ML17265A725

Rev 1 to Rept of Development of Rg&E Seismic Safe SD Equipment & Relay Review Lists for USI A-46

ML17265A725
Person / Time
Site:	Ginna
Issue date:	04/23/1999
From:	Denise Wilson ROCHESTER GAS & ELECTRIC CORP.
To:
Shared Package
ML17265A726	List: ML17265A725
References
REF-GTECI-A-46, REF-GTECI-SC, TASK-A-46, TASK-OR NUDOCS 9908060066
Download: ML17265A725 (96)

Text

QQ(c oscJM J

REPORT ON THE DEVELOPMENT OF THE RGEcE SEISMIC SAFE SHUTDOWN EQUIPMENT AND RELAY REVIEW LISTS FOR UNRESOLVED SAFETY ISSUE (USI) A-46 Prepared:

Engineer Date Prepared:

R ay Review Engineer Date I

Reviewed:

J Operation

'/ g7 c

Date Approved:

Manager Date

'P908060066 9'F0730 PDR ADQCK 05000244 P

PDR Page 1 of 42

'c!1i'i::.',.'i: '.ll,:;,:~,';,'!pi",:;:.',::NQOf3gkpdi:-:.SBckx'cl1lg)!S!l1iO::

5'o,~',;:,';6&CQUDC %fpX!'".:AG%)gi':

ghat" 6OVA"':8V84'888""cNWC84%848 i!8887k'.::5%%8!848%&1'OQ8N kSS%' @i';

hajj

".:bloc

.'"j%'.j'i>~?:.:iN;::@Wc~..,",".:,i~.cur~%;:q'c giNi';@NM~~!ace~~~NMMMMm..~%$xW.

Page 2 of 45

TABLE OF CONTENTS 1.0 2.0 3.0 4.0 1.1 1.2 1.3 1.4 1.5 1.6 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 INTRODUCTION Objective Scope Criteria Results Conclusions References IDENTIFICATION OF SEISMIC SAFE SHUTDOWN EQUIPMENT LIST (SSEL)

OBJECTIVES Purpose Safe Shutdown Functions Reactor Reactivity Control Function Reactor Coolant Pressure Control Function Reactor Coolant Inventory Function Decay Heat Removal Function Supporting Systems Equipment Functions Special Functions Assumptions e

e e

o

~

~

2.9.1 Loss of Offsite Power 2.9.2 No Other Accidents 2.9 '

Single Equipment Failure 2.9.4 Manual Operation of Equipment 2.9.5 Proceduralized Operator Actions 2.9.6 Notable SQUG Criteria 2.9.6.1 Exclusion Of NSSS Equipment 2.9.6.2 Rule of the Box 2.9.6.3 Active Equipment 2 '.6.4 Inherently Rugged Equipment 2.9.6.5 Equipment in Supporting Systems 2.9.6.6 Equipment Subject to Relay Chatter 2.9.6.7 Instrumentation BLOCK WALL INTERACTIONS 2.10.1 Discussion 2 '0.2 Results 2.10 '

Method of analysis 2.10.4 Identification of circuits of concern and their associated routing lists.

2.10.5 Development of routing paths of concern l'sts.

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

2.10.6 Review of circuits and routing of concern

2. 10. 7 Failure modes discussion

2. 10. 8 Outcome EQUIPMENT SELECTION CRITERIA EVENT MITIGATION METHODOLOGY OVERVIEW 5

5 5

5 5

6 6

7 7

8 8

8 9

10 10 11 11 11 12 12 12 13 13 13 14 14 15 16 16 17 17 18 18 19 20 20 21 21 23 36 Page 3 of 45

5.0 6.0 5.1 5.2 5.3 5.4 6.1 6.2 6.3 6.4 GENERATION OF SAFE SHUTDOWN EQUIPMENT LISTS (SSEL)

Composite SSEL Attributes of the Composite Safe Shutdown Equipment List SSEL, Attachment I, by Field SSEL for Seismic Review SSEL for Relay Review RELAY EVALUATION REPORT Methodology Utilized for Relay Evaluation Seismic Screening of Essential Relays Relay Walkdown and Mounting Spot Checks Explanation of Relay Evaluation Reports 38 38 38 39 39 40 40 42 42 42 Figure 1 - Equipment Selection Criteria Overview Block Wall Study Attachment A - Circuit of Concerns Attachment B - Areas and Trays of Concern Attachment C - Devices Subject to Block Wall Interaction SSEL Tables Attachment I Attachment II Attachment III Attachment IV Attachment V

Attachment VI Composite SSEL SSEL for Seismic Review SSEL for Relay Review USI A-46 Relays Condensed List of Essential Relays List of Panels/Cabinets Containing Essential Relays Page 4 of 45

INTRODUCTION Obj ective The objective of this report is to describe the methodology used to select a subset of Plant equipment which can be utilized to achieve safe shutdown following a seismic event Also included in this report is the relay evaluation review.

The lists contained in this report will be input into further RGGE seismic evaluations Scope The scope of the Seismic Safe Shutdown Equipment List

( SSEL) is defined by the requirements detailed in RG&E' seismic evaluation program.

The seismic evaluation program was developed to satisfy Seismic Qualification UtilityGroup (SQUG) methodologies for verification of seismic adequacy of active electrical and mechanical equipment.

Criteria The criteria used in the selection of systems, and components is defined by U.S. Nuclear Regulatory Commission correspondence "Verification of Seismic Adequacy of Equipment in Older Operating Nuclear Power Plants",

supplemental Safety Evaluation Report No.

2 on Seismic Qualification UtilityGroup's Generic Implementation Procedures, Revision 2, corrected February 14, 1992 for Implementation of GL 87-02 (USI A-46)

(Ref. 1.6.7).

Results The results of this seismic review are documented in attachments I through VI and in the outlier resolution plan.

Outliers were entered into the ACTION program (IP-CAP-1) for operability and reportability screening.

The results of this report are inputs to the Seismic Evaluation Report, as required for USI A-46 resolution.

Page 5 of 45

1.5 Conclusions As built, Ginna Station has sufficient equipment and appropriate procedural guidance to ensure safe shutdown is achieved following a seismic event.

Many changes in construction methods and analysis techniques have occurred since Ginna was licensed.

Consequently, there veii areas (see outlier resolution plan) which xi'jm'jediphysical modification or analytical validation to'ensure optimum plant performance during and following a seismic event.

1.6 References 1.6.1 Design Analysis DA-NS-92-133-00, "BAST Boron Concentration Reduction Technical Specification Values", revision 0, December 14, 1992 1

~ 6 '

Letter from B. L. King, Westinghouse to R.

C. Mecredy, RG&E, Letter g TMI-OG-83, "Transmittal of WOG Study Results Related to Maintaining Subcooled Conditions During an Extended Loss of Off-site Power",

September 26, 1979 1.6.3 1.6 '

PRA Memo dated March 9,

1993, NSL-PRALT-93.010 NUREG-0909, "SGTR Event" Section 3.2.6 1.6.5 Plant Procedures 1.6.5.1 1.6.5.2 1.6.5.3 1.6.5.4 1.6.5.5 1.6.5.6 ER-Fire.1, "Alternative Shutdown for Control Complex Fire" tI ES-O.l, "Reactor Trip Response" F-0',

"Heat Sink" FR-H.1, "Response to Loss of Secondary Heat Sink" ER-NIS.1, "Source Range Malfunction" ES-0.2, "Natural Circulation Cooldown" 1.6.5.7 ER-PRZR.1, "Restoration of Pressurizer Heaters During Station Blackout" 1.6.5.8 EPIP-1.0, "Emergency Coordinator" 1.6.5.9 ER-SC.4, "Earthquake Emergency Plan" 1.6.5.10 AP-SW.1, "Service Water Leak" Page 6 of 45

1.6.6 Design Analysis DA-ME-96-097, "SWS Hydraulic Analyses with one SAFW pump operating and assumed Leakage and a

Block Wall Failure in the intermediate building."

1.6 '

SER Repor't No. 2, "Verification of Seismic Adequacy of Equipment in Older Operating Nuclear Power Plants",

supplemental Safety Evaluation Report No.

2 on Seismic Qualification UtilityGroup's Generic Implementation Procedures, Revision 2, corrected February 14, 1992 for Implementation of GL 87-02 (USI A-46).

2.0 2.1 IDENTIFICATION OF SEISMIC SAFE SHUTDOWN EQUIPMENT LIST (SSEL)

OBJECTIVES Purpose Safe shutdown is defined as bringing the plant to, and maintaining it in, a hot shutdown condition during the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a safe shutdown earthquake (SSE)

~

Hot Shutdown is defined by Ginna Station Improved Technical Specifications as non-critical conditions with Tavg

> 350 F.

Note that in SSER N2 the NRC has expressed their intent that pressurized water reactors (PWRs) lower their temperature and pressure within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to the point at which residual heat removal (RHR) equipment could be used, but not necessarily require RHR equipment to be included on the SSEL.

As such, for the purpose of this program, hot shutdown will be defined as the ability to reach Mode 4

(Hot Standby).

The purpose of this report is to describe the overall method for identifying the active mechanical and electrical equipment needed to achieve and maintain safe shutdown conditions at Ginna Station.

The scope of equipment to be identified includes active mechanical and electrical equipment which should operate to accomplish a safe shutdown function, tanks and heat exchangers, equipment which should not inadvertently operate due to relay (contact) -chatter, and cable and conduit raceway systems supporting electric wire for safe shutdown equipment.

Page 7 of 45

2.2 Safe Shutdown Functions To achieve and maintain safe shutdown conditions during and following a safe shutdown earthquake, the following four safe shutdown functions must be accomplished (Ref.

Z.6.7):

Reactor Reactivity Control Reactor Coolant Pressure Control Reactor Coolant Inventory Control Decay Heat Removal These functions focus on controlling the nuclear,

thermal, and hydraulic performance of the reactor and the reactor coolant system.

To monitor that these safe shutdown functions are being accomplished, certain process variables must be measured.,

These safe shutdown functions are described below along with examples of the process variables which should be considered for measurement to assure that these functions are being accomplished.

2.3 Reactor Reactivity Control Function The reactivity control function is accomplished by insertion of negative reactivity shortly after obtaining the signal to shutdown.

Additional negative reactivity is also needed to compensate for the combined effects of Xenon-135 decay and reactor coolant temperature decreases.

A process variable which may be measured to monitor reactivity is core neutron flux.

An alternative to measuring core reactivity directly is to measure other parameters which can be used to show that the core remains subcritical.

For PWRs, measurements could be made of the position of all the control rods, the temperature of the reactor coolant cold leg, and the boron concentration in the reactor coolant system; fully inserted rods with sufficient boron concentration in the reactor coolant, for a given temperature, will result in the reactor remaining subcritical.

2.4 Reactor Coolant Pressure Control Function The pressure control function has several elements which should be accomplished to ensure that the reactor coolant system is operated properly:

~

The reactor coolant system pressure should not exceed a maximum pressure; Page 8 of 45

~

The pressure should be maintained within the reactor coolant system pressure-temperature limits of the plant's Technical Specifications to prevent reactor vessel brittle fracture;

~

There should be sufficient subcooling margin, consistent with plant operating procedures to avoid formation of a steam bubble within the reactor vessel and to promote natural circulation between the core and the steam generators;

and,

~

The differential pressure across the steam generator tubes should not exceed the pressure-temperature limits to prevent leaks and ruptures in these tubes.

If it is preferred (or required due to certain plant limitations), the plant may be brought to a cold shutdown condition (Mode 5) during the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an SSE instead of staying in the hot shutdown condition.

However, if this is done, the following additional elements should also be accomplished:

~

There should be a means for reducing the reactor coolant system pressure to the point where the low pressure residual heat removal system can be operated;

and, When the reactor coolant system is connected to the low pressure residual heat removal system, the system.pressure should not exceed a maximum pressure for the low pressure residual heat removal system.

It should be noted that the option to cooldown to Mode 5 was not selected for the purpose of the Ginna Station SSEL.

Process variables which should be measured for monitoring the reactor coolant system pressure include reactor coolant pressure, reactor coolant temperature (or subcooling margin),

and pressurizer level if pressurizer heaters are used for pressure control.

2.5 Reactor Coolant Inventory Function The reactor coolant inventory control function is necessary to assure that the reactor core remains covered so that decay heat can be removed during and after the postulated earthquakes Inventory control has two elements which should be accomplished:

Loss of reactor coolant from the reactor coolant system should be minimized; and, Page 9 of 45

~

Sufficient makeup capacity should be available to compensate for losses due to leakage from the reactor coolant system and for fluid shrinkage when the reactor coolant temperature is lowered.

Note: If it is possible to lose cooling capability to the reactor coolant pump seals, then makeup capacity and coolant supplies should be available to compensate for possible leakage from these seals.

The process variable measured for monitoring the inventory of the reactor coolant system is the water level in the pressurizer.

If the water level drops below the lowest pressurizer level instrument reading in a PWR (during a potential overcooling transient),

then it may be necessary to also measure reactor vessel level so that the operator can monitor the actual inventory of water in the reactor coolant system.

2.6 Decay Heat Removal Function The decay heat removal function is accomplished by removing decay heat and stored heat from the reactor core and reactor coolant system at a rate such that overall reactor coolant system temperatures can be lowered to and maintained within acceptable limits.

Process variables which should be measured for monitoring the decay heat removal function include reactor coolant temperature and pressure.

Both the hot leg (or core exit) temperature and cold leg temperature should be measured during natural circulation decay heat removal conditions to verify that natural circulation is established between the reactor core and the steam generators.

2.7 Supporting Systems Equipment Functions Most of the shutdown equipment on the SSEL will require support from some other systems to operate.

Supporting systems include electrical power, pneumatic

power, hydraulic power,'ubrication, cooling, control and instrumentation.

The support equipment used to provide electric power will be designated as accomplishing "Emergency Power" functions.

The support equipment used to provide for heat removal from essential heat exchangers will be designated as accomplishing an "Essential Cooling" function.

Page 10 of 45

All other equipment necessary to maintain or ensure the availability of any seismic safe shutdown~ devices identified in this report will be tracked with the equipment being supported and has been assigned the related functional classification.

2.8 Special Functions Where specific seismically related features have been identified in the plant licensing basis, the equipment used to perform these features will be identified as performing a "Special Function."

Control Room ventilation isolation is an example of such a function.

Because there is redundancy and diversity in the design of nuclear power plants, there may be several paths (or trains) which could be used to accomplish these functions.

Only the active equipment in a primary path (or train) and backup equipment within that path (or a backup train) need be identified for seismic evaluation.

The preferred safe shutdown path can be selected based on such considerations as previous systems analyses (e.g., for fire protection),

ease of use by operat'ors, compatibility with plant procedures, and status of existing seismic qualification of equipment.

There may be other secondary considerations for selecting certain safe shutdown paths such as ease of performing the plant walkdown and seismic adequacy verification.

2.9 Assumptions For purposes of analysis certain assumptions are made with respect to system/component availability post earthquake.

These include:

2.9.1 Loss of Offsite Power Loss of offsite power may occur as a result of the

, earthquakes The safe shutdown capability should remain intact while offsite power is not available for a minimum of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an SSE.

Note that the possibility of not losing offsite power is also considered if this is more conservative.

Page ll of 45

No Other Accidents No concurrent or sequential potential events are postulated to occur other than a design basis safe shutdown earthquake (SSE) and a loss of offsite power.

For example, no loss of coolant accidents (LOCAs), high energy line breaks (HELBs), fires, flooding, extreme winds and tornados, lightning, sabotage, etc.,

are postulated to occur.

Single Equipment Failure Systems selected for accomplishing safe shutdown should not be dependent upon a single item of equipment whose active failure, either due to seismic loads or random failure, would preclude safe shutdown.

At least one practical alternative should be available for accomplishing safe

shutdown, which is not dependent on that item of equipment.

This alternative should also be evaluated for seismic adequacy.

For example, two motor-operated valves in series may be used to isolate a line and two motor-operated valves in parallel may be used to open a line.

As an alternative, a separate, redundant train of equipment may be used as a backup.

If an item of equipment is taken out of service for maintenance, then that item of equipment is considered the single equipment failure for the purposes of equipment selection.

Manual Operation of Equipment Manual operation of an item of equipment which is normally power-operated is considered an acceptable means of providing backup operation provided sufficient

manpower, time, and procedures, are available.

For

example, the primary mode of closing or opening a valve may be by its motor operator while the backup or redundant means of closure or opening may be manual (local) operation of this same valve or a manual valve in the same line.

Timely operator action is permitted as a means of achieving and maintaining a safe shutdown condition provided procedures are available and the operators are trained in their use.

Operator actions associated with resetting of essential relays is discussed in the EPRI report on Relay Seismic Functionality.

Page 12 of 45

Proceduralized Operator Actions hI The shutdown procedures which are associated with the use of the USI A-46 safe shutdown equipment should be procedures which are available to the operator as a

result of his following approved normal (O,S,and T),

abnormal (AP) and emergency operating procedures (EOPs)

~

Note that normal plant shutdown procedures would be used for any deliberate, 'planned shutdown; EOPs would be used for a plant trip or emergency shutdown.

If an SSE occurs, it is not necessary to use only the safe shutdown equipment identified in the SSEL.

The operator may attempt shutdown using other available systems and equipment provided these other means of shutting down do not prevent later use of the safe shutdown method identified for the USI A-46 program.

Notable SQUG Criteria Exclusion Of NSSS Equipment The major pieces of equipment in the Nuclear Steam Supply System (NSSS) which are located inside the containment are excluded from the scope of review and need not be included on the Safe Shutdown Equipment List.

Also excluded are the supports for this equipment along with all the components mounted in or on this equipment.

Relays and other types of contactors and switches are included within the scope of the GIP.

They have not been included in this section since the seismic evaluation of these components is handled differently, as described later in this report.

Page 13 of 45

2.9.6.2 Rule of the Box One important aspect of identifying the equipment included within the scope of the procedure is explained in the GIP by the "rule of the box."

For skid mounted or enclosed equipment (i.e., parts of parent components which have separate EINs, all the components mounted on or in this equipment are considered to be part of that equipment class and do not have to be evaluated separately.

For example, a diesel generator includes not only the engine block and generator, but also all other items of equipment mounted on the diesel generator or on its skid; such as the lubrication

system, fuel supply system, cooling system,

heaters, starting systems, and local instrumentation and control systems.

Components needed by the diesel generator but not included in the "box" (i.e., not mounted on the diesel generator or on its skid) should be identified and evaluated separately.

Typically this would include such items as off-mounted control panels, air-start compressors and tanks, pumps for circulating coolant and lubricant, day tanks, and switch gear cabinets.

One exception to this "rule of the box" is relays (and other types of devices using contacts in the control circuitry).

Even though relays are mounted on or in another larger item of safe shutdown equipment, they should be identified and evaluated for seismic adequacy using the procedure described in Section 6 of the GIP since they may be susceptible to chatter during seismic excitation.

Note that this relay review is needed even if the item of equipment being controlled, such as a

pump, is itself seismically adequate.

The relays to be evaluated are identified by first identifying the major items of safe shutdown equipment which could be affected if the relays malfunctioned.

Then, for the relay review SSEL, the particular relays used to control these major items of equipment are identified and evaluated for seismic adequacy.

2. 9. 6. 3 Active Equipment Active mechanical and electrical equipment which operate or change state to accomplish a safe shutdown function should be identified for seismic evaluation.

Electrical equipment without moving parts such as batteries, transformers, battery chargers and inverters are considered active for the purposes of this report and are included within the scope of USI A-46.

Page 14 of 45

It is not in the scope of USI A-46 to verify the seismic adequacy of passive equipment such as piping, filters, and electrical penetration assemblies, nor building structures.

Exceptions to this rule are tanks and heat exchangers and cable and conduit raceways.

Likewise, it is not in the scope of USI A-46 to verify the seismic adequacy of potentially active equipment which does not need to operate if it is already in the proper state to accomplish its safe shutdown function and it fails in that desire position upon loss of power.

For example, if a motor-operated gate valve, which isolates a drain line in the reactor coolant

system, is already closed, and it stays closed upon loss, of power, then it can be considered a passive item of equipment for the purposes of this report.

The valve body and its disc are considered to be an extension of the passive piping system.

The potential for inadvertent opening of the valve due to relay chatter in its control circuit is evaluated in section 6 of this Report; therefore such equipment should be identified for relay evaluation.

Inherently Rugged Equipment Certain types of potentially active mechanical and electrical equipment are inherently rugged and need not be evaluated for seismic adequacy in the USI A-46 program.

This equipment includes but is not limited to:

~

Self-actuating check valves without external actuators.

If a check valve has an external

actuator, then this actuator and its connection to the check valve should be evaluated for seismic adequacy.

~

Manually-operated valves.

While it is not necessary to verify the seismic adequacy of inherently rugged equipment when such equipment is active for accomplishing a safe shutdown function, the equipment is included on the Safe Shutdown Equipment List (SSEL) for completeness.

Page 15 of 45

Equipment in Supporting Systems Any active equipment in systems which support the operation of identified safe shutdown equipment is also identified for seismic evaluation.

Supporting systems can include power supplies '(e.g., electrical, pneumatic),

control systems, cooling systems, lubrication systems, instrumentation, and heating, ventilating, and air conditioning systems.

Likewise, if any item of equipment in these supporting systems is dependent upon some other system for support, then the active equipment in this secondary supporting system should also be identified for seismic evaluation.

Equipment Subject to Relay Chatter If an item of equipment could inadvertently start, stop, or change state due to relay chatter (or other malfunction of a relay or other electrical device with contacts) and thereby prevent a safe shutdown function

'from being accomplished, then it should be identified and used as an input to the Relay Review SSEL.

The equipment which should be identified as subject to relay chatter includes all the active, electrically-

powered, safe shutdown equipment identified for seismic evaluation.

In addition, some of the electrically-powered equipment considered

passive, and hence, not subject to seismic evaluation, should be identified for

~rela evaluation.

This could include equipment which is already in the proper state to accomplish a safe shutdown function and would fail in this state upon loss of power, but due to relay chatter, could inadvertently change state and thereby result in the safe shutdown function failing to be accomplished.

The example..used earlier of a closed, motor-operated gate valve which isolates a drain line in the reactor coolant system is a case where the valve would not be identified for seismic evaluation, but should be identified for ~rela evaluation.

Obviously any electrically-powered equipment whose operation, or the lack thereof, does not affect the accomplishment of any safe shutdown function, need not be -identified for relay.evaluation.

For example, there may be a closed, motor-operated valve which should stay closed; however, if there is a closed manual valve downstream of this motor-operated

valve, then it does not make any difference whether the motor-operated valve inadvertently opens or remains closed.

Page 16 of 45

2.9.6.7 Instrumentation The scope of equipment which should be identified for seismic evaluation includes those instruments which measure the primary process variables used to assure that the plant is in a safe shutdown condition.

This includes instruments used to measure reactor reactivity, reactor coolant pressure, reactor coolant inventory, and decay heat removal.

In addition to the instruments needed for measuring the primary process variables, any instruments needed to control the safe shutdown equipment should also be identified.

For example, if a modulating valve is being used to control the level of water in a tank, then the level instrumentation for this tank should be identified as instrumentation needed by the modulating valve.

Note that the power supply for this level instrumentation should also be identified as a

supporting system for the level instrumentation.

Note that it is not necessary, in general, to identify instrumentation which simply indicates the status of an item of safe shutdown equipment.

2.10 BLOCK WALL INTERACTIONS The Structural Upgrade Program at Ginna Station resulted in the extensive review of the consequences associated with masonry block wall failure.

Several safe shutdown strategies were developed and approved by the NRC with respect to the following related Systematic Evaluation Program (SEP) topics:

II-2.A III-2 III-4.A III-S.B III-7.B Severe Weather Phenomena Wind and Tornado Loadings Tornado Missiles High Energy Pipe Breaks Outside Containment Design Codes, Design Criteria, and Load Combinations Additionally, block walls were analyzed in response to IE Bulletin 80-11, Masonry Wall Design.

The result of these analyses led to numerous modifications detailed in the appropriate sections of the UFSAR.

The block wall failure/safe shutdown equipment interaction protection afforded by these changes is also described in the UFSAR.

Page 17 of 45

Discussion Ginna Station was constructed utilizing masonry blocks as room and building boundaries in certain locations.

This construction technique was common for the period but, by 1980, sufficient flaws in block wall performance were identified to cause the USNRC to issue IE Bulletin 80-11, Masonry Wall Design.

Ginna analyzed its block walls per that bulletin and later on performed extensive block wall reviews as part of an overall Structural Upgrade Program.

Documented within the results of the SEP are the strategies RGEE developed to mitigate the consequences of block wall

failures, those failures being caused by a variety of reasons.

Ginna then utilized those methods of safe shutdown described in the SEP results to bound the consequences of seismically induced block wall failures.

After examining the various strategies detailed in the related SEP and Appendix R programs it was apparent that the complex overlay of methods which comprises our current licensing basis seismic shutdown process does not meld well with the SQUG methodology.

Therefore, the purpose of this section is to rigorously review the potential equipment/masonry block interactions with particular attention given to safe shutdown circuit routing.

This review is beyond the scope of the SQUG GIP with respect to the traditional development of an SSEL.

It is not outside the overall scope of SQUG however because the block/equipment interactions are potential seismic interactions.

Results The results of this cable block wall interaction routing review have been incorporated into the SQUG SSEL.

Unresolved problems were identified and documented in the SQUG Outlier 'list for operability analysis and resolution.

Page 18 of 45

Attachment A is the list of EINS which are associated with electrical circuits of concern.

Attachment A

includes those EINs which are judged to be boundary components whose misposition could affect the accomplishment of an SSEL function.

Attachment B is documentation of the results of the, field walkdown of the areas and trays of concern.

Attachment C is the list of SSEL devices whose cable routing is subject to block wall interaction.

It is the evaluation (including the effects of potential hot shorts) of the items on Attachment C that compelled modification of the initially proposed SSEL or an addition to the list of unresolved issues brought forward as SQUG outliers.

A discussion of the findings brought about in the block wall interaction evaluation is provided in the outcome portion

((P!:,~i'0!."::O'I of this section.

The control schematics and circuit schedules used in this review are incorporated into the SQUG program as part of the SSEL development record set.

Method of analysis In order to ensure a complete review, a six step process was used:

Identification of devices of concern.

2.

Documentation of routing circuits for devices of concern.

3.

Identification of circuit trays and conduits susceptible to block wall interactions

("routing paths of concern").

4

~

Review of routing of circuits for devices of concern to determine if they are located within routing paths of concern.

5.

Review of devices which are associated with routing paths of concern to determine if redundant equipment can be identified to accomplish the SSEL function.

6.-

Modification of the proposed SSEL or documentation as outlier those circuit routings for which an acceptable alternative SSEL device could not be found.

Page 19 of 45

Additionally, important circuits not on the circuits of concern list were reviewed to ensure that block wall interactions would not create a demand for equipment or functions not already available on the SSEL (i.e. the unintended operation of a functional boundary component).

Identification of circuits of concern and their associated routing lists.

To reduce the number of circuits to review, the SSEL was screened to identifying only the devices of concern.

The selection criteria was simple:

2.

devices of concern are those devices using electric power or control, which must perform in an active way to accomplish their SSEL function.

Devices on the proposed SSEL that are functional boundaries (even though they do not perform an active function) were also examined to ensure they do not misposition and affect the SSEL functions.

After all the devices of interest were identified, the equipment's primary electrical drawing and circuit schedules were compiled for review.

Development of routing paths of concern lists.

Additional field walk downs were conducted to determine which circuit trays were susceptible to block wall interactions.

First, all trays which could possibly be affected were identified. That list was subsequently re-screened to identify which trays could be excluded from the concerns list (trays not susceptible to block wall interactions)

~

Conduit routings of concern form a special challenge due to the way conduits are labeled.

A conduit may contain circuitry in addition to the circuit whose number was chosen as the conduit label (if a field label can be found).

Simply identifying a conduit susceptible to block wall interaction would not ensure all the possible circuits were accounted for.

The concern being:

a circuit-is routed through trays which do not have block wall interactions but exits the tray and runs through a seemingly unrelated conduit and that conduit is susceptible to block wall interaction.

Page 20 of 45

The majority of conduits of concern can be identified by identifying where devices of concern are located in areas of concern.

That is because the cables for those devices usually enter or exit trays via conduit.

Conduit of this category need not be field verified as it is assumed the SSEL device will be disabled by block wall failure.

To ensure completeness of review each time a circuit schedule indicates a circuit of concern is in conduit, and that the conduit was in an area of concern, the conduit has been walked down and examined to determine if it is susceptible to block wall induced failure.

Review of circuits and routing of concern After the appropriate lists are developed, circuit schedules for the devices of concern have been examined to find where cable routings entered zones of concern (plant areas which contain block walls).

For those routings in zones of concern, the circuits have been examined to see if they traveled in trays of concern (trays susceptible to block wall interaction).

Circuits in zones of concern that traveled in conduits have been examined in the field to identify possible block wall interactions.

The results of the examination was a list of devices which either need to be replaced with a functional equivalent not susceptible to the routing problems (but otherwise SQUG acceptable),

or needing to be placed on the outlier list for management attention and resolution.

Failure modes discussion All circuits which are in areas susceptible to block wall interaction have three basic failure modes of concern: circuit interruption (opens),

short circuiting and grounding, and hot shorting.

Safe shutdown circuit interruption causes a loss of the device under reviews safe shutdown active function.

This condition must be avoided in order to meet the SQUG criteria of having two independent trains of active equipment available for safe shutdown.

Page 21 of 45

Short circuits and grounds in active safe shutdown circuits also cause loss of function and, like circuit interruption, can only be countered by guarding against the cause of the fault or by selecting new circuits not susceptible to the cause

~

Short circuit fault currents in equipment circuits not on the SSEL are not of issue because the fuse and breaker coordination program ensures selective tripping occurs prior to cascading failures which might lead to the loss of an SSEL power supply.

Hot shorting is a condition whereby the fault causes an activation or perturbation in a control circuit (spurious operations)

One possible seismically induced cause of a hot short would be a piece of metal falling or being thrust through a cable or cable bundle (like a guillotine).

The hot short does not draw enough current to actuate a circuit protection device,

thus, the circuit remains functional.

This condition can lead to loss of a safe shutdown function by "turning off" a desired device or it can cause the activation of an unintended function by "turning on" an undesired function.

The effects of seismically induced spurious operations are analyzed in SQUG in the Relay Evaluation.

For purposes of this cable(block wall interaction review the affects of hot shorts can be viewed in a similar fashion to SQUG effects of relay chattering.

A hot short would be acceptable so long as the short was not preventing an SSEL function or causing a condition wherein the SSEL equipment set is insufficient to mitigate.

An example of an unacceptable consequence of hot shorting can be shown analytically in the PORV control circuitry.

Should the control SOV fail such that the PORV opened prematurely, the reactor coolant system pressure boundary function would be violated.

Hot short induced spurious operations can be divided into two classes:

Mal-operation of SSEL equipment due to control circuit failures; and 2.-

Mal-operation of equipment which is not-active SSEL equipment, but which could operate to prevent the accomplishment of an SSEL function; for

example, the inadvertent depressurization of the RCS from the spurious opening of a boundary valve.

Page 22 of 45

Equipment whose circuity could have a hot short induced failure leading to loss of an SSEL function must have its circuitry hardened against those effects or be re-routed so it is no longer vulnerable.

Outcome Several circuit routing configurations for SSEL devices are susceptible to block wall interactions.

Most of these were previously identified in the various SEP

programs, and modifications or procedural compensatory measures were instituted.

The results of the block wall interaction study revealed several cable or equipment failures which affect apparatus selected for inclusion on the SSEL.

Because most of the interactions were already identified, and the consequences procedurally reconciled, they do not meet the definition of traditional SQUG outliers (i.e. the manual operator actions are proceduralized).

This selection of equipment Wi), however, included on the SQUG outliers list, not Secause they result in a loss of safe shutdown function, but because they would cause a loss of pr'eferred mode of operation.

The cumulative affects of the losses of preferred modes of operation, and the subsequent manual operation of SSEL equipment, VPeFe studied to examine the possibility of physical or procedural enhancements.

These studies also ixiiluiFd margins studies to aid in defining the priorities in which manual actions should be taken.

Accordingly, the discussion of the outcome of the block wall interaction study is divided into two groups, A

and BE Group A equipment is equipment that incurs a

potential loss of function which normal proceduralized operator actions do not mitigate.

Group A equipment are true SQUG outliers.

Group B reflects equipment that has loss of preferred mode of operation of has the potential to mal-operate and require manual operator action.

These are not traditional outliers because there is not a loss of safe shutdown function or because a violation of SQUG selection criteria does not occur.

Nevertheless, equipment in this category Pyi included on the outliers list for further study oE possible physical or procedural enhancements.

Page 23 of 45

GROUP A Steam Generator A Wide Range Level (LT-504)

This indication is desired during cooldown.

Cables associated with this device are routed in areas of concern.

Although other wide range levels are available, they have power interdependencies which may make them susceptible to other than block wall induced potential single failures'hould it be necessary, Steam Generator A wide range level can be obtained by manually reading the current loop associated with loop LT-505.

This involves obtaining the proper measuring equipment, lifting leads in a cabinet in the relay room, taking a current measurement, and converting that measurement to a level reading.

Although the process is simple it is not a normally performed procedure.

Consequently this issue 8aa; brought forward as an outlier.

Reactor Coolant System loop A hot leg and cold leg temperature indications (TE-409A-1 and TE-409B-1)

This indication is desired during safe shutdown to monitor cooldown rates and reactor core delta temperatures for natural circulation.

The cables associated with these temperatures are routed in trays of concern and are susceptible to block wall induced failures.

Should the loop A indication be lost, loop temperatures can be obtained by manually reading the resistance of other RTDs in the RCS loop.

This process involves obtaining the proper measuring device, lifting leads in cabinets in the relay room, taking resistance

readings, and converting those reading to temperature.

Although this process is simple, and has been performed in the past, it is not a normally performed procedure.

Consequently, this issue w'as': brought forward as an outlier.

.~NwoxoYc+"" %8+%0(, l~'Y'I'ccox+No&yPFN'kY(+/c.0 rMg&co+c'a(ccoA~+x@Av Ax~...ox&'NA50YAQg?)~) "~+Row?%ggPs!c&EO.

%.t Px'a6p~:~;:..:au~

@X.ti@wNa'ti'v&g@au>pment'j'jg6'lecto~Q:::(a'Q5PQg'egR5'i'onB'1!

proQ6 Qx&'jjiv 8ng68,'

.rNCcv MA'/My~cv ~~,w@G:CM Page 24 of 45

"AWAYAVWxaCee~POPPC)PPXm~XeXeO~VW Whh~~vhVh.. ',CMWA~VC~~<~AWVAA>

AhVV~YVA'<4AVAYAY~~V~Wehh'Vh~

t'e,"-,'coxiaeijuahneaux::~:":aj:"::ya5yiita~~;.::::.ioaavgoi:aieamgganexe~g"x!

midi>jwihgi'!.:1'ev%1!:.':::ha gjfgg~jjjjjqjjgjjQ'gojjPig'jjQjj:$Qgg "":.QggQ""~jjQ IVX'@,i~'61AS~BD'CV;4cLR6'>.-",:SX'::tan~<..,"CAHCXDg&XLCg~~:.'QXQC86UX88:.+

Q3;:..3:::X~%'vai-i:.fy.':.:Ki~e Q~":/k'"<~ahjjjja:'Q~QN'gjj.f:j"'j'~ji~Q5'jjjgQpj"'"":j;:jj~~ejj.t'Pj

'Re'aa,,hew;:..';',Cee1ari~'.,:.:.'5cjoy:,::::;::.';A~pempexat~ei X'@'5'9:~ c7166QQBIl@5;6,::~pg"::'.,';65'9 X'iOQg;.:;-A:p<w38e.".jx'RDgpji48RgexRCv'x'8,",:;:,'RE&i'.';i&'ggset,'::i';.kpgi~C'h@

p3 an0'::,',.,"':epazgipiy,:,:..':;::,:,i';-..'.a'ih;e','::,;;ident'::9.':iigmey:,':,::,'pip'ei" AWNVNhhlKWA'AA'lYAANN'VIMN&VVAA'rNYwWh'h~CRVNhN~RNViNMYAAY'drM5:hhyhhhYMYShAVNAYNYNNV'O'Y'iK4I'~M(NN h

h Y

h ' '+W VPPVWAVNl.%WPVPP+WhVAWg((gV+PQVAVhW~AYl~P'gWhVA~YAhVVPWAVV~YYhV' V ' ~%W YVAA' '++++)%~hg+hhYAY

'hh'C XW hg'!'gl'Rx'x;,Oval,i':g'GD9@:&,",,t%@@@Bc'gEp'8!::,'i+x@gcBpikppi@':

pz.";

TAVE,Pirij'::":.',

5 '!gXQV3i'C184!gllX8811QS",i!XP'!Ut'2!t3!gR't311i'::t'hEtg!O'Q113'PEBDti':":

'OX! QX..itQY,!"::CQQ'iA'QQ":

QMIi",.

Page 25 of 45

GROUP B

Service Water Isolation Valves (4613,

4614, 4663,

4664, 4773)

Valves 4614 and 4664 (Turbine Building isolation valves) and 4663 and 4733 (control room chiller isolation valves) are assumed to fail open (their normal position) because the valve operators and their cabling are located in an area of concern.

Analysis shows that even assuming block wall induced leakage in the Intermediate Building, the service water system will'be capable of performing its intended function.

Valve 4613 is also a Turbine Building isolation valve to the non-safety service water loop.

Its power and control cables are routed through an area of concern.

Consequently, should all the block wall susceptible service water isolation valves be rendered inoperable, those failures must be recognized and manual leak isolations performed prior to exceeding diesel generator temperature operating limits.

Page 26 of 45

Specifically, although the service water leak isolation procedure, AP-SW.1 and attachments, direct appropriate operator action to mitigate this issue the procedure does not specifically account for the effects of block wall failure.

Zt is important to note that the analysis (Ref. 1.6.6) examining the possible service water flows utilizes a value of 320 gpm for required D/G flow.

During the block wall failure scenario the required flow to preclude overheating the D/G will be lower than 320 gpm.

This is because the reduced electrical load on the D/G will cause a corresponding reduction in the amount of cooling water needed to prevent D/G overheating.

Because the service water system non-safety loop isolation valves may lose remote operability, and because the service water leak isolation procedures require operator action this issue wai included on the outliers list for possible proceduraX or equipment enhancement.

Main Steam ARVs (3410 and 3411)

The control cables for these valves are routed in areas of concern.

The air and nitrogen mode of force for remote operation is also located in areas of concern.

Although the valves are susceptible to mispositioning should a control circuit short occur, and remote mode of force survive, it is assumed that to achieve safe shutdown they are manually operated.

Because the valves may inadvertently open, plant operators might be compelled to manually close them before they would normally be dispatched to the area for local operations.

This could have the potential of conflicting with other operator activities that might be necessary at the time.

Thus, although these valves are credited for manual operation, they ice included on the outlier list for possible enhancement.

Page 27 of 45

Turbine Driven Auxiliary Peedwater Pump Steam Admission Valves (valves 3504a and 3504b)

These valves are included in the SSEL as main steam pressure boundary components.

They represent an issue because they receive an open signal on receipt of a UV on Buses 11A and 11B.

Should the valves start to open before the block wall fails, upon block failure, the valves might lose their power or control cabling rendering them electrically inoperable (open, incapable of remote closure)

The result might be actuation of the TDAFW pump (not an SSEL device).

The consequences of this could be failure of the pump if the plant operators cannot establish recirculation flow and a

minor increase in the cooldown rate from the increased steam exhaust flow.

The repercussions of this failure are not significant as all the SSEL functions can still be achieved and the valves in all likelihood could be manually closed.

Closing them is desired for both long term cooldown control and to improve the Intermediate Building habitability (there will be minor exhaust steam leaks in the Intermediate Building lower elevations)

Because the valves may inadvertently open, plant operators might be compelled to manually close them before they would normally be dispatched for local operations.

This could have the potential of, conflicting with other operator activities that might be necessary at the time.

Thus, although these valves can be manually operated, they will be included on the outlier list for possible enhancement.

Blowdown Isolation Valves 5737 and 5738 These valve are susceptible to mispositioning should a

control cabling short occur and the remote mode of operating force (IA) survive.

Although the valves are not required to achieve safe shutdown blowdown isolation will be desired for temperature control during the cooldown process.

These valves or several downstream valves could be manually closed to achieve the preferred results.

Because these valves may transition to an unexpected position and because mitigating that transition would require manual operator action the valves pete included on the outliers list for possible enhancement".

Page 28 of 45

Blowdown Sample Isolation Valves 5735 and 5736 These valves are susceptible to mispositioning should a

control cabling short occur and the remote mode of operating force (IA) survive.

The downstream piping associated with these valves is very small (3/8 inch) and the consequences of their mispositioning with respect to cooldown negligible.

Diagnosis and resolution of this issue is within the normal skill set of plant staff.

This issue is considered minor and hence the outlier is to formally make staff aware of the condition, and for the staff to examine the need to modify procedures to account for this case.

Pressurizer Heater Backup Group (PHGB)

The heaters have a remote control station in the intermediate building.

The station contains control power to the heaters power supply breaker.

An open in this circuit would render the breaker incapable of remote operation.

Approximately six hours after seismic safe

shutdown, assuming no forced RCS flow, 100 kw of PZR heaters will need to function to facilitate natural circulation in the RCS.

The plant reconfigurations necessary to achieve this are manually performed (normally in the natural circulation cool down and station blackout procedures).

The loss of the heater supply breaker control is not judged to be significant because the breaker can be made operable by simply removing its control power fuses and manually closing it.

Diagnosis and resolution of this issue is within the normal skill set of plant staffs This issue is considered minor and hence the outlier is to formally make staff aware of the condition and for the staff to examine the need to modify procedures to account for this case.

~Vow Y 'IVNdh%V'AChV@hVW(4ww%%hNhS~WN%4%4CY YI4$

g'l'gQp:: Qf"::.a+gf'@vgn9j@qugpme+Q "4/+call(

Page 29 of 45

'~gjj~ggq ~joe>>>>jjg>gclgjj~og~"P('Pgc~y~gg jjg~y%ziygjj'~g

'; XeFigfcihRPCR",,9'8~'02t>%Tahe s~elflie'>>

,',11y s:!:.".",:...,,y,:,-,;:;,:;:::*;~i!,;:,.;,-~y,"...,, ',RR!'1tgBI

%fck( @%5fxv8."%05. 'P~llg,";:.c>pBgR4528.:;""~Qf~":;.458@<QLQQp~g%

ppO'88;,

'4"',;".,'>> '883'8A, "~i @pipe.OV,'8<~."~: '.

OQ'C'8";>"'. 'A...,';%: ",. ':,',QS; .Ag~<,;. i '8

+<QCks~<b4s o(sf~Aj(~i~$4(cN~A ~@~~%,~)4K.

-'~-Ajb~<<(kp"'aP~p%4"+5<>j'j'ji'I,-'!'-"'i "alii"""~)""""::-"i""i'!'-"-""':",'---"

8~v 'd8@%ht 8x'".'o':XVtio&:;.Vh'X'.%@8; iihgi~egi"aaa~~eorissyp,sn,oas;.,:,eg:,'etio-:;.";

pogjintXai.:,

Saba~'iiVi1VjiV~i':<<"v'a1%>>iass'iiic ta~'li%ii%i'oil:::::i%~V8fiiatpSy~th's'Wlos s

s a

a <<>>

a a>>

ad'i'),"'d'igni'sFig 'a st!!p'1aiig+jop'a'aa'0!ci ill,',:s'>>)agatha'a'p'jsbsi5:""

a'aop~aOqx!a'asI',,;."*'aasR;.".Lo@!l'cApi~appx'oap'xp,'av',,

'i';st'aC4ga'c@llg Ra;i~e. 84eae

>%%vs,,'.:.-:,l8.,4$ ~0~wnc~s4p<fpajidP%mage~;sr

'.veu L"':sinai,::"

a:'i'~".::i':,'-'i!"::"":,-::-:::-":a4-'a-,--,"i'.::-"':i:.:,:-'-'-i!:*'er:

'~@

w'~@~~~~.~.~.::Q$ ~wama>>k'>>u>>a' svAma~@m'::.a'>>'>>

a K'ot"."a~l<iidR'hosti3,;i',!-;eriy'tgiiimi pi'. iso'>> 'jjs4k'xiii:iiifoik'aa'jaj'in'g:'::,it'ih.'skii'ui~i;-

gxiv4om6',.,Xsi,l'otioo; <<vaxviig<~('sg37;:~~in'4g89@8)g<e'i' ";.sxovlovo Page 30 of 45

RG&E's commitment to resolution of Generic Letters 87-02 (SQUG) and 88-20 Supplement 5

(IPEEE) requires that additional criteria for block wall interaction vulnerability be met.

The issues that are outside our CLB or that do not have a suitably rigorous (using GIP criteria) analytical resolution were incorporated into the outlier resolution plan.

EQUIPMENT SELECTION CRITERIA Figure 1 provides an overview of the selection criteria which was used.

Details are provided below:

~

Reactivity Control Page 31 of 45

Negative reactivity is initially added by the insertion of control rods.

The reactor protection system, which includes the reactor trip breakers, initiates control rod insertion into the reactor core.

This system has numerous actuation signals that may be received during a seismic event or may be enabled'manually.

Control rods are also inserted on loss of power to the rod control system (rod drive motor generator deenergization) even if the reactor trip breakers remain closed.

The rod position indication system can be used to monitor rod position.

The Chemical and Volume Control System (CVCS) is necessary to inject boron into the Reactor Coolant System (RCS) to offset the positive reactivity addition caused by RCS cooldown and xenon decay.

Borated water is injected from the Refueling Water Storage Tank (RWST) to the primary system via reactor coolant pump seals or through AOV-392A.

The preferred 'path is through the seals since AOV-392A fails closed on loss of control power.

The AOV is a viable pathway however as it acts as a relief valve to the RCS on high differential pressure.

Analysis has shown that one charging pump on its minimal speed setting, taking suction from the RWST can provide sufficient negative reactivity to transition from hot to cold shutdown (Ref. 1.6.3).

Alignment of the RWST to the CVCS system requires manual operator action.

The volume control tank (VCT) must be isolated and the RWST valved into the charging pump suction piping.

The negative reactivity worth of the boron in the RWST water will not be= required until about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> post trip (UFSAR Section 3.A.4.2.1),

thus allowing ample time for system realignments.

Reactivity control is monitored by measuring boron concentration, RCS cold leg temperature, verifying rod insertion and, if available, neutron count.

~

Reactor Coolant Pressure Control Reactor coolant pressure Control is necessary to maintain RCS thermal hydraulic limits within design specifications and to avoid reactor vessel b=ittle fracture failures.

Primary pressure control is also necessary for maintenance of subcooling margins sufficient to promote natural circulation through the RCS and to avoid excessive differential pressures across the steam generator U-tubes.

Page 32 of 45

Primary pressure is controlled by limiting volume losses to the RCS (see reactor coolant inventory control) and through the use of pressurizer heaters and power operated relief valves (PORVs).

Pressurizer spray flow may not be available due to the loss of instrument air and/or the loss of forced RCS flow.

100 kw of pressurizer heater availability compensates for pressurizer heat loss and is necessary to maintain optimum conditions for natural circulation in hot shutdown conditions (assuming loss of forced RCS flow).

This is required to be available within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (Ref.

1.6.2) which provides ample time for operator action.

Power operated relief valve operation may be necessary during RCS cooldown to cold shutdown, depending on how rapidly the operators choose to cool the RCS.

If a loss of offsite power occurs such that pressurizer spray is unavailable, the PORVs are expected to be challenged following a reactor trip (UFSAR Figures 15.2-13 and 15, ~ 2-14).

However, there will be no challenge to the pressurizer safeties.

It is also noted that failure of the PORVs to liftwill not lift the safeties due to the available pressurizer steam volume (i.e.,

success of the PORVs to automatically lift is not required).

Reactor coolant pressure control is monitored by measuring pressurizer level, RCS pressurizer pressure and RCS temperature.

~

RCS Inventory Control Reactor coolant inventory control is necessary to support decay heat removal.

Inventory control is initially accomplished by the isolation of all CVCS letdown pathways.

RCS inventory is lost due to normal

leakage, reactor coolant pump seal return and shrinkage due to cooldown.

These losses can be recovered by the use of charging from the CVCS system which has been previously identified as used for reactivity control.

The CVCS system is the preferred system for inventory control because RCS pressure post reactor trip is greater than the shutoff head of the safety injection pumps.

As with reactivity control, inventory control is accomplished by injecting water through RCP seals.

One charging pump operating at its minimum speed should maintain pressurizer level at 15% assuming worst case RCS inventory loss (Ref. 1.6.3).

With no air available a charging pump delivers 15 gpm.

Page 33 of 45

0

Should RCP seal return isolation be necessary to maintain RCS inventory, the preferred isolation is at manual valves 293A and 293B located in containment outside the missile barrier (OMB).

This is because if isolation is achieved using MOV-313, relief valve 3'14 may lift, allowing fluid flow through the RCP Nl seal to the pressurizer relief tank, thus removing inventory from the RCS.

If the reactor trip was caused from loss of offsite power or loss of external load the subsequent pressurizer insurge may cause the pressurizer PORVs to actuate (UFSAR Section 15.2).

Should a

PORV actuate then fail to reseat, operators must close the associated block valve to ensure RCS inventory control.

It is important to note that with letdown to the volume control tank (VCT) isolated only a limited amount of charging water is available before charging pump suction realignment to the RWST is required.

If the VCT level is 30% immediately after reactor trip operators will have approximately 30 minutes to accomplish the swap over if one charging pump is in use.

With a capacity of 1500 gallons, operators will lose one minute off the time line for each percent the initial VCT level is reduced at time of reactor trip.

RCS inventory control can be monitoxed by pressurizer level indication (assuming subcooling is maintained)

~

Decay Heat Removal Decay heat removal is necessary to remove sufficient sensible and fission product decay heat energy from the RCS such that RCS pressure and temperature are maintained within design limits ~

Initially, following reactor trip decay heat will not be removed using heat transfer across the steam generators.

Feedwater and auxiliary feedwater may not be available as a cooling water source due to damage to components caused by intermediate building block wall failures.

RCS temperature will not be readily decreased because of the limited heat sink capability of -the main steam safeties (their setpoint of 1085 psig corresponds to an RCS temperature of 556'F) and the lack of an automatically supplied seismic source of cooling water.

Page 34 of 45

To achieve long term decay heat removal and cooldown the Standby 'Auxiliary Feedwater System (SAFW) must be placed in operation supplying service water to the secondary side of the steam generators.

The main steam atmospheric relief valves (ARVs) will need to be manually operated (there is no seismically qualified mode of force available) to reduce steam generator pressure.

Cooldown to hot shutdown, the removal of decay heat at hot shutdown, and the transition towards cold shutdown will be accomplished through careful steam generator inventory and pressure control using SAFW and the ARVs.

In order to maintain a controlled cooldown rate it may be necessary to perform manual operation of some main steam valves.

Long term operation of the SAFW system requires SAFW building cooling when the outside air temperature is 80'F.

The transition to cold shutdown may also require the use of pressurizer power operated relief valves (PORVs) to maintain RCS pressure/temperature limits within allowable bands.

The PORVs have a

seismically qualified mode of force available allowing them to be remotely operated as necessary.

Decay heat removal can be monitored by measuring RCS temperature and steam generator level apd',::~stan68$ '.':(auÃilii~

'Q'@

wag'i&/,:'"i."",:

Q%',"::

~

Support Functions Service Water (SW) is necessary to supply essential cooling to the emergency diesel generators, required equipment HVAC coolers, and as a water source for SAFW.

The service water headers are normally operated cross connected with at least one pump in each header being supplied vital power.

On loss of offsite power SW flow will be temporarily interrupted as the emergency diesel generators pick up on the vital buses after the undervoltage.

Should the non-seismic portions of the service water system be damaged by the event operators will trouble shoot and isolate the affected area per procedure AP-SW.1.

A portion of the safety related service water system could be impacted by Intermediate Building block wall failures.

This includes the motor operated valves which isolate the non-safety service water loop from the safety loop.

Page 35 of 45

Because the valves may not reposition to provide isolation, an analysis was performed to verify sufficient flow would be provided to the necessary SSEL equipment.

The analysis, reference 1.6.6, showed that adequate service water flow margins exist to achieve safe shutdown.

It is important to note that in some cases manual operator actions will be required.

The analysis also accounted for the assumption that several small bore leaks would develop within the seismic boundary.

This was done to account for the potential for falling blocks shearing or cracking small bore instrument lines, vents,

drains, etc.

Emergency Power is supplied to safe shutdown equipment from the emergency diesel generators and the vital batteries.

4.0 EVENT MITIGATIONMETHODOLOGY OVERVIEW At event onset plant operators will respond through procedural compliance to whatever plant symptoms are presented.

Should a seismic event be reported to the plant, or the plant seismic monitor alarm, operators will respond using ER-SC.4, "Earthquake Emergency Plan".

"oxoxxo.ooxxoxoxxog~Cmo>>.co.cXo~ooXoxc xcoXoxoxOxoxco~cxccoXoxoxoxco coxoxoxxoooxcoix Zo...x~wxcooOcoxcom T'e::,:::.::;',:equi-:;.iriquait.'.':,,i,:emsrgencjj)g'ijxi';."'prxpv.;z aej '",opei;aiais mt': gaC::::i',';;-:'.::-:: 'o'se:. 'e; ace.i;--;-':',i'hould a reactor trip occur or be manually initiated due to an alarm response the process for event mitigation will be driven primarily from ES-0.1, Reactor Trip Response.

Assuming Intermediate Building Block wall failures disable Auxiliary Feedwater, operators will recognize the loss of heat sink and will utilize F-0.3, Heat Sink, which will direct them to FR-H.1,

Response

to Loss of Secondary Heat Sink.

FR-H.1 will establish Standby Auxiliary Feedwater Flow and return them to ES-0.1.'f instrument air (IA) was lost (due to either block wall failure or loss of offsite power) the MSIVs fail closed.and RCS temperature must be maintained by manual operation of the main steam ARVs.

Page 36 of 45

Operators will ensure vital buses are powered and attempt to restore the normal minimum equipment group required for plant control (CCW, IA, SW, etc.).

Note:

Although CCW should remain operable through this event it is not relied upon to achieve safe shutdown

'ost seismic event.

Because IA may not be functional operators will establish charging flow from the RWST through the reactor coolant pump seals using the B or C charging pump.

If neither of the preferred charging pumps are available (due for instance to EDG B failing to start) plant operators must recognize that charging pump A can be started and aligned to the RWST using the methodology detailed in the fire emergency response procedures.

If IA has failed, letdown will not be available.

Loss of offsite power will trip the RCPs.

Because of no forced loop flow, or because of spray valve failure on loss of IA, pressurizer spray flow may not be available.

Pressurizer pressure control must be maintained via pressurizer heaters and/or PORVs with the letdown flow path from RCP seal return.

Reactivity control using borated water is accomplished through RCP seal injection.

The seal injection also maintains seal cooling thus preventing seal failure should thermal barrier (CCW) cooling not be available.

Should Nuclear Instrumentation fail due to loss of ventilation ER-NIS.l, SR Malfunction, directs RCS boron concentration sampling to verify shutdown margin.

As RCPs may have tripped (due to loss of offsite power, or manually due to loss of cooling) core cooling must be maintained through natural circulation.

ES-0.2, Natural Circulation Cooldown, will be performed without reactor head cooling.

Should the shroud fans be disabled or not have electrical power available, ER-PRZR.l, restoration of pressurizer heaters during station blackout, will be used to prevent loss of subcooling.

While operators are controlling plant decay heat removal and cooldown the shift supervisor will be classifying the event using EPIP 1-1.

As a minimum an

'nusual Event will be declared and additional staff will respond to provide help in problem recognition and equipment restorations.

Page 37 of 45

5.0 5.1 GENERATION OF SAFE SHUTDOWN EQUIPMENT LISTS (SSEL)

Composite SSEL Having established the functional and procedural basis for deriving a SSEL, piping and instrumentation drawings were reviewed to establish the functional trains required for the SSEL data base.

The SSEL data base was developed through an integrative process whereby the devices which constituted the functional paths were investigated for interaction with other plant equipment.

The associated equipment identified was related to the device under investigation.

For example, if the functional path intersects an MOV then that MOV was investigated to determine:

What equipment exists in support of its control and power scheme, if it remains operable, if it operates inadvertently, if it maloperates is the resulting condition acceptable?,

etc.

The compilation of the results of this investigation is maintained in the SSEL data base.

It is important to note that all the fields required to be investigated by the GIP are included in RGRE's SSEL database.

However, not all of the fields are displayed in the attachments contained in this document.

The composite SSEL, Attachment I, details all the equipment necessary to provide all of the safe shutdown functions described in the GIP (all equipment subject to seismic or relay review).

5.2 Attributes of the Composite Safe Shutdown Equipment List SSEL, Attachment I, by Field:

1)

TR (Train)

- System train A, B, or X (shared) 2)

CL (EQUIP CLASS)

- The SQUG equipment class from Table 3-1 of the GIP 3)

EIN - The plant equipment unique identification number

4) -

DESCRIPTION The plant nomenclature fo= the EIN 5)

DRAWING - Plant process PAID associated with the EIN under review (not valid for racks,

panels, or enclosures) 6)

BLD -

Building where component is located Page 38 of 45

7)

EL - Height in feet (with respect to sea level) of closesh floor to component 8)

EVAL - Describes the evaluation type per the GIP R - RELAY, S

SEISMIC, SR - SEISMIC 6'c RELAY, ROB RULE OF BOX, IR -

INHERENTLY RUGGED, NSSS NUCLEAR STEAM SYSTEM SUPPLIED, NV NOT VULNERABLE 9)

BOX - The associated unit with which the EIN under review was seismically evaluated 10)

Functional Reqm't The state or condition the SSEL boundary component must achieve or maintain 11)

Power Required

- Yes if power is required to support safe shutdown function 5.3 SSEL for Seismic Review 5

~ 4 Attachment II, the SSEL for seismic review, is the list of components requiring seismic review.

This list is a subset of the Composite SSEL and includes only those items for which a seismic review is necessary.

The descriptions of the data fields provided are the same as those in the SSEL.

il SSEL for Relay Review Equipment on the seismic review SSEL which is electrically controlled or powered could be affected by a relay (switch or contact) malfunction.

Likewise, powered SSEL functional boundary equipment may receive a spurious signal causing a misoperation which effects or negates a safe shutdown function.

Consequently, all equipment subject to the above was researched to ensure its safe shutdown function would be preserved.

Relays associated with the functioning of SSEL equipment are considered essential relays.

Attachment III, the SSEL for Relay Review, details the equipment selected for relay review.

The field descriptions are the same as in the SSEL.

An additional field is displayed, Required Function, that describes the operation which must be preserved or avoided.

The methods utilized for the relay evaluation are as described in the GIP.

Page 39 of 45

RELAY EVALUATION REPORT (QQ+aJgg('gpQQQ@QQQ'Qyg(

g'2:8Q~QQQ ~essex/+$

%@nd "7

'e858YiCX'43; )"::%78$8@XWRi@k%'85-"'6o>> Bi~a8's6ci:: '5 '8 "::NP may"b*e associ:aE'ed'o one or mo'e O'SEL'omponents.

Relays associated to multiple components vere classified as essential or non essential for each component.

Relay classification depends upon the impact of contact chatter to the specific safe shutdown function of each associated component.

The list of both non-essential and essential relays is smaller for Ginna Station than most other plants.

This is attributed to design characteristics of the electrical distribution system.

Specifically, the fact that Ginna has 480 volt safety buses and emergency generators.

The number of relays associated with 480 volt buses is significantly less than would be associated with 4KV buses and emergency generators.

This section identifies the results from the functional screening of relays which affect components on the relay review SSEL.

The folloving documentation is provided as specified by GIP Sections 6.7'and 9.0.

~

Relay reviev SSEL (Attachment III to this report)

~

List all 1360 A-46 relays (essential and non essential) identified as supporting relay revj.ew SSEL components (Attachment IV to this report).

Condensed list of all essential relays associated, with components on the relay review SSEL (Attachment V to this report).

II

~

List of cabinets/panels which house essential relays (Attachment UI to this report).

The above lists are attached to this report.

Documentation of relay evaluation was accomplished via the use of a computerized database.

The lists are computer generated reports extracted from this database.

Although not identical to the suggested format of EPRI NP-7148 Form G.4, the overall content of these list's and data sheets follows suggested guidelines.

Cumulatively, these lists provide all necessary data to create a complete and auditable record of the relay evaluation for USI A-46.

Methodology Utilized for Relay Evaluation Page 40 of 45

As part of the resolution of A-46, it is necessary to perform a relay seismic functionality review.

The main purpose of this review is to determine if the identified safe shutdown equipment could be adversely affected by relay chatter or failure during an SSE.

A seismic adequacy evaluation is required for relays for which it has been determined that malfunction is unacceptable.

The methodology utilized at Ginna Station to perform the relay evaluation was similar to that described by section 6,

"Relay Functionality Review,"

of the Generic Implementation Procedure, "Seismic Verification of Nuclear Plant Equipment,"

and EPRI report NP-7148-SL, "Procedure for Evaluating Nuclear Power Plant Relay Seismic Functionality."

No significant or programmatic deviations were made from GIP methodology.

The process utilized in performing the relay evaluation is as follows:

1)

A Safe Shutdown Equipment List of equipment that must be evaluated for a relay review was developed (Attachment III).

This list of equipment is based on (1) active electrically controlled or powered safe shutdown equipment whose function could be adversely affected by relay malfunction and (2) inactive safe shutdown equipment for which relay malfunction could cause un-acceptable spurious operation.

2)

Plant electrical drawings of the circuits associated with the above 'safe shutdown equipment was used to identify relays that need to be evaluated for potential malfunction.

The following assumptions were utilized in establishing the scope of the relay review:

a.

Relays will not be damaged by the earthquake, with the exception of fragile relays.

b.

Unqualified relays are assumed to chatter during the short period of strong motion during the earthquake.

c.

Solid-state relays and mechanically actuated switches are considered to be seismically rugged and need not be evaluated for contact chatter.

Page 41 of 45

3)

Relays whose malfunction will not prevent the achievement of any safe shutdown function and will not cause unacceptable spurious operation of equipment are designated as "non-essential" and do not need further review.

The seismic adequacy of the remaining "essential" relays is required.

6.2 6.2.1 Seismic Screening of Essential Relays The seismic adequacy of the relays designated as "essential" is performed in Section 4 of the "USI A-46 Seismic Evaluation Report", prepared by Stevenson Associates for Ginna Station.

6.3 Relay Walkdown and Mounting Spot Checks 6.3.1 A relay walkdown was conducted at Ginna to perform spot checks for relay mounting.

During this review a sampling of relays were spot checked.

The overall results of these spot checks determined that relays were mounted acceptably.

The performance of walkdowns under EWR-4777, "Electrical Control Configuration Drawing Upgrade" ensures that the relay manufacturer and model number utilized in the evaluation of essential relays is accurate.

6.4 Explanation of Relay Evaluation Reports 6.4.1 6.4.2 This section will briefly explain the form'at of the computer generated lists that are attached to this report.

The lists provided are consistent with the list defined by the "SSEL Report" guidelines from Section 9 of the GIP.

To provide for consistency and ease of review, all report computer generated lists are sorted by equipment identifiers, in ascending order.

"Relay Review SSEL",

(Attachment III):

~

Main Equipment Identifier - equipment identifier for each SSEL components The identifiers are consistent with the Ginna Station CMIS database.

~

Description - Component description consistent with the descriptions in the Ginna Station CMIS

'database.

Safety Train - System train A, B, or X (undefined or shared).

Equipment Class

- The SQUG equipment class assigned from Table 3-1 of the GIP.

Page 42 of 4S

~

Drawing-The reference drawing that details the specific SSEL component.

~

Building - The building in which the SSEL component is located.

"USI A-46 Relays",

(Attachment IV):

This is an overall list of all 13'60 relays (essential and non essential) identified as supporting relay review SSEL components.

The following specific fields are provided in this list:

~

Main Equipment Identifier - equipment identifier for each SSEL components The identifiers are consistent with the Ginna Station CMIS database.

~

Relay Identifier - The specific identifier associated with the individual relay.

The identifiers are consistent with the Ginna Station CMIS database.

~

Relay Class SQUG methodology considers any device with electrical contacts to be a relay.

This field provides a generic type identifier to further define each relay by functional characteristics as follows: Auxiliary Relay, Protective Relay, Control Switch, Contractor, Operator Contact (limit switches, overload

contacts, etc) or Pneumatic Switch (pressure

switches, etc).

~

Essential

- This field identifies if the relay is determined to be "essential" (Yes), or "non-essential" (No).

1

~

Relay Location - The rack, panel, or assembly in which the evaluated relay is located.

If designated as "field", the relay is a field mounted component.

Eval Type - This field designates the results of the review performed on function of the A-46 relays'his field is designated as either "CA" (chatter acceptable) or "NV" (not susceptible to chatter) for non-essential relays.

Relays that are determined to cause unacceptable operations if they chatter are designated "CS".

These relays are considered "essential" and require a seismic review.

Page 43 of 45

~

Reference Drawing - The applicable drawing used to screen and classify relays.

"Condensed List of Essential Relays",

(Attachment V):

This is a list (sorted by rack/panel) of 71 essential relays.

No low ruggedness relays were identified in the population of essential relays.

The following specific fields are provided in this list:

Main Equipment Identifier - equipment identifier for each SSEL component.

The identifiers are consistent with the Ginna Station CMIS database.

Relay Identifier - The specific identifier associated with the individual relay.

The identifiers are consistent with the Ginna Station CMIS database.

Relay Class SQUG methodology considers any device with electrical contacts to be a relay.

This field provides a generic type identifier to further define each relay by functional characteristics as follows: Auxiliary Relay, Protective Relay, Control Switch, Contractor, Operator Contact (limit switches, overload

contacts, etc),

Instrument Contacts, or Pneumatic Switch (pressure

switches, etc).

Low Ruggedness Relay - This field identifies if the evaluated relay is a low ruggedness relay.

The field is identified as "Yes" if the relay model number (and contact configuration where applicable) are identified in Appendix E of EPRI Report NP-7148-SL as being low ruggedness.

Essential

- This field identifies if the relay is classified as being essential "Y", or non-essential, "N".

Relay Location - The rack, panel, or assembly in which the evaluated relay is located.

If designated as "field", the relay is a field mounted component.

Page 44 of 45

~

Eval Type - This field designates the results of the review performed on function of the A-46 relays.

This field is designated as either "CA" (chatter acceptable) or "NV" (not susceptible to chatter) for non-essential relays.

Relays that are determined to cause unacceptable operations if they chatter are designated "CS".

These relays are considered "essential" and require a seismic review.

In specific cases the relays contact type is included if required to perform the seismic evaluation (DE/NO indicates de-energized, normally open contact).

~

Manufacturer and Part Number - Relay model and part number.

"List of Panels Containing Essential Relays",

(Attachment VI):

This is a listing of SSEL panels that contain essential relays.

Plant locations for all essential relays are summarized by this list.

The following specific fields are provided in this list:

~

Panel/Cabinet Equipment Identifier - The identifier for each Panel/Cabinet that contains essential relays.

The identifiers are consistent with the Ginna CMIS database.

~

Building - The building the Panel/Cabinet is located.

Elevation - The elevation that.the Panel/Cabinet is located.

Location - The column/row that the Panel/Cabinet is located.

Page 45 of 45

'P

ATTACHMENTA CIRCUITS OF CONCERN

Equipment Evaluated for Blockwall Concerns 30Jan-97 EIN 110B 112B 123 142 200A 200B 202 270A 270B 294 296 310 312 313 3410 3411 350 3504A 3505A REQUIRED FUNC ION NORMALLYCLOSED, MUST REMAINCLOSED (FAILS CLOSED ON POWER AND IA)

NOT REQUIRED, VALVEFAILS CLOSED, NEED IT OPEN, VALVE358 MUST BE MANUALLYOPENED NORMALLYCLOSED, MUST REMAINCLOSED (CLOSES ON LOSS OF IA OR POWER)

NOT REQUIRED, VALVEFAILS OPEN, NEED ISOLATION, VALVE286 WILLBE USED INSTEAD NORMALLYCLOSED, MUST REMAINCLOSED (CLOSES ON LOSS OF IA OR POWER)

NORMALLYOPEN, MUST GO CLOSED (CLOSES ON LOSS OF IA OR POWER)

NORMALLYCLOSED, MUST REMAINCLOSED (CLOSES ON LOSS OF IA OR POWER)

DESIRED ISOLATION, HOWEVER VALVEFAILS OPEN ON LOSS OF INSTRUMENTAIR DESIRED ISOLATION, HOWEVER VALVEFAILS OPEN ON LOSS OF INSTRUMENTAIR NORMALLYOPEN, MUST CLOSE, FAILS CLOSED ON LOSS OF POWER OR IA NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER OR IA NORMALLYCLOSED, MUST REMAINCLOSED (CLOSES ON LOSS OF IA OR POWER)

MUST REMAINAILGNEDTO SEAL RETURN, NORMALLYALIGNED,FAILS ALIGNEDON LOSS OF POWER OR IA NORMALLYOPEN, MUST CLOSE (BACKUP MANUALVALVESARE 293A & 293B)

MUST NOT FO, NC AND FC ON LOSS OF POWER OR IA, CAN BE USED WITH MANUALOPERATION (ARV)

MUST NOT FO, NC AND FC ON LOSS OF POWER OR IA, CAN BE USED WITH MANUALOPERATION (ARV)

NORMALLYCLOSED, MUST REMAINCLOSED (COULD OF USED CHECK VALVE351)

MUST REMAINCLOSED, OPENS ON LOSS OF POWER TO BUS 11A & 11B, MANUALCLOSURE REQUIRED MUST REMAINCLOSED, OPENS ON LOSS OF POWER TO BUS 11A & 11B, MANUALCLOSURE REQUIRED

EIN 3516 3517 371 386 392A 392B 4013 4027 4028 4609 4613 4614 4615 4616 4663 4664 4670 4733 4734 4735 4780 515 REQUIRED FUNCTION NORMALLYOPEN, MUST CLOSE (FAILS CLOSED ON LOSS OF POWER OR IA)

NORMALLYOPEN, MUST CLOSE (FAILS CLOSED ON LOSS OF POWER OR IA)

NORMALLYOPEN, MUST GO CLOSED (CLOSES ON LOSS OF IAOR POWER OR CI SIGNAL)

NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER OR IA NORMALLYCLOSED, MUST REMAINCLOSED, PAILS CLOSED ON LOSS OF POWER OR IA NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER OR IA NORMALLYCLOSED, MUST REMAINCLOSED NORMALLYCLOSED, MUST REMAINCLOSED NORMALLYCLOSED, MUST REMAINCLOSED MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATIONIS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATION IS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATIONIS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATIONIS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATION IS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATIONIS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATIONIS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATION IS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATION IS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOLATIONIS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLATIONVALVE(INADVERTANTISOIATION IS ACCEPTABLE)

MUST OPEN AND CLOSE, SW ISOLA/IONVALVE(INADVERTANTISOLATIONIS ACCEPTABLE)

NORMALLYOPEN, MUST BE ABLETO OPEN AND CLOSE

EIN 516 52/14 52/16 52/17 52/18 52/EG1A1 52/EG1A2 52/EG1B1 52/EG1B2 52/MCC1C 52/MCC1D 52/RTA 52/RTB 526

.527 539 548 5735 5736 5737 5738 592 REQUIRED FUNCTION NORMALLYOPEN, MUST BE ABLETO OPEN AND CLOSE OPEN ON LOSS OF OFFSITE POWER OPEN ON LOSS OF OFFSITE POWER OPEN ON LOSS OF OFFSITE POWER I

OPEN ON LOSS OF OFFSITE POWER CLOSE TO PROVIDE POWER FROM DIESEL GENERATOR A CLOSE TO PROVIDE POWER FROM DIESEL GENERATOR A CLOSE TO PROVIDE POWER FROM DIESEL GENERATOR B CLOSE TO PROVIDE POWER FROM DIESEL GENERATOR B REMAINCLOSED TO PROVIDE POWER TO MCCC REMAINCLOSED TO PROVIDE POWER TO MCCD BREAKER MUST OPEN TO TRIP REACTOR BREAKER MUST OPEN TO TRIP REACTOR NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER OR INSTRUMENTAIR NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER OR INSTRUMENTAIR NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER OR INSTRUMENTAIR NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER OR INSTRUMENTAIR NORMALLYOPEN, MUST CLOSE (FAILS CLOSED ON LOSS OF IA OR POWER)

I NORMALLYOPEN, MUST CLOSE (FAILS CLOSED ON LOSS OF IAOR POWER)

NORMALLYOPE f4, MUST CLOSE (FAILS CLOSED ON LOSS OF IAOR POWER)

NORMALLYOPEN, MUST CLOSE (FAILS CLOSED ON LOSS OF IAOR POWER)

NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER

EIN 593 700 721 856 8603A 8603B 8616A 8616B 8619A 8619B 8620A 8620B 896A 896B 897 898 90/MCCC 90/MCCD 951 953 955 9629A REQUIRED FUNCTION NORMALLYCLOSED, MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF POWER NORMALLYCLOSED, MUST REMAINCLOSED (Breaker open)

NORMALLYCLOSED, MUST REMAINCLOSED (Breaker open)

NORMALLYOPEN, IIJIAYNEED TO BE MANUALLYOPERATED CLOSED MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF IA OR POWER MUST REMAINCLOSED, FAILS CLOSED ON LOSS OF IA OR POWER NORMALLYCLOSED, MUST OPEN ON DEMAND(NITROGEN FEED)

NORMALLYCLOSED, MUST OPEN ON DEMAND(NITROGEN FEED)

MUST ISOL NITROGEN, MUST OPEN TO PORV ON DEMAND MUST ISO NITROGEN, MUST OPEN TO PORV ON DEMAND NORMALLYCLOSED, FAILS CLOSED, MUST NOT FAILOPEN NORMALLYCLOSED, FAILS CLOSED, MUST NOT FAILOPEN NORMALLYOPEN, MAYNEED TO CLOSE NORMALLYOPEN, MAYNEED TO CLOSE NORMALLYOPEN, MAYNEED TO CLOSE NORMALLYOPEN, MAYNEED TO CLOSE MUST CONDUCT CURRENT AND PROVIDE FAULTCURRENT LIMITING MUST CONDUCT CURRENT AND PROVIDE FAULTCURRENT LIMITING NORMALLYCLOSED, MUST REMAINCLOSED (FAILS CLOSED ON LOSS OF POWER OR IA)

NORMALLYCLOSED, MUST REMAINCLOSED (FAILS CLOSED ON LOSS OF POWER OR IA)

NORMALLYCLOSED, MUST REMAINCLOSED (FAILS CLOSED ON LOSS OF POWER OR IA)

NORMALLYCLOSED, MUST OPEN, STAY OPEN

9629B 9632A 96328 966A 966B 966C 9701A 9701B 9703A 97038 9710A 9710B 9746 ACPDPAB10 ACPDPAB11 ACPDPAB12 ACPDPAB13 ACPDPAB14 ACPDPAB15 ACPDPDG01 ACPDPDG02 ADD01A REQUIRED FUNCTION NORMALLYCLOSED, MUST OPEN, STAY OPEN MUSTOPEN, NORMALLYCLOSED, FAILS OPENONLOSS OF IA, FAILS CLOSEDONLOSSOF POWER MUST OPEN, NORMALLYCLOSED, FAILS OPEN ON LOSS OF IA, FAILS CLOSED ON LOSS OF POWER NORMALLYCLOSED, MUST REMAINCLOSED (FAILS CLOSED ON LOSS OF POWER OR IA)

I NORMAI I Y CI OSED, MUST REMAINCLOSED (FAILS CLOSED ON LOSS OF POWER OR IA)

NORMALLYCLOSED, MUST REMAINCLOSED (FAILS CLOSED ON LOSS OF POWER OR IA)

NORMALLYOPEN, MUST REMAINOPEN NORMALLYOPEN, MUST REMAINOPEN NORMAILYCLOSED, MUST REMAINCLOSED NORMALLYCLOSED, MUST REMAINCLOSED NORMALLYCLOSED, DESIRED CLOSED (FAILS OPEN, DEPEND ON FLOW LIMITER)

NORMALLYCLOSED, DESIRED CLOSED (FAILS OPEN, DEPEND ON FLOW LIMITER)

NORMALLYOPEN, MUST REMAINOPEN DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTEPOWER AND CIRCUIT BREAKERS PROVIDE ISOLATION MUST OPEN (FAILS OPEN ON LOSS OP IA, FAILS CLOSED ON LOSS OF DC POWER)

EIN RE UIRED FUNCTION ADD01B ADD02A ADD02B ADF01A ADF01B ADF02A ADF02B AFP01 AFP02 ARA1CC14 ARA1RC14 ARA2CC18 ARA2RC18 ARB1CC16 ARB1RC16 ARB2CC17 ARB2RC17 BUS14 BUS16 BUS17 BUS18 BYCA MUST OPEN (FAILS OPEN ON LOSS OF IA, FAILS CLOSED ON LOSS OF DC POWER)

MUST OPEN (FAILS OPEN ON LOSS OF IA, FAILS CLOSED ON LOSS OF DC POWER)

MUST OPEN (FAILS OPEN ON LOSS OF IA, FAILS CLOSED ON LOSS OF DC POWER)

MUST PROVIDE FLOW MUST PROVIDE FLOW MUST PROVIDE FLOW MUST PROVIDE FLOW MUST START AND PROVIDE ROOM COOLING MUST START AND PROVIDE ROOM COOLING USED FOR UNDERVOLTAGEACTUATION USED FOR UNDERVOLTAGEACTUATION USED FOR UNDERVOLTAGEACTUATION USED FOR UNDERVOLTAGEACTUATION USED FOR UNDERVOLTAGEACTUATION USED FOR UNDERVOLTAGEACTUATION USED FOR UNDERVOLTAGEACTUATION USED FOR UNDERVOLTAGEACTUATION DISTRIBUTE POWER ANDCIRCUIT BREAKERS PROVIDE ISOLATION I

DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOIATION DISTRIBUTEPOWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION PROVIDE DC POWER

BYCA1 BYCB BYCB1 DCPDPAB01A DCPDPAB01B REQUIRED FUNCT ON PROVIDE DC POWER PROVIDE DC POWER PROVIDE DC POWER DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION I

DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPAB02A DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPAB02B DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPCB02A DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPCB02B DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPCB03A DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPCB03B DCPDPCB04A DCPDPCB04B DCPDPDG01A DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPDG01B DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPSH01A DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION DCPDPSH01B DISTRIBUTE POWER AND FUSES IN PANEL PROVIDE ISOLATION FT-4084 FT-4085 IBPDPCBA IBPDPCBAR IBPDPCBC SAFW PUMP C FLOW INDICATION,VALVECONTROL I

SAFW PUMP D FLOW INDICATION,VALVECONTROL PROVIDE POWER PROVIDE POWER PROVIDE POWER

IBPDPCBCB IBPDPCBE INVTA INVTB KDG01A KDG01B KDG02A KDG02B KDG03A KDG03B KDG06A KDG06B LT-426 LTA28 LT-504 LT-507 MCCC MCCD MCCH MCCJ MCCL MCCM REQUIRED FUNCTION PROVIDE POWER PROVIDE POWER PROVIDE AC POWER PROVIDE AC POWER MUST START AND PROVIDE POWER MUST START AND PROVIDE POWER BOOST POWER ON D/G A BOOST POWER ON D/G B BOOST POWER ON D/G A BOOST POWER ON D/G B REGULATE D/G A FREQUENCY REGULATE D/G B FREQUENCY PRESSURIZER LEVELINDICATION PRESSURIZER LEVELINDICATION REQUIRED S/G A LEVELINDICATION REQUIRED S/G B LEVELINDICATION DISTRIBUTE POWER AND CIRCUI'f BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION I

DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION DISTRIBUTE POWER AND CIRCUIT BREAKERS PROVIDE ISOLATION

EIN MQ400A MQ400C MQ400E PCH01A PCH01B PDG02A PDG02B PDG04A PDG04B PHBG PHCG PSF01A PSF01B PSW01A PSW01B PSW01C PSW01D PT-420 PT-420A PT-420B PT-429 PT-431 REQUIRED FUNCTION PROVIDE POWER PROVIDE POWER PROVIDE POWER MUST START AND BE OPERATIONAL I

MUST START AND BE OPERATIONAL hllUST START AND OPERATE (FUEL OIL PUMP)

MUST START AND OPERATE (FUEL OIL PUMP)

FUEL OIL PRIMING PUMP FUEL OIL PRIMING PUMP PRESSURIZER HEATERS PRESSURIZER HEATERS MUST START AND OPERATE WHEN REQUIRED MUST START AND OPERATE WHEN REQUIRED MUST OPERATE AND PROVIDE FLOW MUST OPERATE AND PROVIDE FLOW MUST OPERATE AND PROVIDE FLOW MUST OPERATE AND PROVIDE FLOW PROVIDE RCS PRESSURE INDICATION PROVIDE RCS PRESSURE INDICATION PROVIDE RCS PRESSURE INDICATION PROVIDE RCS PRESSURE INDICATION PROVIDE RCS PRESSURE INDICATION

EIN REQUIRED FUNCTION PT-450 PT-451 PT<52 PT-468 PT-478 TE-409A-1 TE-409 B-1 TE-410A-1 TE410B-1 PROVIDE SIGNAL FOR PORV CONTROL PROVIDE SIGNALFOR PORV CONTROL PROVIDE SIGNAL FOR PORV CONTROL REQUIRED FOR S/G A PRESSURE INDICATION REQUIRED FOR S/G B PRESSURE INDICATION RCS HOT LEG TEMPERATURE INDICATION RCS COLD LEG TEMPERATURE INDICATION RCS HOT LEG TEMPERATURE INDICATION RCS COLD LEG TEMPERATURE INDICATION 10

0

ATTACHMENT B AREAS AND TRAYS OF CONCERN

0

TTACHNIEN 8 CABLE TRAYS Intermediate Building EL 253-Clean Side Note: Trays are classified as either at risk or protected.

At risk trays are located in the postulated fall zone ofblock walls. Protected trays are protected either by distance or some other obstruction from effects offalling blocks.

51Jh}~ - 132 - only at the west end ofthe room where the tray runs near the block walls.

14,91,58 & 59 - after they exit the Cable Tunnel Entryway for their entire runs in this room.

72 - for its entire run in this room.

69 & 70 - short tray runs in the northeast corner ofthe room.

93 - it passes through the F - line block wall.

117 - a short run oftray, runs east-west along the block wall.

118 - runs along the west side block wall and passes through the south block wall.

16 & 122 - run along the block wall in the northwest corner ofthe room.

.91.99. 9E

-1 h

C*hl 7 IE E

y.

132 -for the entire run in this room except for at the west side when the tray runs east-west near the block wall.

71, 192, 112,335,336,337,92, 15 &372 Intermediate Building EL 253-Controlled side 5~~~- 13, 118, 59 Intermediate Building El. 278-Clean Side d.

1

y. 7 g.

y g

i gly I

g h

h gl.

9 1

tray run to ACPDPIB03, tray continues up, cables drop into ACPDPIB04 and conduits run to PS5334, 14437S & 14448S Intermediate Building El. 271 - Controlled Side "

~g~g - 68 Intermediate Building El. 298 - Clean Side

Intermediate Building El. 293 - Controlled Side B,iJh~~ - 72, 122, 16 AuxiliaryBuilding El. 271 h~&rnz - 68A C

ND lT Intermediate Building El. 253-Clean Side Blue conduits: R1503, R1519, R1555, R1440, Rl 542, R1456, R1479, R1491, R2816 Allrun together near the north block wall and into the cable tunnel - they may be impacted by the block wall but it is judged that they (and the cables inside) willremain functional.

R1420, R1420A, R1421, R1421A, C5349 Conduits to 14400S &limitswitches to 4562 &4561S & controller for 4561 (TC5313A), E/P 5314 Conduits to PXIB02, 03, 07 Conduits to TDAFWPump instruments Conduits to V3996 Reset Box &Valve Large conduits to Reactor Trip Breaker Cabinets Conduits to PZ17 - ZA131, 43, 21, 23, 90, 81, 92 Conduits ZA22, 20, 20A Conduits to door latches Conduits to TDAFWAux Control Power Xfer Switch, E195, 193A & others Conduits to ILRTP Conduits to 4663 &4733 Conduits to House Heating Boiler Feedpump Switch Conduit I197A Conduits to AFW Pump instruments Conduits R12255 &R1104 to PI-449B, LI-433B, PI-482B, PI-483B, LI-460A,LI-470A Conduits (2) to PZR HTR B/U Group box - looks like they drop into tray 59 Conduits to C-Inter. Bldg. Exhaust Fan Conduits R4352, 4356, 4354 Conduits (6) that go thru south wall to lAHydrogen Recombiner Panel Intermediate Builkding El. 253-Controlled Side Conduits to PT-947 &PT-948 Intermediate Building EL 278-Clean Side

Conduits to 3505A Conduits to limitswitches on safety valves Conduits that go to tray 132 Conduits behind safety valves that run up wall and thru to Turbine Bldg.

Conduits to 3505A Conduits (3 - large) XXS140, 102, 103 Conduits ZA132, 133, 136, 137, 92 (Fire Prot.)

Conduit to TB-4007 &TB-4030 Intermediate Building El. 271 - Controlled Side Allsecurity and other non-safety Intermediate Building El. 298 - Clean Side Conduits to PS-5334, 14437S 2 14448S Intermediate Building El. 293 - Controlled Side Conduits to A2 B Aux. Bldg. Exhaust Fans

ATTACHMENT C DEVICES SUBJECT TO BLOCK MALL INTERACTION

0,

Page 1 of 4 SSEL Component 3504A 3505A 3516 3517 4613 4614 4663 4664 Component Title S/G B. Steam Supply Valve to TDAFW Pump S/G A Steam Supply Valve to TDAFW Pump Main Steam Isolation Valve B Main Steam Isolation Valve A Turbine Building SW Isolation Valve Turbine Building SW Isolation Valve AirConditioning SW Isolation Valve Turbine Building SW Isolation Valve Required Function Must Remain Closed, Opens on LOOP, Manual Closure Required Must Remain Closed, Opens on LOOP, Manual Closure Required NO, must close (fails closed on loss of IA)

NO, must close (fails closed on loss of IA)

SW Isolation Valve SW Isolation Valve SW Isolation Valve SW Isolation Valve Circuits in Area of Concern E108 (Tray 91),

E112 (Tray 59)

E32 (Trays 91, 117, 122),

E36 (Tray 59)

G1197, G1198,G1199, G1200, G1201,G1180, G1181, GI182,G1183 G1191,G 1192,G1193, G1194,G1195,G1186, G1187,G1188,G1189 C895 (Trays 69,70,58,91)

C1185 (Tray 167,59)

C1187 (Tray 59)

C827 (Tray 117,122)

C828 (Trays 72,58)

C1224 (Tray 167,59)

C1225 (Tray 59)

Notes All conduits associated with valves in the Intermediate Building are also a concern.

All conduits associated with valves in the Intermediate Building are also a concern.

Must verify circuits are routed in acceptable locations.

Must verify circuits are routed in acceptable location.

Failure would prevent remote closure of valve.

Failure would prevent remote closure of valve.

Failure vvould prevent remote closure of valve.

Failure vvould prevent remote closure of valve.

Resolution PCR-98-022 Modified block wall to preserve manual operation.

PCR-98-022 Modified block wall to preserve manual operation.

Routings verified to be acceptable and not susceptible to block

'all interaction.

Routings verified to be acceptable and not susceptible to block wall interaction.

Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

Modified ERSC.4 earthquake emergency plan to provide operator guidance.

C

Page 2 of 4 SSEL Component 4773 4780 52/RTA 52/RTB 5735 Component Title AirConditioning SW Isolation Valve Screen House SW Isolation Valve Reactor Trip Breaker A Reactor Trip Breaker B S/G A Blowdown Sample Isolation Valve I

Required Function SW Isolation Valve SW Isolation Valve Trip Reactor Trip Reactor NO, Must close (fails closed on loss of DC or IA)

Circuits in Area of Coricern C1255(Trays 167,59)

C1256 (Tray 59)

C5077 (Trays 59,167)

L610 (Conduit/Sq Box)

L611 (Conduit/Sq Box)

L612 (Conduit/Sq Box)

L630 (Conduit/Sq Box)

L631 (Conduit/Sq Box)

L632 (Conduit/Sq Box)

R3193 (Tray 59)

R3194 (Trays 58,59)

Notes Failure would prevent remote closure of valve.

Failure would prevent remote closure of valve.

Breakers open on loss of DC.

Also loss of MG sets vvill cause reactor trip. Only concern vvould be hot short from another.

cable to L610 and opening of L611 conductors without fuses blowing.

Breakers open on loss of DC.

Also loss of MG sets vvill cause reactor trip. Only concern vvould be hot short from another cable to L630 and opening of L631 conductors without fuses blowing.

The internal shorting of circuit R3193 could cause valve to stay open ifIA is available and fuses do not blow.

'.',=.-Resoliition'.- ',-.";.

Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

Routings verified to be acceptable and not susceptible to block wall interaction.

Not credible failure modes Not credible failure mode.

Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

5736 S/G B Bloivdown Sample Isolation Valve NO, Must close (fails closed on loss of DC or IA)

R3193 (Tray 59)

R3194 (Trays 58,59)

The internal shorting of circuit R3192 could cause valve to stay open ifIA is available and fuses do not blow.

Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

Page 3 of 4 SSEL Component 5737 Component Title S/G A Blowdown Isolation Valve Required Function NO, Must close (fails closed on loss of DC or IA)

Circuits in Area of Concern R3176 (Tray 59)

R3192 (Tray 59)

R3194 (Trays 58,59)

Notes The internal shorting of circuit R3192 could cause valve to stay open ifIA is available and fuses do not blow.

Resolution Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

5738 S/G B Blowdown Isolation Valve NO, Must close (fails closed on loss of DC or IA)

R3176 (Tray 59)

R3192 (Tray 59)

R3194 (Trays 58,59)

The internal shorting of circuit R3193 could cause valve to stay open ifIA is available and fuses do not blow.

Modified ER-SC.4 earthquake emergency plan to provide operator guidance.

8616A 8619A Accumulator to Surge Tank Valve Nitrogen Arming Valve Normally Closed, Must Open and Close on Demand Normally Closed, Must Open and Close on Demand SAC213 (Conduit Concern)

SAC211A (Conduit Concern)

SAC211B (Conduit Concern)

Concern because conduit routed to CE penetration.

Need to vvalkdown conduit.

Concern because conduit routed to CE penetration.

Need to walkdown conduit.

Routing verilied to be acceptable and not susceptible to block wall interaction Routing veriTied to be acceptable and not susceptible to block vvall interaction.

LT-428 LT-504 PHBG Pressurizer Level Indicator S/G A IVide Range Level Pressurizer Heater Backup Group Pressurizer Level Indication Required for S/G A Level Pressurizer Heater R837 (Conduit Concern)

R4344 (Trays 70,58)

L276 (Tray 59)

L277 (Tray 59)

Concern because conduit routed.

to CE penetration, Need to walkdown conduit.

Ifcomponent fails, then an alternative indication would be via manual reads of LT-505 circuitry.

Remove/Local Switch Located in Intermediate Building.

Manually closing breaker is acceptable alternative.

Routing verified to be acceptable and not susceptible to block wall Interaction.

Added S/G narrow range level 8c Stby AFIV flow to SSEL, ModiTied FR-H.1 response to Loss of Secondary Heat Sink.

Outlier, manual operator action is acceptable.

Page 4 of 4 SSEL Component PT-431 PT-468 Component Title Pressurizer Pressure S/G A Pressure Indicator Required Function Provide RCS Pressure Indication S/G A Pressure Ihdication Circuits in Area of Concern R998 (Conduit Concern)

R886 (Conduit Concern)

R3421 (Conduit Concern)

Notes Concern because conduit routed to CE penetration.

Need to walkdown conduit.

Pressure transmitter located in Intermediate Building. Conduits need to be walked down.

Resolution Routings verified to be acceptable and not susceptible to block wall interaction.

Routings verified to be acceptable and not susceptible to block wall interaction.

PT-478 S/G B Pressure Indicator S/G B Pressure Indication R975 (Conduit Concern)

Pressure transmitter located in Intermediate Building. Conduits need to be walked down.

Routings verified to be acceptable and not susceptible to block wall interaction.

TEA09A-1 RCS Loop A Hot,Leg Temperature RCS Hot Leg Temperature Indication R3555 (Trays 72,58)

Also routed to CE Penetration.

Need to walkdown any applicable conduits.

Added NR RCS temp to SSEL, modified ER.SC-4, earthquake emergency plan to provide operator guidance.

TE-409B-1 RCS Loop A Cold Leg Temperature RCS Cold Leg Temperature Indication R3994 (Trans 70,58)

Also routed to CE Penetration.

Need to walkdown any applicable conduits.

Added NR RCS temp to SSEL, modified ER,SCA, earthquake emergency plan to provide operator guidance.

PAGE 1 OF 3

~<@IS)~r'>V~:>-':~

..Ca~m jane'n(TitIe:::-">

123 310

- 312 3410 Excess Letdown HX Outlet Valve I

Excess Letdown Stop Valve Excess Letdown Diversion Valve S/G B Power Operated Atmospheric ReliefValve NC, must remain closed (Fails closed on loss of DC or IA)

NC, must remain closed (Fails closed on loss of DC or IA)

Must remain aligned to seal return (Fails aligned on loss ofDC or IA)

Must not FO, NC and FC on loss ofDC or IA.

R77 (Trays 59, 167)

R556 (Trays 58, 70)

R561 (Trays 58, 70)

G239 (Tray 59)

G239A (Conduit Only)

Internal shorting ofcable willnot cause valve to mis-align. Requires hot-short to another circuit without fuses blowing and IA being available to mis-align valve.

Internal shorting ofcable willnot cause valve to mis-align. Requires hot-short to another circuit without fuses blowing and IA being available to mis-align valve.

Internal shorting ofcable willnot cause valve to mis-align. Requires hot-short to another circuit without fuses blowing and IA-being available to mis-align valve.

The shorting ofconductors in G239A could cause valve to mis-align ifIAis available.

Not credible failure mode (See Note on Page 3)

Not credible failure mode (See Note on Page 3)

Not credible failure mode (See Note on Page 3)

Outlier, manual operator action to isolate is acceptable

~ ~

o x

3411 S/G B Power Operated Atmospheric ReliefValve Must not FO, NC and i

FC on loss ofDC or IA.

G232 (Tray 59)

G232A (Conduit Only)

The shorting ofconductors in G232A could cause valve to mis-align ifIAis available.

Outlier, manual operator action to isolate is acceptable

PA 2OF3 392B 4013 4027 4028 951 Charging line Stop Valve TDAFWPump SW Suction MOV MDAFWPump SW Suction MOV MDAFWPump SW Suction MOV Pressurizer Steam Space Sample Isolation Valve Must not FO, NC and FC on loss ofDC orIA.

Must not FO, NC Must not FO, NC Must not FO, NC NC, Must remain closed (Fails closed on loss of DC or IA)

R579 (Trays 58, 70)

R1214 (Tray 59)

R1215 (Tray 59)

C837 (Trays 117, 118)

C838 (Trays 72, 58)

C1208 (Tray 59)

C1209 (Tray 59)

R3135 (Tray 68)

R3140 (Tray 59)

Internal shorting ofcable willnot cause valve to mis-align. Requires hot-short to another circuit without fuses blowing and IA being available to mis-align valve.

Failure ofC1215 is acceptable.

Misalignment ofvalve requires all three phases ofpower cable (C1214) to short with another circuit.

Failure ofC838 is acceptable.

Misalignment ofvalve requires all three phases ofpower cable (C837) to short with another circuit.

Failure ofC1209 is acceptable.

Misalignment ofvalve requires all three phases ofpower cable (C1208) to short with another circuit.

Internal shorting ofR3140 could cause valve to mis-align iffuses do not blow and IAis available.

Not credible failure mode (See Note on Page 3)

Not cred>ble fa>lure mode (See Note on Page 3)

Not credible failure mode (See Note on Page 3)

Not credible failure mode (See Note on Page 3)

Valve 966A will provide isolation (Not credible for both valves to fail)

PAGE 3 OF 3 953 955 966A 966B 966C Pressurizer Liquid Space Sample Isolation Valve LOOP B Hot Leg Sample Isolation Valve Pressurizer Steam Space Sample Isolation Valve Pressurizer Liquid Space Sample Isolation Valve LOOP B Hot Leg Sample Isolation Valve NC, Must remain closed (Fails closed on loss of DC or IA)

NC, Must remain closed (Fails closed on loss of DC or IA)

NC, Must remain closed (Fails closed on loss of DC or IA)

NC, Must remain closed (Fails closed on loss of DC or IA)

NC, Must remain closed (Fails closed on loss of DC or IA)

R3141 (Tray 68)

R3150 (Tray 59)

R3141 (Tray 68)

R3150 (Tray 59)

R3171 (Tray 59)

R3171 (Tray 59)

R3163 (Tray 59)

Internal shorting ofR3140 could cause valve to mis-align iffuses do not blow and IAis available.

Internal shorting ofR3140 could cause valve to mis-align iffuses do not blow and IAis available.

Internal shorting ofR3171 could cause valve to mis-align iffuses do not blow and IAis available.

Internal shorting ofR3171 could cause valve to mis-align iffuses do not blow and IAis available.

Internal shorting ofR3163 could cause valve to mis-align iffuses do not blow and IAis available.

Valve 966B will provide isolation (Not credible for both valves to fail)

Valve 966C will provide isolation (Not credible forboth valves to fail)

Backup to Valve 951 (Not credible for both valves to fail)

Backup to Valve 953 (Not credible for both valves to fail)

Backup to Valve 955 (Not credible for both valves to fail)

Note:

Reference:

Inter-OfBce Correspondence from R. Baker to J. Pacher, D. Wilson and D. Zebroski, "Position on Circuit Failure Modes Due to Raceway Failure", Dated 1/9/97,