ML17265A298

1998 Rept of Facility Changes,Tests & Experiments Conducted W/O Prior Approval for Aug 1996 Through Dec 1997 Under Provisions of 10CFR50.59.

ML17265A298
Person / Time
Site:	Ginna
Issue date:	12/31/1997
From:	ROCHESTER GAS & ELECTRIC CORP.
To:
Shared Package
ML17265A297	List: ML17265A296 ML17265A298
References
NUDOCS 9805280213
Download: ML17265A298 (97)

Text

1998 REPORT OF FACILITYCHANGES, TESTS, AND EXPERIMENTS CONDUCTED WITHOUT PRIOR APPROVAL FOR AUGUST 1996 THROUGH DECEMBER 1997 UNDER THE PROVISIONS OF 10 CFR 50.59 R.E. GINNA NUCLEAR POWER PLANT DOCKET- NO. 50-244 ROCHESTER GAS AND ELECTRIC CORPORATION DATED MAY 21, 1998

'P8052802i3 9'80521 PDR ADQCK 05000244 R PDR

SEV-1057 18 MONTH FUEL CYCLE For economical operation of an 18 Month Fuel Cycle core peaking factors needed to be increased. This requires reanalysis of several of the UFSAR Chapter 15 transients. Since the transients were being reanalyzed and the steam geneiators are being replaced it is appropriate to include the characteristics of the new steam generators in the analysis. Since the new steam generators (RSGs) produce higher steam pressure operation at a reduced Tavg would be economically beneficial. Therefore, the changes being incorporated into the 18 Month Fuel Cycle are:

~ increased core peaking factors

~ incorporation of the RSGs

~ Tavg window This evaluation was previously submitted with the 1996 10 CFR 50.59(b) submittal and is being revised to include the following:

Analysis and Standard Review Plan support an upper limit of 10.5 pH on containment spray vs.

the Westinghouse guideline of 10.0 pH. The higher limit would allow widening the range on sodium hydroxide concentration.

Increased peaking factors, Tavg window, and characteristics of the BWI SG do not affect the probability of occurrence of an accident or malfunction. They are assumptions used in calculating the consequences of an accident. The Tavg window would allow operation at a Tavg of up to 15'F lower than the current Tavg. This small reduction in Tavg does not affect the probability of an accident. The changes associated with this evaluation have been incorporated into the calculation of accident or malfunction consequences. The consequences meet the required acceptance criteria, thus the consequences are acceptable.

The Standard Review Plan upper pH limit of 10.5 results in an acceptable probability of equipment malfunction or failure. Therefore, replacing the Westinghouse guideline of 10.0 with the Standard Review Plan value of 10.5 is consistent with the probability of malfunction or failure to acceptable Standard Review Plan values. An increase in the probability of malfunction or failure only results when the 10.5 pH value is exceeded.

The nature of the changes addressed by this safety evaluation can not cause an accident or malfunction of a different type than previously evaluated. The changes only effect the consequences.

The changes addressed by this safety evaluation do not reduce the margin of safety as defined in the basis for any technical specification because the analysis of the accident consequences meet the required acceptance criteria. Since all acceptance criterion are met there is no reduction in the margin of safety.

SEV-1065 USE OF MAIN FEEDWATER PUMP BREAKER TEST POSITION FOR IMPROVED TECHNICAL SPECIFICATION TABLE 3.3.2-1 FUNCTION 6.F Improved Technical Specification (ITS) Table 3.3.2-1, Function 6.f requires that the motor-driven auxiliary feedwater (MDAFW) pumps be capable of being started during MODES 1 and 2 upon opening of both main feedwater (MFW) pump breakers.

However, during MODE 2, neither MFW pump is typically in service until approximately 4%

RTP. Therefore, the purpose of this safety evaluation (SEV) is to evaluate the use of the MFW pump breaker test position as a sufficient means to meet the requirements of ITS Table 3.3.2-1, Function 6.f under conditions when MFW is not in service. This SEV will also serve as the basis for an ITS bases change to reflect the use of the MFW pump breaker test position.

Operation of Ginna Station in accordance with the proposed change does not involve an increase in the probability or consequences of an accident previously evaluated. The MFW pump breaker position only impacts the actuation of the MDAFW pumps and the main feedwater pump discharge valves (MFPDVs). This equipment is only used for accident mitigation purposes; therefore, there is no increase in the probability of a previously analyzed accident. Also, 'for both sets of equipment, it has been demonstrated that the accident analyses (i.e., SGTR and MFW and main steam line breaks) are not adversely impacted. As such, there is no increase in the consequences of an accident.

The use of the MFW pump breaker in the test position does not involve a change to the parameters within which the plant is normally operated or in the setpoints which initiate protective or mitigative actions. There is also no new equipment being permanently installed as the breaker test position currently exists and has been previously utilized. The use of the temporary jumpers does not have a detrimental impact on the manner in which plant equipment operates or responds to an analyzed event. As such, no new failure modes are being introduced.

In addition, the change does not alter assumptions made in the safety analysis and licensing basis. Therefore, the change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The margin of safety is defined by the difference between the limits based on true design and qualification of plant equipment (i.e., point of equipment failure without any conservatism applied) and the limits imposed by analysis or NRC regulations. The point at which protective or mitigative actions are initiated must ensure that the analytical or NRC imposed limit is not exceeded and thus reduce the specified margin of safety. The proposed use of the MFW pump breaker in the test position in order to meet ITS Table 3.3.2-1, Function 6.f requirements does not impact these factors. There are no equipment performance parameter changes associated with this change. No setpoints are affected, and no change is being proposed in the plant operational limits as a result of this change. Therefore, this change does not involve a reduction in the margin of safety.

SEV-1072 REPLACEMENT OF MOTOR VALVEOPERATORS FOR VALVES 852A AND 852B This evaluation addresses upgrade of the motors for the core deluge motor operated valves 852A and 852B. Specifically:

1) Replacement of breaker 52/852A at MCC C position 7J.

2) Replacement of breaker 52/852B at MCC D position 7J..

3) Replacement of the current environmentally qualified motors for valves 852A and 852B (460V, 60 ft-lbs, 1800 rpm) with new environmentally qualified motors rated for 460V, 60 ft-lbs, 3600 rpm.

4) Replacement of all existing interconnecting 10 gauge cable from the MCC to the valve motor with new 2 gauge cable. All new cable and splices in containment are environmentally qualified.

5) The revised cable routing will utilize containment penetrations AE-6 and CE-20 in lieu of the current penetrations AE-3 and CE-23.

6) Changing of the existing gears on the valve operators to increase the gear ratio from the current 27.2:1 to 60.15:1.

Will the probability of occurrence or the consequences of any accident or malfunction of equipment important to safety previously evaluated in the UFSAR be increased?

The changes evaluated here do not increase the probability of failure of any equipment important to safety. By maintaining the design basis of all systems the potential consequences'f accidents evaluated in the UFSAR are unchanged.

Will the possibility for an accident or malfunction of a different type than any previously evaluated in the UFSAR be created?

The proposed changes do not increase the probability of any system failure that could initiate an accident, and therefore the possibility of an accident or malfunction of a different type than previously evaluated in the UFSAR cannot be created as a result of this change.

Will the margin of safety as defined in the basis for any Technical Specification be reduced?

The proposed changes do not affect the basis of any Technical Specification. Therefore the margin of safety is not reduced.

0 0

SEV-1073 MDAFW DISCHARGE VALVES The purpose of this safety evaluation (SEV) is as follows:

Determine if manual actions are adequate to meet motor-driven Auxiliary Feedwater (MDAFW) requirements with reactor power ~ 5% (i.e., in MODES 2 and 3). Specifically, this SEV documents the acceptability of manually opening and throttling MOVs 4007 and 4008 during MODEs 2 and 3.

b. Determine if setting the flow control logic for 4007 and 4008 prior to MODE 1 is acceptable since steam generator (SG) pressures are different between low power and full power conditions.

Determine if delaying AFW flow injection into the SGs for 10 minutes during a design basis accident or transient in MODE 1 is acceptable.

Operation of Ginna Station in accordance with the proposed changes does not involve an increase in the probability or consequences of an accident previously evaluated. The AFW System is only used to mitigate the consequences of an accident, and as such, the proposed use of 4007 and 4008 does not increase the probability of an accident. All accidents and transients which credit the use of AFW have been reviewed to determine that the existing UFSAR analyses remain bounding. Therefore, there is no increase in the consequences of any analyzed accident.

The proposed use of 4007 and 4008 will not add any new equipment to Ginna Station and does not result in any changes to installed control circuitry. There is no alteration to the parameters

'ithin which the plant is normally operated or in the setpoints which initiate protective or mitigative actions. The changes do not have a detrimental impact on the manner in which plant equipment operates or responds to an analyzed event. As such, no new failure modes are being introduced. In addition, the change does not alter assumptions made in the safety analysis and licensing basis. Therefore, the change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The margin of safety is defined by the difference between limits based on true design and qualification of plant equipment (i.e., point of equipment failure without any conservatism applied) and the limits imposed by analysis or NRC regulations. The point at which protective or mitigative actions are initiated must ensure that the analytical or NRC imposed limit is not exceeded and thus reduce the specified margin of safety. The proposed use of the AFW discharge valves does not impact these factors. There are no equipment performance parameter changes associated with this SEV. No setpoints are affected, and no change is being proposed in the plant operational limits as a result of this change. Therefore, this change does not involve a reduction in the margin of safety.

0 SEV-1074 THROTTLING OF AUXILIARYFEEDWATER SYSTEM VALVES 4011 AND 4012 This evaluation addresses positioning of the auxiliary feedwater system valves 4011 and 4012 in a throttled (less than full open) position. The purpose of this change is to provide additional hydraulic resistance in the motor driven auxiliary feedwater pump delivery lines to lower the pressure drop across the flow control valves 4007, 4008 which will improve the flow control characteristics of these valves. The throttle position will be determined as follows:

At hot zero power conditions (Sg pressure =1005 psig) a motor driven auxiliary feedwater pump will be started.

2) By manual operation of the associated motor operated flow control valve (4007 or 4008) and the manual globe valve (4011 or 4012) a flow of 240 gpm will be established with the associated MOV (4007 or 4008) in the full open position.

3) The associated manual valve will be secured in this position.

Will the probability of occurrence or the consequences of any accident or malfunction of equipment important to safety previously evaluated in the UFSAR be increased?

The changes evaluated here do not increase the probability of failure of any equipment important to safety. By maintaining the design basis of all systems the potential consequences of accidents evaluated in the UFSAR are unchanged.

Will the possibility for an accident or malfunction of a different type than any previously evaluated in the UFSAR be created?

The proposed changes do not increase the probability of any system failure that could initiate an accident in that the design requirements continue to be met and therefore the possibility of an accident or malfunction of a different type than previously evaluated in the UFSAR cannot be created as a result of this change.

Will the margin of safety as defined in the basis for any Technical Specification be reduced?

The proposed changes do not affect the basis of any Technical Specification. Therefore the margin of safety is not reduced.

SEV-1075 REPOSITIONING VALVES 880B AND 880C The Safety Injection Accumulators are losing level through relief valve 887 to the Pressurizer Relief Tank at a rate of .07 GPM. This requires the accumulators to be filled.two times a day to maintain the required Technical Specification minimum level. Nonintrusive methods to seat the relief valve and/or AOV's 839A, 839B, 840A and 840B have been unsuccessful.

Replacement of the relief valve would require the plant to be in cold shutdow'n since the valve is located inside the missile wall adjacent to the pressurizer and is unisolatable from the Safety Injection system.

This proposed change would close the normally locked open 880B and 880C valves to isolate the relief valve from the accumulators, thus removing the overpressure protection capacity for the class 1501 piping between the test line AOV's and the 880 valves. This change is being implemented to reduce unnecessary starts and run time of the Safety Injection Pumps which are required to fill the accumulators.

This change was temporary in nature until an appropriate time when RV 887 could be repaired or replaced.

The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the'UFSAR are not increased by this change because operation and design of the Safety Injection system has not changed. The test line is normally isolated during operation and is not credited during safety injection. The valves are manual and have no automatic actions and are not manipulated or relied upon by operations for any events.

The possibility for an accident or malfunction of a different type than evaluated previously in the UFSAR will not be created by this change because this change does not change design or operation of the Safety Injection system. The design pressure capability of the portion of piping which could be exposed to RCS pressure has been shown to be adequate. The relief capability of the Safety Injection discharge piping and test line downstream of valves 880B and 880C is still preserved by RV 887 and, hence, no new event is created.

The margin of safety as defined in the basis of any Technical Specification is not changed by the repositioning of these valves because all technical specifications requirements are still satisfied.

SEV-1076 SAFETY INJECTION PUMP TESTING WITH SI TEST LINE OPEN The purpose of this safety evaluation is to determine the effect on high head safety injection flow during the periodic testing phase during which the 3/4-inch SI test lines are in the open position.

During normal plant operation, the test lines are closed, i.e. valves 879, 879C, and 884 are closed. The SI test lines are depicted on PAID 33013-1262, Sheets 1 and 2. TSR 96-122 was initiated to determine the effect on flow delivery to the RCS by the high head safety injection system during accident conditions. Each SI train contains a 3/4-inch test line inside the containment boundary that branches from the main 4-inch SI injection line, are then headered together, pass through three manual valves, and ultimately tie back to the normal pump mini-flow recirculation system's 2-inch line that leads to the RWST. The normal system configuration is not being changed, since SI test lines will continue to be closed during operation other than periodic testing.

During periodic testing of the SI pumps, the test line manual valves are opened in order to increase the flow of the SI pump to 150 gpm. That value was chosen by RGEcE in order to attempt to minimize the potential for age related degradation of the pumps during their testing.

The pump vendor recommended a flow of 1/3 of BEP (best efficiency point) flow for continuous operation, which would correspond to 150 gpm. Although the testing certainly does not constitute continuous operation, it was chosen as a conservative value, and the system could accommodate that flow by opening the test line. The normal recirculation system was designed to provide a recirculation flow near but not to exceed 100 gpm, and currently provides in the order of 90 gpm, using a fixed orifice. (The maximum value was established in order to ensure the required SI delivery to the RCS during design basis accidents). Opening the test line and throttling the flow through the test line using valve 884 enables a recirculated flowrate of 150 gpm to be achieved during testing.

Opening the SI test line during periodic testing provides an additional bypass for the other SI trains should they receive a start signal, since the test line for each of the two SI injection lines are headered together and are not independent. Therefore, a design basis accident occurring during the periodic testing of an SI pump, effectively causes a plant configuration that allows more bypass flow from each of the other SI pumps, to be recirculated than was previously assumed, and not be available for safety injection during the event. The current accident analyses, however, allowed additional margin on -SI delivery, and this evaluation will demonstrate that the delivery requirements are still acceptable with the SI test line open.

The probability of occurrence or consequences of an accident or malfunction of equipment important to safety previously evaluated in the SAR is not increased by the operation of the SI test line open during testing of the SI pumps or system. Consequences are not increased, because two SI pumps are still available and operable during a postulated event if the event were to occur during a testing evolution. This is consistent with the number of pumps assumed available in the accident analysis. During testing with a single pump out of service and the SI test line open to the redundant train, another single failure is not required to be assumed. The

e open SI test line would provide a flow path'for the other two SI pumps in that situation. The effects of the open SI test line on the flow delivered to the RCS during such a configuration has been determined to be still bounded by the values tabulated in the COLR for MSLB. For SBLOCA events it has been determined that the total delivered flow to the RCS is only 3.3 gallons out of 842.2 gallons less than the volumes assumed to be delivered in the accident analysis. This amount (0.4%) would result in an indistinquisable change in the peak clad temperature for the worst case SBLOCA. Since the analyzed'PCT was determined to be 1308

. F as compared to. the 10 CFR 50.46 criteria of 2200 'F, consequences are not increased.

These cases were based upon a assumed 5% SI pump degradation and, therefore, a 5%

degradation may be utilized as the pump test limit during PT testing with the SI test line open.

Probability is not increased, because the SI test line is associated with system which performs

'an accident mitigation function. The pressure boundary capability of the test line is not being altered, therefore, the safety function of the test line is not affected. It should be noted that the probability of occurrence of the Type I events such as SBLOCA and MSLB is in the order of 7x10'/year. Operation with the test line open occurs during quarterly pump tests on each of three pumps for a conservatively estimated duration of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> per test. Other system testing throughout the year conservatively may account for additional run time with the test line open.

'All together, the plant operates conservatively in the order of 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> out of an 8000 hour0.0926 days <br />2.222 hours <br />0.0132 weeks <br />0.00304 months <br /> year with the test line open, thus reducing the probability of occurrence by a factor of 0.006.

The possibility of an accident or malfunction of a different type than evaluated previously in the UFSAR is not created by the performance of SI pump or system testing with the SI test line open. The test line is designed to perform its function during testing with the plant at power.

The pressure imposed on the test line system is not changed. The additional recirculated flowrate as a result of the test line being open has been evaluated on the capability of the SI system to deliver the required volume of water during the time following a postulated transient to provide core cooling, maintain peak clad temperature within limits, maintain core response within limits, and maintain containment pressure within limits. The position of the valves in the test line are not being altered during plant operation when the SI pumps are not being tested, i.e.

they will remain in the closed position. Therefore, there is no new type of accident created.

The margin of safety as defined in the basis of any Technical Specification is not reduced while in a configuration with the SI test line open during SI pump or system tests. The Technical Specification basis does not include the specific flow delivery required by the safety injection system, however, the flowrate is an assumption in the transient analyses. The transient analyses assume a 5% degraded pump performance, and the resulting delivered volume per unit time (after subtracting the normal recirculation flow) is utilized in the analyses. The flowrates assumed are tabulated in the COLR. These values were derived utilizing the Kypipe computer model for the ECCS, therefore, the effects on system flowrate provided in this safety evaluation are consistent with the COLR and accident analysis methodology. The UFSAR section 6.3.5.2 identifies a value of 1356 psig total developed pressure (differential between discharge and suction pressure) as the acceptable limit of performance of the SI pumps at 150 gpm. That value was based on the calculations referenced in an earlier Technical Specification Amendment (No.

33), and was based upon a pump performance that was assumed to be degraded 3%. The

0 e

existing accident analyses assume 5% degradation plus additional margin. It has been shown that an assumed 5% degradation, including the effects of an open SI test line, can still meet the delivery requirements for MSLB and would produce an insignificant change in the analyses for SBLOCA. Therefore, section 6.3.5.2 of the UFSAR may be updated through the normal UFSAR update process to reflect the results of this evaluation on the pump performance limit.

Since the effect of the increased bypass flow is still bounded by the existing analyses, there is no reduction in the margin of safety.

SEV-1077 USE OF HYDRO PUMP ON SAFETY INJECTION PUMP DISCHARGE LINE IN MODES 1-4 Due to valve leakage within the Safety Injection (SI) System, the accumulators are experiencing leakage problems requiring them to be frequently filled in order to meet technical specification limits for volume and level. The accumulators are normally filled via SI Pump B.or C.

However, to prevent the potential for degradation of the SI pumps and motors from frequent starts and stops, and to allow for an alternative means to fill the accumulators, a 10 gpm hydro pump will be temporarily installed on the discharge line from SI Pump B in order to fill the leaking accumulators. The accumulator range of level is'between 50% and 82% per LCO 3.5.1 of Technical Specifications. The purpose of this safety evaluation (SEV) is to document the acceptance of installing and using this hydro pump in MODES 1, 2, 3, and 4. Specifically, the following will be temporarily performed:

a. A positive displacement hydro pump powered from a non-safety related source with a safety class 2 check valve located downstream of the pump will be installed on the SI Pump B discharge line; and b., A redundant manual isolation valve with tubing will be installed on the SI pumps suction line from the RWST to provide a suction source for the pump.

Operation of Ginna Station in accordance with the proposed change does not involve an increase in the probability or consequences of an accident previously evaluated. The affected systems are only used for accident mitigation purposes; therefore, there is no increase in the probability of a previously analyzed accident. Also, both Containment and Safety Injection Systems have been demonstrated to remain operable and capable of performing their required safety function.

As such, there is no increase in the consequences of an accident.

The use of the hydro pump does not involve a change to the parameters within which the plant is normally operated or in the setpoints which initiate protective or mitigative actions. There is also no new equipment being permanently installed since the hydro pump willnormally remain isolated from the SI System when not in use and is being installed as a temporary modification.

The use of the hydro pump on a temporary basis does not have a detrimental impact on the manner in which plant equipment operates or responds to an analyzed event. As such, no new failure modes are being introduced. In addition, the change does not alter assumptions made in the safety analysis and licensing basis. Therefore, the change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The margin of safety is defined by the difference between the limits based on true design and qualification of plant equipment (i.e., point of equipment failure without any conservatism applied) and the limits imposed by analysis or NRC regulations. The point at which protective or mitigative actions are initiated must ensure that the analytical or NRC imposed limit is not exceeded and thus reduce the specified margin of safety. The proposed use of the hydro pump 10

does not impact these factors. There are no equipment performance parameter changes associated with this change. No setpoints are affected, and no change is being proposed in the plant operational limits as a result of this change. Therefore, this change does not involve a reduction in the margin of safety.

11

SEV-1080 SURFACE MOUNTED PUSHBUTTONS ON DB BREAKER CUBICLES This safety evaluation reviews the modification of installing surface mounted push-button switches on DB breaker cubicle doors for 480V buses 13, 15, 14, 16, 17 and 18.

The existing push-button switches protrude into the breaker cubicle causing mechanical interference with the amptectors mounted on the DB breakers. The modification is to install a surface mounted enclosure with push-button switches (switch assembly).

The push-button switches provide local close and trip capabilities for the DB breaker. Installing surface mounted switch assemblies will maintain this operational feature.

This modification has been previously analyzed by EWR 4225 Safety Analysis, but only 17 and 18. This analysis will cover buses 13, 15, 14, 16, 17 and 18.

for'uses This modification does not introduce any new component interactions or failure modes. After completion of this change the breakers will function exactly as before the modification. It can therefore be concluded the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the SAR is not increased.

The possibility for introducing an accident or malfunction of a different type than any evaluated previously in the Safety Analysis Report is not created because:

after completion of the proposed modification the DB breakers will function in the same manner as before the change, no new component/functions/interactions are being added or existing interfaces removed the functions, and methods of accomplishing those functions of the standby auxiliary feedwater system remain unchanged The margin of safety as defined in the basis for the standby auxiliary feedwater system is not reduced because there are no specific. technical specifications associated with the DB breaker local close and trip push-buttons. The Standby Auxiliary Feedwater Pumps have technical specification operability, requirements. Those requirements are unchanged by this modification.

12

0 SEV-1081 REPLACEMENT OF GINNA MAIN TRANSFORMER The change assessed by this safety evaluation involves replacing the existing Main Transformer with the spare, currently stored at station 13A. This change involves modification of non-nuclear safety equipment that has interaction with equipment important to safety.

The replacement transformer is the functional equivalent of the old. The details of the technical differences are beyond the level of detail described in the Safety Analysis Report.

The transformer change out is significant, in that the activities associated with performing the change could affect equipment important to safety.

The purpose of this safety analysis is to examine the integrated effects associated with'he modification.

The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the SAR are not increased by this proposed change.

This change involves components in the power generation portion of the offsite power system.

The main transformer is not credited as an emergency power supply to equipment important to safety. Safety related components necessary to maintain safe shutdown (a condition already achieved) will remain operable with power available from the EDGs or independent offsite sources. This is no different then the conditions established during a normal outage and is within the parameters established by the SAR.

Management of the load transfer paths and preservation of alternative shutdown features will ensure that a dropped load will not cause the loss of a safe shutdown function.

The possibility of an accident or malfunction of a different type than any evaluated previously in the SAR is not created. 'Because the plant is in shutdown when the changes occur it is not possible to create a new type of accident.

P Malfunctions affecting shutdown cooling or loss of coolant accidents are the dominate contributors to fuel damage when shutdown. The effected equipment used to manage these issues will have positive control and power available through the EDGs or the function will be preserved by a previously evaluated alternative methods.

The equipment associated with this change is not utilized as the basis for any margins of safety defined in technical specifications.

13

I 0

e

SEV-1082 SPENT FUEL POOL COOLING SYSTEM LOWER SUCTION The purpose of this evaluation is to allow use of the spent fuel pool cooling system (SFPCS) lower suction tap when necessary while operating on the "A" SFPC train.

For example, when maintenance needs to be performed on the skimmer SFP level must be lowered. When this occurs, the upper suction will be above the water level. However, the PAID states that the lower suction valve (Valve 782) shall be locked closed per procedure if "A" SFPC Hx is in service.

A review of old operating procedures indicated that the preferred operating line-up was using the upper suction with the lower suction closed. The lower suction could be used if necessary but was not preferred. In 1985 the lower suction (Valve 782) was given locked status. Later during the P&ID upgrade project the note was placed on the PAID:

Operation of Ginna Station in accordance with the proposed change does not involve an increase in the probability or consequences of an accident previously evaluated. The use of the lower suction with the restriction on the amount-of level decrease allows for greater margin to suction uncovery and ensures that heatup time on loss of cooling is maintained within current basis limit.

The proposed use of the lower suction does not add any new equipment and does not result in any changes to installed control circuitry. There are no alteration to parameters within which the plant is normally operating (pool level discussed above) or in the setpoints which initiate protective or mitigative actions. Therefore, using the lower suction does not create the

'ossibility of a new or different kind of accident from any accident previously evaluated.

The margin of safety as defined in the basis for any technical specification is not reduced because with the limitation on SFP level decrease assures that the SFP heatup time is greater than the current design basis value. Also the bulk pool temperature limit of 150'F is still met.

14

SEV-1084 REVERSAL OF POWER AND CONTROL CIRCUITS FOR PRESSURIZER PORV BLOCK VALVES MOV 515 AND 516 Action report 96-1009 identified a condition whereby the pressurizer power operated relief valves (PORVs) and their associated block valves could be aligned such that a single direct current (DC) power system failure would degrade the ability to mitigate a steam generator tube rupture.

The proposed change reviewed by this safety analysis consists of swapping the power and control cabling for MOVs 515 and 516. Completion of this change will establish a PORV/Block valve control configuration which can not be rendered inoperable to complete its required open function from a single DC power failure.

The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the SAR are not increased by this proposed change.

This change brings the plant into conformance with the accident analysis (single failure resistant with respect to PORV operation and malfunction). Because the change addressed by the proposed modification does not influence the frequency of SG tube ruptures it can not change the probability of occurrence of the event. The proposed modification does not affect the actuation circuitry of the PORVs hence it will not change the probability of a spurious valve actuation. The proposed change creates no new equipment interactions nor does it remove the ability to accomplish any of the equipment functions detailed or assumed in the SAR.

After completion of the change the PORV/Block valves will function as assumed in the safety analysis report. The proposed change does not add any new equipment nor does it change the existing equipment functions. This change results in conformance with the assumptions detailed in the SAR and can not cause an increase in the consequences of an accident or malfunction.

The possibility of an accident or malfunction of a different type than any evaluated previously in the SAR is not created. The equipment affected by the proposed change is involved in accident and transient mitigation. There are no failure modes which can be considered precursors to an accident nor are there any malfunctions which are different than those previously evaluated.

After completion of the proposed modification the affected equipment will function as described in the technical specification basis. Because the equipment associated with this change will function exactly as required in the technical specifications no margins for safety will be reduced.

15

SEV-1086 REMOVAL OF SERVICE WATER REMOTE CONTROL SWITCHES FROM CONTROL CIRCUITS Action Report 96-1125 identifies the potential for a high energy line break (HELB) in the Intermediate Building (including those breaks in the Turbine Building near the Intermediate Building block wall) to fail all DC control power to the Service Water (SW) pumps.

Specifically, local control switches and push buttons for all four SW pumps are located on the turbine-driven Auxiliary Feedwater pump shield wall near the Intermediate Building north block wall. The conduits supplying these devices are run through cable trays located near the same block wall. If a main steam or main feedwater line break were to occur in the Intermediate or Turbine Buildings, the subject block wall is expected to collapse as a direct result of the, HELB potentially impacting the switches, push buttons, and associated wiring. This in turn could fail all DC control power to the SW pumps such that following a coincident loss of offsite power (LOOP), no SW flow would be automatically started to provide necessary cooling water to the diesel generators (DGs).

PCR 96-121 proposes to resolve this concern by removing use of the control switches and push buttons located in the Intermediate Building by performing splices in the cable tunnel that will bypass the switch circuitry.

Operation of Ginna Station in accordance with the proposed changes does not involve an increase in the probability or consequences of an accident previously evaluated. This change removes the potential need for operator action to locally start the SW pumps in the Screenhouse following a HELB in the Intermediate or Turbine Buildings. The use of the control switches and push buttons in the Intermediate Building is not assumed in any accident analysis. Therefore, there is no increase in the consequences of an event. The SW pumps are only used for accident mitigation purposes; therefore, there is no increase in the probability of a previously analyzed accident.

The proposed change will not add any new equipment to Ginna Station; however, currently in'stalled switches and push buttons will be removed from the SW pump DC control power logic.

The changes do not have a detrimental impact on the manner in which plant equipment operates or responds to an analyzed event. As such, no new failure modes are being introduced. There is no alteration to the parameters within which the plant is normally operated or in the setpoints which initiate protective or mitigative actions. Current procedural guidance to start the SW pumps by operator action in the Screenhouse as a result of a fire in the control room is unchanged. In addition, the change does not alter assumptions made in the safety analysis and licensing basis. Therefore, the change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The margin of safety is'define'd by the difference between limits based on true design and qualification of plant equipment (i.e., point of equipment failure without any conservatism 16

applied) and the limits imposed by analysis or NRC regulations. The point at which protective or mitigative actions are initiated must ensure that the analytical or NRC imposed limit is not exceeded and, thus reduce the specified margin of safety. The proposed removal of the Intermediate Building SW control switches and push buttons from the pump DC control logic does not impact these factors. There are no equipment performance parameter changes associated with this SEV. No setpoints are affected, and no change is being proposed in the plant operational limits as a result of this change. Therefore, this change does not involve a reduction in the margin of safety.

17

0 0

SEV-1087 ISOLATION OF CONTAINMENT CHARCOAL FILTER DOUSING SYSTEM Review of NRC Generic letter 96-06 has shown the possibility that a section of the Containment Charcoal Filter Dousing System could experience a thermally induced overpressure transient.

A temporary change consisting of closing manual valves 2860 and 2865, and partially or fully opening one of the dousing MOVs (i.e. 875A or 875B or 876A or 876B) will isolate and vent the Containment Charcoal Filter Dousing system. The Containment Spray system flowpath remains the same.

The current configuration of the Containment Charcoal Filter Dousing system has all four MOV's closed with their breakers locked open. The motors for these MOV's are not EQ qualified and are therefore not expected, nor credited, to be operable in a post accident scenario.

This reconfiguration is consistent with the UFSAR, which specifies manual actions to initiate charcoal filter dousing in the event of a fire.

This change does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis in that the function or condition of the containment spray system is not being affected. The Containment Charcoal filter Dousing system is not credited in any Ginna accident analysis.

This change does not create the possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report in that the function or the condition of the subsystem is not affected.

This change does not reduce the margin of safety as defined in the basis for any Technical Specification in that the Technical Specifications do not address the Containment Charcoal Filter Dousing subsystem and the function of the Containment Spray system is not affected.

18

SEV-1088 CONTAINMENT SPRAY CHARCOAL FILTER DELUGE LINE THERMAL RELIEF VALVE During the review of NRC Generic Letter 96-06, it was discovered that the Containment Spray (CS) Charcoal Filter Deluge line between check valves 866A &, 866B (2" line) was potentially susceptible to an over stress condition due to the thermal expansion of trapped fluid during accident conditions. The thermal overpressurization transient is postulated to occur during the injection phase of a design basis accident (LOCA or MSLB) when containment temperature momentarily increases to approximately 286'F. The immediate corrective action was to isolate and vent this section of the line (Reference SEV-1087).

This SEV evaluates the long term flix, which is to install a pressure relief valve on this line, allowing the header to be unisolated. This relief valve is sized for the relatively low flowrate associated with the gradual heat-up of this line (maximum flow capacity is 10 gpm at 500 psig).

The total volume required to be relieved during the transient is less than 1.5 gallons. The relief valve will relieve to the Containment, which is consistent with the normal discharge location of the CS system.

The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the UFSAR are not increased by the proposed modification since the CS system does not initiate an accident or transient, and the CS system will still deliver the required flow to the ring header with the new relief valve installed.

The possibility for an accident or malfunction of a different type than evaluated previously in the UFSAR will not be created by the proposed modification since the failure of the relief valve to re-close is bounded by the existing assumptions in the accident analyses (i.e. loss of a containment spray pump).

The margin of safety as defined in the basis of any Technical Specification is not reduced by the proposed modification, since the proposed modification does not adversely affect the assumed capabilities of any accident mitigating systems.

19

SEV-1089 INSTALLATIONOF THERMAL RELIEF VALVES ON VARIOUS CONTAINMENT PENETRATION LINES IN RESPONSE TO NRC LETTER GL 96-06 The NRC has issued Generic Letter GL 96-06 concerning a possibility for a thermally induced overpressurization due to LOCA or MSLB conditions. The thermal overpressurization transient is postulated to occur during the design basis accidents when containment pressure and temperature momentarily increases to approximately 60 psig and 286'F.

A review of the piping penetrating and inside containment identified the following lines as lines which may be subjected to overpressurization:

Penetration 324. Primary Water Treatment, Line 2"-125-.1 (between valves 8418

&, 8422)

Penetration 307. Fire Protection, Line 4"-FS-125-11 (between valves 9227 &

9232, 9233, 9234, 9235, 9236, 9237)

Penetration 121. Reactor Coolant Pressurizer (PRT fill line), Line 2"-CH-151 (between valves 508 & 548)

In order to protect the above listed pipes, it is proposed to install relief valves on these lines inside the containment. The relief valves will be installed utilizing existing test connections downstream of the root valves 8421, 9230 and 568. The root valves will be normally locked open. Each thermal relief assembly will be located downstream of the containment isolation valves(checkvalves) on eachpenetration line and will be sized for the relatively low flow rate associated with heat-up of these lines. The lines where the relief assemblies are attached are not required to mitigate the postulated LOCA or MSLB events. The installed relief valves will maintain pipe stresses within the EWR 2512, revision 5, "Ginna Seismic Upgrade Program" stress allowable limits. The valve's cracking pressure is set equal to the design pressure. The relief valves are installed per the original construction code for Ginna (ASA B31.1-1955).

t The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the UFSAR will be not increased by the proposed modification since the modifications are on normally isolated lines and therefore can not initiate a accident or transient.

The possibility for an accident or malfunction of a different type than evaluated previously in the UFSAR will not be created by the proposed modification since this modification is designed to limit local piping systems stresses. Therefore the only effect is a decreased probability of pipe rupture.

The margin of safety defined as the basis of any Technical Specification is not reduced, since no Technical Specifications are affected by the proposed modification.

20

SEV-1090 TECHNICAL SPECIFICATION BASES CHANGE FOR SCREENHOUSE BAY LOWER TEMPERATURE LIMIT The purpose of this safety evaluation is to address changing the Technical Specification Bases for LCO 3.7.8; specifically, the minimum screenhouse'bay operability requirements will be changed from "Temperature ) 35'F..." to "Temperature ) 32'F..." in accordance with the sensitivity analysis that has been performed. This change is being made to better correlate the lake (i.e., ultimate heat sink) environmental conditions with plant operations.

Implementation of this change does not increase the probability of occurrence or the consequences of an accident or the malfunction of equipment as previously evaluated in that the change does not impact the capability to meet the accident analysis nor does it introduce any effects that could increase the probability of an accident. In addition, the reduction in the temperature does not adversely impact the ability of any equipment to perform their intended safety function. The consequences meet the required acceptance criteria, thus the consequences are acceptable.

This change does not introduce the possibility of an accident or equipment malfunction of a different type than previously evaluated in that the change affects only the parametric value used by current analyses.

This change does not reduce the margin of safety as defined in the basis for the Technical Specifications in that the slight impact upon PCT does not result in a PCT above the criteria basis. Since all acceptance criteria are met there is no reduction in the margin of safety.

21

SEV-1091 SAFETY INJECTION TO RCS COLD LEGS DURING PROCEDURE AP-RHR.2 As a result of Generic Letter 88-17, the Westinghouse Owners group issued a guideline to provide the actions necessary for maintaining core cooling and protecting the reactor core in the event that RHR cooling is lost during low loop conditions. RG&E procedure AP-RHR.2 is based on this guideline with appropriate allowances made for Ginna's specific plant design. A revision to the WOG guideline was issued on 06/06/96 which contained minor changes in recovery methodology and incorporated previously transmitted changes to the guideline to address surge line flooding issues.

4 The major change associated with this procedure revision incorporates the use of cold leg injection as an alternative for the operator to restore loop level prior to restarting the RHR pumps. Previously there were three sequential options for the operator to follow: Gravity fill from the RWST to the RHR hot leg suction connection, charging to the cold legs, and safety injection to the RCS hot legs. The proposed change would insert an option of safety injection to the RCS cold legs. This option would be employed if the gravity fill and charging methods are not successful (as long as core boiling is not occurring) and would become the third in a series of four methods of event mitigation.

The sequence of RCS level restoration is explicitly described in the Ginna UFSAR and hence requires a written safety evaluation to address the pertinent safety issues.

A second change is the updating of the specified RHR flow rate when sweeping air out of the RHR lines after flow restoration. Previously this was specified as greater than 1200 GPM. This will be changed to between 1200 and 1400 GPM. This was previously evaluated by the safety review for PCN 97-3547 (procedure 0-2.3.1).

This change does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis in that appropriate methods of restoring coolant level are maintained. The use of a continuous action step to proceed directly to hot leg injection if core boiling is imminent or in progress ensures that the addition of an extra step to the mitigation sequence does not delay hot leg injection when it is warranted. The proposed change is associated with mitigation of an event and can neither create nor increase the probability of an accident or malfunction of equipment important to safety.

This change does not create the possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report because the addition of another possible flow path to the RCS provides the operator with more options to restore level. Appropriate procedural guidance has been employed to isolate this flow path should hot leg injection be determined to be necessary.

This change does not reduce the margin of safety as defined in the basis for any Technical 22

0 0

Specification since it maintains the function of restoring RHR cooling as quickly as possible should it be lost at low loop level conditions.

23

0 e

SEV-1092 THERMAL OVERPRESSURIZATION OF CONTAINMENT PENETRATIONS 205 206A 207A The purpose of this evaluation is to provide protection for containment penetrations P205, P206a, and P207a from a potential for thermally induced overpressurization. This change is being made in response to issues raised in response to NRC Generic Letter GL 96-06 where by certain containment penetrations may be subject to isolated water solid conditions with no relief path available in the event of design basis accident containment environment. As part of this response, the following lines were found to be subject to the possibility of water solid conditions during possible design basis accident scenarios:

~ Penetration P205: RCS loop B hot leg sampling through valve 955 Penetration P206a: RCS loop A hot leg sampling through valve 953

~ Penetration P207a: Pressurizer steam space sampling through valve 951 In order to protect the penetration piping from overpressurization, a bypass line will be installed around valves 955, 953, and 951 with a check valve to prevent flow in the direction of the sample sink. The check valve will allow for backflow to the primary system from the sample side (penetration portion side) of the above valves should pressure on the sample side exceed primary system pressure. During normal operation, the check valve will be seated by primary system pressure. The check valves will have requisite isolation capability installed to provide for inservice testing. To ensure proper seating of the check valves, sampling procedures must allow for depressurizing the sample side piping upon completion of sampling activities.

The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in safety analysis report will not be increased by the proposed modification in that the change provides additional assurance of functional response during accident conditions.

The possibility of an accident or malfunction of a different type than previously evaluated in the safety analysis report will not be created by the proposed modification in that the change provides additional assurance or functional capability.

The margin of safety as defined in the basis of any Technical Specification is not reduced in that no Technical Specifications are affected by the proposed change.

24

SEV-1093 REMOVAL OF THE PRESSURIZER LOW PRESSURE LEAD/LAG MODULE The Ginna plant was originally designed to be able to withstand a 50% load reduction without a reactor trip provided automatic steam dump and rod control are functioning. Recent testing on the plant simulator indicates that a large load change may result in a low pressurizer pressure reactor trip, due to a lead/lag circuit in the pressure input to this function. This lead/lag function is not modeled in the original design. Therefore, it is proposed to remove the lead/lag module from the low pressure reactor trip circuit. The low pressurizer pressure trip function as stated in the USFAR and Technical Specifications would remain unaffected.

Removal of the lead/lag circuit would be performed by removing the power supply wiring for the lead/lag module, removing the module, and removing the test point connections. The input cable for the lead/lag unit could then be connected to the input of the low pressure trip setpoint module.

This change does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis in that the function or condition of the pressurizer low pressure reactor trip setpoint is not being affected.

This change does not create the possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report in that the required function or the condition of the other channel subsystems are not affected.

J This change does not reduce the margin of safety as defined in the basis for any Technical Specification in that the lead/lag compensation for the pressure input to the low pressurizer pressure reactor trip channel is not credited in any accident or transient analysis. The functions of the pressurizer pressure channels setpoint, control or other protective logic remain unaffected.

25

,/

SEV-1094 REPLACEMENT OF RTD INPUT MODULES IN THE REACTOR PROTECTION RACKS The electronic components used to generate the T,, and ~ T signals in the Reactor Protection System (RPS) are going to be changed to replace the aging loop modules which have no available replacements. This will require the removal of five Foxboro H-line modules which will be replaced with six modules manufactured by'NUS. The new module arrangement will consist of four Resistance-to-Current (R/I) converters, and two Time Domain Modules (all safety grade analog devices). The four R/I convertors will be used for the conversion of Hot leg and Cold leg temperatures in the Reactor Coolant System (RCS), and the Time Domain Modules will be used to condition the RCS temperature inputs into T;and ~ T signals. One additional function of the Time Domain Modules will be to provide the required lag time associated with

, the temperature signal; The insertion of instrument loop lag time provides a compensating factor for the extremely fast responding loop RTDs with respect to the rest of the instrument loop.

The lag time factor was part of the original instrument loop response calculation for both the T,,

and ~ T signals. The signal outputs of the Time Domain Modules will be identical to the outputs of the existing modules being removed, including lag time, and therefore will have on the function of the loop downstream of the new modules. no'mpact After completion of this proposed change the instrument loop will be capable of being re-configured to function accounting for the effects of a failed RTD. This safety evaluation does not analyze the use of any configuration other than the use of two T-hot and.two T-cold RTD inputs.

The probability of occurrence or the consequence of an accident or malfunction of equipment important to safety previously evaluated in the SAR is not increased by this proposed modification. The change does not introduce any new failure modes or effects into the affected instrument loop nor does it functionally modify the loop (including delay times, setpoints and uncertainties) or associated RPS and control systems in any way.

The possibility for an accident or malfunction of a different type than any evaluated previously in the SAR is not created. The proposed change does not create any new equipment interactions. Because there are no changes in loop failure modes and effects (note that the replacement equipment is also analog) and no new equipment interactions are added, the change cannot lead to a new type of malfunction.

The margin of safety as defined in the basis for any technical specification is not reduced by this proposed modification. The Overpower and Overtemperature setpoints, the process by which they are generated, and the total RPS delay time are all unaffected by the change.

26

e SEV-1095 BLOWDOWN JET SHIELD REMOVAL IN THE INTERMEDIATEBUILDING The primary purpose of this safety evaluation is to document the analysis of the effects of removing the Steam Generator Blowdown system valves 5737 and 5738 stem missile restraints and associated steam jet impingement shields in the intermediate building. The work associated with this evaluation was performed under Technical Staff Request (TSR)94-058 "Blowdown Jet Shield Removal" which provided support to Engineering Work Request 4324C, "Steam Generator Blowdown System, Phase 3".

The removal of the devices received a technical evaluation for the TSR but the evaluation was not incorporated into the EWR safety evaluation nor did the TSR invoke an independent safety evaluation. This deficiency was identified in Action Report 97-0756.

The secondary purpose of this evaluation is to provide documentation of the basis for determining why the change under evaluation did not affect the operability of the systems which were afforded protection by the shields and restraints.

The removal of the jet shields and valve stem restraints does not increase the probability of a blow down line failure. The shields protect equipment against the effects of a break they do not prevent a break from occurring. The stem restraints prevent the valve stems from becoming missiles which could affect other equipment should a failure occur, again they do not prevent a blowdown failure. The consequences of a blowdown failure are bound by. the consequences of steam and feedwater line breaks in the intermediate building. The changes associated with this review do not impact the equipment used to achieve safe shutdown following the occurrence of the bounding line breaks. It is concluded that the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the SAR is not increased.

Safe shutdown following high-energy line breaks (HELB) in the intermediate building is evaluated in the SAR. No equipment utilized to mitigate an intermediate building HELB is affected by the removal of the missile shield. Removal of the missile shield does not expose any equipment not previously evaluated to withstand the effects of a HELB to a new hazard. The nuclear and radiological effects of breaks in intermediate building high energy lines are independent of the jet shields, providing safe shutdown can be achieved. Because safe shutdown can be achieved without the equipment the shields protect, it is determined that the possibility of a accident or malfunction of a different type that any evaluated in the SAR is not created.

Equipment utilized as jet force and missile protection against the effects of HELBs is not described in technical specification. The equipment associated with this change is not utilized as the basis for any technical specification. Accordingly, the margin of safety as defined in the basis for any technical specification is not reduced by this change.

SEV-1096 A AND B BATTERY ROOM AIR CONDITIONING UNIT REPLACEMENT The scope of this modification is to replace the existing "A" & "B" Battery Room AC unit with a larger AC unit. The changes required when going from the existing 5 ton unit to a 7.5 ton unit require a Safety Evaluation due to the changes in air flow and the changes in the power supply configuration. This upgrade will require ductwork changes, service water piping changes and electrical power and control changes to support the new equipment .

The design of the proposed modifications is addressed in PCR 96-084. The plant configuration description in the UFSAR Section 9.4.9.3 specifically lists the air flow fan capacity of the existing AC unit at 2000 cfm. The new AC unit has a minimum air flow capacity of 2400 cfm and a maximum of 3600 cfm.

The existing Battery Room cooling unit electrical supply is from the Emergency Flooding Distribution Panel A, ACPDPCB07, which is supplied by motor control center (MCC) K, position 1D. The replacement cooling unit will be fed directly from MCC K, position 1K.

The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety, previously evaluated in the Safety Analysis Report (SAR), is not increased as a result of this modification.

The probability of occurrence of an accident or malfunction of equipment important to safety is unrelated to the changes proposed in this modification. 'he equipment this modification affects has no failure modes than can lead to the initiation, or prevent the mitigation of, an accident.

The consequences of an accident or malfunction of equipment important to safety are not changed as a result of this modification. Because this modification does not make any functional changes, or introduce any new previously unanalyzed hazards, the consequences associated with any accident or malfunction are as previously analyzed.

The proposed modification does not create the possibility for an accident or malfunction of a different type than any previously evaluated in the SAR.

The changes made for this modification are not functional changes. Because this modification does not introduce any new failure modes to existing plant safety equipment, it is not possible for it to create a new type of accident or malfunction.

The equipment associated with this proposed change is not detailed in technical specifications or bases. The margin of safety as defined in the basis for any Technical Specification is not reduced as a result of this proposed change.

28

e SEV-1097 VALVE866B REPLACEMENT The purpose of this safety evaluation is to evaluate the changes made under Ginna Emergency Maintenance Procedure EM-503, Revision 0 in March 1985 during the 1985 annual refueling outage.

The changes will be evaluated with respect to the original safety considerations of the plant design basis and will determine if NRC approval is required (i.e., if the modification involves an unreviewed safety question or affects the plant Technical Specifications).

EWR 4121 "866B Replacement" was approved on 3-8-85 and was intended to be an engineering modification project governing this change. The valve was actually replaced under a plant Emergency Maintenance Procedure (EM-503) before any formal engineering project design input documents (Design Criteria or Safety Analysis) were prepared to control the design process.

Subsequently, EWR 4121 was used to analyze the piping and support changes associated with the replacement check valve 866B. This EWR project analyzed those items and found them acceptable.

The modification consisted of removal of the original 866B valve, a'2" Rockwell check valve, and its replacement with a new 2" Kerotest check valve. The valves were similar (stainless steel materials, y-type design, 1500-lb. pressure class, socket weld ends). The only significant differences were that the new Kerotest valve was almost 20% heavier and used a soft-seat (EPT) material.

The fact that the new Kerotest valve used a soft-seat (EPT) material, which has a finite radiation resistance, prevents it from being automatically judged as equivalent to the Rockwell valve it replaced. The increase in valve weight required piping and support reanalysis.

This modification does not increase the probability of occurrence of an accident previously evaluated in the SAR. The modification involves replacement of piping pressure-boundary items with qualified, functionally-equivalent items.

This modification does not increase the consequences of an accident previously evaluated in the SAR. The modification involves replacement of piping pressure-boundary items with qualified, functionally-equivalent items, and is independent of accident mitigation features.

This modification does not increase the probability of a malfunction of equipment important to safety, previously evaluated in the SAR. The modification involves replacement of piping pressure-boundary items with qualified, functionally-equivalent items.

This modification does not increase the consequences of a malfunction of equipment important to safety, previously evaluated in the SAR. The modification involves replacement of piping pressure-boundary items with qualified, functionally-equivalent items.

29

e

This modification does not create the possibility of an accident of a type different from any previously evaluated in the SAR. The modification involves replacement of piping pressure-boundary items with qualified, functionally-equivalent items, and is independent of accident mitigation features.

This modification does not create the possibility of a malfunction of equipment important to safety of a type different from any previously evaluated in the SAR. The modification involves replacement of piping pressure-boundary items with qualified, functionally-equivalent items.

This modifications will not reduce the margin of safety as defined in the bases for any technical specifications. The modification does not affect any automatic actuation signals or the operability of any of the components involved, nor will the functions that those components currently perform be altered.

30

SEV-1099 PRESSURIZER SAFETY VALVELVDT POWER SUPPLY UFSAR CORRECTION The purpose of this review is to examine the consequences of modifying the Reg. Guide 1.97 "Post Accident Monitoring Variable", table contained in the UFSAR. Included in the table are details of the power supplies of the monitoring devices.

One variable, item number 59, pressurizer safety valve position, lists the power supply as being from instrument bus lA. This is incorrect, their supply is from a non-vital source, Bus 13 via ACPDPCB01.

The proposed change is not a correction of a typographical error because the R.G.-1.97 safety

. evaluation issued by the Nuclear Regulatory Commission was based on an RGB'ransmittal

. which detailed the power supply incorrectly. The documentation error was introduced by listing the power supply.to the terminal decks of the cabinet the devices are, located in (containment isolation reset panel) as the valve position power supply. In fact, the panel contains two separate power sources, one for the CNMT isolation monitoring and reset and one for the panel "convenience" outlets. The position indicators are supplied from the latter source.

It is important to note that the original design of the indicators specified them being powered from the non-safety source. The change reflects the as designed and installed configuration.

The use of reliable power verses safety grade power reflects the devices role as one of several indications available to monitor the status of the reactor coolant pressure. boundary. The momentary loss of the safety valve position indication can be tolerated, therefore the devices do not need battery backup. It should be noted that the, Reg. Guide does not require a safety related power source for a variable of this type.

The change under review does not effect the function of any equipment directly used in the mitigation of accidents or transients. Because the change is not a functional change and because the equipment associated with the change continues to operate as designed, the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the SAR is not increased.

The possibility of an accident or malfunction of a different type than any evaluated previously in the SAR is not created. The pressurizer safety valve position indication power supply has no functional interaction with the safety valves. Any power supply of the correct voltage, regardless of its source, is conditioned by the LVDT instrument loop. The instrument loop and its independence from the safety valves are not affected by the change.

The pressurizer safety valve indications are not part of the basis for any technical specification.

Consequently, the margin of safety as defined in the basis for any technical specification is not reduced.

31

SEV-1101 ALIGNMENTOF MOV 857A 857B 857C DURING SUMP RECIRCULATION IN ES-1.3 The purpose of this safety evaluation is to support a procedure change PCN 97-4341 to ES-1.3, Transfer to Cold Leg Recirculation. This change is proposed as an improvement to the procedure. RHR flow is checked and throttled as necessary to less than 1500 gpm during the injection phase alignment (RWST>> 28% level), whereas the NPSH analysis established the flow limit based on the sump recirculation system alignment. Based on the results of the Kypipe Hydraulic Model for the ECCS, the system flowrate when comparing these two alignments

'varies enough so that additional system throttling may be necessary following the realignment for high head safety injection following the completion of Step 11 of ES-1.3. Given 1), the flow instrument uncertainties for FI-626, FI-931A, and FI-931B that must be accounted for, 2) the current ES-1.3 requirement to open all three 857 valves, and 3) a calculated level of 0.34 feet less water above the floor of containment as compared to that assumed in the previous analysis, an enhancement to the procedure is recommended that willprovide additional NPSH margin such that additional throttling in the recirculation phase would be unnecessary. The procedure should be changed so that ifonly one RHR pump is operating, only the associated valve(s) in that train, MOV-857A and MOV-857C (Train A) or MOV-857B (Train B), should be opened. Use of the current ES-1.3 procedure with one suction path isolated, one pump running, and both injection lines open results in the system performance being less than optimal but still operable.

The probability of occurrence of an accident previously evaluated in the SAR is not increased, because the change involves equipment used in the mitigation of an accident, namely the ability to provide long term sump recirculation using high head pumps, and the use of containment spray for containment pressure control in the unlikely condition where containment pressure exceeded 37 psig during recirculation.

The consequences of an accident previously evaluated in the SAR are not increased, because the proposed change still requires the opening of one train of high head flow path through either 857B or 857A and 857C. Opening either of these lines exposes those lines and portion of the auxiliary building basement to radioactivity assuming fuel damage as postulated. Therefore, there is no change in the consequences.

The probability of occurrence of a malfunction of equipment important to safety previously evaluated in the SAR is not increased, because the SAR assumes only one train is available post LOCA, during the sump recirculation phase (Table 6.3-9 of UFSAR). The procedure is being modified to instruct operators to open only one train through the 857 valves, in the event only one RHR train is operating. Since credit is only taken for a single train of high head flowpath RHR pump, there is no effect on any malfunctions previously evaluated. The 857 valves

'er left closed procedurally would still be available for later use in the event this was desired. A failure of one of the flow paths combined with a failure of the opposite RHR pump would not be consistent with the plant design basis.

32

0 The consequences of a malfunction of equipment important to safety previously evaluated in the SAR is not increased, because the integrity of the valves against external leakage is not being changed. Failure of both paths is not consistent with the plant design basis. If pump A is operating and the flowpath through 857A and C were blocked, flow could still be delivered to the SI system through 857B. Conversely, if pump B were operating and the 857B valve failed to open, flow would be prevented from passing through 857A and C to the SI system due to the placement of check valve 697A. In this case the flowpath would be provided from pump A through 857A and 857C. These set of circumstances are also not consistent with the plant design basis.

I The possibility of an accident of a different type than any evaluated previously in the SAR is not created, because no new equipment or controls are being added or modified. The change is a procedural one that does not affect the capability of the system to deliver flow for high head safety injection. There is no change to any events or malfunctions in the injection phase since the valves remain closed during that duration. There are no predetermined delivery flowrates established for recirculation phase long term cooling. The change, in effect, has a zero net effect on the flowrate delivered, because keeping one train through the 857 valves closed with one RHR pump operating results in the same amount of flow delivered as previously analyzed, since throttling was dictated in either case. The change provides a substantial improvement in the NPSH margin for the A pump operation, because the flow will be reduced due to elimination of the "loop around" effect when all 857 valves are opened. The B RHR had more NPSH margin than the A RHR pump, when all three 857 valves were opened, since minimum flow recirculation flow would exist through both trains when the B RHR pump was operating.

Following this proposed change, this effect will no longer exist, and the NPSH margin of both RHR pumps will be essentially the same.

The possibility of a malfunction of equipment important to safety of a different type then evaluated previously in the SAR is not created, because only procedural steps are being changed and the valves will be operated as before. There are no changes to controls, and no changes in external or internal conditions placed on the valves exists.

The margin of safety as defined in the basis for any technical specification is not reduced, because no changes are being made to the functions of the valves, and each flowpath is still being called upon to serve its associated train of RHR.

33

SEV-1102 PCN 97-4346 SAFETY EVALUATION This Safety Evaluation describes proposed changes to test procedure PT-60.4. This procedure is used to test the performance of the A Diesel Generator Lube Oil and Jacket Water Coolers coincident with the monthly A Diesel Generator run done under PT-12.1.

The fouling in the Diesel Generator A heat exchangers is determined analytically from PT-60.4

'est measurements using a well developed methodology. The uncertainty in the determination of fouling is strongly dependent on the service water temperature difference across the coolers.

In order to reduce the uncertainty in the fouling, the service water will be throttled to approximately 250 gpm.

¹ PCN 97-4346 adds steps to PT-60.4 to unlock and throttle globe valve 4671 during testing of the Diesel Generator A coolers. Diesel Generator A will be declared INOPERABLE for the duration of time that valve 4671 is unlocked and throttled.

PCN ¹ 97-4346 adds a precaution to PT-60.4 to have an observer continually monitor the lubricating oil and jacket water outlet temperatures from Diesel Generator A, and record the values on a ten-minute frequency, whenever the engine is running and the service water is throttled. In the event that the jacket water temperature rises above the alarm setpoint of 182'F or the lubricating oil temperature rises above the alarm setpoint of 195'F, the HCO is informed and test personnel immediately open valve 4671. Test personnel also immediately open valve 4671 if the HCO receives a high-temperature alarm on the MCB.

All other proposed changes to PT-60.4 are inconsequential. They involve installation of additional non-intrusive instrumentation (surface-mounted RTDs) and changes to the frequency and duration at which data is taken. These changes are intended to further improve the accuracy of the tests.

The proposed changes do not increase the probability of occurrence of an accident previously evaluated in the SAR.

The proposed changes do not increase the consequences of an accident previously evaluated in the SAR. Diesel Generator A, although INOPERABLE, is expected to function normally, and can be returned to OPERABLE status by opening and locking valve 4671. In addition to the normal MCB alarm, Diesel Generator A will be continually monitored locally to verify that the lube oil and jacket water temperatures do not exceed the alarm setpoint values. In the event that temperatures reach alarm setpoints, test personnel will take immediate action to open valve 4671.

Therefore, the probability of failure of Diesel Generator A'is no higher than it is during the regular monthly PT-12.1 Surveillance Test.

The proposed changes do not increase the consequences of a malfunction of equipment important to safety previously evaluated in the SAR. Accident analyses already assume the loss of a diesel 34

generator.

The proposed changes do not increase the probability of an accident of a different type than any evaluated previously in the SAR. The proposed changes involve minor modifications to a test that is routinely carried out. The most severe occurrence would be the tripping of Diesel Generator A to prevent it from overheating. Contingent actions stemming from a diesel generator trip are already covered.

The proposed changes do not increase the possibility of a malfunction of equipment important to safety of a different type then evaluated previously in the SAR. The Diesel Generator A lube oil and jacket water temperatures will not be allowed to rise above the currently established alarm setpoints. It has been established by the vendor that these are acceptable operating temperatures for the diesel engines.

The margin of safety as defined in the basis for any technical specification is not reduced, since no Technical Specifications are violated.

35

e SEV-1103 VACUUM FILL OF THE REACTOR COOLANT SYSTEM Industry wide use of the vacuum fillmethod of increasing the reactor coolant system (RCS) level from mid loop to the narrow range on the pressurizer is to be evaluated.

This procedure is to be used during mode 5 prior to and during the final RCS loop fill process.

It will be installed only during this process and will be removed when RCS refill is complete.

The duration of the equipment being in containment should be less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. The vacuum fillprocess will be incorporated into procedures 0-2.3.1 and 0-1B. The present method of RCS system fill requires a long and complicated vent procedure. This modification will allow a vacuum to drawn on the RCS when at midloop in order to allow the RCS to be filled without the need for venting.

The vacuum operation will consist of a vacuum pump connected via 2 inch diameter vacuum rated hoses to two manifolds. The manifolds will be located on the pressurizer relief tank (PRT) level column area and the reactor head vent area. The PRT will be drained and the pressurizer PORV and Block valves will be open to allow the PRT to be connected to the RCS. The pressurizer vent manifold will supply the vacuum taps for reactor vessel level sightglass and RCS loop level instrumentation.

Once vacuum is attained (approx 24 to 25 inches of Hg), the RCS will be filled. As the RCS is filled, level indicators are isolated and removed from service. When the RCS level is inches but ( 84 inches the fill will be stopped. The RCS will no longer be in a reduced

) 64 inventory condition. 0-2.3.1 can now be closed out and all low loop level restrictions are lifted.

Procedure 0-1B will now continue the fill and pressurize the RCS. Once the pressurizer level is at 80% the fill process will be stopped and vacuum will be broken.

All temporary modification equipment, hoses and components will be removed from containment prior to leaving mode 5 ()200 f).

This change does not increase the probability of occurrence of an accident previously evaluated in the UFSAR.

The RCS vacuum vent and fillprocedure will maintain positive control over the RCS vents and the low temperature overpressure system (LTOP) alignment. The procedure maintains control over all equipment that can inject into the RCS and increase its pressure. This assures RCS boundary protection at low temperatures, therefore the initial conditions and probability of occurrence for any accident analysis previously evaluated in the UFSAR is not increased.

The RCS vacuum vent and fill procedure maintains control of reactor coolant boron, density, or operating temperature. The procedure monitors the dilution and boration paths to the RCS.

The vacuum process will not influence coolant boron concentration, therefore the initial conditions and probability of occurrence for any accident analysis for reactivity insertion in

II~

e

chapters 15.4.4.2.2 or '15.4.4.2.6 have not changed and are valid.

The RCS vacuum vent and fill evolution does not increase the consequences of an accident previously described in the UFSAR.

The RCS vacuum vent and fill procedure will maintain positive control over the RCS vents and the low temperature overpressure system (LTOP) alignment. The procedure maintains control over all equipment that can inject into the RCS and increase its pressure. This assures RCS boundary protection at low temperatures per chapter 5.2.2. Therefore the consequences of an accident previously described in the UFSAR have not changed and are valid.

The RCS vacuum vent and fill procedure maintains control of reactor coolant boron, density, or operating temperature. The procedure monitors the dilution and boration paths to the RCS.

The vacuum process will not influence coolant boron concentration, therefore the initial conditions and consequences of an accident previously. described in the UFSAR for reactivity insertion in chapters 15.4.4.2.2 or 15.4.4.2.6 have not changed and are valid.

The probability of occurrence of a malfunction of equipment important to safety previously evaluated in the UFSAR is not increased.

The wall thickness of the pressurizer, steam generators and U-tubes, reactor coolant pumps and associated components exposed to the vacuum is sufficient to maintain the integrity of the systems during vacuum venting, and after the fill process is complete.

The integrity of the reactor coolant pump seals is assured by maintaining a positive pressure at the number 1 seal inlet area. The pressurizer relief tank is designed to withstand a full vacuum.

The tank is equipped with an internal support for the rupture disk to prevent the damage to the disk. Therefore the integrity of the RCS remains unchanged and the probability of occurrence of a malfunction of equipment important to safety is not increased.

The containment isolation system will remain unaffected by this change. The system will still be able to achieve containment closure within the allowed 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> time period of generic letter 88-17, and be capable of preventing a radiation release within 10 CFR 100 limits. Therefore the ability to isolate containment during reduced RCS inventory operations remains unchanged and the probability of occurrence of a malfunction of equipment important to safety is not increased.

The RHR, charging, and safety injection systems will all be lined up and controlled per Operations procedure 0-2.3.1 "Draining and Op'crating at Reduced Inventory in the Reactor Coolant System". Therefore the ability to recover from a loss of RHR cooling during reduced RCS inventory operations remains unchanged and the probability of occurrence of a malfunction of equipment important to safety is not increased.

The ability of the Residual Heat Removal system to provide for core cooling when the RCS is in'a reduced inventory condition will not change. The NPSH available for the RHR pumps is greater than required, therefore the capability of RHR system to provide core cooling will not 37

be adversely affected. The WCAP-11916 was reviewed to verify that operating in midloop with the RCS at a vacuum did not invalidate its analysis. The analyses for vortex formation were most sensitive to fluid velocity with the density and viscosity of the fluid as secondary affects.

None of these parameters are affected by the RCS being under a vacuum. The analysis therefore remains valid. There is no increase in the probability of occurrence of an malfunction previously evaluated in the UFSAR.

The consequences of a malfunction of equipment important to safety previously evaluated in the UFSAR has not increased.

The wall thickness of the pressurizer, steam generators and U-tubes, reactor coolant pumps and associated components exposed to the vacuum is sufficient to maintain the integrity of the systems during vacuum venting, and after the fill process is complete. The integrity of the reactor coolant pump seals is assured by maintaining a positive pressure at the number 1 seal inlet area. The pressurizer relief tank is designed to withstand a full vacuum. The tank is equipped with an internal support for the rupture disk to prevent the damage to the disk.

Therefore the integrity of the RCS remains unchanged and the consequences of a malfunction of equipment important to safety is not increased.

The containment isolation system will remain unaffected by this change. The system will still be able to achieve containment closure within the allowed 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> time period of generic letter 88-17, and be capable of preventing a radiation release within 10 CFR 100 limits. Therefore the ability to isolate containment during reduced RCS inventory operations remains unchanged and the consequences of a malfunction of equipment important to safety is not increased.

The RHR, charging, and safety injection systems will all be lined up and controlled per Operations procedure 0-2.3.1 "Draining and Operating at Reduced Inventory in the Reactor Coolant System". Therefore the ability to recover from a loss of RHR cooling during reduced RCS inventory operations remains unchanged and the consequences of a malfunction of equipment important to safety is not increased.

The ability of the Residual Heat Removal system to provide for core cooling when the RCS is in a reduced inventory condition will not change. The NPSH available for the RHR pumps is greater than required, therefore the capability of RHR system to provide core cooling will not be adversely affected. The WCAP-11916 (section 2.5) was reviewed to verify that operating in midloop 'with the RCS at a vacuum did not invalidate its analysis. The analyses for vortex formation were most sensitive to fluid velocity with the density and viscosity of the fluid as secondary affects. None of these parameters are affected by the RCS being under a'vacuum.

The analysis therefore remains valid. There is no increase in the consequences of an accident previously evaluated in the UFSAR.

This change does not create the possibility for an accident of a different type than any evaluated previously in the UFSAR.

38

The RHR, charging, and safety injection systems will all be lined up and controlled per Operations procedure 0-2.3.1 "Draining and Operating at Reduced Inventory in the Reactor Coolant System". This procedure implements RGEcE's response to generic letter 88-17 concerns. The RCS is maintained in an analyzed condition per WCAP 11916. The RCS and mitigating systems are lined up and operating per established procedures. Therefore this system and-procedure does not create the possibility for an accident of a different type 'onfiguration than any evaluated previously in the UFSAR.

The ability of the Residual Heat Removal system to provide for core cooling when the RCS is in a reduced inventory condition will not change. The NPSH available for the RHR pumps is greater than required,.therefore the capability of RHR system to provide core cooling will not be adversely affected. The WCAP-11916 was reviewed to verify that operating in midloop with the RCS at a vacuum did not invalidate its analysis. The analyses for vortex formation were most sensitive to fluid velocity with the density and viscosity of the fluid as secondary affects.

None of these parameters are affected by the RCS being under a vacuum. The analysis remains valid. Therefore RHR pump operation when the RCS is under vacuum conditions does not create the possibility for an accident of a different type than any evaluated previously in the UFSAR.

The possibility of a malfunction of equipment important to safety of a different type than evaluated previously in the UFSAR is not created.

With the steam generator intact and the pressurizer manway installed, the criteria is met for the RCS intact configuration. This configuration was analyzed and is one of the configurations that WCAP-11916 and Generic Letter 88-17 reviews. Therefore, the possibility of a malfunction of the RCS boundary of a different type than evaluated previously in the UFSAR is not created.

RCS pressure and temperature limits as stated in the Pressure Temperature Limits Report (PTLR) are not exceeded. The shutdown requirements and PORV operability limits for the RCS are maintained. Therefore, the possibility of a malfunction of the RCS boundary of a different type than evaluated previously in the UFSAR is not created.

This change does not reduce the margin of safety as defined in the basis for any Technical Specification.

With the steam generator intact and the pressurizer manway installed, the criteria is met for the RCS intact configuration. This configuration was analyzed and is one of the configurations that WCAP 11916 and Generic Letter 88-17 reviews. This evolution occurs well beyond the 120 hours0.00139 days <br />0.0333 hours <br />1.984127e-4 weeks <br />4.566e-5 months <br /> after shutdown analysis and temperature is far below the 140'f starting temperature as evaluated in the WCAP 11916 analysis. This configuration does not reduce the margin of safety as defined Technical Specification 3.4.8 and 3.4.12.

A KYPIPE analysis (noted on "Expeditious Actions" response to the NRC, dated January 4, 1997) of the RHR system verified that the gravity feed method would place approximately 7000 39

gallons of water in the RCS if initiated within 16 minutes of the event and assuming an intact, unvented RCS, that would pressurize according to the WCAP 11916 fig. 3.3.1-1. This was based on the decay heat load at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shutdown. The vacuum fill evolution is taking place at greater than 300 hours0.00347 days <br />0.0833 hours <br />4.960317e-4 weeks <br />1.1415e-4 months <br /> after shutdown, the estimated time to saturation is approximately 27 minutes and there is additional time needed to build up pressure in the RCS. The open PORV's and having one steam generator filled will further delay the increase in RCS pressure.

Therefore additional time is available for the operators to increase RCS level using gravity feed.

A pressure of approximately 42 psia was found to stop gravity feed flow from the RWST. The final recovery action of restarting RHR would occur after level is increased. Performing the RCS vacuum vent and fillunder these conditions does. not reduce the margin of safety as defined in the basis for any Technical Specification.

In addition, SI flowpaths to the hot and cold legs and charging flowpaths to the cold leg will be available by procedure in the event gravity feed capability is lost.

The RCS vacuum vent and fill process does not" require a change to Ginna Technical Specifications. RCS pressure and temperature limits as stated in the Pressure Temperature Limits Report (PTLR) are not exceeded. The shutdown requirements and PORV operability limits for the RCS are maintained. The margin of safety for the reactor coolant pressure boundary as defined by the ASME code for wall thickness, stress limits, integrity of systems and components is maintained.

40

0 0

SEV-1104 PCN 97-4347 SAFETY EVALUATION This Safety Evaluation describes proposed changes to test procedure PT-60.5. This procedure is used to test the performance of the Diesel Generator B Lube Oil and Jacket Water coolers coincident with the monthly Diesel Generator B run done under PT-12.2.

The fouling in the Diesel Generator B heat exchangers is determined analytically from PT-60.5 test measurements using a well developed methodology. 'The uncertainty in the determination of fouling is strongly dependent on the service water temperature difference across the coolers.

In order to reduce the uncertainty in the fouling, the service water will be. throttled to approximately 250 gpm.

¹ PCN 97-4347 adds steps to PT-60.5 to unlock and throttle globe valve 4672 during testing of the Diesel Generator B coolers. Diesel Generator B will be declared INOPERABLE for the duration of time that valve 4672 is unlocked and throttled.

PCN ¹ 97-4347 adds a precaution to PT-60.5 to have an observer continually monitor the lubricating oil and jacket water outlet temperatures from Diesel Generator B, and record the values on a ten-minute frequency, whenever the engine is running and the service water is throttled. In the event that the jacket water temperature rises above the alarm setpoint of 182'F or the lubricating oil temperature rises above the alarm setpoint of 195'F, the HCO is informed and test personnel immediately open valve 4672. Test personnel also immediately open valve 4672 if the HCO receives a high-temperature alarm on the MCB.

All other, proposed changes to PT-60.5 are inconsequential. They involve installation of additional non-intrusive instrumentation (surface-mounted RTDs) and changes to the frequency and duration at which data is taken. These changes are intended to further improve the accuracy of the tests.

The proposed changes do not increase the probability of occurrence of an accident previously evaluated in the SAR.

The proposed changes do not increase the consequences of an accident previously evaluated in the SAR. Diesel Generator B, although INOPERABLE, is expected to function normally, and can be returned to OPERABLE status by opening and locking valve 4672. In addition to the normal MCB alarm, Diesel Generator B will be continually monitored locally to verify that the lube oil and jacket water temperatures do not exceed the alarm setpoint values. In the event that temperatures reach alarm setpoints, test personnel will take immediate action to open valve 4672.

Therefore, the probability of failure of Diesel Generator B is no higher than it is during the regular monthly PT-12.2 Surveillance Test.

The proposed changes do not increase the consequences of a malfunction of equipment important to safety previously evaluated in the SAR. Accident analyses already assume the loss of a diesel 41

0 generator.

The proposed changes do not increase the probability of an accident of a different type than any evaluated previously in the SAR. Jhe proposed changes involve minor modifications to a test that is routinely carried out. The most severe occurrence would be the tripping of Diesel Generator B to prevent it from overheating. Contingent actions stemming from a diesel generator trip are already covered.

The proposed changes do not increase the possibility of a malfunction of equipment important to safety of a different type then evaluated previously in the SAR. The Diesel Generator B lube oil and jacket water temperatures will not be allowed to rise above the currently established alarm setpoints. It has been established by the vendor that these are acceptable operating temperatures for the diesel engines.

The margin of'safety as defined in the basis for any technical specification is not reduced, since no Technical Specifications are violated.

42

0 SEV-1105 VACUUM AFFECTS ON RCS INSTRUMENTATION DURING VACUUM VENT AND FILL The effects of having a vacuum on the Reactor Coolant System (RCS) instrumentation during the RCS vacuum vent and fill evolution are to be evaluated. The instrumentation will be exposed to RCS temperatures of 90-100'F. The pressure will range from atmospheric to 25 inches of Hg vacuum or 2.42 psia. The RCS loop will be initially at the mid loop level. This level is 10 inches using local level indication and is at the 246'0" elevation. The time duration of the exposure to vacuum is less than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Once the RCS level is in the 50% - 80% narrow in the pressurizer the vacuum will be removed and the system will be returned to normal 'ange operational pressures. Impact of the RCS Vacuum Vent and Fill procedure on system performance is evaluated in SEV-1103.

This change does not increase the probability of occurrence of an accident previously evaluated in the UFSAR.

The RCS vacuum vent and fillprocedure will maintain positive control over the RCS vents and the low temperature overpressure system (LTOP) alignment. The procedure maintains control over all equipment that can inject into the RCS and increase its pressure. This assures RCS boundary protection and RCS instrument operability at low temperatures per UFSAR chapter 5.2.2. The RCS instrument system will continue to accurately monitor and display the process variables needed to verify RCS parameters. Therefore the initial conditions and probability of occurrence for any accident analysis previously evaluated in the UFSAR have not changed.

The RCS vacuum vent and fill procedure maintains control of reactor coolant boron, density, and operating temperature. The procedure monitors the dilution and boration paths to the RCS.

The RCS instrument system will continue to accurately monitor and display the process variables needed to verify RCS parameters. The vacuum process will not influence coolant boron concentration, therefore the initial conditions and probability of occurrence for any accident for reactivity insertion in UFSAR chapters 15.4.4.2.2 or 15.4.4.2.6 have not changed and are valid.

The RCS vacuum vent and fill evolution does not increase the consequences of an accident previously described in the UFSAR.

The RCS vacuum vent and fillprocedure will maintain positive control over the RCS vents and the low temperature overpressure system (LTOP) alignment. The procedure maintains control over all equipment that can inject into the RCS and increase its pressure. This assures RCS boundary protection at low temperatures per UFSAR chapter 5.2.2. The RCS instrument system will continue to accurately monitor and display the process variables needed to verify RCS parameters. Therefore the consequences of an accident previously described in the UFSAR have not changed and are valid.

The RCS vacuum vent and fill procedure maintains control of reactor coolant boron, density, 43

0 and operating temperature. The procedure monitors the dilution and boration paths to the RCS.

The RCS instrument system will continue to accurately monitor and display the process variables needed to verify RCS parameters. The vacuum process will not influence coolant boron concentration, therefore the initial conditions and consequences of an accident previously described in the UFSAR for reactivity insertion in chapters 15.4.4.2.2 or 15.4.4.2.6 have no't changed and are valid.

The probability of occurrence of a malfunction of equipment important to safety previously evaluated in the UFSAR is not increased.

The wall thickness of the RCS process instrumentation and sensing lines and associated components exposed to the vacuum is sufficient to maintain the integrity of the systems during vacuum venting, and after the fillprocess is complete. The integrity of the reactor coolant pump seal instrumentation is assured by maintaining a positive pressure at the number one seal inlet area. The pressurizer relief tank instrumentation is designed to withstand a full vacuum. The tank is equipped with an internal support for the rupture disk to prevent the damage to the disk.

Therefore the integrity of the RCS instrumentation remains unchanged and the probability of occurrence of a malfunction of equipment important to safety is not increased.

The containment isolation system and its associated instrumentation will remain unaffected by this change. The system will still be able to achieve containment closure within the allowed 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> time period of generic letter 88-17, and be capable of preventing a radiation release within 10 CFR 100 limits. Therefore, the ability to isolate containment during reduced RCS inventory operations remains unchanged and the probability of occurrence of a malfunction of equipment important to safety is not increased.

The RHR, charging, and safety injection systems will all be lined up and controlled per Operations procedure 0-2.3.1 "Draining and Operating at Reduced Inventory in the Reactor Coolant System". The RCS and RHR instrument systems will continue to accurately monitor and display the process variables needed to verify their parameters. Therefore the ability to recover from a loss of RHR cooling during reduced RCS inventory operations remains unchanged and the probability of occurrence of a malfunction of equipment important to safety is not increased.

The ability of the Residual Heat Removal system to provide for core cooling when the RCS is in a reduced inventory condition will not change. The NPSH available for the RHR pumps is greater than required, therefore the capability of RHR system to provide core cooling will not be adversely affected. WCAP-11916 was reviewed to verify that operating in midloop with the RCS at a vacuum did not invalidate its analysis. The analyses for vortex formation:were most sensitive to fluid velocity with the density and viscosity of the fluid as secondary affects. The RCS and RHR instrument systems will continue to accurately monitor and display the process variables needed to verify their parameters. None of these parameters are affected by the RCS being under a vacuum. The analysis therefore remains valid. There is no increase in the probability of occurrence of an malfunction previously evaluated in the UFSAR.

44

e The consequences of a malfunction of equipment important to safety previously evaluated in the UFSAR has not increased.

The wall thickness of the RCS process instrumentation and sensing lines and associated components exposed to the vacuum is sufficient to maintain the integrity of the systems during vacuum venting, and after the fillprocess is complete. The integrity of the reactor coolant pump seal instrumentation is a'ssured by maintaining a positive pressure at the number one seal inlet area. The pressurizer relief tank instrumentation is designed to withstand a full vacuum.

is equipped with an internal support for the rupture disk to prevent the damage to the disk.

The'ank Therefore the integrity of the RCS remains unchanged and the consequences of a malfunction of equipment important to safety is not increased.

The containment isolation system and its associated instrumentation will remain unaffected by this change. The system will still be able to achieve containment closure within the allowed 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> time period of generic letter 88-17, and be capable of preventing a radiation release within 10 CFR 100 limits. Therefore, the ability to isolate containment during reduced RCS inventory operations remains unchanged and the consequences of a malfunction of equipment important to safety is not increased.

The RHR, charging, and safety injection systems will all be lined up and controlled per Operations procedure 0-2.3.1 "Draining and Operating at Reduced Inventory in the Reactor Coolant System". The RCS and RHR instrument systems will continue to accurately monitor and display the process variables needed to verify their parameters. Therefore the ability to recover from a loss of RHR cooling during reduced RCS inventory operations remains unchanged and the consequences of a malfunction of equipment important to safety is not increased.

The ability of the Residual Heat Removal system to provide for core cooling when the RCS is in a reduced inventory condition will not change. The NPSH available for the RHR pumps is greater than required, therefore the capability. of RHR system to provide core cooling will not be adversely affected. The WCAP-11916 (section 2.5) was reviewed to verify that operating in midloop with the RCS at a vacuum did not invalidate its analysis. The analyses for vortex formation were most sensitive to fluid velocity with the density and viscosity of the fluid as secondary affects.

The RCS and RHR instrument systems will continue to accurately monitor and display the process variables needed to verify their parameters. None of these parameters are affected by the RCS being under a vacuum. The analysis therefore remains valid. There is no increase in the consequences of an accident previously evaluated in the UFSAR.

This change does not create the possibility for an accident of a different type than any evaluated

, previously in the UFSAR.

The RHR, charging, and safety injection systems will all be lined up and controlled per Operations procedure 0-2.3.1 "Draining and Operating at Reduced Inventory in the Reactor 45

Coolant System". This procedure implements RGAE's response to generic letter 88-17 concerns. The RCS is maintained in an analyzed condition per WCAP 11916. The RCS and mitigating systems are lined up and operating per established procedures. Therefore this system configuration and procedure does not create the possibility for an accident of a different type than any evaluated previously in the UFSAR.

The possibility. of a malfunction of equipment important to safety of a different type than evaluated previously in the UFSAR is not created.

With the steam generator intact and the pressurizer manway installed, the criteria is met for the RCS intact configuration. This configuration was analyzed and found acceptable in WCAP-11916. Therefore, the possibility of a malfunction of the RCS boundary of a different type than evaluated previously in the UFSAR is not created.

RCS pressure and temperature limits as stated in the Pressure Temperature Limits Report (PTLR) are not exceeded. The shutdown requirements and PORV operability limits for the RCS are maintained. Therefore, the possibility of a malfunction of the RCS boundary of a different type than evaluated previously in the UFSAR is not created.

This change does not reduce the margin of safety as defined in the basis for any technical Specification, With the steam generator intact and the pressurizer manway installed, the criteria is met for the RCS intact configuration. The RCS and RHR instrument systems will continue to accurately monitor and display the process variables needed to verify their parameters. This configuration was analyzed and found acceptable in WCAP 11916. This configuration does not reduce the margin of safety as defined in Technical Specifications.

The RCS vacuum vent and fill process does not require a change to Ginna Technical Specifications. RCS pressure and temperature limits as stated in the Pressure Temperature Limits Report (PTLR) are not exceeded. The RCS and RHR instrument systems will continue to accurately monitor and display the process variables needed to verify their parameters. The shutdown requirements and PORV operability limits for the RCS are maintained. The margin of safety for the reactor coolant pressure boundary as defined by the ASME code for wall thickness, stress limits, integrity of systems and components is maintained.

46

SEV-1106 CORE EXIT THERMOCOUPLES DISPLAY REPLACEMENT The Core Exit Thermocouple (CETM) Monitors are obsolete and require replacement. The monitors are an integral part of the safety related CET system. Required as a post accident monitoring system, the units function to calculate and display core exit temperatures, deviations

.of individual points from average, and provide deviation and temperature alarms..

The replacement units contain programmable microprocessors. The CETM unit's design and configuration is different than the existing display modules. Accordingly, they must be evaluated to ensure that they are not susceptible to failure modes or effects which could lead to an unreviewed safety question.

The purpose of this safety evaluation is to provide a record demonstrating where all the critical attributes associated with the digital upgrade are analyzed, and documenting the results of those analysis with respect to determining if the modification can be implemented without prior NRC approval.

The probability of occurrence of an accident previously evaluated in the SAR is not increased.

The proposed change has no functional inter-relations with equipment directly utilized in accident mitigation. The modification will not change the ability of the plant operators to monitor core exit temperatures or any of the related post accident and safety parameter displays.

The consequences of an accident previously evaluated in the SAR will not be increased by this proposed modification. As previously stated, the CETMs do not have any direct interaction with plant process or control equipment nor can they introduce a failure which would preclude the functioning of any process or control equipment. After completion of the change the CET system will provide plant staff with the identical information set as the existing units. Because the plant operators will have the same information availability there will be no reduction in their ability to manage the consequences of an accident.

The probability of occurrence of a malfunction of equipment important to safety previously in the SAR is not created. The proposed change does not establish any new functional relationships with plant equipment. Because no new equipment inter-actions are created (nor existing ones removed) the proposed change cannot increase the probability of a malfunction.

The consequences of a malfunction of equipment important to safety previously evaluated in the SAR is not increased. The proposed change creates no new functional inter-actions and no new equipment failure modes or mechanisms. Because the proposed change is functionally like-for-like, the change has no effect on the consequences of any equipment malfunction.

The possibility of an accident of a different type than any evaluated previously in the SAR is not created. The proposed change creates no new functional inter-actions with existing plant equipment nor does it introduce any new failure modes or mechanisms which could lead to 47

reactor core damage or fission product release The possibility of a malfunction of equipment important to safety of a. different type then evaluated previously in the SAR is not created. The proposed change does not introduce any new equipment inter-actions or failure modes or mechanisms.

The margin of safety as defined in the basis for any technical specification is not reduced by this proposed modification. The proposed change will not alter the CET system response or degrade system accuracy. Other than providing for the aforementioned display functions, the CET's are not utilized in the bases for any technical specifications.

48

SEV-1107 EVALUATIONOF MODE 4 ECCS CONFIGURATIONS During normal plant cooldowns the RHR system can be aligned to the RCS when temperature is 350 degrees or lower. Should a shutdown loss of coolant accident occur during the RCS temperature span between 350 and approximately 280 degrees, (the actual lower temperature is a function of RWST temperature and level), the depressurization could cause flashing in the RHR suction piping due to loss of RCS pressure and thus subcooling. This could cause the pumps to malfunction when the suction is transferred to the RWST. This condition can result in water hammer and the potential degradation of RHR delivery until such time as the RHR suction piping temperature/pressure profile returns to sub-saturated conditions.

Procedures AP-RHR.1, "Loss of RHR" and AP-RCS.4, "Shutdown LOCA", provide plant operators with guidance to mitigate the event when a leak is indicated. However, the current shutdown LOCA procedure does not utilize all the possible plant configurations that could be made available to mitigate this event.

The purpose of the evaluation is to examine the safety impact of modifying plant procedures and the ECCS technical specification bases to allow re-alignment of the ECCS system when entering mode 4 such that the optimum ECCS equipment set is available for use. The need for this stems from the potential for RHR suction piping flashing if the RHR suction is transferred to the RWST when the temperature of the liquid is above 280 degrees F. This is temperature associated with saturated conditions of the RWST temperature and pressure., less instrument uncertainty of the RHR suction temperature indication.

The proposed change consists of making the A and B hot leg SI injection paths available for use below an RCS temperature of 350 degrees F - Mode 4. Having hot leg injection available gives each SI pump two injections paths, thus ensuring a delivery path even if the break location is

.in an RCS loop SI injection nozzle. Safety injection from the RWST to the hot legs is one method already analyzed for loss of RHR during RCS reduced inventory operations.

The probability of occurrence of a accident previously evaluated in the SAR is not increased by this proposed change. The proposed change has no affect on probability of accidents previously evaluated at-power, because it does not modify the at-power SI valve configuration. The proposed change does not alter any system configurations or equipment functions as described in the SAR or credited in the accident analysis. Additionally, the change under review has no failure modes or effects which can lead to a shutdown LOCA or a loss of shutdown cooling.

The consequence's of an accident previously evaluated in the SAR are not increased by this proposed change. The change under review does not alter any system configurations or equipment lineups during plant modes when SI is credited in the accident analysis. Because the proposed change does not alter equipment function or availability it cannot have a negative effect on the consequences of an accident.

49

The probability of occurrence of a malfunction of equipment important to safety previously evaluated in the SAR is not increased. The change under review does not affect any at-power system configurations and thus cannot increase the probability of at-power equipment malfunctions.

The consequences of a malfunction of equipment important of safety previously evaluated in the SAR is not increased by the proposed change. The change under review does not affect any at-power system configurations and is unrelated to any potential equipment malfunction. Because the change does not affect the configuration of the equipment when it is credited for accident mitigation the proposed change cannot increase the consequences of at-power equipment malfunctions.

The possibility of a accident of a differ'ent type than any evaluated previously in the SAR is not created. The change under review does not alter the plant configuration during plant modes when SI is credited for accident mitigation. Additionally, the proposed change has no failure modes which act as precursors to an accident. Because the change has no affect on plant equipment availability and no failure modes which prevent core cooling, the change cannot create a new type of accident.

The possibility of a malfunction of equipment important to safety of a different type than evaluated previously in the SAR is not created. The proposed change does not add any new functional inter-actions nor does it remove any existing ones'. Because the proposed change does not alter equipment design or function it can not introduce the possibility of a new type of malfunction.

C The basis for the margin of safety as defined in any technical specification is not reduced by this proposed change. This change will not result in any degradation in the ability of the ECCS to perform its intended safety functions and thus cannot reduce the margins of safety associated with the core cooling systems. One train of ECCS as defined in the proposed basis for the Technical Specifications B3.5.3 consists of one train of SI and its subsystem, including hot and cold leg injection paths. The need for ECCS utilizing the RHR and its subsystem can be delayed until switchover to sump B recirculation. At the time sump recirculation would commence, the RHR suction piping will have cooled sufficiently below the saturation temperature such that the potential for a water hammer no longer exists.

The change under review does not affect the ECCS at-power configuration. Accordingly, the proposed change has no affect on the ability of the ECCS to mitigation the design basis accident set. Making the SI hot leg injection path available for use during MODE 4 operations while delaying the initiation of ECCS using the RHR subsystem until sump recirculation enhances the ability to cope with a Mode 4 LOCA. This proposed change does not result in an unreviewed safety question.

50

SEV-1108 CYCLE 27 RELOAD Cycle 27 consists of 41 new fuel assemblies from feed regions 29A, 29B, 29C, and 29D. This safety evaluation is valid for an end-of-cycle 26 burnup of 15,200 to 16,200 MWD/MTU and Cycle 27 burnup not to exceed 16,517 MWD/MTU without additional analysis. The fuel assemblies for Cycle 27 are mechanically the same as the cycle 26 fuel assemblies except for the following.

1. The use of annular pellets in the axial blankets,

2. A reduction in backfill pressure in IFBA rods to 100 psig,

3. Grooved top and bottom fuel rod end plugs,

4. 3-tab inconel grids,

5. New top nozzle spring pack design.

The Cycle 27 reload will not increase the probability of occurrence of an accident or malfunction of equipment because the reload core does not effect accident initiators or equipment operation.

The reload core does not cause a pipe to break or equipment to malfunction. Therefore, the reload core can not increase the probability of an accident of malfunction.. The fuel design change satisfy existing design criteria; therefore, the probability of failure does not increase.

The Cycle 27 reload does not increase the consequences of an accident or malfunction because the core characteristics are bounded by parameters assumed in the accident analysis. When deviations occurred reanalysis was performed to show the acceptance criteria was still satisfied.

The fuel assembly changes do not degrade fuel performances. The resulting changes are still within acceptable ranges.

The Cycle 27 reload and fuel assembly changes do not cause a new type malfunction or accident because the core parameters are bounded by those assumed in accident analysis and design parameters are still within the assumed ranges.

Since the assumptions in the safety and accident analysis including those related to the core design are bounding for the Cycle 27 reload the conclusions in the Ginna UFSAR remain appropriate and the regulated acceptance criteria for the accident analysis has not been violated there is no reduction in the margin of safety.

The gap reopening criteria and the 17% metal wastage LOCA criteria are met for Cycle 27 through mid-cycle. Therefore, there is no reduction in the margin of safety during this period.

Operation beyond mid-cycle will require a revised evaluation.

51

SEV-1109 NEW PROCEDURE PT-60.3A "CONTAINMENTRECIRCULATION FAN COOLER PERFORMANCE TEST" SAFETY EVALUATION This Safety Evaluation describes new procedure PT-60.3A. This procedure was developed to provide a simplified alternative to procedure PT-60.3. Simplification was desired to reduce the number of people and amount of equipment that would be required in containment to facilitate at-power testing. The new procedure only provides information necessary to determine the fouling of the Containment Recirculation Fan Coolers (CRFC). It DOES NOT test the CRFC motor coolers.

The actions in the procedure that have potential safety-significance include:

1. Throttling the service water flow to each CRFC down to -300 gpm from the usual value of -1200 gpm. This is only done to one CRFC at a time, and the CRFC is declared inoperable.

2. Isolation of service water flow to the fan motor cooler of the CRFC being tested.

Again, the CRFC is declared inoperable when the motor cooler flow is isolated.

3, Installation and removal 'of intrusive test instrumentation (differential pressure cells). This will periodically cause the control room operators to get low flow alarms on FIA-2033, FIA-2034, FIA-2035, and FIA-2036. The operators are informed before these manipulations are done.

4. Positioning and repositioning of A-3.3 Containment Isolation Boundaries.

PT-60.3A does not increase the probability of occurrence of an accident previously evaluated in the SAR.

PT-60.3A does not increase the consequences of an accident'reviously evaluated in the SAR since the inoperable duration of any CRFC is much less than the LCO 3.6.6 allowed time of 7 days.

PT-60.3A does not increase the consequences of a malfunction of equipment important to safety previously evaluated in the SAR since the inoperable duration of any CRFC is much less than the LCO 3.6.6 allowed time of 7 days.

PT-60.3A does not increase the probability of an accident of a different type than any evaluated previously in the SAR. The procedure involves manipulation of service water system valves in the supply to an inoperable CRFC, entry into the enclosure of the inoperable CRFC, and installation of test equipment only.

PT-60.3A does not increase the possibility of a malfunction of equipment important to safety of 52

a different type than evaluated previously in the SAR. The procedure involves manipulation of service water system valves in the supply to an inoperable CRFC, entry into the enclosure of the inoperable CRFC, and installation of test equipment only. No other equipment is manipulated or expected to malfunction as a result of this procedure.

The margin of safety as defined in the basis for any technical specification is not reduced, since no Technical Specifications are violated.

53

SEV-1110 TSC BATTERY CHARGER AS AN ACCEPTABLE DC ELECTRICAL SOURCE WHILE IN MODE 5 AND 6 This evaluation addresses a proposed revision to the Bases for Technical Specifications section 3.8.5, "DC Sources - MODES 5 and 6", to include the use of the Technical Support Center's (TSC) DC battery charger as an acceptable source of DC power. The non-Class 1E TSC DC system is designed to tie into either Class 1E DC train using manual switches. By tying the TSC battery charger to one of the vital DC trains, the associated Class 1E battery and chargers may be removed from service.

The probability of occurrence of an accident previously evaluated in the SAR is not increased.

The TSC battery charger as a second DC source will be used during MODES 5 and 6. There are three types of evaluated events in these MODES; boron dilution and fuel handling accidents and loss of shutdown cooling. The use of the TSC battery charger will not change the ability of the plant operators to monitor boron dilution or fuel movement activities and has no failure modes which act as a precursor to any event or transient.

The consequences of an accident previously evaluated in the SAR is not increased by this proposed change. The TSC battery charger exceeds the capability of either Class 1E battery charger. A failure in the TSC battery system when connected to a Class 1E DC system will not cause a failure in the redundant Class 1E DC system and has no impact on the ability to manage the associated shutdown events.

The probability of occurrence of a malfunction of equipment important to safety previously evaluated in the SAR is not increased. Failure of the TSC battery charger or other components in the TSC DC system results only in the loss of function of the equipment supplied from the connected Class 1E DC which is addressed in the SAR. A TSC failure will not cause the Class lE DC system equipment to malfunction.-

The consequences of a malfunction of equipment important to safety previously evaluated in the SAR is not increased. The proposed change utilizes existing equipment and does not create additional functional interactions or new equipment failure modes or mechanisms.

The possibility of an accident of a different type than any evaluated previously in the SAR is not created. The proposed change creates no new functional interactions with existing plant equipment nor does it introduce new failure modes or mechanisms which could lead to reactor core damage or fission product release.

The possibility of a malfunction of equipment important to safety of a different type then evaluated previously in the SAR is not created. The proposed change does not introduce any new equipment interactions or failure modes or mechanisms.

The margin of safety as defined in the basis for any technical specification is not reduced by this 54

proposed modification. The proposed change affects only the second DC source during MODES 5 and 6. A fault in the TSC battery system when using the TSC charger as a second DC source will not propagate into the redundant Class 1B DC system.

55

SEV-1111 FUEL ASSEMBLY REPAIR PROCEDURE RF-73 In order to repair (reconstitute) selected fuel assemblies the preferred technique is to remove the top nozzle which allows access to the fuel pins. This differs from past methods of reconstitution which involved turning the fuel assembly upside down and removing the bottom nozzle. The removable top nozzle has been incorporated into Ginna fuel designs and it is desirable to utilize this method of reconstitution.

Fuel reconstitution is accomplished by removing defective rods and replacing them with "dummy" stainless steel rods. The acceptability of using a reconstituted fuel assembly in the reactor is not covered by this safety evaluation as that will be covered by a revision to the reload safety evaluation. This evaluation covers the process of reconstitution only.

The general process for reconstitution is as follows: Once a fuel assembly has been identified as a leaker and the defective pin(s) identified by a UT inspection the fuel assembly is transported to the new fuel elevator. The new fuel elevator will be outfitted with a special reconstitution basket that is compatible with the reconstitution tooling. Once the fuel assembly has been placed in the elevator the elevator will be raised to a height where the top nozzle lock tubes can be removed. This elevation is approximately 9 feet below the water surface. The lock tubes and top nozzle are then removed and the fuel assembly lowered to the rack elevation. Next the defective fuel pins are removed and placed in the existing failed fuel storage container. Dummy rod(s) are inserted in the location(s) previously occupied by the defective pins and the fuel assembly raised again to the 9 foot elevation and the top nozzle and lock tubes are reinstalled.

The assembly is then lowered and transferred to its desired location.

The Ginna UFSAR states that the new fuel elevator is used for new fuel only. Since this procedure will deviate from that description this safety evaluation is being prepared to describe the additional use of the elevator for fuel repair activities.

Since the assembly to be reconstituted is contained in systems designed to handle its associated geometry and weight the probability of a fuel handling accident or any other accident in SAR is not increased.

Since the fuel assembly will be the only assembly in transit or being worked on during reconstitution activities the consequences of a fuel handling accident remain bounded by the evaluated accident.

The probability of a malfunction of equipment important to safety is not increased because multiple layers of administrative and physical controls are in place to maintain sufficient water level above the fuel assembly at all times.

The consequences of a malfunction of equipment important to safety are not increased because sufficient controls have been put in place to preclude overexposure of plant personnel as well 56

as the public from reconstitution activities.

The possibility of an accident of a different type than any previously evaluated in the SAR has not been created because the new fuel elevator has sufficient controls in place to prevent the inadvertent withdrawal of a spent fuel assembly from the water. Any possible breakage of a single fuel rod during the reconstitution process is bounded by the fuel handling accident analysis which assumes all rods in a single assembly are failed.

The use of the new fuel elevator will not create the possibility of a malfunction of equipment important to safety because the adjusted elevator stop will be tested prior to placing a spent fuel assembly into it. Since the elevator is designed for the weight and geometry of the component that is being inserted into it this change does not create the possibility of its malfunction.

Since fuel handling, water level, boron concentration specifications are all maintained within their Technical Specification limits this procedure does not decrease the margin of safety as defined in the basis for spent fuel pool technical specifications.

57

0 SEV-1112 ACTION REPORT 97-1846 DISPOSITION OF MAIN STEAM LINE A AND B CRACK REPAIR AT PENETRATION 401 AND 402 As a result of new ISI inspection methods for integral attachments to piping/components, cracks were discovered in the gusset welds of Main Steam (MS) penetrations 401 and 402 inside containment. The purpose of this safety evaluation is to review the root cause and corrective action taken as a result of the cracks and determine if the affected systems are operable.

The root cause of the cracks was found to be due to poor weld joint design, referred to as a tee joint, which caused high residual stresses in the heat affected zone of the weld. Heavy presence of oxides is evidence that the cracks have existed for a long time, possibly from original construction initiation. Cracking in tee joints is a well know phenomena (Lamellar tearing) which was identified in the late 1960s for large section structural members. The literature reviewed shows cracks starting from the weld toe and propagating down into the base metal along the heat affected zone. Based on the report, further cracks should not develop since the initiating cause was the welding stresses, not service induced stresses (fatigue). All cracks were found at the outer toe of the weld.

The repair process removed gussets which were located adjacent-to the cracked weld to allow access to the pipe wall for defect removal. Cracks were not found in any of the area between the outer toes of the two fillet welds on either side of the three gusset which were removed. The cracks were excavated down to "defect free" base metal and then rewelded to restore the required pipe wall. All repairs were done in accordance with the original plant construction code. The maximum crack depth was found to be less than 5/8" in all cases and started at the weld toe on the pipe. The removed gussets were not re-installed over the repaired pipe area per PCR 97-089,. since they were not required to meet the design basis loads.

The Feedwater (FW) system was found to have the same penetration design as the MS except with thinner members and smaller fillet welds. The inspections did not reveal any cracks. A review was also done of the remainder of the MS and FW system for other potential tee joint configurations which have the potential for cracks. No other attachments were found which were highly restrained and had weld sizes large enough to generate high residual stresses. A third review was done of the remainder of the plant piping systems and the results showed that the systems did not have a large enough pipe wall thickness or attachment welds to create the high residual stresses.

The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the UFSAR are not increased by the proposed repair since the capability of the MS line penetrations to resist design loads has not been reduced beyond what was originally assumed.

The possibility for an accident or malfunction of a different type than evaluated previously in the UFSAR will not be created by the proposed repair. Since the repair meets the original code 58

requirements and design basis, and will not change the function of the penetrations, no new types of accidents or malfunctions would be introduced.

The margin of safety, as defined in the basis of any Technical Specification, is not reduced by the proposed repair since it meets the original design basis and codes.

59

0 SEV-1113 TAVG DEFEAT SWITCH IN DEFEAT POSITION TO PREVENT UNWANTED ROD MOTION IN AUTO In order to prevent the downward swings from channel 2's Tavg signal from causing unwanted rod motion when the Rod Control System is in Auto (which is being caused by the current core configuration/temperature streaming), the Tavg Defeat switch T/401A will be placed in the Defeat position so that Channel 2's Tavg signal will be prevented from going to TM-4010 (Average Tavg). When the Tavg defeat switch is placed in the defeat position, it prevents the selected Tavg signal from being used in the development of Average Tavg. The Average Tavg signal is still produced using Tavg signals from both loops, with the only exception being that channel 1's Tavg signal is doubled so that the average is still a result of four input values.

The Average Tavg signal is used in non Safety Related control systems such as Rod Control, Steam Dump, Pressurizer Level Control and Feed Water Isolation. The Rod Control and Pressurizer Level control should be in manual when the Tavg defeat switch is placed in or out of Defeat, this will prevent any perturbations due to minor changes in Average Tavg.

The Tavg defeat switches will be controlled by Operations with the use of Operator Aid tags being placed on both switches. This will ensure that T/401A is placed in the Normal position prior to performing testing that requires the use of the Tavg Defeat for the "A" and "B" loops.

The tag will also ensure that T/401A Tavg Defeat switch is returned to defeat position for channel 2 after maintenance.

The probability of occurrence of an accident previously evaluated in the SAR is not increased.

The change does not introduce any new failure modes or effects into the affected Tavg instrument loop nor does it functionally modify the loop or associated RPS and control systems in any way not originally designed for.

The consequences of an accident previously evaluated in the SAR is not increased by this proposed change. The change does not introduce any new failure modes or effects into the affected Tavg instrument loop nor does it functionally modify the loop or associated RPS and control systems in any way not originally designed for.

The probability of occurrence of a malfunction of equipment important to safety previously evaluated in the SAR is not increased. The change does not introduce any n e w failure modes or effects into the affected Tavg instrument loop nor does it functionally modify the loop or associated RPS and control systems in any way not originally designed for.

The consequences of a malfunction of equipment important to safety previously evaluated in the SAR is not increased. The change does not introduce any new failure modes or effects into the affected Tavg instrument loop nor does it functionally modify the loop or associated RPS and control systems in any way not originally designed for.

60

The possibility for an accident of a different type than any evaluated previously in the SAR is not created. The proposed change does not create any new equipment interactions.

The possibility of a malfunction of equipment important to safety of a different type the n evaluated previously in the SAR is not created. The proposed change does not create any new equipment interactions.

The margin of safety as defined in the basis for any technical specification is not reduced by this proposed switch position. The Overpower and Overtemperature setpoints, the process by which they are generated, and the total RPS delay time are all unaffected by the change.

10CFR50.59 SAFETY REVIEW FOR ACTION REPORT 96-1200 NO LONGER RE UIRING SPARE CHARGING PUMP BREAKER FOR PIPE BREAK OUTSIDE'CONTAINMENT IPSAR SECTION 4.14 NRC correspondence to RG8'cE dated 4/21/83, INTEGRATED PLANT SAFETY ASSESSMENT REPORT (IPSAR) SECTION 4. 14 PIPE BREAK OUTSIDE CONTAINMENT, required the implementation of administrative controls for the installation of a spare charging pump breaker and cable for postulated steam heating line breaks in the Auxiliary building.

RG&E has since performed an environmental evaluation of the installed charging pump breakers and determined that they are environmentally qualified (EQ Package 49), therefore there is no requirement to maintain a spare breaker and administrative controls for its installation.

Administrative controls will remain in place for the cable replacement.

62

10CFR50.59 SAFETY REVIEW FOR CHANGE TO FRE UENCY OF PERIODIC VENDOR CONTACTS FOR VENDOR MANUALPROGRAM RG&E's correspondence to the NRC dated 2/2/93, Response to Generic Letter 90-03, stated our commitment to perform periodic vendor contacts on a frequency of biennially (every two years).

As the result of process improvements in the Vendor Manual Program, RG8cE will be revising our commitment and utilizing a three year vendor recontact cycle.

Industry experience has shown that through the implementation of a vigorous recontact process, a three year recontact cycle is the optimum period for performance from both a technical and economic perspective, and in many instances is more technically effective than recontacts at tighter intervals. Generic Letter 90-03 provided clarification of the vendor interface for safety-related components and did not specifically stipulate a recontact frequency.

f 63