ML17258A701

SEP Review of NRC Safety Topic VII-2,Associated W/Electrical,Instrumentation & Control Portions of Engineered Safety Feature Sys Control Logic & Design for Ginna Nuclear Power Plant.

ML17258A701
Person / Time
Site:	Ginna
Issue date:	08/31/1980
From:	Gilmore L, Laudenbach D, Mayn B EG&G, INC.
To:
Shared Package
ML17258A699	List: ML17258A700 ML17258A701 ML17311A007
References
TASK-07-02, TASK-7-2, TASK-RR EGG-1183-4162, NUDOCS 8101120342
Download: ML17258A701 (36)

Text

I 'J

~ f >>. >>W '>>'.: 'JJ>>JJJ'>> J J>>

J 1183

'n a

1981:

416'UGUST

@@K&'z&

Energy Measuremenis Group J

J J

SYSYKÃhMIC EVALUATIONPROGRAM MVIHV QF MRC SAFETY TOPIC Vll-2 ASSOCIATED 1MTH THE ELECTRICAL, INSTRUMENTATIQN AND CQNVRQL PORTIONS QF THE ESF SYSTEM CQHTRQL LOGIC AND DESIGN FOR THE GIHNA HVCLEAR POWER PLANT SAN RAMON OPERATIONS 2801 OLD CROW CANYON ROAD SAN RAMON. CALIFORNIA 84583

,'/0//gggp~

1183-4162 Energy Measurements Group August 1980 San Ramon Operations SYSTEMATIC EVALUATIONPROGRAM REVIEW OF NRC SAFETY TOPIC Vll-2 ASSOCIATED WITH THE ELECTRICAL INSTRUMENTATIONr AND CONTROl. PORTIONS OF THE ESF SYSTEM CONTROL LOGIC AND DESIGN FOR THE GINNA NUCLEAR POWER PLANT by D. H. Laudenbach Approved for Publication B. G. Mayn Scientific Specialist III This document is UNCLASSIFIED 7

Derivative Classifier:

/ Leonar M. > more Assistant Program Manager L

L j V/ork Performed for Lawrence Livermore National Laboratory under U.S. Department of Energy Contract No. DE-ACOS-76 NVO 1183.

ABSTRACT This report documents the technical evaluation and review of NRC Safety Topic VII-2, associated with the electrical, instrumentation, and control portions of the ESF system control logic and design for the Ginna Nuclear Power Plant, using current licensing criteria.

FOREWORD

. This report is supplied as part of the Systematic Evaluation

/

Program being conducted for the U.S. Nuclear Regulatory Commission by Lawrence Livennore National Laboratory. The work was performed by EGEG, Inc., Energy Measurements Group, San Ramon Operations for Lawrence Livermore National Laboratory under U.S. Department of Energy contract number DE-AC08-76NV01183.

f TABLE OF CONTENTS

~Pa e

1. INTRODUCTION 1

2. CURRENT LICENSING CRITERIA. 3

3. RE V IEM GU I OEL INES. 5

4. SYSTEM DESCRIPTION 7 4.1 Containment Pressure. 7 4.1.1 Channel I (Loop Al) 7 4.1.2 Channel II (Loop A2) . 8 4.1.3 Channel III (Loop A3). ~ ~ 0 ~ 8 4.1.4 Channel II (Loop Bl) 9 4.1.5 Channel III (Loop B2). 9 4.1.6 Channel IV (Loop B3) 10 4.2 Reactor Coolant Flow. 11 4.2.1 Channel I (Loop A1) 11 4.2.2 Channel II (Loop A2) 11 4.2.3 Channel III (Loop A3). 12 4.2.4 Channel II (Loop Bl) 12 4.2.5 Channel III (Loop 82). 12 4.2.6 Channel IV (Loop 83) 13 4.3 Coolant Temperature (Tavg). 13 4.3.1 Loop Al 13 4.3.2 Loop A2 14 4.3.3 Loop 81 ~ ~ 15 4.3.4 Loop B2 15

5. EVALUATION AND CONCLUSIONS. 17 6~

SUMMARY

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 19 REFERENCES. 21 APPENDIX A NRC SAFETY TOPICS RELATED TO THIS REPORT A-1 Vii

1 SYSTEMATIC EVALUATION PROGRAM REVIEW OF NRC SAFETY TOPIC VII-2 ASSOCIATED WITH THE ELECTRICAL, INSTRUMENTATION, AND CONTROL PORTIONS OF THE ESF SYSTEM CONTROL LOGIC AND DESIGN FOR THE GINNA NUCLEAR POWER PLANT by Donald H. Laudenbach

1. INTRODUCTION The Engineered Safety Features Actuation Systems (ESFAS) of both PWRs and BWRs may have design features that raise questions about the electrical independence of redundant channels and isolation between ESF channels or trains.

Non-safety systems generally receive control signals from the ESF sensor current loops. The non-safety circuits are required to have isola-tion devices to insure electrical independence from the ESF channels. The safety objective is to verify that operating reactors have ESF designs which provide effective and qualified isolation between ESF channels and between ESFs and non-safety systems.

This report reviews the ESF EI8C design features of Ginna Nuclear Power Plant to insure that the non-safety systems electrically connected to the ESFs are properly isolated from the ESFs. This report also reviews the plant's ESFs to insure that there is proper isolation between redundant ESF channels or trains and that the isolation devices br techniques meet the current licensing criteria detailed in Section 2 of this report. The qualification of safety-related equipment is not within the scope of this report and is discussed in NRC Safety Topic III-12 and NUREG-0458 [Ref. 1].

2. CURRENT LICENSING CRITERIA GDC 22 [Ref. 2], entitled, "Protection System Independence,"

states that:

The protection system shall be designed to assure that the effects of natural phenomena and of normal operating, main-tenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function, or that they shall be demonstrated to be accept-able on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent prac-tical to prevent loss of the protection function.

GDC 24 [Ref. 2], entitled, "Separation of Protection and Control Systems," states that:

The protection system shall be separated from control systems to the extent that failure of any single control, f

system component or channel, or ai lure or removal from service of any single protection system component or channel which is common to the control and protection system leave intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Inter-connection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired.

IEEE Std-279-1971 lRef. 3], entitled, "Criteria for Protection Systems for Nuclear Power Generating Stations," states in Section 4.7.2 that:

The transmission of signals from protection system equipment for control system use shall be through isolation devices which shall be classified as part of the protection system and shall meet all the requirements of this document. No, credible failure at the output of an isolation device shall prevent the associated protection system channel from meet-ing the minimum performance requirements specified in the design bases.

P 1

Examples of credible failures include short circuits, open circuits, grounds, and the application of the maximum credible a-c or d-c potential. A failure in an isolation device is evaluated in the same manner as a failure of other equipment in the protection system.

3. REVIEW GUIDELINES The following NRC guidelines were used for this review:

Verify that the signals used for ESF functions are isolated from redundant ESF trains or channels. Review the schematic diagrams to assure that the wiring satisfies the functional logic diagrams in the FSAR or its equivalent (GDC 22). ~

Verify that qualified electrical isolation devices are utilized when redundant ESF trains or channels share safety signals. Identify and describe the type of isolation device employed (GDC 22) .

Verify that the safety signals used for ESF functions are isolated from control or non-safety systems. Identify and describe the type of isolation device employed (GDC 24, IEEE Std-279-1971, Section 4.7.2).

Verify that the logic does not contain sneak paths that could cause false operation or prevent required action as the result of operation of plant controls.

Identify the related NRC Safety Topics in an appendix to the report.

4. SYSTEM DESCRIPTION 4.1 CONTAINMENT PRESSURE The Ginna FSAR [Ref. 4] states in Section 7 .5.2 that containment pressure is the variable required for post-accident monitoring. Six trans-mitters are installed outside the containment to prevent potential missile damage. The pressure is indicated and recorded ( all six channels) on the main control board. The six channels monitoring the containment pressure reflect the effectiveness of engineered safety features. High pressure indicates high temperature and reduced pressure indicates reduced tempera-tures.

Loop A containment pressure is monitored by pressure'transmitters PT-945, PT-946 and PT-947. Loop B containment pressure is monitored by pressure transmitters PT-948, PT-949 and PT-950.

4.1.1 Channel I (Loo Al)

Containment Pressure Channel I, Loop Al (designated RED), origi-nates at pressure transmitter PT-945 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol PM-945 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawin'g BD-14].

PT-945 provides an unisolated signal to Foxboro pressure controller, Model M/635-BR-OEHA, circuit symbol PC-945 A/B [Ref. 5, drawing BD-12]. The "A" section output of PC-945 A/B provides one of the inputs to the two-out-of-three (2/3) containment pressure safeguards actuation logic; the other two inputs are from PC-947A and PC-949A. The 2/3 containment pressure logic output provides enabling signals to feedwater isolation, containment isola-tion, reactor trip, containment ventilation ,isolation, and safeguards

I sequence logic. The "B" section output of PC-945 A/B provides one of the inputs to the 2/3 containment pressure safeguards actuation logic; the other two inputs are from PC-9478 and PC-949B. The 2/3 containment pres-I sure logic output provides enabling signals to containment spray actuation logic [Ref. 6, drawing 882D612, sheet 6].

4.1.2 Channel II (Loo A2)

Containment Pressure Channel II, Loop A2 (designated MHITE) originates at pressure transmitter PT-946 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol PM-946 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing BD-14].

PT-946 provides an unisolated signal to Foxboro pressure controller, Model M/635-BR-OEHA, circuit symbol PC-946 A/B [Ref. 5, drawing 80-12]. The "A" section output of PC-946 A/B provides one of the inputs to the two-out-of-three (2/3) containment pressure safeguards actuation logic; the other two inputs are from PC-948A and PC-950A. The 2/3 containment pressure logic output provides enabling signals to Loop A steam line isolation and Loop B steam line isolation. The "B" section output of PC-946 A/B provides one of the inputs to the 2/3 containment pressure safeguards actuation logic; the other two inputs are from PC-948B and PC-950B. The 2/3 containment pres-sure logic output provides enabling signals to containment spray actuation logic [Ref. 6, drawing 882D612, sheet 6].

4.1.3 Channel III (Loo A3)

Containment Pressure Channel III, Loop A3 (designated BLUE) originates at pressure transmitter PT-947 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol PM-947 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 6, drawing B0-14].

PT-947 provides an unisolated signal to Foxboro pressure controller, Model M/635-BR-OEHA, circuit symbol PC-947 A/B [Ref. 5, drawing BD-12]. The "A" section output of PC-947 A/B provides one of the inputs to the two-out-of-three (2/3) containment pressure safeguards actuation logic; the other two inputs are from PC-945A and PC-949A. The 2/3 containment pressure logic output provides enabling signals to feedwater isolation, containment isolation, reactor trip, containment ventilation isolation, and safeguards sequence logic. The "B" section output of PC-947 A/B provides one of the inputs to the 2/3 containment pressure safeguards actuation logic; the other two inputs are from PC-945B and PC-949B. The 2/3 containment pres-sure logic output provides enabling signals to containment spray actuation logic [Ref. 6, drawing 882D612, sheet 6 1.

4.1A Channel II (Loo Bl)

Containment Pressure Channel II, Loop B1 (designated MHITE),

originates at pressure transmitter PT-949 and provides isolated output to

.the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol PM-949 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing BD-14].

PT-949 provides an unisolated signal to Foxboro pressure controller, Model M/635-BR-OEHA, circuit symbol PC-949 A/B [Ref. 5, drawing BD-12]. The "A" section output of PC-949 A/B provides one'f the inputs to the two-out-of-three (2/3) containment pressure safeguards actuation logic; the other two inputs are from PC-945A and PC-947A. The 2/3 containment pressure logic output provides enabling signals to feedwater isolation, containment isola-tion, reactor trip, containment ventilation isolation, and safeguards sequence logic. The "B" section output of PC-949 A/B provides one of the inputs to the 2/3 containment pressure safeguards actuation logic; the other two inputs are from PC-945B and PC-947B. The 2/3 containment pres-sure logic output provides enabling signals to containment spray actuation logic [Ref. 6, drawing 882D612, sheet 6].

4.1.5 Channel III (Loo B2)

Containment Pressure Channel III, Loop B2 (designated BLUE);

originates at pressure transmitter PT-948 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol PM-948 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing BD-14].

PT-948 provides an unisolated signal to Foxboro pressure controller, Model M/635-BR-OEHA, circuit symbol PC-948 A/B [Ref. 5, drawing BD-12]..The "A" section output of PC-948 A/B provides one of the inputs to the two-out-of-three (2/3) containment pressure safeguards actuation logic; the other two inputs are from PC-946A and PC-950A. The 2/3 containment pressure logic output provides enabling signals to Loop A steam line isolation. and Loop B steam line isolation. The "B" section output of PC-948 A/B provides one of the inputs to the 2/3 containment pressure safeguards actuation logic; the other two inputs are from PC-9468 and PC-950B. The 2/3 containment pres-sure logic output provides enabling signals to containment spray actuation logic [Ref. 6, drawing 882D612, sheet 6].

4.1.6 Channel IV (Loo B3)

Containment Pressure Channel IV, Loop B3 (designated YELLOW),

originates at pressure transmitter PT-950 and provides isolated output to the control system via Foxboro isolation device, model M/66BR-OH, circuit symbol PM-950 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing BD-14].

PT-950 provides an unisolated signal to Foxboro pressure controller, Model M/635-BR-OEHA, circuit symbol PC-950 A/B [Ref. 5, drawing BD-12]. The "A" section output of PC-950 A/B provides one of 'the inputs to the two-out-of-three (2/3) containment pressure safeguards actuation logic; the other two inputs are from PC-946A and PC-948A. The 2/3 containment pressure logic output provides enabling signals to Loop A steam line isolation and Loop B steam line isolation. The "B" section output of PC-950 A/B provides one of the inputs to the 2/3 containment pressure safeguards'ctuation logic; the other two inputs are from PC-946B and PC-948B. The 2/3 containment pres-sure logic output provides enabling signals to containment spray actuation logic [Ref. 6, drawing 8820612, sheet 6].

4.2 REACTOR COOLANT FLOW Six reactor coolant flow channels are used for monitoring the RCS flow of the two-loop configuration. Isolated output signals from these channels are used for computer input and control board indication. Loop A coolant flow is monitored by flow transmitters FT-411, FT-412, and FT-413.

Loop B coolant flow is monitored by flow transmitters FT-414, FT-415, and FT-416.

4.2.1 Channel I (Loo Al)

Reactor Coolant Flow Channel I,,Loop A1 (designated RED), orig-inates at flow transmitter FT-411 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol FM-411 [Ref. 5, drawing BD-12]. The control system provides signals, to the computer and control board indicators [Ref. 5, drawing B0-15].

FT-411 provides an unisolated signal to Foxboro flow controller, Model N/635-AR-OAHA, circuit symbol FC-411 [Ref. 5, drawing BD-12]. The output of FC-411 provides one of the inputs to the two-out-of-three (2/3) Loop A RCS trip logic; the other two inputs are from FC-412 and FC-413. The 2/3 Loop A RCS trip logic output provides enabling signals to Loop B RCS trip logic and reactor trip logic [Ref. 6, drawing 882D612, sheet 141.

4.2.2 Channel II (Loop A2)

Reactor Coolant Flow Channel II, Loop A2 (designated WHITE),

originates at flow transmitter FT-412 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol FM-412 [Ref. 5, drawing BD-121. The control system provides signals to the computer and control board indicators [Ref. 5, drawing B0-15].

FT-412 provides an unisolated signal to Foxboro flow controller, Model M/635-AR-OAHA, circuit symbol FC-412 [Ref. 5, drawing BD-12]. The output of FC-411 provides one of the inputs to the two-out-of-three (2/3) Loop A RCS trip logic; the other two inputs are from FC-411 and FC-413. The 2/3 Loop A RCS trip logic output provides enabling signals to Loop B RCS trip logic and reactor trip logic [Ref. 6, drawing 8820612, sheet 14].

4.2.3 Channel III (Loo A3)

Reactor Coolant Flow Channel III, Loop A3 (designated BLUE),

originates at flow transmitter FT-413 and provides isolated output, to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol FM-413 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing B0-15].

FT-413 provides an unisolated signal to Foxboro flow controller, Model M/635-AR-OAHA, circuit symbol FC-413 [Ref. 5, drawing BD-12]. The output of FC-413 provides one of the inputs to the two-out-of-three (2/3) Loop A RCS trip logic; the other two inputs are from FC-411 and FC-412. The 2/3 Loop A RCS trip logic output provides enabling signals to Loop B RCS trip logic and reactor trip logic [Ref. 6, drawing 8820612, sheet 14].

4.2A Channel II (Loo Bl)

Reactor Coolant Flow Channel II, Loop Bl (designated WHITE),

originates at flow transmitter FT-414 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol FM-414 [Ref. 5, drawing B0-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing BD-15].

FT-414 provides an unisolated signal to Foxboro flow controller, Model M/635-AR-OAHA, circuit symbol FC-414 [Ref. 5, drawing BD-12]. The output of FC-414 provides one of the inputs to the 'two-out-of-three (2/3) Loop B RCS trip logic; the other two inputs are from FC-415 and FC-416. The 2/3 Loop B RCS trip logic output provides enabling signals to Loop A RCS trip logic and reactor trip logic [Ref. 6, drawing 882D612, sheet 141.

I 4.2.5 Channel III (Loo B2)

Reactor Coolant Flow Channel III, Loop B2 (designated BLUE),

originates at flow transmitter FT-415 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol FM-415 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing B0-15].

I gS

FT-415 provides an unisolated signal to Foxboro flow controller, Model M/635-AR-OAHA, circuit symbol FC-415 [Ref. 5, drawing BD-12]. The output of FC-415 provides one of the inputs to the two-out-of-three (2/3) Loop B RCS trip logic; the other two inputs are from FC-414 and FC-416. The 2/3 Loop B RCS trip logic output provides enabling signals to Loop A RCS trip logic and reactor trip logic [Ref. 6, drawing 882D612, sheet 14].

4.2.6 Channel IV (Loo B3)

Reactor Coolant Flow Channel IV, Loop B3 (designated YELLOM),

originates at flow transmitter FT-416 and provides isolated output to the control system via Foxboro isolation device, Model M/66BR-OH, circuit symbol FM-416 [Ref. 5, drawing BD-12]. The control system provides signals to the computer and control board indicators [Ref. 5, drawing BD-15].

FT-416 provides an unisolated signal to Foxboro flow controller, Model M/635-AR-OAHA, circuit symbol FC-416 [Ref. 5, drawing BD-12]. The output of FC-416 provides one of the inputs to the two-out-of-three (2/3) Loop B RCS trip logic; the other two inputs are from FC-414 and FC-415. The 2/3 Loop B RCS trip logic output provides enabling signals to Loop A RCS trip logic and reactor trip logic [Ref. 6, drawing 882D612, sheet 14].

4.3 COOLANT TEMPERATURE T I

Four T avg channels are used for overtemperature-overpower pro-tection. Isolated output signals for all four channels are averaged for automatic control rod regulation of power and temperature. Unisolated output signals provide input enables to the safeguards actuation logic.

4.3.1 ~Loo Al The Loop Al T signal is generated by a dual-current source device, circuit symbol TT-401, as a product of inputs from temperature elements TE-401A TE-401B . TE-405A. and TE-405B The Tav signal is

isolated from the control'ystem by Foxboro isolation, device Model M/66GR-OW, circuit symbol TN-401C [Ref. 5, drawing BD-2]. The control system provides signals for control rod regulation and control board in-dication. In addition, the control system provides input to the computer through another stage of isolation, Foxboro isolation device Model M/66BR-OH, circuit symbol TM-401W [Ref. 5, drawing BD-17]. The control system also provides input to recorder TR-401 through Foxboro isolation device Model M/66BR-OH, circuit symbol TM-401G [Ref. 5, drawing BD-15].

The unisolated Low T signal is generated by Foxboro temperature con-avg troller, Model M/635-BR-OEHA, circuit symbol TC-401A [Ref. 5, drawing BD-2]. The output of TC-401A provides one of the inputs to the two-out-of-four (2/4) Loop A RCS trip logic; the other three inputs are from TC-402A, TC-403A, and TC-404A. The 2/4 Loop A RCS trip logic output pro-vides enabling signals to Loop A steam line isolation and Loop B steam line isolation [Ref. 6, drawing 882D612, sheets 6 and 14].

4.3.2 ~Loo A2 The Loop A2 T signal is generated by a dual-current source avg device, circuit symbol TT-402, as a product of inputs from temperature elements TE-402A, TE-402B, TE-406A, and TE-406B. The T signal is avg isolated from the control system by foxboro isolation device Model M/66GR-OW, circuit symbol TM-402C [Ref. 5, drawing BD-3]. The control system provides signals for both control rod'regulation and control board indication. In addition, the control system provides input to the computer through another stage of isolation, Foxboro isolation device Model N/66BR-OH, circuit symbol TM-402W [Ref. 5, drawing BD-17]. The control system also provides input to recorder TR-401 through foxboro *isolation device Model M/66BR-OH, circuit symbol TM-401G [Ref. 5, drawing BD-15].

The unisolated Low T avg signal is generated by Foxboro temperature con-troller, Model M/635-BR-OEHA, circuit symbol TC-402A [Ref. 5, drawing BD-3]. The output of TC-402A provides one of the inputs to the two-out-of-four (2/4) Loop A RCS trip logic; the other three inputs are from TC-401A, TC-403A, and TC-404A. The 2/4 Loop A RCS trip logic output pro-vides enabling signals to Loop A steam line isolation and Loop B steam line isolation [Ref. 6, drawing 8820612, sheets 6 and 14].

4.3.3 ~Loo Bl The Loop Bl T avg signal is generated by a dual-current source device, circuit symbol TT-403, as a product of inputs from temperature elements TE-403A, TE-403B, TE-407A, and TE-407B. The T avg signal is isolated from the control .system by foxboro isolation device Model M/66GR-OW, circuit symbol TM-403C [Ref. 5, drawing BO-4]. The control system provides signals for control rod regulation and control board in-dication. In addition, the control system provides input to the computer through another stage of isolation, Foxboro isolation device Model M/66BR-OH, circuit symbol .TM-,403W [Ref. 5, drawing BD-17]. The control system also provides input to recorder TR-401 through Foxboro isolation device Model M/66BR-OH, circuit symbol TM-401G I.Ref. 5, drawing BD-15].

The unisolated Low T signal is generated by Foxboro temperature con-avg troller, Model M/635-BR-OEHA, circuit symbol TC-403A [Ref. 5, drawing BD-4]. The output of TC-403A provides one of the inputs to the two-out-of-four (2/4) Loop B RCS trip logic; the other three inputs are from TC-401A, TC-402A, and TC-404A. The 2/4 Loop B RCS trip logic output pro-vides enabling signals to Loop A steam line isolation and Loop B steam line isolation [Ref. 6, drawing 882D612, sheets 6 and 14].

4.3.4 ~Loo 82 The Loop B2 T avg signal is generated by a dual-current source device, circuit symbol TT-404, as a product of inputs from temperature elements TE-404A, TE-404B, TE-408A, and TE-408B. The T avg signal is isolated from the control system by Foxboro isolation device Model M/66GR-OW, circuit symbol TM-404C t.Ref. 5, drawing BD-5]. The control system provides signals for control rod regulation and control board in-dication. In addition, the control system provides: input to the computer through another stage of isolation, Foxboro isolation device Model M/66BR-OH, circuit symbol TM-404W [Ref. 5, drawing 80-.17]. The control system also provides input to recorder TR-401 through Foxboro isolation device Model M/66BR-OH, circuit symbol TM-401G [Ref. 5, drawing B0-15].

The unisolated Low T avg signal is generated by Foxboro temperature con-troller, Model M/635-BR-OEHA, circuit symbol TC-404A [Ref. 5, drawing 80-5]. The output of TC-404A provides one of the inputs to the two-out-of-four (2/4) Loop 8 RCS trip logic; the other three inputs are from TC-401A, TC-402A, and TC-403A. The 2/4 Loop 8 RCS trip logic output provides enabl-ing signals to Loop A steam line isolation and Loop 8 steam line isolation I.Ref. 6, drawing 8820612, sheets 6 and 141.

5. EVALUATION AND CONCLUSIONS Based on a review of the Foxboro drawings [Ref. 53 and the Foxboro Technical Information Bulletins [Refs. 7, 8, and 91, we conclude that the ESF systems are adequately isolated from the control or non-safety systems, and that the isolation of the ESF systems from non-safety systems satisfies the requirements of GDC 24 and Section 4.7.2 of IEEE Std-279-1971 detailed in Section 2 of this report-Based on a review of Westinghouse drawings [Ref. 6j and Rochester Gas and Electric Corp. drawings [Ref. 10], we conclude that the redundant ESF channels are NOT adequately isolated from one another and that the isolation of the redundant ESF channels does NOT satisfy the requirements of GDC 22 detailed in Section 2 of this report. The following examples are specific areas of non-compliance to GDC 22:

The Loop A 2/3 Reactor Coolant Flow LOW output signal is used, without isolation, in the Loop B Reactor Coolant Flow logic.

The Loop B 2/3 Reactor Coolant Flow LOW output signal is used, without isolation, in the Loop A Reactor Coolant Flow logic.

The Loop A RCP Breaker OPEN signal is used, without isola-tion, in the Loop B Breaker Open logic.

The Loop B RCP Breaker OPEN signal is used, without isola-tion, in the Loop A Breaker Open logic.

Isolation between Loop A steam line logic and Loop B steam line logic is defeated by the 2/4 LOW T signal line that provides inputs to both loops in a seAet string arrange-ment.

Isolation between Loop A steam line logic and Loop B steam line logic is defeated by the 2/3 Pressurizer Pressure LOW signal line that provides inputs to both loops in a series string arrangement.

Isolation between Loop A steam line isolation logic and Loop B steam line isolation logic is defeated by the 2/3 Contain-ment Pressure HIGH signal line that provides inputs to both loops in a series string arrangement.

6.

SUMMARY

Based on a review of the documentation listed in the reference section of this report, we conclude that the isolation of the ESF systems from non-safety systems satisfies the current licensing criteria detailed in Section 2 of this report.

Based on a review of the documentation listed in the reference section of this report, we conclude that the isolation of redundant ESF channels does NOT satisfy the current licensing criteria detailed in Section 2 of this report.

0 REFERENCES

1. U.S. Nuclear Regulatory Commission, "Short-term Safety Assessment of the Environmental (}ualifications of Safety-related Electrical Equip-ment of SEP Operating Reactors," NUREG-0458, May 1978.

2. Code of Federal Regulations, Title 10, Part 50 (10 CFR 50) Appendix A, enera essgn rater>a , 1978.

3. Institute of Electrical and Electronics Engineers, IEEE Std-279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations."

4. Rochester Gas and Electric Corp., Ginna Final Safety Analysis Repor (FSAR) dated April 23, 1975.

t

5. Foxboro drawings; BD-2 through BD-19 for the Ginna Nuclear Power Station.

6. Westinghouse drawings 882D612 (sheets 1 through 15), for the Ginna Nuclear Power Station.

7. Foxboro Technical Information Bulletin ¹39-168b, dated March 30, 1965.

8. Foxboro Technical Information Bulletin ¹18-240, dated March 1965.

9. Foxboro Technical Information Bulletin ¹18-241, dated July 1965.

10. Rochester Gas and Electric Corp., drawings E33013-660 through E33013-665 .

21-

APPENDIX A NRC SAFETY TOPICS RELATED TO THIS REPORT

1. Safety Topic III-1 "Classification of Structures, Systems and Components."

2. Safety Topic VI-10.A "Testing of RTS and ESF including Response Time Testing.

3. Safety Topic VI-10.B "Shar ed ESFs, On-Si te Emergency Power and Service Systems for Multiple Unit Facilities."

4. Safety Topic VII-3 "Systems Required for Safe Shutdown."

5. Safety Topic VII-4 "Effects of Fail ur e in Non-Safety Related Systems on Selected ESFs."

6. Safety Topic XVI "Techni cal Speci fi cati ons. "

Cathy 84/89/CEB/amr