematic Evaluation Program (SEP),
Topic 1l-2.C. The shortest EAB distance per the above mentioned UFSAR table is 450 meters.
Page 1 of 8
ATTACHMENT 1 If recalculated based on 450 meters, the x/Q value increases slightly to 2.17E-6 sec/m3. Using this x/Q, the dose at the EAB increases from 2.16E-2 rem to 2.51 E-2 rem, which is less than 1%
of the 6.3 rem dose acceptance criteria. Therefore, the results of the analysis are not significantly affected.
In your response, dated July 14, 2004, you assumed no fuel melt for the rod ejection accident analysis. However, Ginna Updated Final Safety Analysis Report, Table 15.4-3, "Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident, " assumes that the fuel melt is less than 10%. Using an appropriate fuel melt assumption for this design bases event, please provide a sensitivity analysis of the radiological consequences.
Response
Ginna UFSAR Section 15.4.5.6 does not quantify a melted core fraction, but only a failed fuel fraction. The 10% failed fuel and 0% fuel melt assumptions used in the analysis were referenced from the Ginna SEP (topic XV-12). In subsequent phone conversations, the NRC Reviewer suggested that 0.25% melt fraction was a typical and appropriate assumption. If the suggested 0.25% melt fraction is assumed, the calculated doses are:
EAB LPZ Control Room (Limit = 6.3)
(Limit=6.3)
(Limit=5.0)
W/O Fuel Melt 6.64e-01 2.03e-01 1.06e+00 With 0.25% Melt 7.59e-01 2.31e-01 1.19e+00 As can be seen from the above, the increase in calculated dose is minimal as compared to the established limit and does not significantly affect the results of the analysis.
In your response, dated July 14, 2004, you included the Gas Decay Tank Rupture as a design bases event. Since there is no change in the source term for the Gas Decay Tank Rupture Analysis, the staff believes that this event need not be re-analyze using the AST.
In addition, the staff does not consider this accident to be a design bases event. It is not listed or addressed in RG 1.183 or Standard Review Plan 15 and should, therefore, not be included in the license amendment request. Based on the above reasons, the staff recommends that this event be excluded from the license amendment request.
Response
The analysis was performed primarily to evaluate the control room dose using the new x/Q for the different operating modes of the new CREATS. The source term was not changed from previous analysis. Therefore, this analysis is not within the scope of the alternate source term (AST) conversion, and does not require NRC review for that purpose.
Page 2 of 8
ATTACHMENT 1
- 2.
CREATS Equipment Qualification In your response, dated July 8, 2004, to RAI, No. 1, you stated that (a) Dampers and Duct Work in the Relay Room Annex, (b) Dampers and Duct Work in Stairwell, and (c) the Filter Units in the Relay Room Annex were seismically qualified in accordance with IEEE 344-1987, "IEEE Recommended Practices for Seismic Qualification of Class IE Equipment for Nuclear Power Plants." Please provide a brief description of the method of analysis and the acceptance criteria used.
Response
(a) Relay Room Annex Dampers and duct work:
Dampers were qualified by analysis following the recommended practices of IEEE-344/87. The Equivalent Static Coefficient method was used to develop seismic loading and perform the analysis. These analyses were performed by SSM Industries, are documented in seismic qualification report # 153-QS-03-2851, and comply with the requirements of Ginna Station specification ME-326.
Ductwork is qualified by analysis following the recommended practices of IEEE-344/87.
A finite element model was developed and an Equivalent Static method applied to develop seismic loading and perform the analysis. These analyses were performed by SSM Industries, are documented in seismic qualification report # 153-QS-03-2851, and comply with the requirements of Ginna Station specification ME-326 (b) Stairwell Dampers and duct work:
Dampers are qualified by analysis following the recommended practices of IEEE-344/87.
The Equivalent Static Coefficient method is used to develop seismic loading and perform the analysis. The analysis was performed by SSM Industries, documented in seismic qualification reports SSM # 163-QS-99-1899, and complies with the requirements of Ginna Station specification ME-326.
Duct work, dampers and corresponding damper supports will be added in the stairwell adjacent to the control room. The new equipment will be connected to existing duct work to complete the flow paths. Design analysis CEG DA-ME-2004-034 addresses seismic qualification of added dampers, duct work, and corresponding supports. The Equivalent Static Coefficient Method is used to develop seismic loading and perform the analysis. The analysis complies with the requirements of Ginna Station specification ME-326.
The new equipment is designed such that it does not add load to the existing duct work, and in fact acts to stiffen the existing ducts because of the well-supported dampers Page 3 of 8
ATTACHMENT 1 added to the span. Therefore, no additional analysis is being performed for the existing ductwork.
(c) Relay Room Annex Filter Units (components and housings) are qualified by analysis, by AAF International Report # NESE 1110. An ANSYS finite element model was developed and run.
Response spectra runs were made using the appropriate response spectra curves. The analysis and acceptance criteria comply with the requirements of Ginna Station specification ME-326.
In your response to RAI No.5, you stated that Ginna Design Specification ME-326 is used only for components located inside the Control Room and Relay Room Annex. Please provide criteria for the design of the air conditioning units mounted on the roof of the Relay Room Annex including seismic and design basis tornado wind loads.
Response
The air conditioning units mounted on the roof of the relay room annex were seismically tested in accordance with the requirements of IEEE 344-1987 and are documented in TRENTEC report # 4Q007. Load combinations contained in design criteria for PCR 2000-024, Revision 1 (previously submitted on February 16, 2004), were considered for the tornado wind load qualification of these units, as documented in CEG DA-ME-2004, Revision 0.
In addition, please provide the status of the qualification effort including the appropriate 10 CFR 50, Appendix B documentation for all equipment affected by the modified CREATS and CRECS systems.
Response
The below table has been revised/expanded from that shown in the above-mentioned July 8, 2004 response to show the requested level of detail.
Table of Equipment and Seismic Qualification Equipment Equipment Qualification Status of Testing/Analysis Location Method CREATS Fans Relay Room Testing Test performed by TRENTEC Annex IEEE 344-1987 report # 3Q028 (Complete)
Page 4 of 8
ATTACHMENT 1 Interconnecting See Ref. 3 See Ref. 3 DA-CE-2003-067 (Complete) duct/pipe DA-CE-2003-068 (Complete) between Control Room and Annex Dampers Control Room Analysis Analysis Qualification reports:
above IEEE 344-1987 SSM # 163-QS-03-2851 (In Progress) suspended Spec. ME-326 ceiling Dampers Relay Room Analysis Analysis Qualification reports:
Annex IEEE 344-1987 SSM # 153-QS-03-2851 (In review)
Spec. ME-326 Dampers Stairwell Analysis Analysis Qualification reports:
IEEE 344-1987 SSM # 163-QS-99-1899 (In review)
Spec. ME-326 Duct Control Room Analysis Analysis report:
above EPRI 1007896 CEG DA-ME-2003-064 (Complete) suspended Spec. ME-326 CEG DA-ME-2004-039 (Complete) ceiling Duct Relay Room Analysis Analysis Qualification reports:
Annex IEEE 344-1987 SSM # 153-QS-03-2851 (In review)
Spec. ME-326 Duct Stairwell New - Analysis CEG DA-ME-2004-034 (Complete)
Spec. ME-326 Existing See (b) above Filter Units Relay Room Analysis AAF International Report #
Annex IEEE 344-1987 NESE 1110 (In review)
Spec. ME-326 Heaters Relay Room Test Test performed by Nutherm Annex IEEE 344-1975 Qualification report #
(as endorsed by AAF-9099R (Complete)
Reg Guide 1.100 rev. 1)
Motor Control Relay Room Test Spectrum Technologies report #
Center (MCC)
Annex IEEE 344-1987 QTR04POO90 (Complete)
Molded case circuit breakers and transformers Page 5 of 8
ATTACHMENT 1 Thermostats Control Room Test TRENTEC report # 4Q034.1 IEEE 344-1987 (Complete)
Relays Various Test AREVA Framatome ANP, Inc. Report IEEE 344-1987 (Complete)
QR04-05 rev 1 (Complete)
Timers Relay Room Test TRENTEC REPORT # 61393.0 Annex IEEE 344-1987 (Complete)
Switches and Control Room Test United Controls indicators IEEE 344-1987 NQR-VCI-002, Rev 0 (Complete)
NQR-1930, Rev 0 (Complete)
CGDS-208, Rev 6 (Complete)
Air conditioning Relay Room Test Test performed by TRENTEC unit Annex IEEE 344-1987 report # 4Q007 (Complete)
- 3.
Cable Separation The following questions are with regards to your letter dated March 8, 2004, concerning cable separation and fault protection.
Are all Train A and B cables for the CREATS modification routed in separate cable trays or conduits? If the same cable tray is designated for both trains, please clarify how physical separation will be maintained in accordance with your licensing bases.
Response
With the exception of two trays, all cables are routed in separate cable trays or conduits. In these two instances, although the same tray is used for both cables, different portions (lengths) of the tray are used. A detailed description of both instances where the same tray is used for both trains is provided below:
Tray 28N: This tray runs directly under the Auxiliary Benchboard (ABB), (beneath the floor) for the full length of the ABB. The penetrations from the Relay Room up through the floor into the ABB can only be accessed from Tray 28N. Therefore, all cables, from both trains, that enter the ABB must be routed in Tray 28N. The penetrations to be utilized for CREATS cables have been selected so that A train cables enter through Penetration CR-1 48-P in the west end of the ABB, while B train cables enter through Penetration CR-41-P in the center section, east of CR-149-P. Those penetrations are approximately 12" apart. From there, A train cables are routed directly west and B train cables directly east in Tray 28N, directly away from each other.
Therefore, the closest that opposite train cables approach each other is the 12" separation where they enter the penetrations. After that, all of these circuits route back to the annex in separate trays.
Page 6 of 8
ATTACHMENT 1 Tray 180: Tray 180 contains the two circuits, one per train, that go to the Safety Injection (SI) cabinets to pick up the Si auxiliary contact used to initiate CREATS isolation. SIAM rack and SIB1 rack are in two rows in the Relay Room, separated by a 36 inch wide aisle. Tray 180 runs across the aisle, directly above both racks. Therefore, the first tray encountered by any cable coming out of either train rack is Tray 180. Therefore, circuits C5663 (A train) and C5666 (B train) enter Tray 180, but three feet (the distance between the racks) apart. From there, the two circuits are routed into separate trays, going in opposite directions. At no point do the two circuits come closer than the initial three feet separation. The circuits stay in separate trays until entering conduit before penetrating into the annex.
Please confirm that the installation of the new power/control cables (480 VAC, 120 VAC, and 125 VDC) associated with the CREATS modification are designed such that:
(a) no single fault on any of the new cables can cause failure of both redundant trains of the CREATS or any othersafety related systems.
Response
All 480 VAC cable is being routed in conduit. Regarding 120 VAC and 125 VDC cables, with the exception of the cables noted above, all control and power cables are routed in separate trays to ensure redundancy. To prevent failure of other safety related systems, the new CREATS cables are protected by isolation devices to ensure a fault in those cables will not propagate to other cables/systems (Attachment 3).
Please confirm that all pre-existing 120 VAC and 125 VDC control and power cables routed in the same cable trays containing CREATS cables have protective devices and are capable of clearing the most limiting fault such that no CREATS cables will be damaged. Discuss the results of the analyses (energy released and cable heat up) that supports this conclusion.
Response
Existing cables in the trays being utilized for CREATS have protective devices installed (fuses or breakers) to protect the cables from sustaining a cable-damaging fault that would propagate across both CREATS trains. We previously sent to NRC the document titled "Topical Design Basis - Electrical Independence" (provided again as Attachment 2), which includes discussion relating to the original design reviews and original plant design criteria. Plant modification procedures are in place to maintain the design bases. To illustrate this, a representative analysis (Attachment 4) of the 125VDC system cables and 120 VAC Instrument Power system cables has been completed and demonstrates that these cables are protected within their cable damage curves. However, a comprehensive analysis does not exist to analyze every cable in the utilized relay room trays.
- 4.
Control Room Radiation Monitor Analytical Limit Page 7 of 8
ATTACHMENT 1 In accordance with your letter dated September 10, 2004, you stated in Attachment 1, Design Analysis DA-EE-2001-013, that the limiting analytical limit (AL) for the control room radiation monitor is 0.91 mr/hr. The previous AL for these instruments was 0.96 mr/hr. Since the new AL is less conservative then the previous value, Design Analysis DA-EE-2000-009 for the control room radiation monitor setpoints should be revised to indicate the correct Limiting Safety System Setting (LSSS). Technical Specifications Table 3.3.6-1, "CREATS Actuation Instrumentation," should also be revised to reflect the new LSSS and the performance based operability requirements for the Channel Operational Test.
Per a phone conversation on 1212/04, Mr. Clark (NRC) requested that the revised analysis (DA-EE-2000-009) pertaining to the new LSSS setting be included in this submittal for NRC review.
Response
Design Analysis DA-EE-2000-09 has been revised to reflect the new AL and appropriate sections included as Attachment 5. The proposed updated revision to Technical Specification Table 3.3.6-1 is included as Attachment 6.
Page 8 of 8
Topical Design Basis Electrical Independence
F TOPICAL DESIGN BASIS - ELECTRICAL INDEPENDENCE Revision 0 06/19/97 Prepared Reviewed Approved by: g
~ t L 6. \\
An byes:
ef-4h/-Z/7 be 1 Jw7
--21f 7 1 1 m--
9
- '-IS-I
REVISIONS PAGE Revision Number 0
Date 06/19/97 Section all 2
TOPICAL DESIGN BASIS -
ELECTRICAL INDEPENDENCE Table of Contents 1.0 PURPOSE 2.0 DESIGN BASIS CRITERION DEVELOPMENT 2.1 Physical Separation 2.2 Electrical Isolation 2.3 Relating the electrical independence design criteria to the separation and independence criteria described in the Updated Final Safety Analysis Report 2.4 Special Case: cable convergence in Racks, Panels, and Control Boards 2.5 Assignment to Designated Trains 2.6 Criteria Development General Summary TABLE 1 Historical Milestones 3.0 DEFINITIONS Table 2 -
Updated Final Safety Analysis Report / IEEE Standard cross reference 4.0 DESIGN BASIS 4.1 Design Basis Summary Table 3 -
Design Basis Matrix 3
.1 -r-F
I
1.0 PURPOSE The purpose of this Topical Design Basis Document is to describe the evolution of the licensing basis with respect to electrical independence for the Ginna Nuclear Power Plant.
Ginna Station was licensed to specific set of approved Atomic Industry Forum design criteria.
When changes were made in the criteria, plant change documents were modified, as considered appropriate, and these criteria were used in plant modifications, to the extent practicable.
The overall objective in modifying the plant's licensing basis, and the resultant plant changes, was to maintain plant configuration in accordance with current safety and regulatory criteria as much as reasonably possible.
Adherence to the principles described in this document will assist electrical design personnel in assuring the continued compliance with Ginna's design basis, licensing requirements, and related commitments made to the Nuclear Regulatory Commission.
4
2.0 DESIGN BASIS CRITERION DEVELOPMENT Ginna Station was designed, constructed, and tested to standards that were selected with the prime objective of ensuring the safe and reliable operation of the plant under all anticipated conditions. Those standards were reviewed by the Atomic Energy Commission and were found adequate with respect to ensuring the design posed no undue risk to the public.
Over time the standards applicable to commercial nuclear power units have evolved.
Ginna Station does not meet all modern (current) standards for cable separation.
There is, however, an original design basis for cable separation and electrical isolation and there are standards which must be achieved to ensure compliance with our current licensing basis.
Functions which are important to safety (essential functions) must be preserved sufficiently such that no credible event places the public at unreasonable risk.
With respect to preserving the essential functions of cables and electrical wiring there are three areas of interest; physical separation, electrical isolation, and cable material selection.
When taken together, physical separation and electrical isolation should work to achieve a desired level of electrical independence -
for Ginna Station this translates to: the state in which there is no credible mechanism by which any single design basis event can cause a loss of the functions credited with mitigating that event.
To best understand Ginna Station's electrical independence 5
£ I
nw-Il
' Ac
.r.--
criteria it is logical to examine the history of Ginna Station from its conceptual design and construction, through the Systematic Evaluation Program, and then through the Appendix R Fire Protection evaluation.
Each of these represents a milestone in the history of cable separation and electrical isolation and each added to, or otherwise modified, the cable criteria maintained by Ginna Stations's current licensing basis.
The Updated Final Safety Analysis Report (UFSAR) contains numerous, but widely distributed, references to electrical separation, independence, and circuit protection methods (see also Table 2 -
Updated Final Safety Analysis Report I IEEE Standard cross reference).
Those descriptions reflect the results of the Ginna Station design basis but not necessarily the basis itself.
When reading the UFSAR care should always-be given to fully understand the framework for which the text is crafted.
Statements which are appropriate to a specific circumstance are not always transportable to another case, even if the subject matter appears to be the same.
2.1 Physical Separation Physical separation is a term used to describe the use of free space or barriers interposed between redundant functional devices important to safety.
The concept is to provide sufficient autonomy between the devices so that there is no single mechanism which can render both simultaneously inoperable.
6
The conceptualization and design of Ginna Station reflects the design engineers' knowledge that it was necessary to protect the operability of certain pieces of equipment from the effects of random and common-mode failures.
That is, certain functions must be performed following a given design basis event to ensure the event is successfully mitigated.
Equipment important to safety has to be relied upon to achieve their functions even in the event of the worst case postulated event.
As described in early Westinghouse design documents (i.e. WCAP 7486), "the principal defense against random component failures is the employment of redundancy; that is, if a component failure can give rise to problems in a vital circuit, a redundant component provides an identical function so that one component (or train) can fail without impairment of function.. Simple redundancy does not, however, provide significant defense against common-mode failures unless coupled with other techniques.
To prevent occurrence of such failure, it is necessary to employ such measures as functional diversity, physical separation, testing, and equipment diversity...".
Functional diversity was primarily applied to the reactor protection system.
Functional diversity relies upon monitoring and utilizing the maximum number of process variables such that completely eliminating the sensing of one variable would not lead to a failure of the protection system to perform its function.
Equipment diversity refers to the use of multiple equipment of different design or manufacture to perform identical or 7
.1 a_
- re
equivalent redundant functions.
Physical separation offers a measure of defense against common-mode failures EXCEPT against unrecognized functional (design) deficiency and those situations where the causative factor is widespread in its effects.
The general premise of physical separation is that a designer can aid in eliminating the effects of some unrecognized system design deficiencies by being alert to possible interdependencies and making conscious efforts to avoid introducing the potential for common-cause failures.
[Separation protects redundant equipment from common-cause failure, diversity protects important functions from the effects of design deficiencies.)
Physical separation is an important factor in minimizing the effects of external hazards such as fires or missiles.
Separation must be considered a design feature whose function is to increase a system's resistance to common-mode failures.
Implementation of Ginna Station's original electrical separation design philosophy is best described by Westinghouse document E-EPS-1, Issue 3, Electrical Systems Recommended Design Basis, ELECTRICAL CIRCUIT PHYSICAL SEPARATION which states in part:
rAuthor's note:
These criteria are illustrative.
The design and construction of Ginna Station predates present industry standards of physical separation, but have a continuity to these standards.
E-EPS-1 is an example that shows the thought and process used by the design engineers at the time of Ginna's design and construction.
The link between E-EPS-1 era documents and later standards, i.e. the engineering thought and process, is that the same engineers often developed both.
For instance, R. I. Hayford signed the approval of E-EPS-1 as Manager, Electrical Power Systems, Westinghouse; Hayford was also a member of the Nuclear Power Engineering Committee at the time of approval 8
of IEEE 384 Independence of Class 1E EQuipment and Circuits.]
The electrical supply and control conductors for redundant or back-up circuits of a nuclear plant should have such physical separation as is required to assure that no single credible event will prevent operation of the associated function by reason of electrical conductor damage.
Critical circuits and functions include power, control and analog instrumentation associated with the operation of reactor protection, engineered safeguards, reactor shutdown and residual heat removal systems.
Credible events shall include, but not be limited to, the effects of short circuits, pipe rupture, missiles, etc.
Such electrical separation as is required for protection against plant design basis events should be included in the basic plant design.
General Cables of redundant or back-up circuits shall be run in separate conduits, cable trays, ducts, penetrations, etc.
Where it is impractical for reasons of terminal equipment arrangement to provide separate wireways,
--- cables of redundant or back-up circuits shall be isolated by physical barriers, be in separate metallic conduit, or consist of suitable armored cable.
One foot horizontal or three foot vertical separation shall be maintained between wireways (or armored cable) associated with redundant equipment.
Power and control conductors rated at 600 volts or below shall not be placed in wireways with conductors rated above 600 volts.
Low level analog signal conductors shall not be routed in wireways containing power or control cables.
[In the original design of Ginna Station, safety related analog instrumentation circuits used for reactor protection and safeguards actuation were routed in dedicated conduits from the instrument sensor to the Protection Racks in the control room.
Display and indication functions were isolated from the safety related portion of these instrument channels, and their signal cables were routed in non-safety related instrument cable trays. At that time, all display and indication functions were considered non-safety related, and to this day, all cable trays designated as instrument trays are still classified as non-safety. After TMI and the issuance of NUREG 0737 and Reg. Guide 1.97, many new instruments were installed with safety related indication and control functions.
Since the non-safety related 9
instrument cable trays could not be utilized for these new circuits, they were routed in safety related control and power trays.
These new circuits utilized shielded cables with 600 volt insulation rating.
For this reason, several low level analog signal cables are now existing in power and control cable trays (see also section 2.5, Assignment to Designated Trains).]
In congested areas, such as under or over the control boards, instrument racks, etc., wireways shall be identified using permanent markings.
The purpose of such markings is to facilitate cable routing identification for future modifications or additions.
Positive, permanent identification of cables and/or conductors shall be made at all terminal points.
As previously explained, during the period Ginna Station was designed and constructed many of the codes and standards available today were either non-existent, in draft, or of an early revision.
In 1967 plant designers relied upon the proposed Atomic Industrial Forum (AIF) General Design Criteria (GDC) in defining the safety objectives and approaches necessary to incorporate those objectives into Ginna's design.
A description of those criteria, along with a comparison to the GDC later contained in the Code of Federal Regulations (CFR), is maintained in the UFSAR, section 3.1, Conformance with NRC General Design Criteria.
In 1972, when the plant submitted an application for a full term operating license, the application contained a supplement which examined the adequacy of the design with respect to IEEE standards 279-1971, 308-1971, 317-1971, 323-1971, 334-1971, 336-1971, 338-1971, 334-1971.
This examination is discussed in UFSAR section 1.8.3, Conformance to IEEE Criteria.
The acceptance of the adequacy of Ginna Station's original 10
design and construction by the Atomic Energy Commission (later to become the Nuclear Regulatory Commission) was documented in an AEC Safety Evaluation Report.
A provisional operating license was granted to Rochester Gas and Electric corporation for Ginna Station on September 19, 1969.
The AEC Safety Evaluation Report SAFETY EVALUATION BY THE DIVISION OF REACTOR LICENSING U. S.
ATOMIC ENERGY COMMISSION IN THE MATTER OF ROCHESTER GAS AND ELECTRIC CORPORATION ROBERT EMMETT GINNA NUCLEAR POWER PLANT UNIT NO. 1, dated 06/19/69 states, in part:
Section 3.7.3 The applicant's criteria relating to the cable tray loading and separation may be summarized as follows:
(a) cables,.whether power, control, or instrumentation of one train or system are not mixed with cables of a redundant train or system; (b) physical separation is provided between redundant cables for control and instrument systems within a tray by means of a galvanized sheet metal barrier in cable trays; (c) the minimum physical dimensions between redundant power, control, and instrument cable trays are 5 inches vertical separation and 2 inches horizontal separation; (d) metal-enclosed 4160-volt buses are used for all major bus runs where large blocks of current are carried; and (e) the routing is such as to minimize exposure to mechanical, fire and water damage.
An ambient temperature of 50 degrees C within the reactor containment and an ambient temperature of 40 degrees C in all other plant areas is the design basis for all power cable ratings.
All a.c. circuits within the plant are protected by three-phase circuit breakers.
We have reviewed the criteria and conclude that they reduce the possibility of cable fires, and provide protection against random and systematic failures.
Our conclusion with respect to the low probability of cable fires is based on 11
the limited cable tray loading, and upon derating factors.
There is only one layer of 4160-volt cable in a tray, and a derating factor of 0.81 is used. For the 480-volt cables, a derating factor of 0.6 has been used for size #4 and larger, and 0.5 for size #6 and smaller.
Further, the pressurizer heater cables have been given extra spacing, and have been derated by a factor of 0.5.
With respect to systematic and random failures, we conclude that the physical separation of redundant cables, and the metal barrier (where used) within a tray provide adequate protection against the propagation of a fire, and against any lesser single event occurring within a tray.
The use of three-phase breakers in lieu of fuses should immediately isolate all three phases of a line from a fault occurring in one phase.
As more standards became codified it became questionable to the nuclear regulatory body (the transition had occurred from the Atomic Energy Commission to the Nuclear Regulatory Commission, or NRC) if plants of Ginna Stations vintage provide sufficient protection when judged against the (then) newer standards.
In order to resolve these concerns, a regulatory initiative known as the Systematic Evaluation Program (SEP) was begun at Ginna Station in 1978.
This effort, completed in December, 1982, documented the acceptability of Ginna Station's design (after plant modifications) with respect to the intent of the present day design criteria as documented in Appendix A to 1oCFR50. That is, the SEP review essentially sought to demonstrate functional equivalency between Ginna's design and a plant designed to newer construction standards.
Included in the SEP were events and causal effects which were not considered in the original licensing basis.
One of the major differences between Ginna Station's original design basis and the SEP review criteria is consideration of a series of 12
mitigative requirements necessary to achieve safe shutdown accounting for the effects of more stringent internal, external, or "special" events. The inclusion of the mitigative features for these increased requirements into the licensing basis reflected a fundamental change in which equipment functions, and hence cables, were required to be protected.
The SEP not only validated the adequacy of the plant design against the original design basis, but also necessitated commitments to maintain a plant design commensurate with new principles. (i.e., Some of these commitments dealt with the physical protection of cables which did not meet the separation standards which would be imposed on newly constructed systems of equal importance.]
The list of credible events was expanded and now included different postulates than were explicitly detailed in the original design basis (e.g. high energy line breaks outside containment).
RG&E was required to demonstrate the ability to protect the public from the consequences of all the design basis events by. demonstrating the ability to shut down the reactor and remove decay heat in a safe and acceptable manner.
The equipment set necessary to mitigate the newly defined events was bound, in most cases, by the set certified to mitigate the original design basis events.
In these cases, the NRC closed the review of the SEP topic by providing a Safety Evaluation Report (SER) detailing the acceptance of our compliance methodology (including the acceptance of the adequacy of any 13
necessary proposed modifications).
These reports became integral to the plant current licensing basis.
Those cases where the plant conformance with the then-current criteria was of concern to RG&E and the NRC, an evaluation consistent with the principles of 10CFR50.109 was conducted.
A set of ground rules needed to be agreed upon in order to establish conformance standards.
Chief among the issues was the question of whether or not the facility needed to engineer the solutions to the expanded event and hazard set such that the equipment group necessary to achieve safe shutdown must withstand the postulated event while sustaining an active single failure.
The mitigation of an event while accounting for the effects of random single failure in the equipment set used to manage that event is one of the reasons why important systems are designed with at least two trains (or divisions).
Many SEP SERs were written acceding to the principle that the consequences (damages) sustained during the newly postulated (beyond original design basis) events embody the single failure the plant needs to be designed to withstand (e.g., tornado).
That is, so long as the event did not act as a precursor to a design basis event then the event effects, and the cascaded consequences of those effects, were what was needed to be mitigated. This ideology promulgated two important concepts; functional equivalency and safe shutdown.
The UFSAR, section 7.4, describes the minimum systems 14
required to take the reactor from operating to shutdown conditions (SEP topic VII-3).
These systems, and their functional alternatives, are described in UFSAR Table 7.4-1.
ONE OF THE PRIMARY GOALS OF GINNA'S CABLE SEPARATION DESIGN BASIS IS TO ENSURE THAT THE SAFE SHUTDOWN FUNCTIONS ARE SUSTAINED GIVEN THE POSTULATED EFFECTS OF DESIGN BASIS ACCIDENTS, TRANSIENTS AND EXTERNAL EVENTS.
In defining the equipment set referred to above it is important to understand and distinguish between terms used to describe an equipment set's attributes.
Often equipment is "binned" in broad quality group categories such as "safety related", "safe shutdown", "class lE" and the like.
Typically, specific codes and standards apply to the procurement, fabrication, installation and testing of equipment commensurate with their importance to safety.
Likewise, these quality labels each evoke a specific level of design control. CAUTION MUST BE EXERCISED WHEN EXAMINING THE ROUTING AND SEPARATION CRITERIA THAT IS APPLIED TO THE ELECTRICAL EQUIPMENT AT GINNA.
As described in the various SEP SERs, circuits which provide alternative functional equivalency do not always meet the separation criteria associated with their respective quality group classification.
They must, however, always meet the criteria associated with their licensed function.
An easy to understand example of this issue can be shown by examining the auxiliary and standby auxiliary feed water systems.
The auxiliary feedwater pump motors are located next to each 15
IW SIs other in the Intermediate Building.
If we judged the adequacy of their separation using IEEE 384-1974 (Independence of class lE equipment and circuits) we would find them not in compliance.
They are susceptible to a common-mode failure caused by a steam line break in the area.
In order to achieve safe shutdown a diverse system, standby auxiliary feedwater, was installed. This system is protected against the effects of a steam line break, yet individually, it too does not meet all of the IEEE hazards separation requirements.
Yet together, they provide sufficient independence to achieve the licensed objective of providing cooling water for decay heat removal during all events feedwater is required for, even while accounting for the effects of an additional single active failure (e.g. a diesel failing to start, a pump motor failure, etc.).
THUS, IT IS POSSIBLE THAT MORE SPECIFIC SEPARATION CRITERIA IS APPLICABLE TO A PARTICULAR FUNCTION THAN IS TYPICALLY IMPLEMENTED BASED ON QUALITY GROUP CLASSIFICATION.
During the period the SEP program was underway one other regulatory initiative was undertaken that had significant impact on Ginna's cable separation design basis: 10CFR50 Appendix R -
Fire Protection for plants operating prior to January 1, 1979.
Although Ginna was licensed to the fire protection requirement of Branch Technical Position BTP 9.5-1 the unit committed to sections G, J and 0 of 10CFR50, Appendix R. Part G, Fire Protection of safe shutdown capability, contains specific cable protection and separation criteria which must be achieved 16
thus ensuring one train of the systems necessary to achieve and maintain hot shutdown are maintained free from fire damage.
For RG&E this includes the alternative shutdown system components.
Ginna's strategy is described in the UFSAR section 7.4.4, Alternative Shutdown System and section 9.5.1.4, Safe Shutdown Capability.
The Appendix R Alternative Shutdown System Report is the analysis which describes in detail the modifications that were necessary to demonstrate the ability to achieve safe shutdown (including physical protection of safe shutdown cables and cable re-routs) following the effects of a fire.
Basically, all the circuits required to achieve (single train) safe shutdown either meet IEEE 384 standards for physical protection with respect to the hazard in a particular fire zone, or an alterative way of -
achieving the associated function was found which was not susceptible to that same fire hazard.
The specific separation criteria employed to ensure compliance with this strategy is complex and is implemented by Ginna's Fire Protection/Appendix R conformance verifications. All wiring and cable modifications made at Ginna must be screened through the Appendix R conformance verification process.
Like the equipment credited in the SEP the licensing basis for the Appendix R equipment is complicated.
The alternative shutdown process utilizes both safety and non-safety quality group equipment.
Additionally, the equipment set used to achieve safe shutdown given a fire in a specific area may not be the set required if the fire is in a different area. GINNA'S 17
CABLE SEPARATION DESIGN BASIS MANDATES THAT CAREFUL CONSIDERATION MUST ALWAYS BE GIVEN WHEN ADDING OR RE-ROUTING BOTH SAFETY AND NON-SAFETY CABLES, EVEN IF THE CHANGE DOES NOT INVOLVE A FUNCTIONAL CHANGE FOR THE AFFECTED EQUIPMENT.
Because of the results of changing requirements all the functions credited to a cable, cable routing, cable tray, or conduit are not always readily apparent.
MAINTAINING GINNA'S CABLE SEPARATION DESIGN BASIS INCLUDES ACCOUNTING FOR FUNCTIONAL AND PHYSICAL DIVISION.
SYSTEM EQUIPMENT MAY BE DIVERSE AND SEEM PHYSICALLY UNRELATED YET BE CREDITED TO ACHIEVE THE SAME SAFE SHUTDOWN FUNCTION GIVEN THE EFFECTS OF A POSTULATED FAILURE. For example; Safety Injection is used to provide primary system makeup in the event of a fire in the charging pump room.
Therefore during plant modifications consideration must be made of all the cables and equipment associated with that SI function so that it is not possible to fail both the SI and the charging function because of one fire.
[Examining the Appendix R success path matrix contained in the safe shutdown report will show further detail of equipment inter-dependencies and functional equivalencies.]
CARE MUST ALWAYS BE EXERCISED TO ENSURE THAT COMMON-MODE FAILURES ARE NOT INTRODUCED BETWEEN FUNCTIONALLY REDUNDANT EQUIPMENT SETS CREDITED WITH MITIGATING THE CONSEQUENCES OF AN EVENT.
2.2 Electrical Isolation Along with the spatial analysis necessary to achieve physical separation, Ginna's separation design basis also 18
accounts for electrical isolation.
Electrical isolation provides a means of ensuring that associated circuits do not introduce a failure mechanism in a circuit that performs an important function.
Electrical isolation is also the means used to ensure that a fault in a load will be interrupted prior to its causing a failure of the cable supplying power to the load.
In vital applications electrical isolation devices are also typically coordinated such that the device closest to the fault provides circuit interruption prior to failing the sources' protection devices (breaker selective tripping and DC fuse coordination).
The UFSAR section 8.3.1.1, The 480V System, provides a description of breaker coordination for vital buses.
Sections 8.3.1.2.4.6 and 8.3.2.3 provide descriptions of fuse coordination.
With respect to cabling, the consequence of an uninterrupted load fault is typically a fire.
UFSAR section 8.3.3, Fire Protection for Cable Systems, summarizes the methods by which AC breakers and DC fuses are credited with protecting vital cables.
As discussed in the Appendix R submittal, non-vital cables are routed in trays containing vital cables (associated circuits).
The acceptability of this practice is predicated on the proper use of isolation devices.
If the cable has appropriate electrical isolation it will not create a secondary fire in a different area than where the source fire introduced the fault.
Having isolation devices does not, however, give liberty to 19
randomly mix divisions or trains within conduits or cable trays.
As discussed in section 2.1, whenever redundant equipment or systems are at risk from the consequences of an single, cascaded failure (event), an alternative means must be available to achieve the at risk function, or the primary provider must be protected.
Ginna Station's licensing basis does contain exceptions to the generally accepted electrical separation and isolation criteria.
Ginna Station has committed to the NRC to provide certain post-accident instrument displays (UFSAR section 7.5.2, Safety Parameter Display).
Some portions of the instrument loops which drive the displays are associated with non-vital control functions.
This is because Ginna Station's original design isolated the protection portion of the loop from the control portion.
This configuration ensured that a fault in a non-vital process control circuit would not affect the protection channel.
In this arrangement a specific train's control and display signals are not electrically independent. Additionally, because of the control room design (see section 2.4), redundant channels may not have complete physical separation.
In the SER reviewing Ginna's conformance to Reg. Guide 1.97 (2/24/93) the NRC examined Ginna's configuration and found the redundancy and separation acceptable for those Category 1 variables where instrumentation is not upgraded to meet the Reg. Guide 1.97 recommendations.
As part of that acceptance RG&E committed to perform safety analysis of future modifications where separation of Category 1 20
instrument channels can not be maintained to IEEE standard 384-1981.
2.3 Relating the electrical independence design criteria to the separation and independence criteria described in the Updated Final Safety Analysis Report The UFSAR includes information that describes the facility, establishes the design basis and the limits of operation, presents a safety analysis of the structures, systems and components as a whole, and other information detailed in 10CFR50.34. The information is intended to provide the NRC staff with a basis for determining that the plant can be operated without undue risk to public health and safety.
Ginna Station's UFSAR is not a compendium of commitments with respect to equipment engineering and design details.
All modifications to the station require a safety review or safety analysis.
As part of these reviews the UFSAR is examined.
The examination for topics related to electrical separation, isolation and independence will yield instances where configuration descriptions and design statements are softened with; "generally", "to the extent practicable", "where possible",
etc..
The phraseology is crafted to demonstrate the understanding that Ginna Station's licensing basis contains deviations to some specific codes, standards and construction criteria (as described in sections 2.1 and 2.2 above).
Those "generally" and "to the 21
I extent practicable" cases are specifically defined in the licensing basis; the wording is not to be viewed as authorization to add additional nonconforming cabling simply because it is acknowledged that exceptions do exist.
As compelled by GDC 1, Where generally recognized codes and standards are used, they shall be identified and evaluated to determine their applicability, adequacy, and sufficiency and shall be supplemented or modified as necessary to assure a quality product in keeping with the required safety function."
2.4 Special Case:
Cable Convergence in Racks, Panels, and Control Boards As described in the plant design basis, every attempt has been made to maintain cable separation within the applicable codes and standards.
The size and configuration of the Main Control Board (MCB), and system instrument racks, panels, and enclosures in the Control and Relay Rooms of the Control Building require that cables converge in these areas.
Within some of the above enclosures, cable termination point physical limitations have made it impractical to maintain minimum separation distances or to install the fire barriers or cable shielding necessary for train separation.
[Plants designed and constructed after Ginna also grappled with defining separation criteria for these areas and enclosures.]
As noted in Regulatory Guide 1.75, Physical Independence of Electrical Systems, "the degree of separation required varies with the potential hazards in a particular area".
The above referenced areas are special in that control of the 22
space manages hazards and thus limits damage precursors to fires and the consequences of random equipment (in this context; cable) failures.
The consequences of a fire have been discussed in the Appendix R analysis.
The risks associated with a random cable failure at one of the convergence points during a design basis event must be managed.
As detailed in R.G. 1.75, section 5.1.1.2, "In those areas where the damage potential is limited to failures of faults internal to the electrical equipment or circuits, the minimum separation distance can be established by analysis of the proposed cable installation".
Per the guide, this applies to both the Main Control Board and Instrument Cabinets.
The design basis separation is therefore the offset distances or physical shielding described by the applicable code or the analysis of the installation, (including fault isolation] and the suitability of the flame-retardant characteristics of the cable material.
2.5 Assignment to Designated Trains It must be acknowledged that the system of cable trays (raceway system) at Ginna Station was not designed to accommodate segregated routing of designated trains and channels on a comprehensive basis.
[This is a designation or labeling issue; as discussed throughout this document, functional separation was a routing objective.)
Where a choice of several cable trays was available, the routing assignments were straight-forward.
In certain locations
the structural configuration precludes redundant raceways, in these cases other schemes such as barriered trays or shielded cable were used (see section 2.1). (In order to abate the {at the time of construction) emerging issue, certain areas also had enhanced fire detection and suppression capability installed.
The design philosophy was to engineer an equivalent level of protection as would be afforded by a redundant raceway system.]
In addition, while certain statements in the FSAR refer to separating "all redundant" circuits by train (or channel) it is clear that this was used in a sense that permitted routing of cable with one train designation in raceway with the redundant train designation if the redundant cable was not present in that tray or that section of tray. [i.e. There are cables for redundant components that enter the same tray, then the-cables-,
are routed in opposite directions such that when they enter a hazards area they have achieved separation.]
Hence, a tray of either train designation may have cable from redundant systems occurring at specific locations along its length.
There was a significant effort to maintain physical separation consistent with train designation for documentation purposes but this was not considered as important as functional separation.
If routing a cable in a raceway of the redundant train achieved physical separation with its redundant function, that routing was permitted.
When there was an ambiguous train assignment, such as with power to the "swing" SI pump, or control for diesel generators, which have provision for automatic 24
transfer between A and B trains, separation was also not always consistent with train designation.
Additionally, during construction, when routing redundant circuits in areas with no exposure to significant internal or external hazards, and where routing paths had restricted raceway availability, the rigorous separation of redundant circuits was not always of prime concern.
The design strategy of objectively separating all circuits on the basis of train designation alone was not standardized at the time of Ginna Station's construction. There was no consensus standard for acceptable "arbitrary" physical separation on this basis until IEEE-384 was published in 1974 (IEEE Standard 384-1974, Trial-Use Standard Criteria for Separation of Class 1E equipment and Circuits).
All statements made in the FSAR regarding routing, train designation and physical separation of circuits must be interpreted in the context of these issues.
25
=.............................
2.6 Criteria Development General Summary In summary, Ginna Station's design basis for electrical independence incorporates the principle of functional separation.
For equipment used in mitigating UFSAR Chapter 15 accidents and design basis earthquakes, cable separation and isolation must support reaching Hot Shutdown conditions assuming the initiating event, one single credible failure, and all cascading effects.
For the equipment used to mitigate the remaining external events, cable separation and isolation must support reaching Hot Shutdown conditions assuming the initiating event and its cascading effects only.
For equipment used in mitigating fire events, cable separation and isolation must support reaching Cold Shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> assuming the initiating event and cascading effects only.
26
Table 1 Historical Milestones Oct Nov Apr Oct Jan Jul 1965 Rochester Gas and Electric Corporation applies to the Atomic Energy Commission (AEC) for a Construction/operating License for Ginna Nuclear Power Plant.
1965 The AEC issues 27 proposed General Design Criteria (GDC) which, in part, required electrical separation to be considered in the design of the Reactor Protection System and Engineered Safety Features Systems.
1966 Construction Pernit issued by the AEC.
1967 cable tray installation begins in Ginna containment.
1968 Review, discussion, and rerouting of cable installation and separation to address AEC concerns (RG&E, Westinghouse and Gilbert Associates).
1968 Development of Institute of Electrical and Electronics Engineers (IEEE) CRITERIA FOR NUCLEAR POWER PLANT PROTECTION.
1968 Submittal of Final Safety Analysis Report to AEC.
1969 Westinghouse document E-EPS-1 Electrical Systems Recommended Design Basis, ELECTRICAL CIRCUIT PHYSICAL SEPARATION.
1969 SAFETY EVALUATION BY THE DIVISION OF REACTOR LICENSING U. S. ATOMIC ENERGY COMMISSION IN THE MATTER OF ROCHESTER GAS AND ELECTRIC CORPORATION ROBERT EMMETT GINNA NUCLEAR POWER PLANT UNIT NO. 1.
1969 RG&E receives Provisional Operating License.
Jun Sep Nov Mar 1969 1970 1971 Initial criticality of Ginna reactor.
Reactor achieves 100% power.
Final Safety Analysis Report reviewed against IEEE 279 STANDARD FOR PROTECTION SYSTEMS.
1972 RG&E applies for full term license.
27
3.0 DEFINITIONS The definitions that follow include both those in use during the design/construction phase of Ginna Station as well as those in present use by industry.
Definitions provided are for use in this document only.
Active Safe Shutdown Components Components that must actively operate (i.e., run) to achieve safe shutdown, or change their operating state or position from the normal position or operating state (i.e., stop, open, close, etc.).
Alternative Shutdown Safe shutdown activities requiring utilization of operational practices including:
(a) Other than normal safe shutdown activities from the Control Room (b) Operations from designated alternative control systems location (c) Manual operations at various equipment locations Arpendix R Fire Achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> f. owing a single fire with no additional failures.
Associated Circuits Non-Class IE circuits that share power supplies, signal sources, enclosures, or raceways with Class IE circuits and are not physically separated or electrically isolated from Class IE circuits by acceptable separation distance, barriers, or isolation devices. Also, circuits not considered as part of safe shutdown circuits, but whose fire-induced failure could prevent the proper performance of safe shutdown system functions.
Associated circuits of concern are categorized by common power supply, common enclosure, and spurious operation.
Associated Circuits By Common Power SupPly Cables not required for safe shutdown whose fire-induced failure could cause the loss of a power source (power, control or instrument bus) that is necessary to support safe shutdown.
28
Associated Circuits By Common Enclosure (a) Cables not required for safe shutdown whose fire--
induced failure could cause circuit faults in electrically unprotected cables such that secondary fires may occur in enclosures (raceways, panels, etc.) outside the fire area of concern and damage safe shutdown equipment or cables.
(b) Cables that would allow fire to spread by burning beyond the immediate area of concern, ultimately affecting redundant safe shutdown equipment or cables.
Associated Circuits Due To Spurious Operation Those circuits that could, by fire-induced failures, cause safe shutdown or equipment not required for safe shutdown to mal-operate in a way that defeats the function of safe shutdown systems or equipment, including high/low pressure interfaces and circuit interlocks from instruments and control circuits not required for safe shutdown.
The concept of associated circuits, as it relates to the plant safe shutdown in the event of a fire, is included in the Rochester Gas and Electric Corporation's Appendix R Report.
Auxiliary Supporting Features Systems or components which provide services (such as cooling, lubrication, and energy supply) which are required for the safe shutdown system to accomplish its functions.
Cable Failures Open circuits, short circuits, shorts to ground and cable to cable hot shorts.
Channel An arrangement of components and modules as necessary to generate a single protective signal within the plant protection system when required by a plant condition.
A channel's identity is lost after passing through an isolation device.
A plant protection system channel's identity undergoes transition to a safety system train at the logic relay coil/relay contact interface.
Class IE The Institute of Electrical and Electronics Engineers (IEEE) safety classification of the electric equipment and systems that 29
are essential to emergency reactor shutdown, containment isolation, reactor core cooling, and containment and reactor heat removal, or are otherwise essential in preventing significant release of radioactive materials to the environment.
Desicfn Bases That information which identifies the specific functions to be performed by a structure, system, or component of a facility, and the specific values or ranges of values chosen for controlling parameters as reference bounds for design.
These values may be (1) restraints derived from generally accepted "state of the art" practices for achieving functional goals, or (2) requirements derived from analysis (based on calculations and/or experiments) of the effects of a postulated accident for which a structure, system or component must meet its functional goals.
Design Basis Accident Accidents addressed within Chapter 15 of the UFSAR.
These events require the consideration of a credible single failure in addition to the accident initiator.
Design Basis Event Per 10CFR50.49(b)(1) includes:
- a.
Conditions of normal operation
- b.
Anticipated operational occurrences
- c.
Design basis accidents
- d.
External events
- e.
Natural phenomena Items a, b, and c require consideration of a credible single failure in addition to the accident initiator.
Items d and e are essentially the same category of events (i.e., an initiating event external to the plant systems) and are referred to as external events hereafter.
Included within external events are earthquakes, tornadoes, hurricanes, floods, and tsunami (GDC 2).
Hurricanes and tsunami are not credible design basis events given Ginna Station's location.
Mitigation of an earthquake requires consideration of a credible single failure while tornadoes and floods do not.
Division The designation applied to a given system or set of components that enable the establishment and maintenance of physical, electrical and functional independence from other redundant sets of components.
This terminology envelopes both train and channel.
30
£a-rI
- y A_
Essential Function A function which assists in managing the ability to remove heat from the reactor core.
Essential functions include:
Control of reactivity Control of reactor coolant system pressure Control of reactor coolant system inventory Heat removal from the reactor coolant system Equipment that is safety related or important to safety perform essential functions.
High/Low Pressure Interface Components Components that have the potential of causing uncontrolled or unrecoverable depressurization and loss of primary coolant.
Imnortant to Safety Systems, structures and components that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public.
(See also 10CFR50, appendix A, General Design Criteria for Nuclear Power Plants, Introduction and 10CFR50, Appendix R, Fire Protection Program for Nuclear Power Facilities, Introduction and Scope.)
Independence The state in which there is no mechanism by which any single design basis event, such as a loss of coolant accident (LOCA),
can cause redundant equipment to be inoperable.
Interaction A direct or indirect effect of one device or system upon another.
Internal Tray Divider A strip of metal used in trays in order to separate cables due to service class requirements.
Isolation Device A device in a circuit that prevents malfunctions in one section of an electrical circuit from causing unacceptable effects in other sections of the circuit or in other circuits.
Acceptable isolation devices for power circuits are single isolation devices actuated by fault currents (breakers and fuses).
For low energy control and instrumentation circuits, acceptable isolation devices are those actuated by fault currents (e.g., fuses or circuit breakers), relays, control switches, transducers, isolation amplifiers, current transformers, diodes, and fiber optic couplers.
31
_r
. s-M
Licensing Basis All changes to the original design basis as reflected in commitments made to the NRC and/or as documented in the UFSAR.
The original licensing basis therefore is equivalent to the original design basis.
Local Controls and Indications Components located outside of the Control Room near the equipment or at local control panels.
Missile Producing or Missile Hazard Area The following areas are considered missile producing or missile hazard areas due to the fact that they are in direct line with a potential projectile generated by a malfunction of machinery or equipment:
Physical Barrier A partition, cover, wall, floor, or ceiling which provides protection between redundant safety system components and/or cabling when adequate physical separation is not provided.
Raceway Any device that is designed and used expressly for supporting or enclosing wires, cables, or bus bars.
Raceways consist primarily of, but are not restricted to, cable trays, conduit, and cable risers.
Redundant Equipment or System An equipment or system that duplicates the essential function of another equipment or system to the extent that either may perform the required function regardless of the state of operation or failure of the other.
Safe Shutdown A condition that exists when the plant achieves and maintains:
(a) the reactor subcritical; (b) the reactor coolant inventory such that p essurizer level is within the indicating range; (c) the reactor heat removal function such th t it is capable of removing the decay heat being enerated; and 32
(d) the process monitoring function such that it is capable of providing direct readings of the process variables necessary to perform and control the above functions.
Safe Shutdown Eauipment Equipment (i.e., components, support components, cables, piping, raceways) that may be used for achieving and maintaining safe shutdown in the event of a fire in a plant area.
Safe Shutdown Functions The safe shutdown functions are reactivity control, reactor coolant make-up, reactor coolant pressure control, reactor heat
- removal, process monitoring, and support functions.
Safety Function One of the processes or conditions (for example, emergency negative reactivity insertion, post-accident heat removal, emergency core cooling, post-accident radioactivity removal, and containment isolation) essential to maintain plant parameters within acceptable limits established for a design basis event.
Safety Related That term used to call attention to safety classifications incorporated in the design, installation and documentation of the system.
Safety related systems, structures and components are those relied upon during or following design basis to assure:
the integrity of the reactor coolant pressure.
boundary the capability to shutdown the reactor and maintain it in a safe shutdown condition, or the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposures.
Safety System Those systems (the reactor trip system, an engineered safety feature, or both, including all their auxiliary supporting features and other auxiliary features) which provide a safety function. A safety system is comprised of more than one safety group of which any one safety group can provide the safety function.
33
Train One set of equipment required to achieve safe shutdown.
Vital Circuit Circuit which serves equipment important to safety.
34
Table 2 IEEE References in FSAR IEEE Standard 279-1971 308 308-1971 308-1974 317 317-1971 323 323-1971 323-1974 323-1983 334-1971 336-1971 338-1971 344-1971 344-1975 379-1072 383 384-1974 384-1981 450 FSAR Section 7.1.2 7.2.1.1 8.3.1.2.7.1 8.3.2.3 1.8.3.2 8.1.4.3 8.3.1.2.7.1 1.8.3.3 8.3.1.3 8.1.4.3 6.2.1.5.3 1.8.3.4 8.1.4.3 6.2.1.5.2 8.3.2.1.2 1.8.3.5 1.8.3.6 8.1.4.3 1.8.3.7 1.8.3.8 8.1.4.3 3.10.1.2 6.2.1.5.2 8.3.1.2.5 9.5.1.2.4.8 8.3.1.2.5 9.5.1.2.4.8 8.3.2.3 8.3.2.1.1 7.2.5.1
- 10. 6.2.9 7.3.3.1 8.3.1.1.4 8.3.2.1.2 35
4.0 DESIGN BASIS 4.1 Design Basis Summary The columns in Table 3 are shown chronologically, left to right, from design and construction to present day.
One of the primary goals of Ginna Station's cable separation design basis is to ensure that the safe shutdown functions are sustained, given the postulated effects of design basis accidents, transients and external events.
Therefore, caution must be exercised when examining both the routing and separation of cable and electrical equipment, and the criteria that is applied to the routing and separation. Maintaining Ginna Station's cable separation design basis includes accounting for functional and Phvsical division.
System equipment may be diverse and seem physically unrelated yet be credited to achieve the same safe shutdown function given the effects of a postulated failure.
Examining the Appendix R success path matrix contained in the safe shutdown report will show further detail of equipment inter-dependencies and functional equivalencies.
Care must always be exercised to ensure that common-mode failures are not introduced between functionally redundant equipment sets credited with mitigating the consequences of an event.
36
- 1 r
InF Tzr_
T I i r
Ginna Station does not meet modern (current) standards for cable separation. There are, however, a)
Original design basis for cable separation and electrical isolation and b)
Standards which must be achieved to ensure compliance with our current licensing basis.
When evaluating the routing and separation of existing cables, the cables must meet the standards invoked at the time of installation; i.e. original installation or modification.
Originally installed cable would be evaluated to criteria of a, above (the columns headed Design Standard, Documentation Submitted for Design Basis Review, and After Construction Reviewed Against IEEE Standards (UFSAR section) in Table 3).
The routing and separation of existing cables installed after the submittal of the original FSAR (Green Book) or the impact and effects of new cable installation would be evaluated to criteria b, above (the columns headed Current Licensing Basis and Preservation Process in Table 3) as specified in the Engineering Evaluation that implemented the plant change.
37
. -Y----*
A_.,._._.,_
iI II ii
.4 It
-1 Table 3 DESIGN BASIS
SUMMARY
c DESIGN BASIS I
Documental Submitted Topical I
Design Design Bal
-!3 I
_ansd I
-ek VAC I E-EPS-1 (Westinghouse) j FSAR 1 {
8.2.2 II lion
$is CURRENT 1 > > 1 3 LICENSING BAS11 I After ConstAluion 9 Current Licensing Reviewed Against B
iasis Described IEEE Slandards in UFSAR IUFSAR Secdionl Section I
I PRESERVATION' I
- ce<c" PROCESS >
I I
Ginna S.abon I
Procedure Which I
Maintains I I I
EE.29 I
EE-80 I Design Criteria EWR.10275
.I I
I I
I I
I Industry I
__W I
IEEE 308 1
IEEE 384 1
IEEE 422 I
I 4160 I1.8.3.2 I 1.8.3.4 1
I 8.1.4 1 '.2.2 1 8.3.1.1.3 I t.3.1.4.1 a b I
I 120VAC I
Control Power I
I 120VAC Instniment PowerI I
E-EPS-1 (Westinghouse)
F fSAR 1 1.8.3.2.2 l 8.1.4 l
EE-29 I
IEEE 308 J.2.2 I 1.8.3.4 1 8.2.2.2 I
EE-58 0 IEEE 384 t8.3.1.1.4 D Design Crhera EWR-1027S I
IEEE 422 I
I I 8.3.1.1.6 I
I 8.3.1.4.1a.c.d I
I i
E-EPS-1 (Westinghouse)
I FSAR 1 1.8.3.2 I 8.1.4 I
EE.29 IEEE 308 8 t.2.2 I 1.8.3.4 l 8.2.2.2 EE-80 I
IEEE 384 I
I 8.3.1.4 1 Design Criteria EWR-10275 I
IEEE 422 j
i E-EPS-1 (Westinghouse)
FSAR I 1.8.3.2 j 8.1.4 t
EE-29 I
IEEE 308 8.2.2 1.8.3.4 8 8.2.2.2 1
EE.80 9
IEEE 384 8
I I 8.3.1.4 I Design Criteria EWR.10275 I
IEEE 422 g 8.3.1.5 1
iIIIIIIIIIIIIIIII Page 1
Toole 3 DESIGN BASIS *;UMMARY (Cont)
CURRENT PRESERVATIOiS I
O DESIGN BASIS LICENSING BASIS ItC<C<<<
PROCESS a))>
I
- I I
I
. I 4
Docunentation After Consinicion ;
Cwrent Llcensing I
1 o
I I Submitted for I Reviewed Agasnsf Basis Desenibed I
Glnne Station 1
TOPICa I
Design I
Design Basis I
IEEE Standards I
In UFSAR I
Procedure Which I
Industry I
5t!lds I
RUESAR Sec ionE Section Maintains I
Standarsd I
I I
I I
I I
I 120VDC EEPS-1 (Westinghouse)
I FSAR 1.8.32 11s 14 EE-29 I
IEEE 30 I
8.2.2 I 1.34 I.314 I
EE.8 0 IEEE 3841 I
I 8.3.2.1 I Design Criteria EVR-10275 I
IEEE 422 Instniment and E-EPS-1 (Westinghouse)
F fSAR
' 1..3.4 1 7.1.2 EE£29 f
IEEE 279 Cornrol 7.2.2 I 7.2.1 EE-80 J
IEEE384 8
l Signal Loops 8.2.2 i
7.3.1 I Design Criteria EWR.10275 I
IEEE 422 I
I I
I 1~7.4.1.1jj I
I 1Z8.3.1.4 I
I I
Cable 1
IPCEA' I
FSAR 1.8.32 8.3.1.4.1 EE-29 I
IEEE 422 Setledlon I
I 8.2.2 1.8.3.4 9.5.1.2.4.8s EE.80 I
IEEE 383 (Materials)
D i
1 l
I esign Criteria EWR.10275 i
Page 2
I i
I Table 3 DESIGN SASIS
SUMMARY
(Cont) i CURRENT PRESERVATION I,
I DESIGN BASIS I
I I
Documenta I
I Submitted Topicalt I
Design I
Design Bs Ai I
5 I
fEvi I
I I
tion for
- sls 0 ),
I I
I I
I I
I LICENSING BASIS I
"<c"<
PROCESS
)))>>>
I After Constction I Current Licensing Reviewed Against Basis Desaibed I
Ginna Station IEEE Standaf ds in UFSAR Procedure Which Industry (JFSAR Secion Section S
Marntins I
Stndards 1,_I_
13 3 8.14 l
DA-EE-93.107.07 I
IEEE 279 8.3.1.1.4.2 I
DA.EE93.104-07 1
IEEE 308 I
8.3.l.4 f
EEA-09003 I
IEEE 384 8.3. 21 I
DA-EE.96&005"07 I lEE 422 I
EWR4713-1 1
I Circuit Isolaion I E-EPS 1 (Westinghouse)
I I
I I
I I
I FSAR 722 8.2.2 I
NOTES:
- 1) IPCEA - Insulated Power Cable Engineers Association
- 2) Standards enabled after construction are described In the Mod packaga on a job basis
- 3) Final Facility Dscripilon and Saety Analysis Repont I
Representative Analysis New CREATS Cables
Response to NRC Inquiry Concerning Electrical Separations for CREATS Cables in Tray This purpose of this correspondence is to describe the approach taken by Ginna to ensure that the installation of the cables required for the CREATS modification would maintain the plant design basis for separation of redundant systems' cables installed in trays. The routing of the CREATS cables was evaluated from two different perspectives. First, the new cables to be installed in cable trays for the CREATS modification were reviewed to demonstrate that they will not be susceptible to failure of both redundant trains due to a single cable fault. Secondly, the cable installation and protection was reviewed to ensure that no single fault on any of the new cables can cause loss of any other safety related redundant equipment functions. Within those two approaches, the key characteristics of the installation that were reviewed were 1) physical separation between the two new trains of CREATS cables, 2) the fault protection of the cables to clear faults before cable damage could occur, propagating faults or fires, and 3) cable ratings with respect to voltage levels for CREATS cables and other cables in the trays being used.
Circuit schedules issued for PCR 2003-0037, "CREATS Electrical Scope", for construction have the cable routing details representing the cables being installed in trays in the Relay Room. All of these cables are 120 volts AC or 125 volts DC. There are no 480 volt or higher power cables being installed for the CREATS modification in tray. All 480 volt cables being installed for CREATS are in independent conduits.
The Ginna design philosophy, since original plant design and during all plant modifications since, has been to implement protection schemes that assure that the fuses and breakers selected for a circuit are sized to protect the cable from damage. The fuse/breaker clearing curves are evaluated to ensure a fault or overload clears before the cable damage curve is reached. The fault protection of all cables being installed for this modification has been analyzed to show that the protective device for each cable will clear any fault before the cable damage curve is reached. Breaker and fuse protection of these circuits has been reviewed. The devices installed for this modification will all be procured and installed Safety Related. This feature ensures that if a cable installed for CREATS faults, that fault will clear before cable damage could cause a tray fire that could spread to the redundant train on any "associated circuit" that may transverse between the two redundant cables. Attached are two representative curves created to evaluate the cable protection of new cables. These represent the circuits with the highest voltage rating and smallest cable size for the circuit in each category installed in trays: a 120 VAC control cable (Circuit Schedule C5635) and a 125 VDC control cable (C5692).
Both plots show that the protective device (breaker or fuse) will protect the limiting cable.
Following is a table that lists the trays to be utilized by the CREATS project. A walkdown of these trays in the relay room was performed to verify that the utilized portion of each of these trays is separate. Where the same tray designation is utilized for both trains, the cables for each train will maintain physical separation in the tray so the A and B cables will not be routed together, but utilize separate sections of the trays.
/ V f 6
A Train Tr
_s _
B Train Trays 20 25 21 27N 23 28N 27S 29N 28N 29 28S 30 31 180 32.
195 126 401 127 157 163 180 3796 The voltage level of the cables installed in the trays being utilized for CREATS routing was reviewed. There is no 480 volt or higher power cables installed in the utilized trays.
Safety related 120 VAC and 125 VDC instrumentation and control cables have been previously analyzed to demonstrate that the protective device will protect the installed cable. It is a design assumption that original plant design and subsequent design changes were performed to applicable standards such that all unanalyzed cables have appropriate protection. This design characteristic will clear a cable fault before the cable could damage CREATS cables in the same tray.
/g4 ee 2 coeo4
3-GHB 1015 0.1 0.01 0.5 2-C5635 1-120 vac LOAD 1
10 100 1000 1 0000 C5635 A Train 120 VAC TIME CURRENT CHARACTERISTIC CURVES BY:
. NO:
PLOTTING VOLTAGE:
0.12 kV DATE: 9-24-2004 Studv: untitled.dat Ite 3
3so+;,
4 2-Cable 16 AWG (Copper)
CROSS LINK POLY.
(1/phase) 0.12 [kV)
I 3-BAF-3 2-C5692 1-125 VDC load 0.5 1
10 100 1000 10000 PLOTTING VOLTAGE:
0.12 kV Studv-S:%Prod\\MOD\\PCR\\2003.003-0037 Rev 1\\#16 awA vs BAF-3 fuse.tec
ROCHESTER GAS AND ELECTRIC CORP. - GINNA STATION CIRCUIT SCHED&E Page: I of 2
Date:
01/29/04 Rev.:
A Circuit No.:
C5635 Prepared:
f I2 Reviewed: '3 Approved:
Project:
CREATS I & C I ELECTRICAL SCOPE Job No.:
PCR 2003-0037 &.
I Other Date Status Engr.
Misc.
3/D CONSTRUCTION Conductors Conduit(s)
Cable Routing No. of No. of Cable Shield perating Cable BOMI able Ste Length Cables Cond.
Size Voltage Rating PO#
Length 1
10
- 23. 32, 31, C5635, 1
3/C 14AWG 120 600 MID5005788 140 1
20 RR-129A-P, C5635 1 Work Group / QC Verification and Validation Reel No. Cut Length pC Cable IQC Pull QC Conduit JQC Tag Nature of C 120 VAC CONTROL Division:
A - TRAIN A Circuit:
3 Phase:
NO Appendix R Safe Shutdown:
NO Maintained Spacing:
NO Safety Classification:
SAFETY CLASS-3 From Equip
- ABBToEup
- CB3 From Desc
- AUXILIARY BENCHBOARD To Desc q
CREATS JUNCTION BOX 3A From Drawing:
ATTACHMENT 18, SH 6 To Drawing: ATTACHMENT 17, SH-1 Term Block Term No.
Wire Mark To Base I Trace Color Cont.
Megger From Term Block Term No.
IoC comn~ I sn ar W r WACf kr WG.
I_-_--
I I
I CB 8
1103-3 1
1 TB1 I
CB 9
1103-4 L
I I
TB1 4
CB 10 1103-N I
I II TB1
-2 NOTES:
- 1. THIS IS A NEW CIRCUIT.
- 2. INITIATE A BREECH PERMIT IN ACCORDANCE WITH FPS-1.
- 3. INSTALL THROUGH NEW PENETRATION RR-129A-P AND EXISTING PENETRATION CR-148-P.
1,e e 3 5-of &
7z4 /5U ROCHESTER GAS AND ELECTRIC CORP. - GINNA STATION CIRCUIT SCHEDULE Page: I of 2 Date:
02/24/04 Rev.:
A Circuit No.:
C5692 Prepared:
Reviewed:
-Approved:
Project:
CREATS I & C ELECTRICAL SCOPE Job No.:
PCR 2003-0037 1&*v__
Other Date Status Engr.
Misc.
Y J CONSTRUCTION Conductors Conduit(s)
Cable Routing No. of No. of Cable hield Operating Cable BOMI Cable Size fength C5631,RR-804-PC5631.I Cables Cond.
Size Voltage Rating PO#
Length 2
70
- 25. 27N. 28N. CR41-P 2
10 2
2/C 16AWG YES 125 600 MID5000196 120 Work Group / QC Verification and Validation Reel No. -Cut Length PC Cable IQC Pull JQC Conduit 1QC Tag Nature of C 125 VDC CONTROL/POWER Division:
D - TRAIN B Associated Circuit:
3 Phase:
NO Appendix R Safe Shutdown:
NO Maintained Spacing:
NO Safety Classification:
SAFETY CLASS-3 From Equip
- CJB-1B From Desc CREATS JUNCTION BOX 1B To Desc
- AUXILIARY JUNCTION BOX From Drawing:
ATTACHMENT 16, SH 4 To Drawing: ATTACHMENT 18, SH 6 TermTem Tr Block Term Wire Base I Cont.
Megger From To lock T
rn No.
Mark Trace Color WG QC CONDISHD lC WG QC TB9 1
ANN-E08 I
I I
I CRHD 4
T89 4
EAP l_
I I
I CRHD 8
TB9 8
ANN-K31 I
I I I
CRHD 12 TB9 9
KAP I
I I
CRHD 11 NOTES:
- 1. THIS IS A NEW CIRCUIT.
- 2. INITIATE A BREECH PERMIT IN ACCORDANCE WITH FPS-1.
- 3. INSTALL THROUGH NEW PENETRATION RR-804-P AND EXISTING PENETRATION CR41-P.
6 o ~4 Representative Analysis Existing Cables
EXISTING CABLE ANALYSIS As discussed with NRC during several conference calls, and demonstrated to the NRC representatives who participated in the August 19, 2004 walk-down of the relay room, the trays in question contain a large number of cables. However, very few are marked due to construction standards used at the time of installation.
To provide a reasonable assurance that the existing cables are properly protected, representative pre-existing cables from the trays used for the CREATS modification have been sampled and reviewed to determine the protective device used for fault protection of that cable. Cable damage curves were then created to demonstrate that the protective device is appropriately selected to protect the cable, clearing any fault or overload before cable damage can occur.
The cables in these trays fall into three categories: 125 VDC control power, 120 VAC control power, and 120 volt and lower instrument power. No 480 volt or higher power cables are in these trays. Addressing each category, the 125 VDC cables are protected by fuses. A DC fuse coordination analysis for the safety related DC system has been performed that would envelope the protection of DC circuits that may be routed in these trays. A representative plot is attached demonstrating that the fusing is designed to protect the cable below the cable damage curve. 120 VAC control power cables in these trays are fed by breakers. Most 120 VAC control power cables in the relay room trays originate from instrument bus or associated sub-panels. These circuits are all protected by safety related breakers, and an analysis has been performed that demonstrates that the breakers are correctly sized to protect the cables. A representative curve for 120 VAC control power cables damage curve versus breaker protection is attached. The last category, for 120 volt and lower instrumentation cables, was reviewed. The currents carried by these cables are driven by instrumentation that has current driving capability limited by power supply size or instrument fusing. Non-Safety related portions of these instrument loops are normally isolated from safety related portions by isolation devices (optical isolators, transformers, or fuses).
As demonstrated from the above discussion and attached curves, there is reasonable assurance that a fault in existing cables will not result in cable damage sufficient to propagate to adjacent CREATS cables.
lylr Zf
/ ofr
V 0
0 C,)
C E
Fo 0.5 1
10 100 1000 10000 Coordination between Feedwater Transmitter PLOTTING VOLTAGE:0.12 kV l 7)
- A C-Panel and Instrument Bus D distribution panel.
BY: D.Martin Circuit G273 routed In tray 28 NO:
DATE:
11-19 2004 Study S:\\Prod\\MOD\\PCR\\2003\\2003-0037 Rev 1\\cable loading for NRC g273.tcc fl y ijz-
Current In o
0 U
CD co E
1-I FUBUS]4/21A-P 17-v S-% 0C 0.1 G0947 Contacts in control circuit 0.5 1
- 10 100 1000 10000 0
Coordination between load and control PLOTTINGVOLTAGE:0.12 kV I LS V D C-circuit fuse (ref dwg 21946-0112.1)
BY: D.Martin Circuit routed In cable tray 28 l NO:
I DATE:
11-19-2004 Study: S:%Prod\\MOD\\PCRV2003L2003-0037 Rev 1%cable loading for NRC dc circuit.tcc
?XS of
-&Z 3 CV+5' 2-J 2.
ROCHESTER GAS AND ELECTRIC CORP. -
GINNA STATION CIRCUIT SCHEDULE 1EF 1 of 1 DATE: 5/10/85 REV: 2 CIRCUIT NO. G273 Prepared :
Z~- Ia,)A - :)'
.Jg N 6 19 8 Project: MFWP NPSH EWR No: 4115 Reviewed ?....,
FCR No:
J DATE l-STATUS-lENGR lApproved I -(-£ I 4s eu iL-U I R45; -- -I ECN No:
V CONDUCTORS I
CONDUIT CABLE ROUTING Maintained Spacinq ( )
NO & SIZEI LENGTH IVOLTSI B/M I SIZE I LENGTH 1-2-12 tj EK-7c j 3/4 j
5 (12+10)31,32,23(12+i6)27,28, 1
1 I
1
-1 1 29,151,56,53,48,49(A+3)20 REEL NO.
ICUT L'THI QC VERIFICATION 1
_ CUT l PULL ICONDUIT ITAGGINGI NU OF1 II NATURE OF CIRCUIT: Instrument Power.
) 3 l
FROM: Inst. Distribution Panel ID l TO: Feedwater Transmitter Panel REFERENCE DRAWING FROM:
l REFERENCE DRAWING TO:
W SOOB447 (3) l 33013-1627 TERM I TERM 1*1 WIRE ICOLORICONT.I MEGGER IFROM I TO I TERM I TERM l*l BLOCK l NO. 'j MARK IBA/TRIWGIQCICONDI SHDIQCIWGIQCvWG QCI BLOCK l NO. l l 16 l
Li1 A
T LI T
l N
lL2 I
I 1
1 A
lL2 ll I
II I
I I
III.I I
'I*1I 1 1
1 II I
I I I
I I I
I I
I I
I I
J I I I
II I
II I
I I
I. I....
1 II iil I
II I
lii I I I
I I I
I I I I
I I I I
IJ I 1.1u I
II l
ll lii l I
I III
~IN IAL REJ'ORDS I I II II II 1
1II I
I I I I 1
1 1 NOTES:
- Indicates determination.
Indicates revi
- tems.
liiT.
Inst. I.D. Numbers:
Tool I.D. Numbers:
Aoprovals:
WG Supervisor(s)
WG/QC Remarks:
Date(s)
QC Supervisor(s)
Date(s)
/7 Zf /
4 i
5
ROCHESTER GAS AND ELECTRIC CORP. -
GINNA STATION CIRCUIT SCHEDULE PAGE 1 OF 1 DATE: 01/12/94 REV:
6 CIRCUIT NO. G0947 PROJECT:
FIRE RELAY PANEL MODIFICATION Prepared EWR No: 4668 l
DATE l
STATUS l
ENGR l
R evieweT!
FCR No:
[As-Built A S ECN No:
II Approvedpt'
_tz CONDUCTORS J
CONDUIT l
CABLE ROUTING NO & SIZE ILGTHIV:OP,BOMI BOM#,PO#S[ SIZE I LENGTH l Maintained Spacing (N) 1 I
01 125 IEK-7C I1 1 30.00 1197,28,29,151,56,59,167, 4/C 1
1600 1
I l
l165,170,171,62,G0947 14(AWG)
I I
I I
I I
REEL NO. ICUT L'THI QC VERIFICATION I
ICUT I PULL ICONDUIT I TAGGINGI II I
I I
NATURE OF CIRCUIT:
3 PHASE SAFE SHDN:
C 125 VDC Control/Power (N)
NO l
SAFETY CLASSIFICATION:
DIVISION:
Safety Sianif./Non 1 FROM EQUIP:
PZ42 TO EQUIP: CFLCG DESC: TERMINAL BOX PZ42 DESC: CHARCOAL FILTER LOGIC CAB G WIRING DIAG: 33013-0993 WIRING DIAG: 10909-0067 TERM I TERM I WIRE I COLOR ICONT.1 MEGGER IFORM 1 TO I TERM l TERM BLOCK I NO.
I MARK 1 A/TR/TRIWGI0CIC,SHDIOCIWGIOCIWGIOCI BLOCK I NO.
A 17 IFP-P5 IBLACK I I I I
I I
I I
lFUSE IP5 A
18 IFP-N5 IWHITE I I I I
I I
I I
lFUSE INS A
19 121A-P IRED I II I
I I
I I l TC 122 A
110 121A-T lGREEN I II I
I I I I ITC
.123 I
I I
II ll l
il l
l I
NOTES:
- 1. RELAY AR93.
- 2. CIRCUIT CONTINUES VIA G947A.
ADDITIONAL REFERENCE DRAWINGS:
Elementary: 10905-0439 Other Dwg: 21946-0112S2 Cond Dwg 1:
Cond Dwg 2:
Inst I.D. Numbers:
Tool I.D. Numbers:
Approvals WG Supervisor(s)
Date(s)
QC Supervisor(s)
Date(s)
WG/QC Remarks:
I-CCD 38 1 CONTROLLED COPYl
- 90.
+'
f NO-2.
-1 I
I t
-/
_re7r' Design Analysis DA-EE-2000-009 Revision 1
Instrument Loop Performance Evaluation and Setpoint Verification Instrument Loop Number RMS R45/R46 Constellation Generation Group R.E. Ginna Nuclear Power Plant 1503 Lake Road Ontario, NY 14519 DA-EE-2000-009 Revision 1 October 26, 2004 Prepared by:_
Reviewed by:.
Reviewed by:
/27A ZA'!
i Design Engineer t2;o&A(
- 2-T1 Primary Reactor Systefis
///i61,2 I/
/Dak Date a-fe I
Nuclear Erafety & Li Date Approved by:. -T-Q W 1 Independent Review En ineer 4A1t1 0 Date Design Analysis DA-EE-2000-009 Revision 1 1 0/26/2004
REVISION STATUS SHEET REVqISION AFFECTED SECTIONS DESCRIPTION OF REVISIONS 0
All Initial issuance to support PCR 99-004.
I 1.0, 2.0, 3.2, 3.5, 3.7, 3.8, 3.9, 3.11, 4.2, 4.3, 5.7, 5.13, 7.1.1, 7.1.3, 7.3.1.1, 7.3.2, 7.7, 7.7.2, 7.8.1, 7.9, 8.1, 8.2 Removed reference to RG&E.
Methodology change to remove the term Allowable Value, consistent with Technical Specification amendment 85.
Incorporated revised Analytical Limit.
Revision 1 10/26/2004 Design Analysis DA-EE-2000-009 Page 2 of 20
INSTRUMENT PERFORMANCE EVALUATION AND SETPOINT VERIFICATION TABLE OF CONTENTS Sectior 1.0 2.0 3.0 4.0 5.0 6.0 7.0 8.0 I
Title Page Purpose...............................................................
Conclusions...........................................................
Design Inputs..........................................................
Referenced Documents..................................................
Assumptions...........................................................
Instrument Channel Block Diagram.
Computer Codes..............................
Analysis.............................................................
Results.
4 4
4 5
6 10 I11 1 1 19 Design Analysis DA-EE-2000-009 Revision 1 10/26/2004 Page 3 of 20
INSTRUMENT PERFORMANCE EVALUATION AND SETPOINT VERIFICATION
1.0 Purpose
The purpose of this calculation is to document the overall loop uncertainty associated with control room ventilation system air intake radiation monitors R-45 and R-46, and to ensure that sufficient margin exists at the alarm setpoint. Since R-45 and R-46 are identical in design, R-45 wvill be discussed; however, this calculation applies to both loops.
Revision 1 of this analysis is for the following purposes:
Update the analysis based on a revised Analytical Limit.
Remove the section associated with Allowable Value determination.
Provide the Channel Operational Test (COT) acceptance criteria.
2.0
==
Conclusions:==
The calculated uncertainties of -36.8% for the indication and 37.4% for the alarm is acceptable to ensure proper indication and alarm functions and to ensure that control room ventilation isolation occurs when necessary.
3.0 Design Inputs:
3.1 Victoreen (Inovision), Installation Operation, and Maintenance Instruction Manual, Model 955A, Part No. 955A-1, published 5/96 by Victoreen (Inovision) Inc.
3.2 R.E. Ginna Drawing 33013-1867, Control Room HVAC.
3.3 PCR 99-004, Control Room Radiation Monitor Skid Replacement.
3.4 EE-171, Control Room Radiation Monitor Specification, 12/6/99.
l 3.5 R.E. Ginna drawing 33013-0721, Control Building Ventilation Duct New Outside supply.
3.6 Procedure P-9, Radiation Monitoring System.
l 3.7 R.E. Ginna sketch 33013-2656-1, RMS1, RMS2 and RMS3 Rack Layout.
3.8 R.E. Ginna sketch 33013-2787-1, Control Room Ventilation Instrument Locations, Instrument Panels and Conduit Layout.
I 3.9 Design Analysis, DA-EE-2001-013, Revision 1, Control Room Radiation Monitors Analytical Limit Calculation.
3.10 Victoreen (Inovision) procedure CAL848AD, Calibration Procedure for Model 848-8A 10 mCi Field Calibrator-- Digital, dated 3/2/01.
l 3.11 CPI-MON-R45, Calibration of Control Room Ventilation Radiation Monitor R-45.
Design Analysis Revision 1 DA-EE-2000-009 Page 4 of 20 10/26/2004
4.0 Referenced Documents:
4.1 Regulatory Guide 1.97, "Instrumentation for Light Water-Cooled Nuclear Plants to Assess Plant and Environs Conditions During and Following an Accident", (Rev. 3, Dated 5/83).
4.2 R.E. Ginna Drawing 10905-384, Elementary Wiring Diagram Annunciator Panel E.
l 4.3 R.E. Ginna UFSAR, Sections 6.4.2, 6.4.5, 11.5.2, and Table 3.11-1 Environmental Service Conditions for Equipment Designed to Mitigate Design Basis Events.
4.4 Improved Technical Specifications, R.E. Ginna Nuclear Power Plant, Section 3.3.6 and Table 3.3.6-1.
4.5 Procedure CH-RETS-RMS, RMS Monitor Setpoint Determination.
4.6 AR-E-I 1, Alarm Response Procedure, Control Room HVAC.
4.7 ANSI NB.1-1969, Guide to Sampling Airborne Radioactive Materials in Nuclear Facilities.
4.8 ODCM, Offsite Dose Calculation Manual.
4.9 Procedure CH-RETS-CAL-SPEC, Calibration of Victoreen (Inovision) RMS Detectors to Establish Alarm Setpoints.
4.10 Procedure EP-3-S-0505, Instrument Setpoint/Loop Accuracy Calculation Methodology.
4.11 ANSI N13.10-1974, Specification and Performance Of On-Site Instrumentation For Continuously Monitorng Radioactivity In Effluents.
4.12 ANSI N42.22-1995, American National Standard Traceability of Radioactive Sources.
Design Analysis Revision 1 DA-EE-2000-009 Page 5 of 20 10/26/2004
5.0 Assumptions
5.1 Victoreen (Inovision) reference accuracy specification for the detector is +/-20% of actual dose (reading), +/-1 digit (+1% of reading) for the digital display and +/-3% of reading for the alarm setting.
Basis:
Reference Victoreen (Inovision) Model 897A series detector and Model 956A-201 Universal Digital Ratemeter specification sheets in Design Input 3.1.
5.2 The following inaccuracies were assumed:
Detector power supply effect is negligible.
Detector and monitor drift effects are assumed to +10% of reading.
Basis:
The equipment operates within stated limits of performance specifications for the variations in external power supply voltage. The high voltage setting for optimal detector response is set at the mid point of the voltage plateau. This allows for variations in the detector dc supply voltage of at least 4 50 vdc with no significant change in the detector response. Normal variations in the regulated 120 VAC +/-2% supply (MQ400E) will result in insignificant changes to the detector and UDR dc voltage levels. Therefore, the external power supply effect is considered negligible.
The detector is a GM tube which has negligibl2 drift over a 30 month period and the monitor digital signal processing is inherently stable. Therefore, although the drift may be considered negligible, a 30 month drift value of +10% of reading will conservatively be used.
5.3 The monitor (indication) M&TE error is conservatively estimated to be +5.0%.
Basis:.
M&TE equipment should be more accurate than the device being calibrated by a ratio of 4 to 1. The calibration of the system will be performed during normal conditions and the calibration tolerance for the displayed indication is + 20% of the Cs 137 source strength.
Plant calibration procedures normally require that the accuracy of the test equipment is four times greater than the accuracy of the equipment being calibrated (reference IP-MTE-1). It is assumed that the M&TE equipment used to calibrate the monitor has an accuracy equal to 1/4th of the calibration accuracy. Therefore, it is considered that the M&TE error of +5% of the reading for the meter is conservative.
5.4 The detector and monitor (ratemeter) temperature and radiation effects are negligible.
Basis:
The detector will be located in the control room ventilation duct, which per design input 3.2 has temperature limits of 20F to 91'F. The vendor specification of -10F to 122WF envelopes these limits. The monitor (ratemeter) will be located in the main control room where the normal temperature limits are 50'F to 1040F (normally 70-781F). The vendor specification of 32WF to 1227F envelopes these limits also.
Design Analysis Revision 1 DA-EE-2000-009 Page 6 of 20 10/26/2004
For a steam line break accident, the turbine building temperature may reach as high as 2200F (for 30 minutes), then is reduced tol0O0 F within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (see section 7.3.3.2).
Because of the high flow rate (2000 cfin) in the 42 inch ventilation duct and the relatively short duration that the turbine building temperature is greater than 1 000F, there will be no significant increase in the internal duct temperature. Therefore, the detector will continue to operate below the vendor specified upper limit of 1220F.
It is assumed that control ventilation isolation will occur prior to any significant increase in radiation levels in the control room and therefore there will be no radiation effect on the monitor.
5.5 Insulation resistance error (cable leakage effect) is not applicable..
Basis During harsh temperature and humidity conditions associated with a LOCA or HELB design basis accident, insulation resistance (current leakage) effects may induce signal current leakage. The cable that connects the detector to the monitor will not be exposed to a harsh environment during accident conditions. Therefore, abnormal environmental conditions due to an accident are not applicable to this function.
5.6 Indicator resolution is assumed to be negligible.
Basis Indicator resolution is assumed to be + 1 digit (least significant digit) per draft ISA-dTR67.04.03, "Indication Uncertainties and Their Relationship With Indicated Values".
The least significant digit of the Victoreen (Inovision) model 956A-201 UDR is 1/100 mr/hr, and therefore will have a negligible effect on the overall uncertainty value of the indicated reading.
5.7 Indicator calibration tolerance is assumed to be + 20% of reading, the alarm/control room HVAC isolation actuation tolerance is assumed to be +4% of setting.
Basis The calibration procedure (CPI-MON-R45) requirement for the indicator tolerance band is +/-20% of the corrected Cs 137 source value, and for the alarm/control room HVAC isolation actuation the tolerance is +4% of the alarm setting.
5.8 M&TE accuracy and drift uncertainty for the alarm are assumed to be + 3% of setting.
Basis The vendor does not specify a drift setting for the alarm setpoint. The alarm setpoint circuitry is part of the UDR (Universal Digital Ratemeter) and as such is expected to be inherently stable. The drift term will therefore be conservatively set equal to the vendor alarm reference accuracy of 3% of setting. The M&TE error effect is conservatively assumed to be equal to the reference accuracy for the alarm setting. This is considered reasonable because it is necessary for the M&TE equipment to be more accurate than the device being calibrated in order for the calibration to be effective. In addition, M&TE equipment is required to be more accurate than the device being calibrated by a factor of 4:1 unless otherwise justified.
Design Analysis Revision 1 DA-EE-2000-009 Page 7 of 20 10/26/2004
5.9 The statistical accuracy of the indication is +10% of reading.
Basis During normal operation the "statistics" switch may be maintained in the 10% position.
This causes the monitor to base the displayed radiation level on the (last) minimum number of counts that will ensure a "precision" of +10% at 95% confidence. Therefore, the displayed radiation level will move after each update within an approximately 10%
band around the "true" radiation level.
The total response time of the system to a step change in the radiation value is 60 seconds, due to the operation of the pulse counting algorithms. The detector radiation value displayed is the result of a rollin average of the latest 60, 1 second values, and is updated once per second. An alarm will be initiated within one second after the current rolling one minute average exceeds the alarm setpoint.
For a large radiation source term, as during a postulated Design Basis Accident, the effect of the statistical error and time averaging circuitry become negligible. The Control Room intake air gamma activity rises well above the level of the control room ventilation isolation setpoint in a very short period of time (Design Input 3.9).
5.10 Cs-1 37 reference source field calibrator has an uncertainty of +1 0%.
Basis Victoreen (Inovision) calibration procedure CAL848-8AD "Calibration Procedure for Model 848-8A 10 mCi Field Calibrator-- Digital" specifies an uncertainty of +10%
relative to actual dose rate for the Model 848-SA field calibrator.
5.11 The process measurement effects due to location of the detector will not negatively impact the calculation.
Basis The detector location in the air duct will be such that there is adequate mixing of the sample. The measurement of the activity inside the duct is a representative sample of the actual activity such that isolation will occur before significant exposure can occur. The more centralized in the duct the detector is, the more accurate the reading. The input to this calculation assumes the most offset mounting location, at 28" to the end of the duct.
Any location more centralized will result in a more conservative result. There is also a conservative assumption that only the activity within the air duct is being measured and no credit is taken for any activity outside the duct (at the detector location in the turbine building).
5.12 The energy dependence is + 15% of the reading.
Basis The response of a radiation detector is sensitive to the specific radionuclide present.
Changes in the level of radiation flux incident upon the detector and the environment will cause changes in the detector response. Each type of detector has a different response to radiation of varying energies. The vendor specification sheet for this detector shows an energy dependence value of + 15% of the reading.
Design Analysis Revision 1 DA-EE-2000-009 Page 8 of 20 10/26/2004
5.13 The Analytical Limit for Control Room Ventilation isolation is 0.91 mr/hr as read at the in-duct monitoring locations.
Basis The Analytical Limit of the setpoint for the monitors is based on the limit in the Control Room specified in 1 0 CFR 50, Appendix A, GDC 19 and the guidance provided by the NRC in NUREG-0737 Clarification of TMI Action Plan Requirements section Il.B.2, Dose Rate Criteria, and NUREG-0800 Standard Review Plan section 6.4, Control Room Habitability Program. Areas that require continuous occupancy are to be designed for a maximum of 5 rem whole body dose, or its equivalent to any part of the body for the duration of the accident. This is further defined as a 30 day weighted average dose rate of less than 15 mremlhr. Due to the reduced effective volume within the air duct as compared to the Control Room the Analytical Limit at the detector location must be lowered. Per reference 3.9 Design Analysis, this results in an Analytical Limit of 0.91 mr/hr.
5.14 The high alarm/control room ventilation isolation actuation setpoint shall be set high enough (greater than 10 times background) to prevent spurious alarms and undesired actuations of control room isolation.
Background radiation levels were measured at the control room air intake duct (at the detector location) and also at the roof air intake to the control room. All readings were less than 0.01 mr/hr, which is less than 1/10th of the high alarm/control room ventilation isolation actuation setpoint of 0.25 mr/hr.
Design Analysis DA-EE-2000-009 Page 9 of 20 Revision 1 10/26/2004
R-45 Block Diagram Figure 1 Design Analysis Revision 1 DA-EE-2000-009 Page 10 of 20 10/26/2004
6.0 Computer Codes:
I I
N/A
7.0 Analysis
7.1 Instrument Channel and Scope of Analysis - Refer to Figure 1 7.1.1 Description of Functions The Control Room Ventilation Radiation Monitoring System consists of two redundant monitoring channels R-45 and R-46, which provide information concerning the gamma radiation intensity within the ventilation stream of the control room supply air. Each channel consists of a model 897A-210 Geiger-Muller (GM) tube detector with an integral preamplifier, and a model 956A-201 Universal Digital Ratemeter (UDR). The G-M tube is a halogen quenched aluminum encased device, sensitive to beta-gamma activity in the gas sample. The Victoreen (Inovision) monitor (ratemeter) converts the detector input (counts) into a mr/hr display. The ratemeter outputs a 1-5 vdc signal representative of the radiation level in mr/hr to the PPCS. It also has a contact output that feeds the control room HVAC isolation and MCB Annunciator El1 circuitry. Alarm and control room ventilation isolation functions will occur when the high alarm/isolation setpoint is reached. The two channels are identical, therefore, further discussion will be on R-45, but will also be applicable to R-46.
7.1.2 Protection This channel does not perform any (reactor) protective functions.
7.1.3 Control This channel will generate an automatic control room ventilation isolation signal (isolating the Control Room HVAC) when the sensed radiation signal reaches the high alarm setpoint. Also, the charcoal filter fan will be started and the control room ventilation system dampers aligned to recirculate the control room air through the HEPA and charcoal filters.
7.1.4 Indication Design Analysis DA-EE-2000-009 Page 11 of 20 Revision 1 10/26/2004
RMS Channel R-45 provides control room personnel with digital indication of the radiation level of the incoming air to the control room and a high radiation/control room HVAC isolation alarm (control room annunciator El 1).
Summary of Instrument Channel Functions Function Description of Function Safety Classification Within this scope?
Reactor None N/A N/A Protection Eng. Safety None N/A N/A Features Control Control Room Ventilation Safety Related YES Isolation Alarm Control Room Radiation Safety-Related YES Indication Control Room Radiation Safety-Related YES 7.2 Documenting the Components of Sensor Accident Uncertainty (AEUp and AEUs) 7.2.1 Pipe Breaks N/A 7.2.2 Seismic Event N/A 7.2.3 Documenting the Components of the Accident Current Leakage Effect (CLU)
During harsh temperature and humidity conditions associated with LOCA or HELB design basis accidents, insulation resistance effects induce signal current leakage.
Abnormal environmental conditions due to an accident are not applicable to this function.
CLU = N/A 7.2.4 Determining the Components of Process Measurement Uncertainty (PMU)
The random nature of the radioactive decay process causes a statistical uncertainty in the detection process. These inherent fluctuations are random and approximately normally distributed. They represent an unavoidable source of uncertainty in all nuclear measurements, often resulting in the predominant source of imprecision of error. The statistical accuracy is + 10% (Assumption 5.9).
Pma, = +/-10.0%
The energy dependence of the reading is + 15% (Assumption 5.12).
Pma2 =+/-15.0%
Design Analysis DA-EE-2000-009 Revision 1 10/26/2004 Page 12 of 20
7.3 7.3.1 Victoreen (Inovision) calibration procedure CAL848-8AD "Calibration Procedure for Model 848-SA 10 mCi Field Calibrator -- Digital" specifies an uncertainty of +10%
relative to actual dose rate for the Model 848-8A field calibrator. (Assumption 5.10).
Pma3 = +10.0%
Instrument Loop Performance Requirements Documenting the Design Requirements for Monitoring the Process Parameter Identify Performance Related Design Bases Associated WVith the Instrument Loop:
7.3.1.1 SR NO NO Si YES YES NO Safety Classification (SR/SS/NS).
NUREG 07371RG 1.97 as documented in Table 7.5-1, of the Ginna UFSAR Per a review of UFSAR Table 7.5-1, this instrument channel is not identified in RG 1.97 as being required as a post-accident monitoring instrument.
EQ (per the 10 CFR 50.49 list)
This instrument loop is not identified as requiring Environmental Qualification.
Seismic Category ( Seismic Class I/ Structural Integrity Only / NS)
Technical Specifications The limits applicable to this instrument loop are addressed in Section 3.3.6 of the Ginna Improved Technical Specifications.
UFSAR This instrument is described in Sections 6.4.2.2.2, 6.4.2.2.3, 6.4.5, and 11.5.2.2.16 of the GinnaUFSAR.
EOP Per a review of the EOP Setpoint database, there are no EOP related setpoints covered by this analysis.
7.3.2 Description of Limits Function Control Room Isolation Anal]tical Limit
.91 mr/hr Reference Design Input 3.9 Design Analysis DA-EE-2000-009 Revision 1 10/26/2004 Page 13 of 20
7.3.3 Documenting the Environmental Conditions Associated With the Process Parameter 7.3.3.1 Identification of the Sensor Location:
Control room 42 inch diameter air intake duct, turbine building operating floor 7.3.3.2 Description of Environmental Service Conditions for the Sensor:
Normal Operation, Turbine Building Reference 4.3, UFSAR Table 3.11-1.
Temperature: 500F to 104'F Pressure:
Atmospheric Humidity:
60% Nominal Radiation:
Negligible The detector is located in the Control room air intake duct, which per PCR 99-004, section 3.2.2 has the following ambient environmental limits: temperature limit of 20 F to 910F, pressure at 0 psig, and 100% humidity.
During Calibration Same as Normal Operation above.
Accident, Turbine Building Reference 4.3, UFSAR Table 3.11-1.
Temperature: 220'F for 30 minutes, reduce to 1000F within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
Pressure:
1.14 psig on mezzanine and basement levels, 0.7 psig on operating floor for 30 minutes, reduce to ambient 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
Humidity:
100%
Radiation:
Negligible Flooding:
18 inches in basement 7.3.3.3 Identification of Other Components Locations:
Instrument Location R-45 Monitor (Indicator)
Control Room, Rack RMS2 and alarm.
7.3.3.4 Description of Environmental Service Conditions for Other Components:
Normal Operation, Main Control Room Reference 4.3, UFSAR Table 3.11-1.
Temperature: 50'F to 1 04'F (usually 70 - 780F)
Pressure:
Atmospheric Humidity:
60% Nominal Radiation:
Negligible Design Analysis Revision 1 DA-EE-2000-009 Page 14of 20 10/26/2004
During Calibration Same as Normal Operation Above.
Accident, Main Control Room Reference 4.3, UFSAR Table 3.11-1.
Temperature: Less than 1040F Pressure:
Atmospheric Humidity:
60% Nominal Radiation:
Negligible Flooding N/A Instrument Channel Component Specifications:
Identify and summarize the specifications associated with each instrument within the scope of this analysis. Complete one Instrument Specification Table for each instrument.
EIN: Readout Module R-45 7.4 Specification Data Source Manufacturer/Model No Victoreen (Inovision)/956A-Design Input 3.1 201 Input Range digital pulse corresponding to Design Input 3.1 1 OE-2 to 1 OE+3 mr/hr Output Range 1 OE-2 to 1 OE+3 mr/hr Design Input 3.1 indication Safety Classification Safety-Related Proposed Setpoints 0.25 mr/hr Proposed Location Control Room Proposed Accuracy monitor +1 % of reading Assumption 5.1 detector +20 % of reading Drift
+ 10.0% of reading Assumption 5.2 Calibration Uncertainty
+/- 5.0% of reading Assumption 5.3 (M & T E )_
Calibration Tolerance
+ 20.0% of source value Assumption 5.7 Temperature Effect Negligible Assumption 5.4 7.5 Determining the Indication Uncertainties No logarithmic conversions take place between the detector signal and the ratemeter digital display or alarm circuit. Therefore, no calculations for converting from % of reading to equivalent linear full scale (ELFS) are required.
Design Analysis DA-EE-2000-009 Revision 1 10/26/2004 Page 15 of 20
7.5.1 Process Measurement Uncertainty (PMU)
(reference section 7.2.4)
PMU = (Pma 12+ Pma22 + Pma 32)1'2 PMU = (10.02 + 15.0 2+ 1 0 0 2)0l2 =20.6%
7.5.2 Accident Environmental Uncertainties (AEU)
AEU = 0%
7.5.3 Accident Current Leakage Effect (CLU)
CLU = 0%
7.5.4 Calibration Uncertainties (M&TEU):
Per assumption 5.3, Measurement and Test Equipment Effect (M&TEU) is 5%.
Ice, = +5%
M&TEU = +[(Ice,)2 ]12 M&TEU = +/-[(5.0)2]'n M&TEU = +/-5.0%
7.5.5 Tolerance Uncertainty (TU):
The as left tolerance of the indicator is Ice2 = +20%
TU= +[(Ice2)2]'n TU 4[(20.0)2]'"
TU = +20.0%
7.5.6 Sensor Uncertainty (SU):
The sensor uncertainty is +20% (Assumption 5.1)
Sa = +20%
SU = 4[(Sa)2 ]11 2
SU=+ [(20.0)2]12 SU = + 20.0%
7.5.7 Drift Uncertainty (DU):
The drift uncertainty is assumed to be 10% (Assumption 5.2).
Red,= 10.0%
DU = +[(Red)']In Design Analysis Revision 1 DA-EE-2000-009 Page 16 of 20 10/26/2004
DU = 4[(10.0)2]'/
DU= 10.0%
7.5.8 Rack Equipment Uncertainty (REU):
Rack equipment uncertainty Rea, is 1.0% (Assumption 5.1)
Rea, = +/-1.0%
REU
[(Rea,)']`
REU = + [(1.0)2]1/2 REU =+ 1.0%
7.6 Calculating the Total Loop Uncertainties (Indication)
Provide the total loop uncertainty (TLU) for each end device for normal, seismic and accident conditions as applicable.
7.6.1 TLU Indicator TLUI = +/- (PMU2 + M&TEU2 + SU2 + DU2 + REU2 + TU2)"2 TLUI = +/- (20.62 + 5.02 + 20.02 +10.02 +1.02 + 20.02)1/2 TLU1(+) = +36.8% of reading TLU1(-)
-36.8% of reading 7.7 Determining Alarm Uncertainties The alarm circuits are integral to the monitor. The additional parameters that must be taken into consideration for the determination of the alarm setting uncertainty are listed in the following table.
EIN: Readout Module R-45 Alarm Function Specification Data Source Accuracy
+ 3% of Setting Design Input 3.1 Calibration Tolerance
+ 4% of Setting Assumption 5.7 M&TE Accuracy
+ 3% of Setting Assumption 5.8 Drift Uncertainty
+ 3% of Setting Assumption 5.8 I
Design Analysis Revision 1 DA-EE-2000-009 Page 17 of 20 10/26/2004
7.7.1 Calibration Uncertainties (M&TEU):
Alarm Measurement and Test Equipment Uncertainty The M&TE error effect for calibrating the alarm is considered equal to the reference accuracy.
Amte =3.0%
M&TEU = +/-[(Amte)2]'f M&TEU = +/-(3.0')'2 M&TEU = +/-3.0%
7.7.2 Tolerance Uncertainty (TU):
Alarm Calibration accuracy The as left tolerance for the high alarm setpoint is + 4.0% of setting.
Ace = +4.0%
TU =
[(Ace)2] ' 2 TU = +/- [(4.0%)2] `2 TU = +4.0%
7.7.3 Rack Equipment Uncertainty (REU):
Alarmn reference accuracy = +3% of setting
- Are = +3.0%
REU = [(Are)2 ]"1 REU = + [(3.0)2] 11 REU = + 3.0%
7.7.4 Determining Drift Uncertainty (DU)
Red2= + 3.0%
DU = + [(Red2)2]'12 DU = + [(3.0)2] In DU = + 3.0%
Design Analysis Revision 1 DA-EE-2000-009 Page 18 of 20 10/26/2004
7.8 Calculating the Total Loop Uncertainties (Alarm) 7.8.1 TLU Alarm TLUA = +/- (TLUI + M&TEU2 + + DU2 + REU2 + TU2)"2 TLUA= 4 ( 36.82 + 3.02 +3.02 +3.02 +4.02)12 TLUA(+) = +37.4% of setting TLUA(-)
-37.4% of setting Where:
TLU1
= The Total Loop Uncertainty Indication TLUA = The Total Loop Uncertainty Alarm CLU
= Current Leakage Uncertainty AEUs = Accident Environmental Uncertainty (Seismic)
PMU = Process Measurement Uncertainty REU
= Rack Equipment Uncertainty SU
= Sensor Uncertainty DU
= Drift Uncertainty TU
= Tolerance Uncertainty IU
= Indication Uncertainty M&TEU= Measurement and Test Equipment Uncertainty No distinction is made between Normal and Accident conditions for the Total Loop Uncertainty.
End Device TLU R-45 (Ind)
+/-36.8% of reading R-45 (Alm)
+/-37.4% of setting 7.9 Comparing the Reference Accuracy vs. the Calibration Tolerance Identify the calibration tolerance associated with each component. Next, obtain the reference accuracy associated with each component. Translate both effects into the equivalent units.
Tag No.
Reference Accuracy Calibration Tolerance R-45 (mon)
E 20% (Reading)
+/- 20 % of (Reading)
R-45 (Alm)
+/- 3% (Setting)
+/- 4.0% (Setting)
Reference accuracy is based on Assumption 5.1. The tolerance is appropriate.
8.0 Results
8.1 Maximum Calculated Setpoint and COT Uncertainty Maximum Calculated Setpoint = Analytical Limit - TLU
= 0.91 mr/hr - (0.374 x 0.91 mr/hr) = 0.57 mr/hr The alarm setpoints should be set such that they actuate control room isolation before the control room ventilation air duct radiation level exceeds 0.91 mr/hr. Therefore, the maximum calculated setpoint will be 0.57 mr/hr.
Design Analysis Revision 1 DA-EE-2000-009 Page 19 of 20 10126/2004
COT Uncertainty = 4 (M&TEU2 + DU2 + REU2)'
=4- (3.02 +3.02+3.02)I2
= +/- 5.2% of setting 8.2 Conclusion I
A review of the instrument loop performance requirements against the proposed loop configuration for RMS R-45 was conducted by this evaluation. The results of this review determined that the proposed safety related control room radiation monitor will initiate control room ventilation isolation prior to exceeding the 0.91 mr/hr limit. For conservatism it is recommended that the alarm (control room isolation) nominal setpoint will be set at 0.25 mr/hr, which is in excess of the minimum value of 0.1mr/hr discussed in assumption 5.14.
Design Analysis DA-EE-2000-009 Page 20 of 20 Revision 1 10/26/2004 Revised Submittal Tech Spec Table 3.3.6-1
Marked-up Technical Specification Sections 3.3 3.3.6 CREATS Actuation Instrumentation 3.3.6 INSTRUMENTATION Control Room Emergency Air Treatment System (CREATS) Actuation Instrumentation i
The CREATS actuation instrumentation for each Function in Table 3.3.6-1 shall be OPERABLE.
LCO 3.3.6 APPLICABILITY:
Ac=cord, z~i-T-ek be 3, Z.C -/
4illrlPlS PllUVUlilUIII Al IIIUUISIUU IU Hi-01E Durin CO-RE ALT4RATFIQG7 TVT
_S, ACTIONS
- NOTE -
Separate Condition entry is allowed for each Function.
I CONDITION l
REQUIRED ACTION COMPLETION TIME A.
One or more Functions A.1 with one channel or train inoperable.
-NOTE -
.The trolrooo - n;ay be uni olate hour eve ours le in this
,K in.
Place CGRCAT-in ml; r.
7 days
,, _____________I_
B.
One or more Functionsl with two channels or two_
trains inoperable.
B.1~ I
-IINO0T-E ----
tharol roomyb unisolat I hour
- every ours e in this Plae Tion.
Pl, ace ~GfiO-.S i
.lvuve 4.
IFJIis tftAm I
Immediately I
I I
C.
Required Action and C.1 Be in MODE 3.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time of Condition A or B AND not met in MODE 1. 2, 3, or 4.
C.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> R.E. Ginna Nuclear Power Plant 3.3.6-1 Amendment CREATS Actuation Instrumentation 3.3.6 I
I I
CONDITION REQUIRED ACTION COMPLETION TIME D.
Required Action and D.1 Suspond CORE 4
associated Completion AL-TRATIOIIZ.
Time of Condition A or B not met during movement D
of irradiated fuel
/
assemblies orduing D./
Suspend movement of Immediately
-eERE ALRATIOTs.
irradiated fuel assemblies.
I I
SURVEILLANCE REQUIREMENTS
- NOTE-Refer to Table 3.3.6-1 to determine which SRs apply for each CREATS Actuation Function.
SURVEILLANCE FREQUENCY SR 3.3.6.1 Perform CHANNEL CHECK.
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> SR 3.3.6.2 Perform COT.
192 days SR 3.3.6.3
-NOTE-Verification of setpoint is not required.
Perform TADOT.
24 months SR 3.3.6.4 Perform CHANNEL CALIBRATION.
124 months SR 3.3.6.5 Perform ACTUATION LOGIC TEST.
124 months B.1.2 Enter applicable Immediately Conditions and Required Actions for one GREFS Cc; a Ar train made inoperable by inoperable EREFS AE T5 actuation instrumentation.
OR cA E,4rsl B.2 Place bott-Arains in Immediately emergency fadiatieA
-preleeotiefonmode.
R.E. Ginna Nuclear Power Plant 3.3.6-2 Amendment83-
- Z@:
Table 3.3.6-1 CREATS Actuation Instrumenta CREATS Actuation Instrumentation
..3 ition
. Y X,
ED SURVEILLANCE ALLOWABLE
-LS REQUIREMENTS VALUE I
I U O EQUIR FUNCTION HNNE
- 1.
Manual Initiation I
1 2 trains SR 3.3.6.3 SR 3.3.6.5 II 2.
Automatic Actuation Logic and Actuation Relays l Control Room Radiation Intake Monitors 2 trains NA NA SA~R/hr I
3.
2 SR 3.3.6.1 S
3 A 9 SR 3.3.6.4 a
CaC "i
r 2o c,
- 3.
.o j
\\
~
~
~
~
~
~
~
C
/Air^so£ "EZgeJ/{t (j
ur.-,it ss Rr/ft t-v i
l-
/A pp )icAk IJ
/
n 3,
4p p f I
/I 2, 3,q,*
,((b)
R.E. Ginna Nuclear Power Plant 3.3.6-3 Amendment-
(a)
A channel is OPERABLE when both of the following conditions are met:
- 1.
The absolute difference between the as-found Trip Setpoint (TSP) and the previous as-left TSP Is within the COT Acceptance Criteria. The COT Acceptance Criteria Is defined as:
las-found TSP - previous as-left TSPI s COT uncertainty The COT uncertainty shall not include the calibration tolerance.
- 2.
The as-left TSP is within the established calibration tolerance band about the nominal TSP. The nominal TSP is the desired setting and shall not exceed the
-Limiting Safety System Setting (LSSS). The LSSS pnd the established plibration tolerance an are defe in accorance with the Ginnaistrument etpoint ethodology. The channel is considered operable even if the as-left SP is non-conservative with respect to the LSSS provided that the as-left TSP.
is within the established calibration tolerance band.
Typed Technical Specification Sections 3.3 3.3.6 CREATS Actuation Instrumentation 3.3.6 INSTRUMENTATION Control Room Emergency Air Treatment System (CREATS) Actuation Instrumentation 6
The CREATS actuation instrumentation for each Function in Table 3.3.6-1 shall be OPERABLE.
LCO 3.3.(
I APPLICABILITY:
According to Table 3.3.6-1.
I ACTIONS
-NOTE-Separate Condition entry is allowed for each Function.
CONDITION REQUIRED ACTION COMPLETION TIME A.
One or more Functions A.1 Place one CREATS train in 7 days with one channel or train emergency mode.
B.
One or more Functions B.1.1 Place one CREATS train in Immediately with two channels or two emergency mode.
trains inoperable.
AND B.1.2 Enter applicable Conditions Immediately and Required Actions for one CREATS train made inoperable by inoperable CREATS actuation instrumentation.
B.2 Place both CREATS trains Immediately in emergency mode.
C.
Required Action and C.1 Be in MODE 3.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time of Condition A or B AND not met in MODE 1, 2, 3, or4.
C.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> I
R.E. Ginna Nuclear Power Plant 3.3.6-1 Amendment
CREATS Actuation Instrumentation 3.3.6 I
I CONDITION REQUIRED ACTION COMPLETION TIME D.
Required Action and D.1 Suspend movement of Immediately associated Completion irradiated fuel assemblies.
Time of Condition A or B not met during movement of irradiated fuel assemblies.
SURVEILLANCE REQUIREMENTS
-NOTE-Refer to Table 3.3.6-1 to determine which SRs apply for each CREATS Actuation Function.
SURVEILLANCE FREQUENCY SR 3.3.6.1 Perform CHANNEL CHECK.
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> SR 3.3.6.2 Perform COT.
92 days SR 3.3.6.3
-NOTE-Verification of setpoint is not required.
Perform TADOT.
24 months SR 3.3.6.4 Perform CHANNEL CALIBRATION.
24 months SR 3.3.6.5 Perform ACTUATION LOGIC TEST.
24 months R.E. Ginna Nuclear Power Plant 3.3.6-2 Amendment
CREATS Actuation Instrumentation 3.3.6 Table 3.3.6-1 CREATS Actuation Instrumentation APPLICABLE LIMITING MODES OR SAFETY OTHER SPECIFIED REQUIRED SURVEILLANCE SYSTEM FUNCTION CONDITIONS CHANNELS REQUIREMENTS SETlTINGS(a) 1 Manual Initiation 1,2,3,4, 2 trains SR 3.3.6.3 NA (b)
- 2.
Automatic Actuation Logic and 1,2,3,4, 2 trains SR 3.3.6.5 NA Actuation Relays (b)
- 3.
Control Room Radiation Intake 1,2,3,4, 2
SR 3.3.6.1 s.57 mR/hr Monitors (b)
SR 3.3.6.2 SR 3.3.6.4 4..
Safety Injection Refer to LCO 3.3.2, 'ESFAS Instrumentation," Function 1, for all Initiation functions and requirements.
(a)
A channel is OPERABLE when both of the following conditions are met:
- 1. The absolute difference between the as-found Trip Setpoint (TSP) and the previous as-left TSP is within the COT Acceptance Criteria. The COT Acceptance Criteria is defined as:
las-found TSP - previous as-left TSPI S COT uncertainty The COT uncertainty shall not include the calibration tolerance.
- 2. The as-left TSP is within the established calibration tolerance band about the nominal TSP. The nominal TSP is the desired setting and shall not exceed the Limiting Safety System Setting (LSSS). The LSSS, COT uncertainty, and the established calibration tolerance band are defined in accordance with the Ginna Instrument setpoint methodology. The channel is considered operable even If the as-left TSP is non-conservative with respect to the LSSS provided that the as-left TSP Is within the established calibration toleranceband.
(b)
During movement of irradiated fuel assemblies R.E. Ginna Nuclear Power Plant 3.3.6-3 Amendment
Marked-up Bases Sections Note: These bases pages are being provided for information only to show the changes that Ginna intends to make following approval of the LAR. The bases are under Ginna control for all changes in accordance with Specification 5.5.13. Ginna requests that the NRC document acceptance of these bases changes in the SER.
.1 CREATS Actuation Instrumentation B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Control Room Emergency Air Treatment System (CREATS) Actuation Instrumentation BASES BACKGROUND The CREATS provides a protected environment from which operators E
can control the plant following an uncontrolled release of radioactivity.
This system is described in the Bases for LCO 3.7.9, Control Room Emergency Air Treatment System (CREATS).' This LCO only addresses wgt2 fix r~y>( Ho th actuation instrumentation4e the high radiation state t
d A'~
O~
~
The high radiation s~actuation instrumentation
.tj f
> (s i) lconsists of two GM probe radiation monitors installed in the outside air t
2 I intake for the control room ventilation system. A high radiation signal jlacc A c from either of these detectorgKvill inatiatp the CREAT
'fil train and l X
ieoolte Gaoh air cupply path with two dampors. The control room operator Iv J &
or W-S
- 'A can also initiatl the6R~AT fil traind islate the
.pe#_te by using 194ipf wo manual pushbuttons in the control room.
-- 4 ~
~
~
I I
APPLICABLE cation of components and CREATS related ducting within SAFETY contro emergency zone envelope ensures an ade upply of ANALYSES filtered air to alto requiring access. The CRE rovides airborne radiological protection se control room odors in MODES 1, 2, 3, and 4, as demonstrated by the t
f accident dose analyses for the most limiting design basist accident and steam generator tube rupture
.1).
This analys ws that with credit for the CREATS, or redit for instantaneous isolati ontrol room coincident e accident initiator and no CREATS filtration ava
, the dose rates to control room personnel remain within GD
.M in1s.
R.E. Ginna Nuclear Power Plant B 3.3.6-1 Revision-Re
Insert A Technical specifications are required by 10 CFR 50.36 to contain limiting safety system settings (LSSS). The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
The Calculated Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit. As such, the Calculated Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration),
uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). As such, the Calculated Trip Setpoint meets the definition of an LSSS and they are contained in the technical specifications.
Technical specifications contain requirements related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in technical specifications as
"...being capable of performing its safety functions(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 serves as the OPERABILITY limit for the nominal trip setpoint. However, use of the LSSS (Calculated Trip Setpoint) to define OPERABILITY in technical specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protective device setting during a surveillance. This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not -necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Calculated Trip Setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for determining the Calculated Trip Setpoint and thus the automatic protective action would still have been ensured with the as-found setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to within the tolerance band assumed in the determination of the Calculated Trip Setpoint to account for further drift during the next surveillance interval.
The Nominal Trip Setpoint is the desired setting specified within established plant procedures, and may be more conservative than the Calculated Trip Setpoint. The Nominal Trip Setpoint therefore may include additional margin to ensure that the SL would not be exceeded. Use of the Calculated Trip Setpoint or Nominal Trip Setpoint to define as-found OPERABILITY, under the expected circumstances described above, would result in actions required by both the rule and technical specifications that are clearly not warranted. However, there is also some point beyond which the OPERABILITY of the device would be called into question, for example, greater than expected drift. This requirement needs to be specified in the technical specifications in order to define the OPERABILITY limit for the as-found trip setpoint and is designated as the Channel Operational Test (COT) Acceptance Criteria.
The COT Acceptance Criteria described in SR Table 3.3.6-1 serves as a confirmation of OPERABILITY, such that a channel is OPERABLE if the absolute difference between the as-found trip setpoint and the previously as-left trip setpoint does not exceed the assumed uncertainty during the performance of the COT. The assumed uncertainty is primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition, as long as the device has not drifted beyond that expected during the surveillance interval. Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established Nominal Trip Setpoint calibration tolerance band, in accordance with the uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria),
and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.
If the actual setting of the device is found to have exceeded the COT Acceptance Criteria the device would be considered inoperable from a technical specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
The control room must be kept habitable for the operators stationed there during accident recovery and post accident operations.
The CREATS acts to terminate the supplV of unfiltered outside air to the control room, and to initiate filtration. These actions are necessary to ensure the control room is kept habitable for the operators stationed there during accident recovery and post accident operations by minimizing the radiation exposure of control room personnel. One train of filtration in conjunction with isolation is sufficient to maintain control room doses within established limits.
I
- 9) 4z---
Control Room doses were analyzed per Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors (Ref. 6). Per reference 7, Safety Injection is credited with initiating the CREATS emergency mode within the time assumed in the dose analysis for LOCA, SGTR and MSLB accidents. For other analyzed accidents (Rod Ejection, Locked RCP Rotor, Fuel Handling Accident, SFP Tornado Missile), the high radiation signal is the primary protection. CREATS actuation is not required for GDT Rupture, although the analysis demonstrates that actuation will occur from the radiation monitors for this event.
-I xx
(
)Wb la for the Control Room Radiation Intake Monitors is
/ CQe; it based on a correlation to the limit specified in 10 CFR 50, Appendix A, i'hnd the guidance provided by the NRC in NUREG-0737 section (QE r 4 II.B.& Dose Rate Criteria, and NUREG-0800 section 6.4, Control Room Habitability Prograra This is a maximum of 5 rem body dose, with a 30 day weighted average dose rate of less than 15 mR/hr. This allowable P
ie
- w.
m
- alue-is calculated in accordance with the Ginna Station Setpoint Verification Program and will provide for isolation of the control room L
ventilation system which will prevent exceeding these limits.+khe current control room accident dose calculations conservatively assume that the C,
cloud released during the accident enters the control room envelope for H i
-sec ecnd prior to ventilation system isolation. The response time of the Control Room Radiation Intake Monitors to an actual release is bounded (3go seC6,,dC s
by the time used in the analyses During movement of irradiated fuel assemblieso orhing GliE /
A A/
^LTEBrTIOH6N, the CREATS ensures control room habitability in the event of a fuel handling accident. It has been demonstrated that the lrza.t,
- e. 09 Ar CREATS is not required in the event of a waste gas decay tank rupture
(
f 2 )-
The CREATS Actuation Instrumentation satisfies Criterion 3 of the NRC Policy Statement.
LCO The LCO requirements ensure that instrumentation necessary to initiate the CREATS is OPERABLE.
- 1.
Manual Initiation I
-. 0A.0. 4.;ie c:-A -'
i-".
The LCO requires two trains to be OPERABLE. A train consists of one pushbutton and the interconnecting wiring to the actuation 2P'I^ <1Y logic. The operator can initiate the CREATS 4-iatraio t any bun pushbuttor n the control room. This e949-will af i11 mr 4r
^
ntr
-n em
II 2)
I
, thc automatic atuatio cignoiclrcquircd by this LCO.
Automatic Actuation Logic and Actuation Relays X-Lr I The LCO requires two trains of Actuation Logic and Actuation Relays to be OPERABLE. Actuation logic consists of all circuitry associated with manual initiatioland Control Room Radiation
- 4 y vJ'
.sIntake Monitors within the actuation system, including the initiation relay contacts responsible for actuating the CREATS.
R.E. Ginna Nuclear Power Plant B 3.3.6-2 Revision 06-
e tomatic SI Actuation Logic and Actuation Relays consist of the sa features and operate in the same manner as described for ESFAS Function Lb.,
SI, in LCO 3.3.2. The applicable MODES and specified conditions for the CREATS portion of these functions are different and less restrictive than those specified for their SI roles. If one or more of the SI ftinctions becomes inoperable in such a manner that only the CREATS function is affected, the Conditions applicable to their SI ftinction need not be entered. The less restrictive Actions of the CREATS Functions specify sufficient this case.
CREATS Actuation Instrumentation B 3.3.6
- 3.
Control Room Radiation Intake Monitor I
The LCO specifies two channels of Control Room Radiation Intake Monitors to ensure that the radiation monitoring instrumentation necessary to initiate the CREATS filtration tra iriFand isolation dampers remains OPERABLE.
The Nominal Trip Setpoint used in the Control Room Radiati Intake Monitors is based on the Allowable Value specified in Table 3.3.6-1. The selection of this trip setpoint is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, and instrument drift are taken into account. The Nominal Trip Setpoint specified in plant procedures is therefore conservatively adjusted with respect to the Analytical Limit. -f the moacurFd Setpeint soda the Przeurae tolda enaoffH 'amrf the
- ia!
Tri nt valuo, the setpoint is considered OPERABLE9 uRlcothe M. able Value a1 cpecifiod in Table 3.3.6 1 is exceeded. The N4cminel Trip
-Gepeint spzeified in the plant FprecdurcG beundc the Allowable
jscrr
APPLICABILITY In MODES 1, 2,3, and 4, the CREATS actuation instrumentation must be OPERABLE to control operator exposure during and following a Design Basis Accident.
During movement of irradiated fuel assemblies or durinR GoE.
-AL-TERATlONS-, the CREATS actuation instrumentation must be OPERABLE to cope with the release from a fuel handling accident.
ACTIONS The most common cause of channel inoperability is failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the plant specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification. Tho was loft" omin-alTrp Setpont must be within te toleranoc pzeified by the calibratien procedue. If the "as-found"osetpoint xceeds-the Allowable Vaue lmit spoeified in Toblo 3.3.6 1, thc channeldmust be declared inoperable immediate"' and tho I
appropriate Con ntd R.E. Ginna Nuclear Power Plant B 3.3.6-3 Revision 26
Insert B A channel is considered OPERABLE when:
- a.
The nominal trip setpoint is equal to or conservative with respect to the LSSS;
- b.
The absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria; and
- c.
The as-left trip setpoint is within the established calibration tolerance band about the nominal trip setpoint.
The channel is still operable even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology.
-0e ON Safety Injection Refer to LCO 3.3.2, Function 1, for all initiating Functions and requirements.
The CREATS emergency mode is also initiated by all Functions that automatically initiate SI. The CREATS emergency mode requirements for these Functions are the same as the requirements for their-SI function. Therefore, the requirements are 1 not repeated in Table 3.3.6-1. Instead, Function 1, SI, is referenced for all applicable initiating Functions and requirements.
CREATS Actuation Instrumentation B 3.3.6 A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.6-1 in the accompanying LCO. The Completion Time(s) of the inoperable channelltrain of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
6,,ndition A applies to one or more Functions with one channel of CR S actuation instrumentation inoperable.
If one raato nitor channel, one manual initiationtriin, or one automatic actuatio ic train is inoperable, 7 days are permitted to restore it to OPERABL atus. In this Condition the remaining redundant OPERABLE cha Itrain is-adequate to perform the control room protection function. Howe ie overall reliability is reduced because a single failure in th PER E channel/train could result in a loss of function. The 7 ompletion is based on the low probability of a DB ccurring during this time iod, and ability of the remaining ch el/train to provide the required cap ity. If the channel/
train can be restored to OPERABLE status, the CREATS must be placed Mode-F. This accomplishes the actuation instrume tion idoniction and places the system in a conservative mode of operata trol~=Lrd Action for Condition A is modified by a Note which a
the control rofoii~Ialed for S 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> evesalw fresh air makeup to improve m
nt within the control room and is a l
sd on the low probab curring dvkgakeup period..
Condition B ap he failure of two radiation monitor channels, _to-manual initiation trains automatic actuation logic traiD shis Condition the CREATS actuation tnsWmentaticpable of performing its intended automatic fu s is considered a loss of safety function. The Requ n is to place thEATS in.Mode-F immediately. Thi shes the actuation instrumen lonDluction that been lost and places the system in a conservative myi-obleQ rnhi makeion for Condition B is modified by a Note which the control roommbVea efr s 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> evs4 allos fresh air makeup to BigE iihn the control room g
~
ile bsed on the low probability of de R.E. Ginna Nuclear Power Plant B 3.3.6-4 Revision.2
II I.
I A.l Condition A applies to the actuation logic train Function of the CREATS. the radiation monitor channel Functions, the manual channel Functions and the SI logic Functions. If one train is inoperable, or one radiation monitor channel is inoperable, 7 days are permitted to restore it to OPERABLE status. The 7 day Completion Time is the same as is allowed if one train of the mechanical portion of the system is inoperable. The basis for this Completion Time is the same as provided in LCO 3.7.9. If the channel/train cannot be restored to OPERABLE status, one CREATS train must be placed in the emergency radiation protection mode of operation. This accomplishes the actuation instrumentation Function and places the plant in a conservative mode of operation.
zi II II i
i i11
/
i I1
'I B.l.l. B.l.2. and B.2 Condition B applies to the failure of two CREATS actuation trains. two radiation monitor channels, two manual channels, or two SI actuation trains. The first Required Action is to place one CR5ATS train in the emergency mode of operation immediately. This accomplishes the actuation instrumentation Function that may have been lost and places the plant in a conservative mode of operation.
The applicable Conditions and Required Actions of LCO 3.7.9 must also be entered for the CREATS train made inoperable by the inoperable actuation instrumentation. This ensures appropriate limits are placed upon train inoperability as discussed in the Bases for LCO 3.7.9.
I II I
III i
Alternatively, both trains may be placed in the emergency mode. This ensures the CREATS function is performed even in the presence of a single failure.
l
--As~........
I.
_..i.!
CREATS Actuation Instrumentation B 3.3.6 C.1 and C.2 Condition C applies when the Required Action and associated Completion Time of Condition A or B has not been met and the plant is in MODE 1, 2, 3, or 4. The plant must be brought to a MODE that minimizes accident risk. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 and D.2 Condition D applies when the Required Action and associate Completion Time of Condition A or B has not been met dunn movement of irradiated fuel assembliesor during CORE ALTEATIO441
. Movement of irradiated fuel assemblies and coRE ALTERATIO14 must be suspended immediately to reduce the risk of accidents that would require CREATS actuation. This places the plant in a condition that minimizes risk. This does not preclude movement of fuel or other components to a safe position.
SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.6-1 REQUIREMENTS determines which SRs apply to which CREATS Actuation Functions.
SR 3.3.6.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of more serious instrument conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is a verification that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
CHANNEL CHECK acceptance criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
R.E. Ginna Nuclear Power Plant E3 3.3.6-5 Revisions2
CREATS Actuation Instrumentation B 3.3.6 The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.
SR 3.3.6.2 This SR is the performance of a COT once every 92 days on each required channel to ensure the.otie channel will perform the intended function. This test verifies the capability of the instrumentation to provide the automatic CREATS actuation. The setpoints shall be left consistent with the plant specific calibration procedure tolerance. The Frequency of 92 days is based on the known reliability of the monitoring equipment and has been shown to be acceptable through operating experience.
SR 3.3.6.3 This SR is the performance of a TADOT of the Manual Initiation Function every 24 months. The Manual Initiation Function is tested up to, and including, the master relay coils.
The Frequency of 24 months is based on the known reliability of the Function and the redundancy available, and has been shown to be acceptable through operating experience.
The SR is modified by a Note that excludes verification of setpoints because the Manual Initiation Function has no setpoints.
SR 3.3.6.4 This SR is the performance of a CHANNEL CALIBRATION every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
The Frequency of 24 months is based on operating experience and is consistent with the typical industry refueling cycle.
SR 3.3.6.5 This SR is the performance of an ACTUATION LOGIC TEST. All possible logic combinations are tested for the CREATS actuation instrumentation. In addition, the master relay is tested for continuity. This verifies that the logic modules are OPERABLE and there is an intact voltage signal path to the master relay coils. This test is acceptable based on instrument reliability and operating experience.
R.E. Ginna Nuclear Power Plant B 3.3.6-6 Revision-2e-
CREATS Actuation Instrumentation B 3.
3.6 REFERENCES
- 1.
UFSAR, Section 6.4.
=
\\
2 mRobert C. Mecredy, RG&E, to Guy S. Vissi s
7 7 /
Subject:
App iendment to F eatng License tv~2, p 6c5 CP Y
wControl Room Emergen cvtmC EATS 7feok /?u10 f fedr Applicabili 3.3.6 and LCO 3.7.9, 3,
CACcLtPcA/
/
C 5 J
2 3,
,c CFj25b, Appd,r,,4,DC /7 L,
AUfF&--737, Secdoc 1f B 2 DosceR i Cr~lt-r o.
5
,V UR 6r -ooos -q-~o 6q Coje-rlRo/ gi 4c.t, et/t e
eir-cla S
a c 7
,c
,-id/
oee.
/'
rpe
?, 1Lze-E. 107F5, CA&{r- /
Ccic/au lc4$W 5ef -
,Q rl I
!S
/4a
~
CGJ
,eO..2 CAJ e7-r, /
R.E. Ginna Nuclear Power Plant B 3.3.6-7 Revision-