ML18143A104

R.E Ginna Unit 1, Amendment No. 2 to Technical Supplement Accompanying Application to Increase Power

ML18143A104
Person / Time
Site:	Ginna
Issue date:	10/05/1971
From:	Rochester Gas & Electric Corp
To:	US Atomic Energy Commission (AEC)
References
Download: ML18143A104 (107)

Text

. *U.S. ATOMIC ENERG'f COMMISSION AEC DOCKET WO.SO-Z44 hegutatpry. FHe cy.

8Pgp//pj'""'::t o,

- -7/

~~g~g gLQ Gate F

RGCHESYER GAS AND ELECTRIC CORPORATION R. E. GINNA NUCLEAR PONER PLANT UNIT NQ.l It 1

M

(

AMENDMENT NG. 2 TQ TECHNICAL SUPPLEMENT ACCOMPANYING APPLICATIQN TQ INCR EAS E PGNER

~ wo S

~'

1 ~ \ E

~ ~

"C I il \ ~

0 e

1 I )

tI

' )1 A* A ~

UNITED STATES OF AMERICA ATOMIC ENERGY COMMISSION In the Matter of Docket No. 50-244 Rochester Gas and Electric Corporation )

AMENDMENT NO. 2 TO PETITION REQUESTING OPERATION AT A HIGHER POWER LEVEL Rochester Gas and Electric Corporation, Licensee in the above-captioned matter, hereby files Amendment No. 2 to its petition filed with the Commission on February 8, 1971, requesting operation of its Ginna facility at a higher power level. With this amendment Licensee hereby transmits Amendment No. 2 to the document entitled, "Technical Supplement Accompanying Applica-tion to Increase Power." This Amendment contains answers to oral questions asked of representatives of Rochester Gas and Electric'y members of the Division of Reactor Licensing.

P" I

~ I

(

I ~. f i tp 4

0

'I f

I 1

0

WHEREFORE, Licensee prays as in its original petition requesting the amendment of its license to operate its Ginna P

facility at a higher power level.

Rochester Gas and Electric Corporation Francis E. Drake, Jr.

Chairman of the Board Subscribed and sworn to before me this >~

.:st, day of- 1971.

Notary Public

'ARI ENE K'. BARNEY I~Ionrce Coon!y IIOTMY PUBLIC, State oi II.Y.,

Idy Cornrnisston Expires Iitarch 30, '.9.$ ,~

I 0

~, E

'~ C I',ge

Question 1: What mould be the effect of a single failure on the boric acid injection systems Answer: The following analysis considers the effects of the failure of a) a battery, b) an inverter, and c) an a-c 'bus, one at a time, on the boric acid tank level system and the injection of boric acid during a safeguards incident. The analysis shows that the single failure criteria is satisfied and boric acid can be injected into the reactor vessel.

A. Failure of a Battery

l. The failure of a battery* will de-energize:

a) one instrument bus inverter, b) dc control power in one of the two trains of engineered safeguards actuation relays, c) dc control power in one of the two engineered safeguards motor control centers.

Loss of the instrument bus inverter output deactivates two of the four boric acid tank level instrumentation channels. The resulting low tank level signals will actuate the "Boric Acid Tank Level" annunciator window on the main control board. Loss of dc control power for the engineered safeguards actuation relays actuates the "Safeguards DC Failure" annunciator window on the main control board.

+ The failure of a battery also trips the reactor and causes trips (with partial trip alarms) in most of the instrumentation channels fed by the deenergized instrument bus inverter.

1.1

1 T

0

2. Should there be a safety injection signal coincident with the battery failure, the redundant train of engineered safeguards equipment will operate to inject boric acid into the reactor vessel. Two of the three safety injection pumps will be started; one of the two sets of valves in the line from the boric acid tanks to the safety injection pump header will be opened; check valves in each of the four high head safety injection lines; allow maintaining the motor operated valves in an open position.

3. When low-low level in the boric acid tanks is reached, the two remaining tank level instrumentation channels will open one of the two parallel valves in the line from the refueling water storage tank to the safety injection pump suction header.

At the same time, the level signals will close, the two opened valves in the boric acid tanks outlet line.

4. Thus, failure of a battery will not prevent the safety injection system from operating.

5. A detailed description of the effect of failing Battery lA follows:

a) Battery 1A fails.

b) Normal dc supply to the main contxol board annunciator is deen rgized. The annunciator automatically transfers to Battery 1B. Annunciator window H25, "Annunciator Normal Supply Off" is actuated.

c) Train A Safeguards Actuation Relay Racks SZAl and SIA2 are deactivated. Relay 74Xl deenergizes, actuating Annunciator window L31, "Safeguards DC Failure" 1,2

If I I I ~

d) Inverter 1A is deenergized, causing Instrument Bus 1A to deenergize.

e) Boric Acid Tank Level Instrument Channels LT-102 and LT-172 are deactivated.

f) Boric Acid Tank Low Level Alarm Relays LC-102BX and LC-172BX deenergize, actuating Annunciator window B15, "Boric Acid Tank Level".

g) When a safety injection signal is generated, circuits in Train B Safeguards Actuation Relay Racks SIB1 and SIB2 are activated. (NOTE: With one instrument bus deenergized, a partial trip of the engineered safeguards initiation instrumentation exists. The safety injection signal signal is generated by the'second trip of an instrumented parameter. This can be the result of a change in the parameter or the loss of a second instrument bus, which would occur with a station blackout.)

h) Safety Injection Pump 1B is started. Pump lA does not start because the Train A Safeguards Relay Racks, SIAl and SIA2, are deactivated.

i) Boric Acid Tank Valves 826B and 826D are normally open because of administrative control. Valves 826C and 826D each receive an opening signal from contacts of relays SI25X, LC-102CX, LC-171CX, LC-106CX, and L'C-172CX. Valve 826C opens. Valves 826A and 826B do not receive an opening signal because of the battery failure". Boric acid flows from the tanks through the valves 826C and 826D to the safety infection pump suction header.

g) Reactor Coolant System Cold Leg Injection Valises 878B and 878D each receive an opening signal from Train B safeguards relay SI26X. RCS Hot Leg Injection Valves 878A and 878C

1. 3

Y I

~

'I I I ~ 'I h, I h

I h

'I 0

~'

II I ~

h' I

h-I ~ I

f. h' I

I

'I I I I

.I

do not receive an opening signal because of the battery failure. However, since these valves are already open by administrative control injection of boric acid is made to both legs of both loops.

k) Crossover valve 871B receives .a closing signal from contacts of sequencing relay 2/871B and Safety Injection Pump 1A breaker 52/SIPlA. Closure of valve 871B routes the discharge of Safety Injection Pump 1B into RCS Loop A and the discharge of Safety In'jection Pump 1C into RCS Loop B.

1) Safety Injection Pump 1C is started by sequencing relay 2/SIPlCl. Power to the pump motor comes from 480 Volts Bus 16.

m) When low-low level in the boric acid tanks is reached, relays LC-106CX and LC-171CX are energized and latched.

Contacts of these relays actuate annunciator window.

B23, "Boric Acid Tank Lo Lo Level." Relays LC-102CX and LC-172CX cannot energize because their respective level channels are deactivated.

n) Refueling water storage tank outlet valve 825B receives an opening signal from contacts of relays SI25X, LC-106CX, and LC-171CX. Valve 825A cannot open because of the battery failure. Plow from the refueling water storage tank is established through valve 825B to the safety injection pump suction header.

o) When valve '825B moves off its fully closed position, relay 825BX deenergizes. Valves 826C and 826D receive closing signals from contacts of relays SI25X, LC-106X, and LC-171CX, and 825BX. Since valve 826A could not open initially, closing valves 826C and 826D prevent refueling water from Eackfeeding into the boric acid tanks.

1.4

1 0

P

6. A detailed analysis of the failure of Battery lB will give similar results as those described in the preceeding paragraph.

(There will be no transfer of the annunciator power supply since it is already connected to Battery lA.) Inverter 1B and Instrument Bus 1C will be deenergized by the failure of Battery 1B. Boric Acid Tank Level Channels LT-106 and LT-171 will be deactivated, along with Train B Safeguards Actuation Relay Racks SIB1 and SIB2. Loss of dc control power in Motor Control Center lD will prevent the Train B motor operated valves from operating.

7. During safety injection, SI pumps lA and 1C will be started,,

both pump motors being fed from 480 volt Bus 14. ~

Boric acid tank valves 826A and 826B, and injection valves 878A and 878C will receive an opening signal. Since the 878 valves are all open due to administrative control, the safety injection pump flow path remains normal. Crossover valve 871A will close.

When low-low level in the boric acid tanks is reached, Boric Acid Tank Level Channels LT-102 and LT-172 will energize relays LC-102CX and LC-172CX. Refueling water storage tank valve 825A will be open and boric acid tank valves 826A and 8269 will close.

Thus boric acid is injected into the reactor vessel until the tanks are empty and then refueling water is injected.

Failure of an Inverter

1. Failure of an inverter deenergizes one instrument bus. Safety related instrumentation powered from this bus deenergizes to the trip condition and causes partial trip alarms. In addition, two of the four boric acid tank level instrumentation channels are deactivated. The resulting low tank level signals will actuate the "Boric Acid Tank Level" annunciator- window on the main control board.

2. Should there be a safety injection signal, coincident with the inverter failure, the operation of the safety injection system is not affected by the failure. The full complement of both trains of equipment will function.

e:

Cf 0

3. A detailed description of the effect of failing Inverter lA follows:

a) Inverter 1A fails, causing Instrument Bus 1A to deenergize.

b) Boric Acid Tank Level Instrument Channels LT-102 and LT-172 are deactivated.

c) Boric Acid Tank Low Level Alarm Relays LC-102BX and LC-172BX deenergize, actuating Annunciator window B15, "Boric Acid Tank Level".

d) When a safety injection signal is generated, circuits in Train A and Train B Safeguards Actuation Relay Racks (SIAl and SIA2; SIBl and SIB2) are activated. (NOTE: With one instrument bus deenergized, a partial trip of the engineered safeguards initiation instrumentation exists. The safety injection signal signal is generated by the second trip of an instrumented parameter. This can be the \ result of a change in the parameter or the loss of a second instrument bus, which would occur with a station blackout.)

e) Safety Infection Pumps 1A and 1B are started.

f) Boric Acid Tank Valves 826B and 826D are normally open because of administrative control. Valves 826A and 826B each receive an opening signal from contacts of relays SI15X, LC-102CX, LC-171CX, LC-106CX and LC-172CX. Valves 826C and 826D each receive an opening signal from contacts of relays SI25X, LC-102CX, LC-171CX, LC-106CX, and LC-172CX.

Valves 826A and 826C open. Boric acid flows from the tanks through valves 826A, 826B, 826C and 826D to the safety injection pumps sucti'on header.

1. 6

1 V

t P

~'

0 l 6 I

C C t

t

~y J' I

'l

1

g. Reactor Coolant System Cold Leg Injection Valves 878B and 878D, although already opened, each receive an opening signal from Train B safeguards relay SI26X. RCS Hot Leg Injection Valves 878A and 878C receive an opening signal from Train A safeguards relay SI-16X. Boric acid is injected into RCS Loop A and Loop B throu'gh these four valves.

h) Safety Injection Pump 1C is started by sequencing relay 2/SIP1Cl or 2/SIPlC2. Power to the pump motor is from 480 volt Bus 14 if relay 2/SIP1C2 operates. If relay 2/SIP1Cl operates, power to the pump motor is from 480 volt Bus 16.

i) When low-low level in the boric acid tanks is reached, relays LC-106CX and LC-171CX are energized and latched.

Contacts of these relays actuate annunciator window B23, "Boric Acid Tank Lo Lo Level." Relays LC<<102CX and LC-172CX cannot energize because their respective level channels are deactivated.

j) Refueling water storage tank outlet valve 825A receives an opening signal from contacts of relays SI15X, LC-106CX, and LC-171CX. Valve 825B receives an opening signal from contacts of relays SI25X, LC-106X, and LC-171CX. Flow from the refueling water storage tank is established through valves 825A and 825B to the safety injection pumps suction header.

k) When valves 825A and 825B move off their fully closed positions, relays 825AX and 825BX deenergize. Valves 826A and 826B receive closing signals from contacts of relays SI15X, LC-106CX, LC-171CX, 825AX, and 825BX.

Valves 826C and 826D receive closing signals from contacts of relays SI25X, LC-106X, LC-171CX, 825AX, and 825BX. Closing valves 826A, 826B, 826C, and 826D prevents refueling water from backfeeding into the boric acid tanks.

l. 7

I' a

II ~ /II

~ 4 K I, 0

F,

4. A detailed analysis of the failure of Inverter 1B will give similar results to those described in the preceding paragraph.

Instrument Bus 1C will be deenergized. Boric Acid Tank Level I

Channels LT-106 and LT-171 will be deactivated. During safety injection, all pumps and valves will be operable.

Failure Of An AC Bus (480 volts Safeguards Bus 14 or Bus 16)

1. Failure of an ac bus will prevent one train of engineered safeguards pumps and'motor operated valves from operating. The boric acid tank level instrumentation is not affected and the redundant train of safeguards equipment will operate during safety injection.

2. A detailed description of the effect of failing Bus 14 follows:

a) ,Bus 14 fails.

,b) 480 volt, 3 phase power is lost on Bus 14 and in Motor Control Center 1C. Undervoltage relays connected to Bus 14 deenergize, actuating annunciator window L14, "Bus 14 Undervoltage Safeguards".

c) When a safety injection signal is generated, circuits in Train A and Train B Safeguards Actuation Relay Racks (SIA1 and SIA2; SIBl and SIB2) are activated.

d) Safety Injection Pump 1B is started. Pump 1A does not start because Bus 14 is deenergized.

e) Boric Acid Tank Valves 826B and 826D are normally open because of administrative control. Valves 826C and 826D each receives an opening signal from contacts of relays SI25X, LC-102CX, LC-17XCX, LC-106CX, and LC-172CX. Valve 826C opens. Valves 826A and 826B also receive opening signals but valve 826A cannot open because Motor Control Center 1C is deenergized.

Boric acid flows from the tanks through valves 826C and 826D to the safety injection pumps suction header.

1.8

e:

I l>> ~ . I I W

~ I 0 I

cia",

J' p

I. ' ~ sf<i < 'r

~ t<

4

f) Reactor Coolant System Cold Leg Injection Valves. 878B and 878D each receives an opening signal from Train B safeguards relay SI26X. RCS Hot Leg Injection Valves 878A and 878C also receive opening signals. Although there is no AC power to valves 878A and 878C because of the loss of Motor Control Center lC, these valves are already opened under administrative control. Thus, the safety injection flow path is normal.

') Crossover valve 871B receives a closing signal from contacts of sequencing relay 2/871B and Safety Injection Pump 1A breaker 52/SIPlA. Clo'sure of valve 871B routes the discharge of Safety Injection Pump 1B into RCS Loop A and the discharge of Safety Injection Pump 1C into RCS Loop B.

h) Safety Injection Pump 1C is started by sequencing relay 2/SIPlC1. Power to the pump motor comes from 480 Volts Bus 16.

i) When low-low level in the boric acid tanks is reached, relays LC-102CX, LC-106CX, LC-171CX and LC-172CX are energized and latched. Contacts of these relays actuate annunciator window B23, "Boric Acid Tank Lo Lo Level."

j) Refueling water storage tank outlet valve .825B receives an opening signal from contacts of relays SI25X, LC-102CX, LC-106CX, LC-171CX, and LC-172CX. Valve 825A cannot open because Motor Control Center 1C is deenergized. Flow from the refueling water storage tank is established through valve 825B to the safety injection pump suction header.

k) When valve 825B moves off its fully closed position, relay 825BX deenergizes. Valves 826C and 826D receive closing signals from contacts of relays SI25X, LC-102CX, LC-106CX, LC-171CX, LC-172CX, and 825BX. Since valve 826A could not open initially, closing valves 826C and 826D prevents refueling

1. 9

~ >

I

~'

V II )

~

$ r rr

( r

,p K

r II r

r h

J r' 1 r

~

~

r f '. ~ lr J II tr

<<r ~,r\ '

r

"~ ' II r r e

water from backfeeding into the boric acid tanks. Valves 826A and 826B also receive closing signals, but are inoper-able because Motor Control Center 1C is deenergized.

3. A detailed analysis of the failure of 480 volts Bus 16 will give similar results as those described in the preceeding paragraph.

Failure of Bus 16 deenergizes Motor Control Center 1B. The Train B pumps and motor operated valves are inoperable. Annunciator window L7, "Bus 16. Undervoltage Safeguards" will be acuated.

4. During safety injection, SI pumps lA and 1C will be started, both pumps motors being fed from 480 volt Bus 14. Boric acid tank valves 826A and 826B will open, Injection valves 878A, 878B, 878C; and 878D are already open by administrative control so safety injection flow will go to both legs of both loops.

Since motor control center D is deenergized;however, no power Xs available for va1ves 878B and 878D. Crossover valve 871A will close. When low-low level in the boric acid tanks is reached, the Boric Acid Tank Level Channels will energize relays LC-102CZ, LC-106CZ, LC-171CX, and LC-172CX. Refueling water storage tank valve 825A will open and boric acid tank valves 826A and 826B will close. Thus, boric acid is injected into the reactor vessel until the tanks are empty and then refuel-ing water is injected.

, 1.10

r u'L 0

Question 2: Describe the Ginna Station battery systexn and the annuncia-tions of=that system.

Answer: The battery system at Ginna Station consists of two separate batteries, each rated at 1080 ampere hours capacity. -

Each battery is charged by one 150 axnpere charger in parallel with one 75 ampere charger. The 75 ampere charger was added to the system duxing startup testing when it was determined that the 150 ampere charger alone did not appear to be sufficiently conservative. Circuitry allows paralleling of the engineered safeguard trains to one battery and the paralleling of both 150 ampere and both 75 ampere chargers for charging to the active battery. This operation is performed each time a battery is load tested when at shutdown conditions as required by Technical Specifications.

Three annunciations for off-normal conditions for the batteries are indicated in the control room. The normal operating voltage for each battery is 130 volts and should the voltage on either bus decrease to 127 volts, an alarm will sound and an annunciation, "A or B Battery Under Voltage", will be activated in the control room. 'he alarming bus can be identified by control board mounted voltmeters for each battery bus. This protection will provide advance warning of a change in normal conditions long before critical voltage is reached.

2. 1

1 C

I'y l

0 I ~

I C

Four relays monitor the DC voltage out of each charger. In the event that the output of one of the chargers is lost, an alarm and annunciation, "Loss of Battery Charger", will be initiated in the control room. Local investigation will reveal the errant charger by utilization of local instrumentation (individual voltmeters and amp-meters).

In addition to the above mentioned protection, control room alarm and annunciation, "Battery Ground", will activate for a ground situation on either battery. The faulty battery is distinguishable by local ground lights on both main chargers.

e-a,

'N 0

Question 3: Describe the inservice inspection'rogram.

Answer: The R.E.Ginna inservice inspection as contained in the facility's Technical Specifications was prepared in 1968 to meet the intent of ASME N-45 dated October 1968. It was recognized, however, that the technology had not yet been developed sufficiently to allow inspection of certain areas of'he reactor coolant system. It was for this reason a five-year inspection interval was specified with the clear understanding the program would be re-evaluated at the end of five years in order to incorporate newly developed techniques. It did not seem advisable to specify inspections that could not be accomplished. The five-year program presently in effect exceeds, in many areas, inspection requirements of both N-45 and the more recent Section XI of the ASME Boiler and Pressure Vessel Code. The bases, for not including certain items of inspection shown in Table IS>>261 of Section XI in the R.E.Ginna inservice inspection program are described below. Table I lists those items required by present Technical Specifications in the format of 15261.

3.1

l

'I 1

l D

Items 1.1 and 1.2 The design of Ginna does not provide for access to the vessel longitudinal and circumferential welds from outside the vessel.

Examination must be conducted from the inside and therefore under water. The equipment to perform this inspection is not presently available. In addition,'nspection will require the removal of the lower internal package which is not scheduled until near the tenth year of operation. Our inspection interval is five years as explained above and therefore inspection that will be done in the second five year interval should not appear in the program at this time.

1.4 The outlet nozzles can be reached during any refueling. The P

equipment to perform such an inspection is not available at this time and therefore we believe should not be included in the Technical Specifications. The inlet nozzles cannot be reached without removing the lower package and therefore inspection should not be included.

1.5 Equipment is not available to volumetrically inspect the control

'rod penetrations. The present specifications require visual inspection of 10% of these penetrations.

3. 2

I c

I" C.

~

~

t

1.9 Although this item does not appear in the specifications, we

'conducted of 100/o examination during the 1971 refueling s hutdown.

1. 10 We consider these items to be included in our Pressure Retaining Bolting Specification.

I We would consider visual examination of bolting to be done during refueling outages part of a good maintenance program and not a requirement of Technical Specifications.

1.12 The reactor vessel supports will be inspected with the nozzle inspection. A specification for visual inspection of the steam generator supports is included.

~

2.2 The nozzles on the pressurizer are cast with the heads, therefore no inspections are requir'ed.

2.3 The heater connectio'ns are not accessible on the ID. The external connections are accessible for visual examination only.

2.4 The pressurizer'eater external. connections are accessible for visual examination. It is customary to visually inspect all accessible areas of the primary system during the hydro test following a refueling operation. We do not consider it necessary to specify each particular visual examination of accessible areas in the Technical Specifications.

3. 3

I 0-4 I

~,

g R

r

2,6 We would consider visual examination of bolting done during refueling outages part of a good maintenance program and not a requirement of Technical Specifications.

2. 7 There are no integrally welded vessel supports.

3.2 The primary nozzles are cast with the heads, therefore no inspections are planned.

3. 5 We would consider visual examination of bolting done during refueling outages part of a good maintenance program and not a requirement of Technical Specifications.

3.7 Inspection to be performed at the end of the 10 year interval.

4.4 We would consider visual examination of bolting done during refueling outages part of a good maintenance program and not a requirement of Technical Specifications.

This item will be included in the Technical Specifications.

4.6 It is normal practice to visually inspect piping hanger systems and spring hanger settings within the system boundary during each refueling shutdown. We believe these procedures are standard requirements for acceptable maintenance programs and should not be included in Technical Specifications.

4. 7 This item will be included in the Technical Specifications.

4. 8 This item will be included in. the Technical Specifications.

3~ 4

I I I

~-

E P

~ . s 'L g

5. l The reactor coolant pump casing is a weldment of two cast shells. At this time there 'are no proven means of volumet-rically inspecting the pump casing welds in service; therefore no inspections are planned during the inspection interval.

5.2 The internal pressure boundary surfaces of the reactor coolant pumps are not accessible during normal or refueling outages. If removal of the pump internals is required during the inspection interval, there will be a visual examination of the internal surfaces of one disassembled pump. Otherwise, no inspection is planned during the inspection interval.

5. 3 There are no nozzle-'to-safe end welds on the Ginna Unit gl reactor coolant pumps.

E 5.5 Pressure retaining bolting less than,"2 inches in diameter'on the reactor coolant pumps is not normally accessible. How-ever, if this bolting is removed, good maintenance practice requires visual examination of all parts removed including bolting. This type of inspection should not be included in Technical Specifications.

5.6 There are no currently known techniques for volumetric inspection of thes'e welds.

5. "7 %'e will include in the Technical Specifications visual examination of the reactor coolant pump supports.

3.5

~ l 0-II

'E

6.2 We will include in the Technical Specifications the visual inspection of the internal surfaces of one (1) valve, 3 inches or larger, during the inspection interval.

6. 3 There are no valve-to-safe end welds in the piping boundary.

6.4 There is no pressure retaining bolting greater than two (Z) inches in'valves within the pressure boundary.

6.S We would consider visual examination of bolting to be done during refueling outages part of a good maintenance program and not a requirement of Technical Specifications.

6. 6 There are no integrally welded supports on the valves within the pressure boundary.

6. 7 It is normal practice to visually inspect piping hanger systems and spring hanger settings within the system boundary during

'each refueling. shutdown. We believe these procedures are standard requirements for acceptable maintenance programs arid should not be included in Technical Specifications.

3. 6

TABLE I R. E. GINNA NUCLEAR POWER PLANT UNIT NO. 1 IN-SERVICE INSPECTION PROGRAM

( )(Inspection Interval - 5 Years)

Note: Program Shown in the Format of Table IS-261 of Section XI, In-Service Inspection of Nuclear Reactor Coolant Systems..

REACTOR VESSEL AND CLOSURE HEAD Examination IS-261 Category Components and Parts Item No. IS-251 to be Examined Method 1,3 Vessel-to-flange and head-to- Volumetric flange circumferential welds Vessel penetrations, including Visual control rod drive penetrations and control rod housing pressure boundary welds

l. 7 Primary nozzles to safe-end weld Volumetric

1. 8 G-1 (2)'Closure studs and nuts Volumetric and visual or surface

l. 13 Closure head cladding ) Visual

1. 14 Vessel cladding ) Visual

l. 15 Interior surfaces and internal Visual and integrally-welded internal supports

3. 1

~-

P li I 4 j w 1

/

T

Examination IS-261 Category Components and Parts Item No. IS-251 to be Examined Method PRESSURIZER (PWR PLANT)

2. 1 Longitudinal and circumferential Volumetric welds

2. 5 ) Pres sure retaining bolting Volumetric

2. 8 1-2 Vessel cladding ( )Visual STEAM GENERATORS 3.1 ) Longitudinal and circumferential Volumetric welds, including tube sheet to head or shell welds on the primary side

3. 3 Primary nozzle to safe-end welds Volumetric s.~ G-1 ( )Pressure retaining bolting Visual and Volumetri c 3.6 Vessel supports (5) Visual PIPING PRESSURE BOUNDARY

4. 1 )Vessel, pump, and valve safe- Volumetric ends to primary pipe welds and s af e ends in branch pipe

4. 2 (7) Circumferential and

~

longitudinal Visual and pipe welds and branch pipe connec- Volumetric tions welds larger than 4 inches in diameter

4. 3 G-1 ) Pr e s sure r etaining bolting Visual and Volumetric PUMP PRESSURE BOUNDARY G-1 (2) Pressure retaining bolting Visual and Volumetric VALVE PRESSURE BOUNDARY 6.1 M-1 )Valve body welds ) Visual

3. 2

J 0

~

NOTES - TABLE I (1) The in-service inspection schedule as specified in the Technical Specifications is based on a 5 year inspection interval.

(2) Specification requires examination of "Pressure Retaining Bolting" 2 inches and larger when removed. Nuts, bushings, threads in base material and the flange ligaments are not mentioned.

(3) Inspection method, for cladding in visual.

(4) Specification requires 10% longitudinal but does not include circum-ferential on secondary side. Bottom head-to-tube sheet requirement is 100% during the inspection interval.

(5) Specifications require visual examination only.

(6) Specification requires 100% examination of safe-ends on main vessel nozzles.

(7) Specifications require 15% examination during the k 5 year inspection inter val.

(8) Specification requires visual examination of 1 (one) valve.

3. 3

Question 4: For electrical and mechanical equipment of the reactor protection system and engineered safety features located in the primary.

containment or elsewhere in the plant, state the design criteria which take into account the potential effects on these components of radiation resulting from both normal operation and accident conditions superimposed on long term normal operation.'escribe the analysis and testing performed to verify compliance with these design criteria.

Answer: Areas of high radiation would exist inside the containment and in those portions of the auxiliary building near residual heat removal system equipment following a major loss-of-coolant accident.

The maximum dose'evels within the containment would be approx-imately 4. 4 x 10 rads during one hour or 2. 7 x 10 rads during one week. The maximum dose rated in high radiation areas of the auxiliary building (residualI heat removal compartme'nts) would be less than one percent as high. The ability of electrical equipment in the emergency core cooling system to withstand radiation exposure is limited by radiation effects on electrical insulation materials and motor and equipment bearing lubrication.

The electrical equipment for the emergency core cooling system located in the containment consists of radiation resistant insula-ing materials. These insulating materials have a threshold for 8

radiation damage which might affect their functioning at 10 rads or higher. They would therefore provide considerable margin

4. 1

~t "

t4 4L~ ) t II 4

F t

1 r,x

~'

>"i)~ . $

.Ci',

'C ~

F c f I,

~-  !

~ t t

) - ~ i (, y il",. t, ~ ~ r t ..(vai.

t I t ~

v'p ci.,~

t

!. g1<g yqt

above the maximum post-accident radiation dose that would result from the exposure times specified earlier.

The lower ambient temperatures and, radiation levels in the auxiliary building permit the use of elastomeric or plastic insulation materials.

These materials have a threshold for radiation damage of 10 rad or higher. Where required, because of location in possible high'radiation areas, motor bearings are lubricated with radiation-rated lubricants.

An, environmental testing program has been completed on components of the type used in the containment.

A Westinghouse topical report covers equipment test results.

r S. Locante "Topical Report Environmental Testing of Engineered.

Safety Features Related Equipment" WCAP-7744, December, 1970 (NES Class 3)

4. 2

I V

E 4.

~\

l ~"

~ ge l ~

I fp h,f P g L t

J ~

NC 0

Question 5: Identify all safety related equipment and components (e. g. motors, cables, filters, pump seals) located in the primary containment which are required to be operable during and subsequent to a loss of coolant accident or a steam line break accident. Describe the qualification tests which have been or will be performed on each of these items to assure their performance in a combined high temperature, pressure, and humidity environment.

Answer: Temperature in the control room and adjoining equipment room is maintained for personnel comfort at 70 F + 10 F. Protective equipment in this space is designed to operate within design tolerance over this t'emperature range.

Design specifications. for this equipment specify no loss of pro-tective or protection function for a temperature of 120 F. Thus, there is a wide margin between the design limit and the normal operating environment for protective equipment.

Within containment, the normal operating temperature for protective equipment will be maintained below 120oF. Protective instrumenta-tion is designed for continuous operation within design tolerance in this environment. Out-of-core neutron detectors are designed for continuous operation at 135 F. The detectors will withstand operation at 175 F for short durations (8 hr. ). Process instru-

5. 1

4 I ~

0

~ q II Il g "ry 0

Ig>>

mentation in containment which is vital to plant protection is C

designed to survive the post-accident environment long enough to, perform the required protective function.

Qualification testing has been performed on various safety V

systems such as process instrumentation and nuclear instrumenta-tion. This testing involved demonstrating operation of safety functions at elevated ambient temperatures to 120 F for this equipment and in full post-accident environment for required equipment in containment for a specified time. Detailed results of some of these tests are proprietary to the suppliers, but are on file at the suppliers and available for audit for qualified parties.

I Qualificatio'n of sensors required to operate in the post-accident environment is discussed in WCAP-7744.

Electrical equipment for the engineered safety features is located inside the containment and in the auxiliary building. Table 5.1 is a listing of the equipment inside the containment'which is re-quired for post-LOCA operation and, indicates how long the equip-ment is required to function as well as specifying which components require qualification testing'.

The foGowing equipment must remain functional for the time period specified:

a. Emergency Core Cooling System containment isolation actuation sensors (first five minutes after accident).

5. 2

P '4 "

~ ~

4 4

b. Emergency Core Cooling System motor-operated valves and flow instrumentation (first five minutes after accident).

c. Accumulator pressure instrumentation (first five minutes after accident).

d. Containment sump level instrumentation (Long term [up to l year]).

e. Air and motor-operated containment isolation valves (oper-ation completed in first five minutes after accident).

f. Containment Fan Coolers. (continuous)

g. Power and instrumentation cables for the above listed equipment. (continuous)

Failure of the above equipment after the specified time will not increase the severity or consequence 'of the accident. The reactor protection" control and instrumentation equipment and electrical equipment for engineered safety features located in the auxiliary building will operate in a normal ambient environment following.

a major loss-of-coolant accident. Auxiliary building equipment in the containment sump water recirculation loop is listed below:

a. Residual heat removal pumps and heat exchangers.

b. Flow, temperature and pressure instrumentation for the residual heat removal system.

c. Power and instrument cables for the above.

5. 3

A I 1

l.

1 P

(~

,TABLE 5. 1 POST-ACCIDENT EQUIPMENT (INSXDE CONTAINMENT)

OPERATIONAL AND TESTING RE UIREMENTS Operating Puration of Fnvir onmenta1 E ui ment Name Mode 0 eration Testin CATEGORY 1 - INSTRUMENTATION Pressurizer pressure channels: . Continuous '/2 hr (S.X. Required initiation)

Pressurizer level channels: Continuous 1/2 hr (S.I. Required initiation)

High-head flow channels: Continuous 1 hr Required minimum Accumulator pressure channels Dur ing 1 hr Required injection phase Containment sump level channels: Continuous Available Not Required to 1 year CATEGORY 2 - VALVES High-head injection line valves: Continuous Within 1/2 hr Required after accident Isolation valves: Open on 1/2 hr Required(

S.X. signal minimum CATEGORY 3 - MISCELLANEOUS ITEMS Fan cooler motors Continuous Available C

~ ~ I ehW for 1 year Safeguard equipment power, Continuous Available A~ ~

control and instrument cable for 1 year

'4 it 0

Question'6: State the seismic design criteria for the reactor protection system engineered safety feature circuits, and the emergency power system. The criteria should address: (a) the capability to initiate a protection action during the design basis earthquake, and (b) the capability of the engineered. safety featured circuits to withstand seismic disturbances during post accident operation.

Describe the qualification testing or analysis which assure that the criteria have been satisfied.

Answer: For either earthquake (operational or design basis) the equipment is designed to assure that it does not lose its capability to perform its function; i. e., shut the plant down and maintain it in a safe shutdown condition.

For the design basis earthquake, there may be permanent de-formation of the equipment however the capability to per-form its function is maintained. Typical protection system equipment is subjected to type tests under simulated seismic accelerations to demonstrate its ability to perform its functions.

Type testing has been done on equipment by vendors or Westing-house using conservatively large accelerations and applicable frequencies. Analyses such as those done for structures are not done for the Reactor Protection System equipment. However, the peak accelerations and frequencies used are checked against those derived by structural analyses of operational and design bases earthquake loadings.

6. l

s 1

4

,v I

as s

'I t

I

(1)

A Westinghouse topical report, provides the seismic evalua-tion of safety related equipment.

All electrical systems and components vital to plant safety, including the emergency diesel generators are designed as Class I and designed so'that their'operability is not ixnpaired by the maxi-mum potential earthquake, wind, storms, floods or distrubances on the external electrical system. Power, control and instrument cabling, motors and other electrical equipment required for operation of the engineered safety features are suitably protected against the effects of either a nuclear system accident or of severe external environmental phenomena in order to assure a high degree of confidence in the operability of such components in the event that their use is required.

E. L. Vogeding "Topical Report Seismic Testing of "Electrical and Control Equipment" WCAP-7397-L, Zanuary, 1970 (NES Proprietary Class 2)

6. 2

I

~ .

J

Question 7: 'How does the Ginna Station conform to GDC-17 Answer: Independendent and alternat'e power systems are provided with adequate capacity and testability to supply the required engineered safety features and protection systems.

The plant is supplied with normal, standby and emergency power sources as follows:

1. The normal source, of auxiliary power during plant operation is the generator. Power is supplied via the unit auxiliary trans-former which is connected to the main leads of the generator.

2. Standby power required during plant startup, shutdown and after reactor trip is supplied from the Rochester Gas and Electric 34.5KV system by underground cable from a substation approximately 3/4 mile from the plant to the station auxiliary transformer and a standby 34KV circuit emanating from another substation facility.

II

3. Two diesel generator sets are connected to the engineered safety features buses to supply emergency shutdown power in the event of loss of all other a.c. auxiliary po~er.

4. Emergency power supply for vital instruments, for control and for emergency lighting is supplied from the two 125 V dc station batteries.

The diesel-generator sets are located adjacent to the turbine building and are connected to separate 480 volt auxiliary system buses.

Each set is started automatically on a safety injection signal or upon undervoltage on its corresponding 480 volt auxiliary buses. Each diesel is adequate to supply the engineered safety features for the 7.1

I E I

~ .

t A 7 a; ~

I

~ ll w

4 4

1t

>i 4<"

1 t P

hypothetical accident concurrent with loss of outside power. This capacity is adequate to provide a safe and orderly plant shutdown in the event of loss of outside electrical power.

The starting of the diesel-generator sets can be tested from the control room. The ability of the units to start within the pre-scribed time and to carry intended loads are checked periodically.

The Rochester Gas and Electric (RG&E) Company's Ginna Nuclear Power Station electrical power system is designed with a single station auxiliary (startup) transformer. This transformer is used to supply the normal auxiliary power during plant startup and shutdown. During power operation this transformer remains energized, essentially unloaded. During normal power operations the plant auxiliary power is supplied from the main generator via the unit auxiliary transformer. With the plant not operating, and offsite power not available, the principal source of power for vital electrical loads will be from the emergency diesel generators. For long term outages of offsite power, during shutdown, a backup source of power for the diesel generators is from the normally outgoing power feeder.

Power can be brought in over this feeder to the unit auxiliary trans-former by removing the flexible generator bus disconnects to disconnect t

the main generator.

The electrical power, installation for the Rochester Gas and Electric Company (RG&E) plant is shown in Figure 7.1. This installation 7.2

l 1

J l

,C l

f I I-P

consists of three basic power sources, each designed to be operated under specific plant conditions. These power sources used, and the plant conditions during which they will be used are as follows:

1. Unit Auxiliary Transformer (From Main Generator) - During normal plant operation station auxiliary power is supplied from the I

main generator via the unit auxiliary transformer. This trans-former is capable of supplying the entire auxiliary load under normal operating conditions.

2. Station Auxiliary Transformer (Startup) << (a) During normal plant startup the required auxiliary power for startup is supplied from offsite power via the station auxiliary (startup) transformer. This transformer is"supplied from a bus which is supplied from two separate offsite feeders. Each of these two feeders is capable of*supplying the entire auxiliary power load, and (b) During normal plant shutdown,

~ ~

all auxiliary plant loads are transferred to the station auxiliary transformer prior to securing the main generator..

NOTE: Upon interruption of power from the main generator during normal operation, auxiliary loads necessary for plant shutdown are transferred automatically tothe station auxiliary transformer.

,3. Emergency Diesel Generators - When the reactor trips with an out-age of offsite power, the emergency diesel generators will auto-matically assume vital station auxiliary loads necessary for safe shutdown. These loads will be transferred to the diesel generators when the last source of voltage decreases to a preset value.

7.3

'1 O.

t>

A 0

r Igq I

'I I [ q) (y j e

A single station auxiliary transformer (See Figure 7.1) will afford the required degree of plant safety for the following reasons:

1. The plant can be safely shutdown without the use of offsite power. Xn the unlikely event of complete loss of electrical power to the station, decay heat removal would continue to be assured by the availability of one steam driven and two motor driven auxiliary steam generator feedwater pumps and steam discharge to atmosphere.via main steam safety valves and atmospheric relief valves.

2. All vital loads (safety syste'ms,'"'instruments, etc.) can be supplied from emergency diesel generators.

3. The diesel generators have readily available to them an adequate fuel supply for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of operation for a single unit.

Reserve fuel supplies are available for delivery within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

The two diesel gener'ators, each capable of supplying safeguard loads, and the station auxiliary transformer provide three separate sources of power immediately available for operation of these loads. Thus, the power supply system meets the single failure criteria required of safety systems.

4. As an emergency backup'o the diesel generators, should they be required to operate for an extended period during an outage of the station auxiliary transformer, power can be fed back from the 115 kv grid through the main and unit auxiliary trans-former. Before power can be brought in from this source, 7.4

4.

( 4c H

4 1.

P-4 P 1 I

flexible connectors at the generator terminals must be removed.

5. Heat removal can be accomplished by dumping steam, in association with natural circulation following loss of power to main coolant pumps.

SEPARATION OF REDUNDANT CIRCUITS

l. All those components requiring redundant cabling as well as that cabling for redundant components have been identified and the redundant power, instrumentation, and control cables are run separately.

a. There is a four channel separation for the reactor pro-tection and,safeguards instrumentation circuits. This separation is maintained from the sensor through the analogue racks to the logic or relay cabinets.

b. Logic output control and power cables for the operation of redundant components in safety or safeguards system are routed separately, except where cable trays converge at the control board. The location of redundant component wiring in the control board requires that these cables con-verge in this area.

2. DC control power from the station batteries is run in underground duct, separated, and apart from the tunnel, in order to maintain partial control in the event of an emergency.

7.5

l l L

I

~

3. The minimum physical dimensions between redundant power, control and instrument cable trays are 5" vertical separation and 2" horizontal separation. An effort has been made to maintain separation between .trays, and in most cases has been accomplished, with separation of as much as one foot or more.

The minimum physical separation between redundant cables for power, control, and instrum nt systems is a galvanized sheet metal barrier in cable trays.

7.6

I h 4 t f ~" S.

'I II I ~ I c l

ye ~

C <<4 t <

P ( I I STA204 II I I SIL. 13A I I ROdE I RGC1E I I PKKKRi CaaPCY Y 1 ~ PKKAXARPOKER STA. NM SYATKPP 30/4050 1 MYA 13/345K. 1 I I I 1 i I I II ,I 1 I rer rSP I I 1 345& L1NES I II I I I 'I I I I I 1 ,I I I I No 12 TRANS 345/416Kr I IS/ I 1 nS/34 5<< 1 T TT I RCRE CORP 91 I APN RANG NETRCRK I 911 tl I I I Ail R RGGE T Ti I I I Noll TRANS I 19 16@v I I 345K@LINES I I I G I I 9 92 I 117p19 Ka l I I I I I I I I I I I I I I TO NMP IPISP34S LOCKPORT I TO NMP I TO NUP LOCKPORT I LQNC BRANCH I 911 I ISO I I I 24 I I 1 I 1 1 J I I I I 2 TO NMP I LONG BRANCPP I I I NPNP MORTIMER STA I 904 I 1 1 23 r I I 914 I 914 1 I I I I 345/115 I4 /I 34$ ISKv. 24 I I I PASPPY i NI GARA 34SKv 34SKY CLAY GENERATOR TO 13A PLANT SLdSTATlON 0.5 MAES(iPPOERCRQVPO) ol 13A PLANT SVSSTATPQN TQ STATPON 204 3.5 MPLES Oil 3 STATPON 204 TO STATION 42 16.3 MILES RPSNY PASNY 2 STATPQN 204 TO NIAGARA MOKAWK 10,3 Illl.ES C>I NIAGARA 349 Kr CLAY TRVNK LINES I CO ~TA ~R 4 I 0-J t' I ,I 0 Question 8: How is the post accident monitoring performed at Ginna Station? (1) Answer: A procedure for determining which of the three major accidents has occurred by use of existing instrumentation is adhered to by the operations group at Ginna Station. After the type of accident has been determined and assuming that the accident is the loss of coolant accident, post-accident monitor- ~ ing through the utilization of instrumentation is described by (1) procedure , All safety related valves have position indication on the control board termed "status lights" and in most cases the valve position is also indicated by red and green lights over the valve control switch. ~ During the injection phase, the safety injection is manually reset as soon as the following conditions are met.

l. The startup sequencing of safeguards is completed (the start-up of the auxiliary feedwater pumps as determined by the control board flow and pressure indicators indicates the completion of the startup sequencing).

2. MOV 825A or 825B is open. A check will be made of the in-jection flow through FI 626 and insure that a break has not occurred in a low head injection line by closing MOV 852A or MOV 852B to observe a flow reduction to the normal recirculation flow from the residual heat removal pumps (100 gpm/pump).

NOTE: Flow reading above 100 gpm/pump when 'the Reactor Coolant System is above 140 psig is an indication of a leak in one of the two low head injection lines. R.E. Ginna Nuclear Power Station Unit No. 1 Emergency Instruction E - 1 8.1 ( I C I C 0 4 If outside power is available, it willbe verified that three service pumps are operating. This is done by observing the breaker indicating lights, and header pressure of each of the two,headers. This instrumentation is located on the control board. The service water will be restored to the previously operating component cooling heat exchanger by opening either valves 4734 and 4615 or valves 4616 and 4735, The service water will be restored to the normal secondary users by opening the isolation valve operators for the following valves: 4613, 4614, 4664, 4670, 4609, 4780, 4663 4733. NOZE: lf service water cannot be restored, the following equipment must be shutdown to minimize equipment damage: Air conditioning equipment Air compressors Circulating water pumps Condensate pumps Heater drain pumps Turbine electro-hydraulic pump unit 'J'he charcoal filter dousing valves (875A & B) or (876A &B) will be opened if a high charcoal temperature alarm is actuated. There are temperature indicators for each charcoal filter. If, 10 minutes after the accident, the reactor coolant system as indicated on control board mounted PI>>420 is under 600 psig, it will be verified that the containment spray pumps are operating and NaOH 8.2 I C I C I J 4 k A injection will be initiated by controllers located on the control board. Verification is made by breaker indication and NaOH tank level in the control room. NOTE: A safety injection pump dischar'ge pressure (PI-922, PI-923) of less than 700 psig, if two pumps are operating, or less than 800 psig, if three pumps are operating is an indication of less than 600 psig.RCS pressure. Safety injection flow in both loops is also monitored. If one spray pump is in service HCV 856A or HCV 836B will be opened and the valve position adjusted until the reading on FI 930 indicates 20 gpm of NaOH addition. If two spray pumps are in service, both HCV 836A and HCV 836B will be opened until reading on FI 930 is 40 gpm. NOTE: Following a decision not to open the NaOH valves, the -operator would remain especially alert to malfunction of the ECCS. Gross. increase in radiation background, as read on the contain-ment radiation monitors, or failure to read flow in ECCS delivery lines when RCS pressure falls below the cut off point, are in-dications of such malfunctions. ,The accumulator isolation valves MOV 841 and MOV 865 will be closed if the accumulator pressure as indicated on PI 936, 937, 940, 941 is less than 250 psig. Accumulator levels will also be checked. The status of the control room ventilation will be checked to in-sure makeup air is still available or can still be supplied from 8.3 ~- 1 h I a <<1 J ~ outside (radiation monitor alarm RE-1 had not actuated). The residual heat removal pumps will be tripped to prevent residual k heat removal loop pressu".ization if the Reactor Coolant System pressure is still above 140 psig 15 minutes after the accident. The injection flow through FI 924 and FI 925 will be checked to in-sure that a break has not occurred in a high head injection line. NOTE: If a break has occurred in a high head injection line, the flow meter reading in the corresponding header will be constant and substantially higher than in the other. The line with the leak can be isolated by closing in sequence the pair of 878 numbered valves in the line of highest flow indication and observing a substantial flow reduction. The controls and necessary monitoring instrumentation for the emer-gency diesel generators are located on the back of the main control board as well as indication of watts and volts of each machine on the front of the main control board. The diesel generators will be stopped, provided outside power has not been interrupted. When the refueling water storage tank low level alarm is actuated, (31% level span) stop one safety injection pump and one containment spray pump. This tank level is read out on the main control board. When the refueling water low level alarm is actuated (10%%u level) terminate injection flow as follows: 8.4 I 4%a ~ as e ~ '~ ' I, i 4 S A +. 1

e ii P *gr t

)i 1 J ll

a. Stop the operating safety injection, containment spray and residual heat removal pumps.

b. Close valves 896A, 896B, 856, 704A, 704B, 897, and 898 to isolate the refueling water storage tank.

D.C. to non-safeguards on MCC 1C and 1D will be restored by re-setting relay target on front of each MCC. RECIRCULATION PHASE The valve status and alignment of valves will be verified as follows for recirculation using the 1A pump: MOV valves closed >> 826A, 826B, 826C, 826D, 896A, 896B, 857A, 850B, 857B, 857C, 1813A, 1813C, 700, 701, 721, 856, 704A, and 704B. AOV valves closed - 897, 898 MOV valves opened - 852A, 852B, 850A, 878A, 878B, 878C, 878D, 851A, 851B, 1815A, 1815B,- 825A, and 825B.

2. One component cooling pump will be started and re-establishment of service water flow to the previously operating component cooling heat exchanger will be made by opening eithex valves (4734, 4615) or valves (4616, 4735).

3. It will be verified that component cooling low flow alarms to the residual heat removal, containment spray and safety injection pumps are not actuate'd (annunciator Panel A).

It will be determined on PI 420 if reactor coolant system pressure will permit recirculation without the use of a high head safety 8.5 ~, f 4 T p f ~ ~ l~ ~ ~ injection pump (system pressure below 140 psig). NOTE: Following a decision to switch to low head recirculation, flow meter FI 626 reading will be carefully checked to insure that the RCS is 'sufficiently depressurized to permit recirculation without the high .head safety injection pumps. If spray additive is actuated during the injection phase, and if the spray additive tank water level is higher than 40%, both spray additive and recirculation are required. Low Head Recirculation

1. The 1A residual heat removal pump will be started.

2. It will be insured that component cooling flow is established to the residual heat exchanger in service by opening MOV 738A and closing 738B if residual heat removal pump 1A is operating.

(Open MOV 738B and close 738A if pump 1B is operating). Com-ponent cooling pressure, temperature, and flow is read out in the control room.

3. Recirculation .flow on FI 626'ill be checked. If FI reading is not substantially higher than 100 gpm, high head recirculation will be activated.

4. The following are indications of passive failure in the low head recirculation path:

• II abnormal flow on FI 626

'y increasing temperature on TI 630 (if pump lA is operating) increasing containment pressure flow on FI 931A or FI 931B high water level alarm in auxiliary building sump 8.6 I ~ . ~" 0 E By exercising MOV 852A, MOV 852B, HCV 624 and HCV 625, and by watching the corresponding indications on FI 626, FI 931A and FI 931B, the operator should detect the failure location, iso-late it, and use an alternate path for recirculation. Low Head Recirculation with S ra

1. The residual heat removal pump 1A will be started.

2. It will be insured that component cooling flow is established to the residual heat exchanger in service by opening MOV 738A and closing 738B if residual heat removal pump 1A is operating.

(Open MOV 738B and close MOV 738A if pump 1B is operating).

3. Valves MOV 857B and C, or MOV 857A will be opened, depending on which residual heat removal pump is operating.

4. One spray pump Vill be started.

5. HCV 836A or HCV 836B will be opened until 5 gpm reading on FI 930.

6. When the spray additive tank level is 40%, HCV 836A and HCV 836B will be closed and containment spray pump stopped.

NOTE 1: Spray should be stopped during recirculation if:

a. Diverting recirculation flow to spray deprives the ECCS of sufficient flow to insure core flooding.

b. NaOH addition has been started though not required during injection phase.

NOTE 2: Spray must be resumed if containment pressure at any time, approaches 25 psig with all available fan coolers in operation. 8.7 I I I ~ . I 'f ~ I Hi h Head Recirculation Plow Path usin 1A Residual Heat Removal Pum Valves MOV 857B and C will be opened. NOTE: If these valves cannot be opened from the control board (diesel or MCC failure), the operator should tie together the MCC 1C and 1D or manually open these valves.

2. Residual heat removal pump lA and two outer safety injection pumps will be started (pumps lA and 1B preferably) to establish recirculation flow to both loops through valves 878A, 878B, 878C, and 878D',

NOTE: In case of blackout and diesel failure, only one safety injection pump will be started to prevent diesel overloading.

3. The recirculation flow on RI 924 and FI 925 will be checked.

After recirculation is established, the turbine will be placed on turning gear once it has come to a complete stop. Por a coincident station blackout the following additional actions are required:

a. Automatic start of the'team driven auxiliary ieedwater pump will be verified.

b. It will be insured that a battery charger is operating.

Remote operated turbine drain valves will be opened and'he turbine auxiliary operator will be notified to perform the following:

a. Open all manual operated turbine drain valves.

b. Commence securing turbine gland seal system and condenser air removal system if condenser vacuum cannot be maintained.

8.8 k '- P \ k A A i 7 I ~ ~ >> ~~ P All containment isolation valves switches will be placed in the "closed" position, and containment isolation will be manually reset by depressing the reset button. Sample recirculation loop fluid by opening AOV 959 to determine solution boron concentration and pH and make necessary adjustments. Recirculation Phase Usin the Reactor Coolant Drain Tank Pum s: This mode of recirculation is available in case both residual heat removal pumps become inoperative or can be used during long term recirculation once it has been determined that the residual heat removal load can be controlled by a flow of 400 gpm. Under 60 psig RCS pressure, low head recirculation can be established.

1. Low head recirculation

a. The residual heat removal pumps will be isolated by, closing MOV 850A and 850B..

b. MOV 1813A, 1813B and valves 1811A and 1811B will be opened.

c. Valve 1100A will be closed and MOV 1003A and 1003B will be checked close.

d. Both reactor" coolant drain tank pumps will be staxted and flow checked through FX 626,

2. Hi h head recirculation Using safety injection pump lA. Parenthese numbers refer to SI pump 1B.

'. "a i'Pl

a. Valves MOV 878A, 878C, 878D, (878A, 878B, 878C) will be closed, 8.9

n ~ ~ I

b. The two reactor coolant drain pumps and safety in)ection pump lA will be started.

c. Manually throttle 88A (888B) until flow reading on FI 924 (FI 925) for about 300 gpm to maintain S.I. pump NPSH.

Xn the case whexe outside power is not available, this is determined by an alarm and annunciation of:

1. 4kv main ox tie breaker trip.

2. 480 volt transformer breaker trip.

3. 480 volt MCC supply breaker trip.

4. Loss of turbine operating floor lighting (easily observed from the control room),

5. Auxiliary transformer number 12 watt, ampere, and voltage indication.

8.10 I ~- I uestion 9: Clarify the apparent discrepancies of steam flow from the steam generators in the various sources of literature. Answer: Investigation of the question on true steam flow for the Ginna plant has disclosed the following facts:

1) The Steam Generator Technical Manual gives a total steam flow of 5.5,x 10 lb(hr at full load. Full load in this case is 1300 MWt or 420 MWe net rating.

2) The FSAR in Table 4.1.4 gives a steam flow of 6.26 x 10 6 lb/

hr. which corresponds to a core power of 1455 MWt and a 470 MWe net rating. This is the warranted plant condition . The Westinghouse Large Turbine Division (LTD) secondary heat balance, CT-18447 dated 6>>7-66, gives a total steam flow of 6,264,075 lb/hr. resulting in a gross turbine output of 496,322 KW which corresponds to 470 MWe net output. The original FSAR presented the conditions which were the basis for the plant warranty.

3) The Technical Supplement of February, 1971 replaces Table 6

4.1.4 in the FSAR and gives a total steam flow of 6.58 x 10 lb/hr. This corresponds to a core power of 1520 MWt and an approximate 490 MWe net rating. This is the maximum calculated condition for the turbine generator. The LTD head balance, CT-18448 dated 6-7<<66, gives a total steam flow of 6,577,879 lb/hr. resulting in a gross turbine output of 516,739 KW. 9.1 4 0 r ~ a." ~~ ,Pl g 1 I n Therefore, the correct steam flow for the uprated plant is 6.58 x 10 6 lb/hr. as reported in the Technical Supplement. 9.2